stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Ian Abbott <abbotti@mev.co.uk>
Subject: [PATCH 3.19 23/27] staging: comedi: adv_pci1710: fix AI INSN_READ for non-zero channel
Date: Sun, 26 Apr 2015 16:15:54 +0200	[thread overview]
Message-ID: <20150426134604.342172893@linuxfoundation.org> (raw)
In-Reply-To: <20150426134603.371719585@linuxfoundation.org>

3.19-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ian Abbott <abbotti@mev.co.uk>

commit abe46b8932dd9a6dfc3698e3eb121809b7b9ed28 upstream.

Reading of analog input channels by the `INSN_READ` comedi instruction
is broken for all except channel 0.  `pci171x_ai_insn_read()` calls
`pci171x_ai_read_sample()` with the wrong value for the third parameter.
It is supposed to be the current index in a channel list (which is
always of length 1 in this case, so the index should be 0), but instead
it is passing the actual channel number.  `pci171x_ai_read_sample()`
checks the channel number encoded in the raw sample value read from the
hardware matches the channel number stored in the specified index of the
previously set up channel list and returns `-ENODATA` if it doesn't
match.  Since the index should always be 0 in this case, the match will
fail unless the channel number is also 0.  Fix it by passing 0 as the
channel index.

Note that when the bug first appeared, it was `pci171x_ai_dropout()`
that was called with the wrong parameter value.  `pci171x_ai_dropout()`
got replaced with `pci171x_ai_read_sample()` in commit 7fd2dae2500d
("staging: comedi: adv_pci1710: introduce pci171x_ai_read_sample()").

Fixes: 16c7eb6047bb ("staging: comedi: adv_pci1710: always enable PCI171x_PARANOIDCHECK code")
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 drivers/staging/comedi/drivers/adv_pci1710.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -455,7 +455,6 @@ static int pci171x_insn_read_ai(struct c
 				struct comedi_insn *insn, unsigned int *data)
 {
 	struct pci1710_private *devpriv = dev->private;
-	unsigned int chan = CR_CHAN(insn->chanspec);
 	int ret = 0;
 	int i;
 
@@ -477,7 +476,7 @@ static int pci171x_insn_read_ai(struct c
 			break;
 
 		val = inw(dev->iobase + PCI171x_AD_DATA);
-		ret = pci171x_ai_dropout(dev, s, chan, val);
+		ret = pci171x_ai_dropout(dev, s, 0, val);
 		if (ret)
 			break;
 



  parent reply	other threads:[~2015-04-26 14:17 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-04-26 14:15 [PATCH 3.19 00/27] 3.19.6-stable review Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 01/27] tcp: prevent fetching dst twice in early demux code Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 02/27] rocker: handle non-bridge master change Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 03/27] net/mlx4_en: Call register_netdevice in the proper location Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 04/27] ipv6: Dont reduce hop limit for an interface Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 05/27] tun: return proper error code from tun_do_read Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 06/27] net: tcp6: fix double call of tcp_v6_fill_cb() Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 07/27] bonding: Bonding Overriding Configuration logic restored Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 08/27] openvswitch: Return vport module ref before destruction Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 09/27] xen-netfront: transmit fully GSO-sized packets Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 10/27] tcp: fix FRTO undo on cumulative ACK of SACKed range Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 11/27] ipv6: protect skb->sk accesses from recursive dereference inside the stack Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 12/27] net/mlx4_core: Fix error message deprecation for ConnectX-2 cards Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 13/27] tcp: tcp_make_synack() should clear skb->tstamp Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 14/27] bnx2x: Fix busy_poll vs netpoll Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 15/27] bpf: fix verifier memory corruption Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 16/27] Revert "net: Reset secmark when scrubbing packet" Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 18/27] udptunnels: Call handle_offloads after inserting vlan tag Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 21/27] tg3: Hold tp->lock before calling tg3_halt() from tg3_init_one() Greg Kroah-Hartman
2015-04-26 14:15 ` Greg Kroah-Hartman [this message]
2015-04-26 14:15 ` [PATCH 3.19 24/27] mm/hugetlb: reduce arch dependent code around follow_huge_* Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 25/27] mm/hugetlb: take page table lock in follow_huge_pmd() Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 26/27] rtlwifi: rtl8192ee: Fix handling of new style descriptors Greg Kroah-Hartman
2015-04-26 14:15 ` [PATCH 3.19 27/27] fs: take i_mutex during prepare_binprm for set[ug]id executables Greg Kroah-Hartman
2015-04-26 20:04 ` [PATCH 3.19 00/27] 3.19.6-stable review Guenter Roeck
2015-04-27 17:20 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150426134604.342172893@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=abbotti@mev.co.uk \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).