Commit d375278d authored by H Hartley Sweeten's avatar H Hartley Sweeten Committed by Greg Kroah-Hartman
Browse files

staging: comedi: das1800: fix possible NULL dereference 



DMA is optional with this driver. If it was not enabled the devpriv->dma
pointer will be NULL.

Fix the possible NULL pointer dereference when trying to disable the DMA
channels in das1800_ai_cancel() and tidy up the comments to fix the
checkpatch.pl issues:
WARNING: line over 80 characters

It's probably harmless in das1800_ai_setup_dma() because the 'desc' pointer
will not be used if DMA is disabled but fix it there also.

Fixes: 99dfc335 ("staging: comedi: das1800: remove depends on ISA_DMA_API limitation")
Cc: <stable@vger.kernel.org> # 4.0+
Signed-off-by: default avatarH Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: default avatarIan Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3a56d700

drivers/staging/comedi/drivers/das1800.c

+13 −9
Original line number Diff line number Diff line
@@ -567,15 +567,18 @@ static int das1800_cancel(struct comedi_device *dev, struct comedi_subdevice *s) 
	struct comedi_isadma_desc *desc;

	int i;



	outb(0x0, dev->iobase + DAS1800_STATUS);	/* disable conversions */

	outb(0x0, dev->iobase + DAS1800_CONTROL_B);	/* disable interrupts and dma */

	outb(0x0, dev->iobase + DAS1800_CONTROL_A);	/* disable and clear fifo and stop triggering */

	/* disable and stop conversions */

	outb(0x0, dev->iobase + DAS1800_STATUS);

	outb(0x0, dev->iobase + DAS1800_CONTROL_B);

	outb(0x0, dev->iobase + DAS1800_CONTROL_A);



	if (dma) {

		for (i = 0; i < 2; i++) {

			desc = &dma->desc[i];

			if (desc->chan)

				comedi_isadma_disable(desc->chan);

		}

	}



	return 0;

}
@@ -934,13 +937,14 @@ static void das1800_ai_setup_dma(struct comedi_device *dev, 
{

	struct das1800_private *devpriv = dev->private;

	struct comedi_isadma *dma = devpriv->dma;

	struct comedi_isadma_desc *desc = &dma->desc[0];

	struct comedi_isadma_desc *desc;

	unsigned int bytes;



	if ((devpriv->irq_dma_bits & DMA_ENABLED) == 0)

		return;



	dma->cur_dma = 0;

	desc = &dma->desc[0];



	/* determine a dma transfer size to fill buffer in 0.3 sec */

	bytes = das1800_ai_transfer_size(dev, s, desc->maxsize, 300000000);