Skip to content

Commit f208a76

Browse files
torvaldstorvalds
committed
Merge tag 'staging-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging into master
Pull staging driver fixes from Greg KH: "Five small staging driver fixes for 5.8-rc7 to resolve some reported problems: - four comedi driver fixes for problems found with them - a syzbot-found fix for the wlang-ng driver that resolves a much reported problem. All of these have been in linux-next with no reported issues" * tag 'staging-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: wlan-ng: properly check endpoint types staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
2 parents 7d22af6 + faaff97 commit f208a76

5 files changed

Lines changed: 63 additions & 19 deletions

File tree

‎drivers/staging/comedi/drivers/addi_apci_1032.c‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -106,14 +106,22 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
106106
unsigned int *data)
107107
{
108108
struct apci1032_private *devpriv = dev->private;
109-
unsigned int shift, oldmask;
109+
unsigned int shift, oldmask, himask, lomask;
110110

111111
switch (data[0]) {
112112
case INSN_CONFIG_DIGITAL_TRIG:
113113
if (data[1] != 0)
114114
return -EINVAL;
115115
shift = data[3];
116-
oldmask = (1U << shift) - 1;
116+
if (shift < 32) {
117+
oldmask = (1U << shift) - 1;
118+
himask = data[4] << shift;
119+
lomask = data[5] << shift;
120+
} else {
121+
oldmask = 0xffffffffu;
122+
himask = 0;
123+
lomask = 0;
124+
}
117125
switch (data[2]) {
118126
case COMEDI_DIGITAL_TRIG_DISABLE:
119127
devpriv->ctrl = 0;
@@ -136,8 +144,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
136144
devpriv->mode2 &= oldmask;
137145
}
138146
/* configure specified channels */
139-
devpriv->mode1 |= data[4] << shift;
140-
devpriv->mode2 |= data[5] << shift;
147+
devpriv->mode1 |= himask;
148+
devpriv->mode2 |= lomask;
141149
break;
142150
case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
143151
if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA |
@@ -154,8 +162,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
154162
devpriv->mode2 &= oldmask;
155163
}
156164
/* configure specified channels */
157-
devpriv->mode1 |= data[4] << shift;
158-
devpriv->mode2 |= data[5] << shift;
165+
devpriv->mode1 |= himask;
166+
devpriv->mode2 |= lomask;
159167
break;
160168
default:
161169
return -EINVAL;

‎drivers/staging/comedi/drivers/addi_apci_1500.c‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -452,21 +452,35 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
452452
struct apci1500_private *devpriv = dev->private;
453453
unsigned int trig = data[1];
454454
unsigned int shift = data[3];
455-
unsigned int hi_mask = data[4] << shift;
456-
unsigned int lo_mask = data[5] << shift;
457-
unsigned int chan_mask = hi_mask | lo_mask;
458-
unsigned int old_mask = (1 << shift) - 1;
455+
unsigned int hi_mask;
456+
unsigned int lo_mask;
457+
unsigned int chan_mask;
458+
unsigned int old_mask;
459459
unsigned int pm;
460460
unsigned int pt;
461461
unsigned int pp;
462+
unsigned int invalid_chan;
462463

463464
if (trig > 1) {
464465
dev_dbg(dev->class_dev,
465466
"invalid digital trigger number (0=AND, 1=OR)\n");
466467
return -EINVAL;
467468
}
468469

469-
if (chan_mask > 0xffff) {
470+
if (shift <= 16) {
471+
hi_mask = data[4] << shift;
472+
lo_mask = data[5] << shift;
473+
old_mask = (1U << shift) - 1;
474+
invalid_chan = (data[4] | data[5]) >> (16 - shift);
475+
} else {
476+
hi_mask = 0;
477+
lo_mask = 0;
478+
old_mask = 0xffff;
479+
invalid_chan = data[4] | data[5];
480+
}
481+
chan_mask = hi_mask | lo_mask;
482+
483+
if (invalid_chan) {
470484
dev_dbg(dev->class_dev, "invalid digital trigger channel\n");
471485
return -EINVAL;
472486
}

‎drivers/staging/comedi/drivers/addi_apci_1564.c‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -331,14 +331,22 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
331331
unsigned int *data)
332332
{
333333
struct apci1564_private *devpriv = dev->private;
334-
unsigned int shift, oldmask;
334+
unsigned int shift, oldmask, himask, lomask;
335335

336336
switch (data[0]) {
337337
case INSN_CONFIG_DIGITAL_TRIG:
338338
if (data[1] != 0)
339339
return -EINVAL;
340340
shift = data[3];
341-
oldmask = (1U << shift) - 1;
341+
if (shift < 32) {
342+
oldmask = (1U << shift) - 1;
343+
himask = data[4] << shift;
344+
lomask = data[5] << shift;
345+
} else {
346+
oldmask = 0xffffffffu;
347+
himask = 0;
348+
lomask = 0;
349+
}
342350
switch (data[2]) {
343351
case COMEDI_DIGITAL_TRIG_DISABLE:
344352
devpriv->ctrl = 0;
@@ -362,8 +370,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
362370
devpriv->mode2 &= oldmask;
363371
}
364372
/* configure specified channels */
365-
devpriv->mode1 |= data[4] << shift;
366-
devpriv->mode2 |= data[5] << shift;
373+
devpriv->mode1 |= himask;
374+
devpriv->mode2 |= lomask;
367375
break;
368376
case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
369377
if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA |
@@ -380,8 +388,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
380388
devpriv->mode2 &= oldmask;
381389
}
382390
/* configure specified channels */
383-
devpriv->mode1 |= data[4] << shift;
384-
devpriv->mode2 |= data[5] << shift;
391+
devpriv->mode1 |= himask;
392+
devpriv->mode2 |= lomask;
385393
break;
386394
default:
387395
return -EINVAL;

‎drivers/staging/comedi/drivers/ni_6527.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -332,7 +332,7 @@ static int ni6527_intr_insn_config(struct comedi_device *dev,
332332
case COMEDI_DIGITAL_TRIG_ENABLE_EDGES:
333333
/* check shift amount */
334334
shift = data[3];
335-
if (shift >= s->n_chan) {
335+
if (shift >= 32) {
336336
mask = 0;
337337
rising = 0;
338338
falling = 0;

‎drivers/staging/wlan-ng/prism2usb.c‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
6161
const struct usb_device_id *id)
6262
{
6363
struct usb_device *dev;
64-
64+
const struct usb_endpoint_descriptor *epd;
65+
const struct usb_host_interface *iface_desc = interface->cur_altsetting;
6566
struct wlandevice *wlandev = NULL;
6667
struct hfa384x *hw = NULL;
6768
int result = 0;
6869

70+
if (iface_desc->desc.bNumEndpoints != 2) {
71+
result = -ENODEV;
72+
goto failed;
73+
}
74+
75+
result = -EINVAL;
76+
epd = &iface_desc->endpoint[1].desc;
77+
if (!usb_endpoint_is_bulk_in(epd))
78+
goto failed;
79+
epd = &iface_desc->endpoint[2].desc;
80+
if (!usb_endpoint_is_bulk_out(epd))
81+
goto failed;
82+
6983
dev = interface_to_usbdev(interface);
7084
wlandev = create_wlan();
7185
if (!wlandev) {

0 commit comments

Comments
 (0)