iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

staging: comedi: das1800: fix possible NULL dereference

Browse Source 
DMA is optional with this driver. If it was not enabled the devpriv->dma
pointer will be NULL.

Fix the possible NULL pointer dereference when trying to disable the DMA
channels in das1800_ai_cancel() and tidy up the comments to fix the
checkpatch.pl issues:
WARNING: line over 80 characters

It's probably harmless in das1800_ai_setup_dma() because the 'desc' pointer
will not be used if DMA is disabled but fix it there also.

Fixes: 99dfc3357e ("staging: comedi: das1800: remove depends on ISA_DMA_API limitation")
Cc: <stable@vger.kernel.org> # 4.0+
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
H Hartley Sweeten 2016-04-08 10:14:58 -07:00 committed by Greg Kroah-Hartman
parent 3a56d700f6
commit d375278d66
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/staging/comedi/drivers/das1800.c
View File

@ -567,14 +567,17 @@ static int das1800_cancel(struct comedi_device *dev, struct comedi_subdevice *s)
struct comedi_isadma_desc *desc;
int i;
outb(0x0, dev->iobase + DAS1800_STATUS); /* disable conversions */
outb(0x0, dev->iobase + DAS1800_CONTROL_B); /* disable interrupts and dma */
outb(0x0, dev->iobase + DAS1800_CONTROL_A); /* disable and clear fifo and stop triggering */
/* disable and stop conversions */
outb(0x0, dev->iobase + DAS1800_STATUS);
outb(0x0, dev->iobase + DAS1800_CONTROL_B);
outb(0x0, dev->iobase + DAS1800_CONTROL_A);
for (i = 0; i < 2; i++) {
desc = &dma->desc[i];
if (desc->chan)
comedi_isadma_disable(desc->chan);
if (dma) {
for (i = 0; i < 2; i++) {
desc = &dma->desc[i];
if (desc->chan)
comedi_isadma_disable(desc->chan);
}
}
return 0;
@ -934,13 +937,14 @@ static void das1800_ai_setup_dma(struct comedi_device *dev,
{
struct das1800_private *devpriv = dev->private;
struct comedi_isadma *dma = devpriv->dma;
struct comedi_isadma_desc *desc = &dma->desc[0];
struct comedi_isadma_desc *desc;
unsigned int bytes;
if ((devpriv->irq_dma_bits & DMA_ENABLED) == 0)
return;
dma->cur_dma = 0;
desc = &dma->desc[0];
/* determine a dma transfer size to fill buffer in 0.3 sec */
bytes = das1800_ai_transfer_size(dev, s, desc->maxsize, 300000000);