From: Frank Mori Hess <fmhess@speakeasy.net>
Date: Wed, 21 Jul 2004 00:10:59 +0000 (+0000)
Subject: fix double-munging when bufinfo ioctl is called in concert with
X-Git-Tag: r0_7_69~15
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=6fefad49f71552d0336a2d1095b50858f1c95023;p=comedi.git

fix double-munging when bufinfo ioctl is called in concert with
read()s from /dev/comediX
---

diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c
index 79fec01a..92d0a825 100644
--- a/comedi/comedi_fops.c
+++ b/comedi/comedi_fops.c
@@ -1504,8 +1504,7 @@ static ssize_t comedi_read_v22(struct file * file,char *buf,size_t nbytes,loff_t
 			schedule();
 			continue;
 		}
-
-		comedi_buf_munge(dev, s, n);
+		comedi_buf_munge(dev, s, async->buf_write_count - async->munge_count);
 		m = copy_to_user(buf, async->prealloc_buf +
 			async->buf_read_ptr, n);
 		if(m){
diff --git a/comedi/drivers.c b/comedi/drivers.c
index 527e711f..045ad0cc 100644
--- a/comedi/drivers.c
+++ b/comedi/drivers.c
@@ -120,7 +120,6 @@ int comedi_device_attach(comedi_device *dev,comedi_devconfig *it)
 	spin_lock_init(&dev->spinlock);
 	dev->minor=minor;
 	dev->use_count = use_count;
-
 	for(driv=comedi_drivers;driv;driv=driv->next){
 		if(!try_module_get( driv->module ))
 		{
@@ -480,14 +479,18 @@ unsigned int comedi_buf_munge( comedi_device *dev, comedi_subdevice *s,
 
 	if( s->munge == NULL || ( s->async->cmd.flags & CMDF_RAWDATA ) )
 		return count;
-
 	/* don't munge partial samples */
 	num_bytes -= num_bytes % bytes_per_sample(s);
 	while( count < num_bytes )
 	{
-		unsigned int block_size;
+		int block_size;
 
 		block_size = num_bytes - count;
+		if(block_size < 0)
+		{
+			rt_printk("%s: %s: bug! block_size is negative\n", __FILE__, __FUNCTION__);
+			break;
+		}
 		if( (int)(s->async->munge_ptr + block_size - s->async->prealloc_bufsz) > 0 )
 			block_size = s->async->prealloc_bufsz - s->async->munge_ptr;