From: Bernd Porr <BerndPorr@f2s.com>
Date: Sun, 24 May 2009 19:36:09 +0000 (+0100)
Subject: Staging: comedi: usbdux: buffer overflow error handling
X-Git-Tag: v2.6.31-rc1~105^2~237
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=efe8d60a923ddd00de394381cb30aab5114b71a4;p=platform%2Fkernel%2Flinux-exynos.git

Staging: comedi: usbdux: buffer overflow error handling

These changes guarantee that the URBs are not resubmitted in case of a
comedi buffer overflow.  Otherwise this runs in the background even when
the userspace program has terminated.

From: Bernd Porr <BerndPorr@f2s.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/staging/comedi/drivers/usbdux.c b/drivers/staging/comedi/drivers/usbdux.c
index eea7dbd..171a6f2 100644
--- a/drivers/staging/comedi/drivers/usbdux.c
+++ b/drivers/staging/comedi/drivers/usbdux.c
@@ -509,14 +509,19 @@ static void usbduxsub_ai_IsocIrq(struct urb *urb)
 	for (i = 0; i < n; i++) {
 		/* transfer data */
 		if (CR_RANGE(s->async->cmd.chanlist[i]) <= 1) {
-			comedi_buf_put
+			err = comedi_buf_put
 				(s->async,
-				le16_to_cpu(this_usbduxsub->
-					inBuffer[i]) ^ 0x800);
+				 le16_to_cpu(this_usbduxsub->
+					     inBuffer[i]) ^ 0x800);
 		} else {
-			comedi_buf_put
+			err = comedi_buf_put
 				(s->async,
-				le16_to_cpu(this_usbduxsub->inBuffer[i]));
+				 le16_to_cpu(this_usbduxsub->inBuffer[i]));
+		}
+		if (unlikely(err == 0)) {
+			/* buffer overflow */
+			usbdux_ai_stop(this_usbduxsub, 0);
+			return;
 		}
 	}
 	/* tell comedi that data is there */
diff --git a/drivers/staging/comedi/drivers/usbduxfast.c b/drivers/staging/comedi/drivers/usbduxfast.c
index 5862078..939b53f 100644
--- a/drivers/staging/comedi/drivers/usbduxfast.c
+++ b/drivers/staging/comedi/drivers/usbduxfast.c
@@ -406,7 +406,7 @@ static void usbduxfastsub_ai_Irq(struct urb *urb)
 					udfs->ai_sample_count
 					* sizeof(uint16_t));
 				usbduxfast_ai_stop(udfs, 0);
-				/* say comedi that the acquistion is over */
+				/* tell comedi that the acquistion is over */
 				s->async->events |= COMEDI_CB_EOA;
 				comedi_event(udfs->comedidev, s);
 				return;
@@ -414,8 +414,13 @@ static void usbduxfastsub_ai_Irq(struct urb *urb)
 			udfs->ai_sample_count -= n;
 		}
 		/* write the full buffer to comedi */
-		cfc_write_array_to_buffer(s, urb->transfer_buffer,
-					  urb->actual_length);
+		err = cfc_write_array_to_buffer(s, urb->transfer_buffer,
+						urb->actual_length);
+		if (unlikely(err == 0)) {
+			/* buffer overflow */
+			usbduxfast_ai_stop(udfs, 0);
+			return;
+		}
 
 		/* tell comedi that data is there */
 		comedi_event(udfs->comedidev, s);