fix double-munging when bufinfo ioctl is called in concert with

read()s from /dev/comediX

diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c
index 79fec01a09c04dcb1512f1bcda5005074fe6a6d8..92d0a825c54f1b2848e32ec79e7701379d939517 100644 (file)
--- a/comedi/comedi_fops.c
+++ b/comedi/comedi_fops.c
@@ -1504,8 +1504,7 @@ static ssize_t comedi_read_v22(struct file * file,char *buf,size_t nbytes,loff_t
                        schedule();
                        continue;
                }
-
-               comedi_buf_munge(dev, s, n);
+               comedi_buf_munge(dev, s, async->buf_write_count - async->munge_count);
                m = copy_to_user(buf, async->prealloc_buf +
                        async->buf_read_ptr, n);
                if(m){

diff --git a/comedi/drivers.c b/comedi/drivers.c
index 527e711f35b6b699f432b57f2d5fea429e093afb..045ad0ccaeb3570bb7e24715712f0d971a2c7383 100644 (file)
--- a/comedi/drivers.c
+++ b/comedi/drivers.c
@@ -120,7 +120,6 @@ int comedi_device_attach(comedi_device *dev,comedi_devconfig *it)
        spin_lock_init(&dev->spinlock);
        dev->minor=minor;
        dev->use_count = use_count;
-
        for(driv=comedi_drivers;driv;driv=driv->next){
                if(!try_module_get( driv->module ))
                {
@@ -480,14 +479,18 @@ unsigned int comedi_buf_munge( comedi_device *dev, comedi_subdevice *s,
 
        if( s->munge == NULL || ( s->async->cmd.flags & CMDF_RAWDATA ) )
                return count;
-
        /* don't munge partial samples */
        num_bytes -= num_bytes % bytes_per_sample(s);
        while( count < num_bytes )
        {
-               unsigned int block_size;
+               int block_size;
 
                block_size = num_bytes - count;
+               if(block_size < 0)
+               {
+                       rt_printk("%s: %s: bug! block_size is negative\n", __FILE__, __FUNCTION__);
+                       break;
+               }
                if( (int)(s->async->munge_ptr + block_size - s->async->prealloc_bufsz) > 0 )
                        block_size = s->async->prealloc_bufsz - s->async->munge_ptr;