Patch from abbotti@mev.co.uk (Ian Abbott):

The following driver files call ioremap() but do not check if the return value
is NULL:

cb_pcidas64.c
daqboard2000.c
dt3000.c
gsc_hpdi.c
me_daq.c
mite.c
rtd520.c
s626.c

The attached patch takes appropriate action if the return value from ioremap()
is NULL.  (In some cases, this also required the addition of a flag
'got_regions' to the device private data structure to record whether the PCI
regions need to be released.)

The patch also removes the antiquated requirement of the address passed to
ioremap() needing to be on a page boundary.

diff --git a/comedi/drivers/cb_pcidas64.c b/comedi/drivers/cb_pcidas64.c
index 20de6ecbd9e1d92312485ab438605fdb7b7af5e1..8c4832e4b82e670cdc4ad4456b58258380976fff 100644 (file)
--- a/comedi/drivers/cb_pcidas64.c
+++ b/comedi/drivers/cb_pcidas64.c
@@ -1723,6 +1723,12 @@ static int attach(comedi_device *dev, comedi_devconfig *it)
        priv(dev)->dio_counter_iobase = ioremap(priv(dev)->dio_counter_phys_iobase,
                pci_resource_len(pcidev, DIO_COUNTER_BADDRINDEX));
 
+       if (!priv(dev)->plx9080_iobase || !priv(dev)->main_iobase || !priv(dev)->dio_counter_iobase)
+       {
+               printk(" failed to remap io memory\n");
+               return -ENOMEM;
+       }
+
        DEBUG_PRINT(" plx9080 remapped to 0x%lx\n", priv(dev)->plx9080_iobase);
        DEBUG_PRINT(" main remapped to 0x%lx\n", priv(dev)->main_iobase);
        DEBUG_PRINT(" diocounter remapped to 0x%lx\n", priv(dev)->dio_counter_iobase);

diff --git a/comedi/drivers/daqboard2000.c b/comedi/drivers/daqboard2000.c
index 38f707067a2e0553e0f01b8e2e9c9e0227c111cc..1a915e49b290c01af56e3aa8a201f3b0cf732954 100644 (file)
--- a/comedi/drivers/daqboard2000.c
+++ b/comedi/drivers/daqboard2000.c
@@ -326,6 +326,7 @@ typedef struct {
   struct pci_dev *pci_dev;
   void *daq;
   void *plx;
+  int got_regions;
   lsampl_t ao_readback[2];
 } daqboard2000_private;
 
@@ -724,8 +725,12 @@ static int daqboard2000_attach(comedi_device *dev, comedi_devconfig *it)
        if((result = pci_request_regions(card, "daqboard2000")) < 0) {
                return -EIO;    
        }
+       devpriv->got_regions = 1;
        devpriv->plx = ioremap(pci_resource_start(card,0), DAQBOARD2000_PLX_SIZE);
        devpriv->daq = ioremap(pci_resource_start(card,2), DAQBOARD2000_DAQ_SIZE);
+       if(!devpriv->plx || !devpriv->daq){
+               return -ENOMEM;
+       }
 
        result = alloc_subdevices(dev, 3);
        if(result<0)goto out;
@@ -807,7 +812,7 @@ static int daqboard2000_detach(comedi_device * dev)
                        iounmap(devpriv->plx);
                if(devpriv->pci_dev)
                {
-                       if(devpriv->daq)
+                       if(devpriv->got_regions)
                        {
                                pci_release_regions(devpriv->pci_dev);
                                pci_disable_device(devpriv->pci_dev);

diff --git a/comedi/drivers/dt3000.c b/comedi/drivers/dt3000.c
index c5e2a88a8b8845c9da406a9678b41b7c3d82b876..93cdb1d2e0e9b62000ead2dada5de0d25dca74ca 100644 (file)
--- a/comedi/drivers/dt3000.c
+++ b/comedi/drivers/dt3000.c
@@ -895,7 +895,6 @@ static int dt_pci_probe(comedi_device *dev)
 
 static int setup_pci(comedi_device *dev)
 {
-       unsigned long           offset;
        u32                     addr;
        int ret;
 
@@ -907,9 +906,8 @@ static int setup_pci(comedi_device *dev)
 
        addr=pci_resource_start(devpriv->pci_dev,0);
        devpriv->phys_addr=addr;
-       offset = devpriv->phys_addr & ~PAGE_MASK;
-       devpriv->io_addr = ioremap(devpriv->phys_addr & PAGE_MASK, DT3000_SIZE + offset )
-               + offset;
+       devpriv->io_addr = ioremap(devpriv->phys_addr, DT3000_SIZE);
+       if(!devpriv->io_addr) return -ENOMEM;
 #if DEBUG
        printk("0x%08lx mapped to %p, ",devpriv->phys_addr,devpriv->io_addr);
 #endif

diff --git a/comedi/drivers/gsc_hpdi.c b/comedi/drivers/gsc_hpdi.c
index d9abfe3d88272a7f81598d77bf392ba1f1f51878..0f94881326be0a1d943b3113047b7270376584fd 100644 (file)
--- a/comedi/drivers/gsc_hpdi.c
+++ b/comedi/drivers/gsc_hpdi.c
@@ -600,6 +600,11 @@ static int hpdi_attach(comedi_device *dev, comedi_devconfig *it)
                pci_resource_len( pcidev, PLX9080_BADDRINDEX ) );
        priv(dev)->hpdi_iobase = ioremap( priv(dev)->hpdi_phys_iobase,
                pci_resource_len( pcidev, HPDI_BADDRINDEX ) );
+       if (!priv(dev)->plx9080_iobase || !priv(dev)->hpdi_iobase)
+       {
+               printk(" failed to remap io memory\n");
+               return -ENOMEM;
+       }
 
        DEBUG_PRINT(" plx9080 remapped to 0x%lx\n", priv(dev)->plx9080_iobase);
        DEBUG_PRINT(" hpdi remapped to 0x%lx\n", priv(dev)->hpdi_iobase);

diff --git a/comedi/drivers/me_daq.c b/comedi/drivers/me_daq.c
index 9ef943e3523447b1338c192b5af358b3a62fac2a..b841a71e9b93c39da1b6dfe05ab3570a3e79ffae 100644 (file)
--- a/comedi/drivers/me_daq.c
+++ b/comedi/drivers/me_daq.c
@@ -760,6 +760,11 @@ found:
   plx_regbase_size_tmp = pci_resource_end(pci_device, 0) - plx_regbase_tmp + 1;
   dev_private->plx_regbase = ioremap(plx_regbase_tmp, plx_regbase_size_tmp);
   dev_private->plx_regbase_size = plx_regbase_size_tmp;
+  if(!dev_private->plx_regbase)
+  {
+    printk("comedi%d: Failed to remap I/O memory\n", dev->minor);
+    return -ENOMEM;
+  }
 
   // Read Swap base address [PCI_BASE_ADDRESS #5].
 
@@ -807,6 +812,11 @@ found:
   me_regbase_size_tmp = pci_resource_end(pci_device, 2) - me_regbase_tmp + 1;
   dev_private->me_regbase_size = me_regbase_size_tmp;
   dev_private->me_regbase = ioremap(me_regbase_tmp, me_regbase_size_tmp);
+  if(!dev_private->me_regbase)
+  {
+    printk("comedi%d: Failed to remap I/O memory\n", dev->minor);
+    return -ENOMEM;
+  }
 
   // Download firmware and reset card
   if(board->device_id == ME2600_DEVICE_ID)
@@ -881,10 +891,13 @@ static int me_detach(comedi_device *dev)
                if (dev_private->me_regbase)
                {
                        me_reset(dev);
+                       iounmap(dev_private->me_regbase);
                }
+               if (dev_private->plx_regbase)
+                       iounmap(dev_private->plx_regbase);
                if(dev_private->pci_device)
                {
-                       if(dev_private->plx_regbase)
+                       if(dev_private->plx_regbase_size)
                        {
                                pci_release_regions(dev_private->pci_device);
                                pci_disable_device(dev_private->pci_device);

diff --git a/comedi/drivers/mite.c b/comedi/drivers/mite.c
index 2e19522649d8f0a406d1147edb151f6010faf29a..c34d5964ae1dc2e953243ae776f2d25a1d6d1473 100644 (file)
--- a/comedi/drivers/mite.c
+++ b/comedi/drivers/mite.c
@@ -104,7 +104,7 @@ static void dump_chip_signature(u32 csigr_bits)
 
 int mite_setup(struct mite_struct *mite)
 {
-       unsigned long offset, start, length;
+       unsigned long length;
        u32 addr;
        int i;
        u32 csigr_bits;
@@ -121,24 +121,27 @@ int mite_setup(struct mite_struct *mite)
 
        addr = pci_resource_start(mite->pcidev, 0);
        mite->mite_phys_addr = addr;
-       offset = mite->mite_phys_addr & ~PAGE_MASK;
-       start = mite->mite_phys_addr & PAGE_MASK;
-       length = PCI_MITE_SIZE + offset;
-       mite->mite_io_addr = ioremap(start, length) + offset;
+       mite->mite_io_addr = ioremap(addr, PCI_MITE_SIZE);
+       if( !mite->mite_io_addr ) {
+               printk("failed to remap mite io memory address\n");
+               return -ENOMEM;
+       }
        printk("MITE:0x%08lx mapped to %p ",mite->mite_phys_addr,mite->mite_io_addr);
 
        addr=pci_resource_start(mite->pcidev, 1);
        mite->daq_phys_addr=addr;
-       offset = mite->daq_phys_addr & ~PAGE_MASK;
-       start = mite->daq_phys_addr & PAGE_MASK;
 
        // In case of a 660x board, DAQ size is 8k instead of 4k (see as shown by lspci output)
        if ((mite->pcidev->device == 0x1310) || (mite->pcidev->device == 0x2c60)){
-               length = PCI_DAQ_SIZE_660X + offset;
+               length = PCI_DAQ_SIZE_660X;
                printk("mite: detected NI660X board, using PCI DAQ SIZE of 8k\n");
        }
-        else length = PCI_DAQ_SIZE + offset;
-       mite->daq_io_addr = ioremap(start, length) + offset;
+       else length = PCI_DAQ_SIZE;
+       mite->daq_io_addr = ioremap(mite->daq_phys_addr, length);
+       if( !mite->daq_io_addr ) {
+               printk("failed to remap daq io memory address\n");
+               return -ENOMEM;
+       }
        printk("DAQ:0x%08lx mapped to %p\n",mite->daq_phys_addr,mite->daq_io_addr);
 
        // The 6602 board needs different initalisation, see the
@@ -195,7 +198,7 @@ void mite_unsetup(struct mite_struct *mite)
                iounmap(mite->daq_io_addr);
                mite->daq_io_addr=NULL;
        }
-       if( mite->used ){
+       if( mite->mite_phys_addr ){
                pci_release_regions( mite->pcidev );
                pci_disable_device( mite->pcidev );
        }

diff --git a/comedi/drivers/rtd520.c b/comedi/drivers/rtd520.c
index 5bb8f9a15cb6c4a821fdd7f4302a76bdcc2c930d..d10faf29116b111f929fc705d0f81d24b3725f85 100644 (file)
--- a/comedi/drivers/rtd520.c
+++ b/comedi/drivers/rtd520.c
@@ -347,6 +347,7 @@ typedef struct{
 
                                        /* PCI device info */
     struct pci_dev *pci_dev;
+    int got_regions;                   /* non-zero if PCI regions owned */
 
     /* channel list info */
     /* chanBipolar tracks whether a channel is bipolar (and needs +2048) */
@@ -809,6 +810,7 @@ static int rtd_attach (
        if((ret=pci_request_regions(pcidev, "rtd520"))<0){
                return ret;
        }
+       devpriv->got_regions = 1;
 
     /*
      * Initialize base addresses
@@ -1150,7 +1152,7 @@ static int rtd_detach (
            iounmap (devpriv->lcfg);
        }
        if (devpriv->pci_dev) {
-               if(devpriv->las0)
+               if(devpriv->got_regions)
                {
                        pci_release_regions(devpriv->pci_dev);
                        pci_disable_device(devpriv->pci_dev);

diff --git a/comedi/drivers/s626.c b/comedi/drivers/s626.c
index 0ff5791fc9b34130dbbbae1bbce37cd064d7357d..ca003db3aa206b6d30cf28988e3c5b1a81464097 100644 (file)
--- a/comedi/drivers/s626.c
+++ b/comedi/drivers/s626.c
@@ -124,6 +124,7 @@ static comedi_driver driver_s626={
 typedef struct{
   struct pci_dev *pdev;
   void          *base_addr;
+  int           got_regions;
   short         allocatedBuf;
   uint8_t       ai_cmd_running;         // ai_cmd is running
   uint8_t       ai_continous;          // continous aquisition
@@ -503,6 +504,7 @@ static int s626_attach(comedi_device *dev,comedi_devconfig *it)
     printk("s626_attach: pci_request_regions fails\n");
     return -ENODEV;
   }
+  devpriv->got_regions = 1;
 
   resourceStart=(uint64_t)pci_resource_start(devpriv->pdev,0);
   
@@ -1227,7 +1229,7 @@ static int s626_detach(comedi_device *dev)
                }
        
                if(devpriv->pdev){
-                       if(devpriv->base_addr)
+                       if(devpriv->got_regions)
                        {
                                pci_release_regions(devpriv->pdev);
                                pci_disable_device(devpriv->pdev);