According to the specifications, an instrument should not return more data in a
DEV_DEP_MSG_IN urb than requested. However, some instruments can send more
than requested. This could cause the kernel to write the extra data past the
end of the buffer provided by read().
Fix this by checking that the value of the TranserSize field is not larger than
the urb itself and not larger than the size of the userspace buffer. Also
correctly decrement the remaining size of the buffer when userspace read()s
more than USBTMC_SIZE_IOBUFFER.
Signed-off-by: Guus Sliepen <guus@sliepen.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
a class driver should have suspend/resume. This makes sure we
don't see a virtual disconnect unnecessarily.
Signed-off-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
usbtmc will happily complete read/write requests even after disconnect
has returned. The fix is to introduce a flag.
Signed-off-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Steve Holland pointed out that we forgot to call break; in the switch
statment. This probably resolves a lot of the bug reports I've gotten
for the driver lately.
Stupid me...
Reported-by: Steve Holland <sdh4@iastate.edu>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The driver already supports the 1 protocol support, so just add it to
the MODULE_DEVICE_TABLE entry so it properly picks up these devices.
Thanks to Jouni Rynö for pointing this out.
Reported-by: Jouni Ryno <Jouni.Ryno@fmi.fi>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
open() will never succeed, as we always return -ENODEV. Fix this
obvious bug.
Thanks to Jouni Ryno for reporting it.
Reported-by: Jouni Ryno <Jouni.Ryno@fmi.fi>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
It seems that there's rather involved way to say something
which is commonly written in a plain simple form.
Some type changes would probably be necessary to get gcc
to do bitops instead of divide but it's no worse after my
change than before I think.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The usbtmc driver forgot to export its device table to userspace.
Without this, it is never loaded properly when such a device is seen by
the system.
Cc: Marcel Janssen <marcel.janssen@admesy.nl>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Silences compiler warning about comparison with 0x80, and type now matches the
corresponding _bulk_out function.
drivers/usb/class/usbtmc.c: In function ‘usbtmc_ioctl_abort_bulk_in’:
drivers/usb/class/usbtmc.c:163: warning: comparison is always false due to limited range of data type
Signed-off-by: Chris Malley <mail@chrismalley.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This driver was originaly written by Stefan Kopp, but massively
reworked by Greg for submission.
Thanks to Felipe Balbi <me@felipebalbi.com> for lots of work in cleaning
up this driver.
Thanks to Oliver Neukum <oliver@neukum.org> for reviewing previous
versions and pointing out problems.
Cc: Stefan Kopp <stefan_kopp@agilent.com>
Cc: Marcel Janssen <korgull@home.nl>
Cc: Felipe Balbi <me@felipebalbi.com>
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Guus Sliepen