From: Frank Mori Hess <fmhess@speakeasy.net>
Date: Sun, 7 Jul 2002 05:54:07 +0000 (+0000)
Subject: fix integer overflow with mite_bytes_transferred()
X-Git-Tag: r0_7_66~163
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=42fa94e3f0aa1f810c1ae74a86b9c67e2121bb5d;p=comedi.git

fix integer overflow with mite_bytes_transferred()
---

diff --git a/comedi/drivers/mite.c b/comedi/drivers/mite.c
index a3447dcf..0d48eaf9 100644
--- a/comedi/drivers/mite.c
+++ b/comedi/drivers/mite.c
@@ -481,10 +481,10 @@ void mite_prep_dma(struct mite_struct *mite)
 }
 
 
-int mite_bytes_transferred(struct mite_struct *mite, int chan)
+unsigned int mite_bytes_transferred(struct mite_struct *mite, int chan)
 {
-	int dar, fcr;
-	
+	unsigned int dar, fcr;
+
 	dar = readl(mite->mite_io_addr+MITE_DAR+CHAN_OFFSET(chan));
 	fcr = readl(mite->mite_io_addr+MITE_FCR+CHAN_OFFSET(chan)) & 0x000000FF;
 	return dar-fcr;
diff --git a/comedi/drivers/mite.h b/comedi/drivers/mite.h
index e3605b66..524004fe 100644
--- a/comedi/drivers/mite.h
+++ b/comedi/drivers/mite.h
@@ -92,7 +92,7 @@ void mite_list_devices(void);
 int mite_dma_tcr(struct mite_struct *mite);
 void mite_dma_arm(struct mite_struct *mite);
 void mite_dma_disarm(struct mite_struct *mite);
-int mite_bytes_transferred(struct mite_struct *mite, int chan);
+unsigned int mite_bytes_transferred(struct mite_struct *mite, int chan);
 
 #if 0
 unsigned long mite_ll_from_kvmem(struct mite_struct *mite,comedi_async *async,int len);
diff --git a/comedi/drivers/ni_mio_common.c b/comedi/drivers/ni_mio_common.c
index 4e101b6f..312f7356 100644
--- a/comedi/drivers/ni_mio_common.c
+++ b/comedi/drivers/ni_mio_common.c
@@ -346,7 +346,7 @@ static void ni_E_interrupt(int irq,void *d,struct pt_regs * regs)
 #ifdef PCIDMA
 static void mite_handle_a_linkc(struct mite_struct *mite, comedi_device *dev)
 {
-	int count;
+	unsigned int count;
 	comedi_subdevice *s = dev->subdevices + 0;
 	comedi_async *async = s->async;
 
@@ -357,6 +357,8 @@ static void mite_handle_a_linkc(struct mite_struct *mite, comedi_device *dev)
 		printk("BUG: too many samples in interrupt (%d)\n",count);
 		return;
 	}
+	// XXX buf_dirty_count should really be incremented earlier...
+	async->buf_dirty_count += count;
 	async->buf_write_count += count;
 
 	if(async->cmd.flags & CMDF_RAWDATA){