Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756540AbbKRRzd (ORCPT ); Wed, 18 Nov 2015 12:55:33 -0500 Received: from smtp113.iad3a.emailsrvr.com ([173.203.187.113]:39394 "EHLO smtp113.iad3a.emailsrvr.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933324AbbKRRz2 (ORCPT ); Wed, 18 Nov 2015 12:55:28 -0500 X-Auth-ID: abbotti@mev.co.uk X-Sender-Id: abbotti@mev.co.uk From: Ian Abbott To: driverdev-devel@linuxdriverproject.org Cc: Greg Kroah-Hartman , Ian Abbott , H Hartley Sweeten , linux-kernel@vger.kernel.org Subject: [PATCH 5/8] staging: comedi: allow buffer wraparound in comedi_write() Date: Wed, 18 Nov 2015 17:55:08 +0000 Message-Id: <1447869311-21955-6-git-send-email-abbotti@mev.co.uk> X-Mailer: git-send-email 2.6.2 In-Reply-To: <1447869311-21955-1-git-send-email-abbotti@mev.co.uk> References: <1447869311-21955-1-git-send-email-abbotti@mev.co.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2177 Lines: 59 `comedi_write()` copies data from the user buffer to the acquisition data buffer, which is cyclic, using a single call to `copy_from_user()`. It currently avoids having to deal with wraparound of the cyclic buffer by limiting the amount it copies (and the amount returned to the user). Change it to deal with the wraparound using two calls to `copy_from_user()` if necessary. Signed-off-by: Ian Abbott --- drivers/staging/comedi/comedi_fops.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c index 8c784c4..4dd4289 100644 --- a/drivers/staging/comedi/comedi_fops.c +++ b/drivers/staging/comedi/comedi_fops.c @@ -2346,6 +2346,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, add_wait_queue(&async->wait_head, &wait); while (count == 0 && !retval) { unsigned runflags; + unsigned int wp, n1, n2; set_current_state(TASK_INTERRUPTIBLE); @@ -2360,9 +2361,6 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, /* Allocate all free buffer space. */ comedi_buf_write_alloc(s, async->prealloc_bufsz); m = comedi_buf_write_n_allocated(s); - /* Avoid buffer wraparound. */ - if (async->buf_write_ptr + m > async->prealloc_bufsz) - m = async->prealloc_bufsz - async->buf_write_ptr; n = min_t(size_t, m, nbytes); if (n == 0) { @@ -2388,8 +2386,14 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, continue; } - m = copy_from_user(async->prealloc_buf + async->buf_write_ptr, - buf, n); + wp = async->buf_write_ptr; + n1 = min(n, async->prealloc_bufsz - wp); + n2 = n - n1; + m = copy_from_user(async->prealloc_buf + wp, buf, n1); + if (m) + m += n2; + else if (n2) + m = copy_from_user(async->prealloc_buf, buf + n1, n2); if (m) { n -= m; retval = -EFAULT; -- 2.6.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/