public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Spencer E. Olson" <olsonse@umich.edu>,
	Ian Abbott <abbotti@mev.co.uk>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>,
	devel@driverdev.osuosl.org
Subject: [PATCH AUTOSEL 4.14 011/371] staging: comedi: ni_mio_common: protect register write overflow
Date: Thu, 16 Jan 2020 12:11:19 -0500	[thread overview]
Message-ID: <20200116171719.16965-11-sashal@kernel.org> (raw)
In-Reply-To: <20200116171719.16965-1-sashal@kernel.org>

From: "Spencer E. Olson" <olsonse@umich.edu>

[ Upstream commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 ]

Fixes two problems introduced as early as
commit 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code"):
(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
    not unduly overwritten on e-series devices.  On e-series devices, the
    first three of the last four bits are reserved.  The last bit defines
    the output selection of the RGOUT0 pin, otherwise known as
    RTSI_Sub_Selection.  For m-series devices, these last four bits are
    indeed used as the output selection of the RTSI7 pin (and the
    RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
    RTSI_Trig_Direction register.
(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
    lines.

This patch also cleans up the ni_get_rtsi_routing command for readability.

Fixes: 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code")
Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../staging/comedi/drivers/ni_mio_common.c    | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 36361bdf934a..2f82dcb1fd06 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -4991,7 +4991,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
 	case NI_RTSI_OUTPUT_G_SRC0:
 	case NI_RTSI_OUTPUT_G_GATE0:
 	case NI_RTSI_OUTPUT_RGOUT0:
-	case NI_RTSI_OUTPUT_RTSI_BRD_0:
+	case NI_RTSI_OUTPUT_RTSI_BRD(0):
+	case NI_RTSI_OUTPUT_RTSI_BRD(1):
+	case NI_RTSI_OUTPUT_RTSI_BRD(2):
+	case NI_RTSI_OUTPUT_RTSI_BRD(3):
 		return 1;
 	case NI_RTSI_OUTPUT_RTSI_OSC:
 		return (devpriv->is_m_series) ? 1 : 0;
@@ -5012,11 +5015,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
 		devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
 		ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
 			      NISTC_RTSI_TRIGA_OUT_REG);
-	} else if (chan < 8) {
+	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
 		devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
 		devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
 		ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
 			      NISTC_RTSI_TRIGB_OUT_REG);
+	} else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
+		/* probably should never reach this, since the
+		 * ni_valid_rtsi_output_source above errors out if chan is too
+		 * high
+		 */
+		dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
+		return -EINVAL;
 	}
 	return 2;
 }
@@ -5032,12 +5042,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
 	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
 		return NISTC_RTSI_TRIG_TO_SRC(chan,
 					      devpriv->rtsi_trig_b_output_reg);
-	} else {
-		if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
-			return NI_RTSI_OUTPUT_RTSI_OSC;
-		dev_err(dev->class_dev, "bug! should never get here?\n");
-		return 0;
+	} else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
+		return NI_RTSI_OUTPUT_RTSI_OSC;
 	}
+
+	dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
+	return -EINVAL;
 }
 
 static int ni_rtsi_insn_config(struct comedi_device *dev,
-- 
2.20.1


  parent reply	other threads:[~2020-01-16 17:21 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-16 17:11 [PATCH AUTOSEL 4.14 001/371] drm/sti: do not remove the drm_bridge that was never added Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 002/371] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 003/371] ALSA: hda: fix unused variable warning Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 004/371] apparmor: don't try to replace stale label in ptrace access check Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 005/371] PCI: iproc: Remove PAXC slot check to allow VF support Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 006/371] drm/hisilicon: hibmc: Don't overwrite fb helper surface depth Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 007/371] IB/rxe: replace kvfree with vfree Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 008/371] IB/hfi1: Add mtu check for operational data VLs Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 009/371] regulator: fixed: Default enable high on DT regulators Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 010/371] ALSA: usb-audio: update quirk for B&W PX to remove microphone Sasha Levin
2020-01-16 17:11 ` Sasha Levin [this message]
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 012/371] pwm: lpss: Release runtime-pm reference from the driver's remove callback Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 013/371] powerpc/kgdb: add kgdb_arch_set/remove_breakpoint() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 014/371] drm/sun4i: hdmi: Fix double flag assignation Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 015/371] mlxsw: reg: QEEC: Add minimum shaper fields Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 016/371] NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 017/371] pcrypt: use format specifier in kobject_add Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 018/371] exportfs: fix 'passing zero to ERR_PTR()' warning Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 019/371] drm/dp_mst: Skip validating ports during destruction, just ref Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 020/371] net: phy: Fix not to call phy_resume() if PHY is not attached Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 021/371] IB/rxe: Fix incorrect cache cleanup in error flow Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 022/371] staging: bcm2835-camera: Abort probe if there is no camera Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 023/371] switchtec: Remove immediate status check after submitting MRPC command Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 024/371] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 025/371] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 026/371] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 027/371] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 028/371] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 029/371] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 030/371] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 031/371] pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 032/371] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 033/371] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 034/371] vxlan: changelink: Fix handling of default remotes Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 035/371] Input: nomadik-ske-keypad - fix a loop timeout test Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 036/371] clk: highbank: fix refcount leak in hb_clk_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 037/371] clk: qoriq: fix refcount leak in clockgen_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 038/371] clk: socfpga: fix refcount leak Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 039/371] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 040/371] clk: imx6q: fix refcount leak in imx6q_clocks_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 041/371] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 042/371] clk: imx7d: fix refcount leak in imx7d_clocks_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 043/371] clk: vf610: fix refcount leak in vf610_clocks_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 044/371] clk: armada-370: fix refcount leak in a370_clk_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 045/371] clk: kirkwood: fix refcount leak in kirkwood_clk_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 046/371] clk: armada-xp: fix refcount leak in axp_clk_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 047/371] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 048/371] clk: dove: fix refcount leak in dove_clk_init() Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 049/371] MIPS: BCM63XX: drop unused and broken DSP platform device Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 050/371] IB/usnic: Fix out of bounds index check in query pkey Sasha Levin
2020-01-16 17:11 ` [PATCH AUTOSEL 4.14 051/371] RDMA/ocrdma: " Sasha Levin
2020-01-16 17:12 ` [PATCH AUTOSEL 4.14 052/371] RDMA/qedr: " Sasha Levin
2020-01-16 17:12 ` [PATCH AUTOSEL 4.14 053/371] drm/shmob: Fix return value check in shmob_drm_probe Sasha Levin
2020-01-16 17:12 ` [PATCH AUTOSEL 4.14 054/371] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD Sasha Levin
2020-01-16 17:12 ` [PATCH AUTOSEL 4.14 055/371] spi: cadence: Correct initialisation of runtime PM Sasha Levin
2020-01-16 17:12 ` [PATCH AUTOSEL 4.14 056/371] RDMA/iw_cxgb4: Fix the unchecked ep dereference Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200116171719.16965-11-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=abbotti@mev.co.uk \
    --cc=devel@driverdev.osuosl.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=olsonse@umich.edu \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox