buffer overflows in comedi drivers
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
Medium
|
Leann Ogasawara | ||
Precise |
Fix Released
|
Medium
|
Leann Ogasawara |
Bug Description
== Precise SRU Justification ==
The default and max buffer size are set to inappropriate values for the
comedi staging driver. This results in program crashes. Patches have
been submitted upstream to resolve this issue and are currently
available in:
git://git.
I have also received confirmation from the bug reporter and patch author
that they intend to submit these to upstream stable as well.
The changes are limited to a single staging driver which should minimize
the risk of regression. I have also received positive test confirmation
from the bug reporter that the patches noted below resolve the issue.
== Fix ==
commit 4d7df821 from staging-next needed very minor fixing up when
cherry-picking. commit 234bb3c6 from staging-next cherry-picked
cleanly. The last commit updates the configs:
commit 4d7df821277e82e
Author: Ian Abbott <email address hidden>
Date: Fri Apr 13 14:12:53 2012 +0100
staging: comedi: Add module parameters for default buffer size
commit 234bb3c60f1f148
Author: Ian Abbott <email address hidden>
Date: Fri Apr 13 14:12:54 2012 +0100
staging: comedi: Add kernel config for default buffer sizes
commit 96dddbbb8a9071c
Author: Leann Ogasawara <email address hidden>
Date: Fri Apr 13 20:40:29 2012 -0700
UBUNTU: [Config] Set CONFIG_
I've also pushed these to a branch if you'd prefer to pull from there:
The following changes since commit 4767f8d1efe2d8b
Linux 3.2.15 (2012-04-14 06:50:30 -0600)
are available in the git repository at:
git:/
for you to fetch changes up to 2bf208c4572e3ac
UBUNTU: [Config] Set CONFIG_
-------
Ian Abbott (2):
UBUNTU: SAUCE: staging: comedi: Add module parameters for default buffer size
UBUNTU: SAUCE: staging: comedi: Add kernel config for default buffer sizes
Leann Ogasawara (1):
UBUNTU: [Config] Set CONFIG_
debian.
drivers/
drivers/
drivers/
drivers/
5 files changed, 59 insertions(+), 10 deletions(-)
== Original Bug Description ==
There asynchronous buffer for the COMEDI drivers is only 65k and is hard coded in the kernel. With slower computers and slow userspace programs there is virtually always a buffer overflow which makes it impossible to run these programs, especially with DAQ cards which have a high resolution or those with high sampling rate.
I'm attaching a patch which has been submitted and accepted upstream. Below the confirmation e-mail from Gregkh:
Return-Path: <email address hidden>
Delivered-To: <email address hidden>
Envelope-To: <email address hidden>
Received: (qmail 39856 invoked from network); 13 Apr 2012 18:20:21 -0000
Received: from as001.apm-
by mail003.
Received: (qmail 73709 invoked from network); 13 Apr 2012 18:20:20 -0000
X-Spam-
as001.
X-Spam-Score: -0.1
X-Spam-Report:
* -0.1 SPF_PASS SPF database pass
X-Spam-
Received: from av002.apm-
by as001.apm-
Received: (qmail 98427 invoked from network); 13 Apr 2012 18:20:20 -0000
X-AV-Scan: clean
Received: from relay004.
by av002.apm-
Received: (qmail 73444 invoked from network); 13 Apr 2012 18:20:19 -0000
Received: from mail-pb0-
by relay004.
X-APM-IP: 209.85.160.41
X-APM-Score: -2
Received-SPF: pass (relay004.
Received: by pbcup15 with SMTP id up15so3700835pbc.28
for <email address hidden>; Fri, 13 Apr 2012 11:20:17 -0700 (PDT)
X-Google-
VqJw==
Received: by 10.68.132.36 with SMTP id or4mr6543286pbb
Fri, 13 Apr 2012 11:20:17 -0700 (PDT)
Return-Path: <email address hidden>
Received: from localhost (c-67-168-
by mx.google.com with ESMTPS id vh10sm9365834pb
Fri, 13 Apr 2012 11:20:16 -0700 (PDT)
Subject: patch "staging: comedi: Add kernel config for default buffer sizes" added to staging tree
To: <email address hidden>,<email address hidden>,<email address hidden>
From: <email address hidden>
Date: Fri, 13 Apr 2012 11:20:08 -0700
Message-ID: <email address hidden>
MIME-Version: 1.0
Content-Type: text/plain; charset=ASCII
Content-
X-Gm-Message-State: ALoCoQlEvqUZ2Xt
This is a note to let you know that I've just added the patch titled
staging: comedi: Add kernel config for default buffer sizes
to my staging git tree which can be found at
git:
in the staging-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also will be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
From 234bb3c60f1f148
From: Ian Abbott <email address hidden>
Date: Fri, 13 Apr 2012 14:12:54 +0100
Subject: staging: comedi: Add kernel config for default buffer sizes
Allow the default values for the module parameters for the default
initial buffer size and default maximum buffer size to be specified in
the kernel configuration.
I'm not sure what the defaults for the defaults for the defaults should
be, but 64 KiB seems to small, so I used values suggested by Bernd Porr,
which are 2048 KiB for the default initial buffer size and 20480 for the
default maximum buffer size.
Signed-off-by: Ian Abbott <email address hidden>
Cc: Bernd Porr <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
---
drivers/
drivers/
2 files changed, 25 insertions(+), 7 deletions(-)
diff --git a/drivers/
index 9037d02..a1cf0b0 100644
--- a/drivers/
+++ b/drivers/
@@ -14,6 +14,26 @@ config COMEDI_DEBUG
This is an option for use by developers; most people should
say N here. This enables comedi core and driver debugging.
+config COMEDI_
+ int "Comedi default initial asynchronous buffer size in KiB"
+ default "2048"
+ depends on COMEDI != n
+ ---help---
+ This is the default asynchronous buffer size which is used for
+ commands running in the background in kernel space. This
+ defaults to 2048 KiB of memory so that a 16 channel card
+ running at 10 kHz has of 2-4 seconds of buffer.
+
+config COMEDI_
+ int "Comedi default maximum asynchronous buffer size in KiB"
+ default "20480"
+ depends on COMEDI != n
+ ---help---
+ This is the default maximum asynchronous buffer size which can
+ be requested by a userspace program without root privileges.
+ This is set to 20480 KiB so that a fast I/O card with 16
+ channels running at 100 kHz has 2-4 seconds of buffer.
+
menuconfig COMEDI_MISC_DRIVERS
tristate "Comedi misc drivers"
depends on COMEDI
diff --git a/drivers/
index ef7bbe4..3222ac6 100644
--- a/drivers/
+++ b/drivers/
@@ -55,9 +55,6 @@ MODULE_AUTHOR("http://
MODULE_
MODULE_
-#define DEFAULT_
-#define DEFAULT_BUF_SIZE_KB 64
-
#ifdef CONFIG_COMEDI_DEBUG
int comedi_debug;
EXPORT_
@@ -78,17 +75,18 @@ MODULE_
"number of comedi minor devices to reserve for non-auto-configured devices (default 0)"
);
-unsigned int comedi_
+unsigned int comedi_
module_
MODULE_
"default asynchronous buffer size in KiB (default "
- __MODULE_
+ __MODULE_
-unsigned int comedi_
+unsigned int comedi_
+ = CONFIG_
module_
MODULE_
"default maximum size of asynchronous buffer in KiB (default "
- __MODULE_
+ __MODULE_
static DEFINE_
static struct comedi_
--
1.7.10
ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: linux-image-
ProcVersionSign
Uname: Linux 3.2.0-23-
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24.
ApportVersion: 2.0.1-0ubuntu2
Architecture: i386
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/
CRDA: Error: [Errno 2] No such file or directory
Card0.Amixer.info:
Card hw:0 'Intel'/'HDA Intel at 0xfdff8000 irq 45'
Mixer name : 'Realtek ALC888'
Components : 'HDA:10ec0888,
Controls : 44
Simple ctrls : 21
Date: Fri Apr 13 23:32:26 2012
HibernationDevice: RESUME=
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha i386 (20120201.2)
IwConfig:
lo no wireless extensions.
eth0 no wireless extensions.
MachineType: Acer AcerPower FH
ProcEnviron:
LANGUAGE=en_GB:en
TERM=xterm
PATH=(custom, user)
LANG=en_GB.UTF-8
SHELL=/bin/bash
ProcFB: 0 radeondrmfb
ProcKernelCmdLine: BOOT_IMAGE=
RelatedPackageV
linux-
linux-
linux-firmware 1.79
RfKill:
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
UserAsoundrc:
pcm.fileout {
type empty
slave.pcm "tee:default,
# 48000 S16_LE 2ch (aplay -t raw -f dat)
}
dmi.bios.date: 03/03/2007
dmi.bios.vendor: Phoenix Technologies, LTD
dmi.bios.version: R01-B4
dmi.board.name: E946GZ
dmi.board.vendor: Acer
dmi.chassis.type: 3
dmi.chassis.vendor: Broadwater
dmi.chassis.
dmi.modalias: dmi:bvnPhoenixT
dmi.product.name: AcerPower FH
dmi.product.
dmi.sys.vendor: Acer
Changed in linux (Ubuntu): | |
status: | New → Confirmed |
tags: | added: patch |
description: | updated |
There are actually two patches - the second one depends on the first one.
First: git.kernel. org/?p= linux/kernel/ git/gregkh/ staging. git;a=patch; h=4d7df821277e8 2ebe2fc9c9af07c 928a83f572b8
http://
Second: git.kernel. org/?p= linux/kernel/ git/gregkh/ staging. git;a=patch; h=234bb3c60f1f1 489630750aba4ad f40154e0bd70
http://