* [PATCH 1/5] comedi: fix endless recursion in comedi_event()
2026-10-27 16:43 [PATCH 0/5] comedi: some small llm-found fixes Greg Kroah-Hartman
@ 2026-10-27 16:43 ` Greg Kroah-Hartman
2026-10-27 16:43 ` [PATCH 2/5] comedi: addi_apci_1500: fix clearing of the gate enable Greg Kroah-Hartman
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Greg Kroah-Hartman @ 2026-10-27 16:43 UTC (permalink / raw)
To: Ian Abbott, H Hartley Sweeten, Frank Mori Hess
Cc: Josef Bacik, linux-kernel, Greg Kroah-Hartman, stable
From: Josef Bacik <josef@toxicpanda.com>
When comedi_event() was split into a wrapper which takes a reference on
the running command and _comedi_event(), which does the work, the wrapper
ended up calling itself:
if (comedi_get_is_subdevice_running(s)) {
comedi_event(dev, s);
comedi_put_is_subdevice_running(s);
}
As long as the command is running every level takes another reference
and recurses, until the stack is used up.
Most drivers go through comedi_handle_events(), which calls
_comedi_event(). usbdux, usbduxfast and usbduxsigma cannot use that and
call comedi_event() from their URB completion handlers, i.e. for every
completed URB of a running acquisition.
Fixes: 51495254fda4 ("comedi: Use reference count for asynchronous command functions")
Cc: stable <stable@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/comedi/comedi_fops.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/comedi/comedi_fops.c b/drivers/comedi/comedi_fops.c
index 05d14839c5a6..68eddf853465 100644
--- a/drivers/comedi/comedi_fops.c
+++ b/drivers/comedi/comedi_fops.c
@@ -3495,7 +3495,7 @@ void _comedi_event(struct comedi_device *dev, struct comedi_subdevice *s)
void comedi_event(struct comedi_device *dev, struct comedi_subdevice *s)
{
if (comedi_get_is_subdevice_running(s)) {
- comedi_event(dev, s);
+ _comedi_event(dev, s);
comedi_put_is_subdevice_running(s);
}
}
--
2.56.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 2/5] comedi: addi_apci_1500: fix clearing of the gate enable
2026-10-27 16:43 [PATCH 0/5] comedi: some small llm-found fixes Greg Kroah-Hartman
2026-10-27 16:43 ` [PATCH 1/5] comedi: fix endless recursion in comedi_event() Greg Kroah-Hartman
@ 2026-10-27 16:43 ` Greg Kroah-Hartman
2026-10-27 16:43 ` [PATCH 3/5] comedi: ni_660x: don't poll without a DMA channel Greg Kroah-Hartman
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Greg Kroah-Hartman @ 2026-10-27 16:43 UTC (permalink / raw)
To: Ian Abbott, H Hartley Sweeten, Frank Mori Hess
Cc: Josef Bacik, linux-kernel, Greg Kroah-Hartman, stable
From: Josef Bacik <josef@toxicpanda.com>
INSN_CONFIG_SET_GATE_SRC reads the mode register of the counter/timer,
is meant to clear the External Gate Enable bit, sets it again if the
external gate was asked for, and writes the register back. The mask lacks
its '~': all the bits but EGE are cleared instead. So
- the external gate can be enabled but never be disabled again, and
- the instruction wipes the mode (continuous or single cycle, external
output, count and trigger enables, retrigger, duty cycle) which
INSN_CONFIG_SET_COUNTER_MODE has programmed: the timer silently falls
back to a single cycle pulse.
With the right mask, the instruction only changes the gate bit. An
application which sets the gate source after the counter mode now keeps
the mode it has asked for.
Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
Cc: stable <stable@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/comedi/drivers/addi_apci_1500.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/comedi/drivers/addi_apci_1500.c b/drivers/comedi/drivers/addi_apci_1500.c
index a203e27888e2..3d65aef565b3 100644
--- a/drivers/comedi/drivers/addi_apci_1500.c
+++ b/drivers/comedi/drivers/addi_apci_1500.c
@@ -696,7 +696,7 @@ static int apci1500_timer_insn_config(struct comedi_device *dev,
return -EINVAL;
val = z8536_read(dev, Z8536_CT_MODE_REG(chan));
- val &= Z8536_CT_MODE_EGE;
+ val &= ~Z8536_CT_MODE_EGE;
if (data[1] == 1)
val |= Z8536_CT_MODE_EGE;
else if (data[1] > 1)
--
2.56.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 3/5] comedi: ni_660x: don't poll without a DMA channel
2026-10-27 16:43 [PATCH 0/5] comedi: some small llm-found fixes Greg Kroah-Hartman
2026-10-27 16:43 ` [PATCH 1/5] comedi: fix endless recursion in comedi_event() Greg Kroah-Hartman
2026-10-27 16:43 ` [PATCH 2/5] comedi: addi_apci_1500: fix clearing of the gate enable Greg Kroah-Hartman
@ 2026-10-27 16:43 ` Greg Kroah-Hartman
2026-10-27 16:43 ` [PATCH 4/5] comedi: ni_tio: Fix overflow of the clock period Greg Kroah-Hartman
2026-10-27 16:43 ` [PATCH 5/5] comedi: vmk80xx: report failed transfers of the K8061 Greg Kroah-Hartman
4 siblings, 0 replies; 6+ messages in thread
From: Greg Kroah-Hartman @ 2026-10-27 16:43 UTC (permalink / raw)
To: Ian Abbott, H Hartley Sweeten, Frank Mori Hess
Cc: Josef Bacik, linux-kernel, Greg Kroah-Hartman, stable
From: Josef Bacik <josef@toxicpanda.com>
A counter command owns a MITE DMA channel from ni_660x_cmd() to
ni_660x_cancel(). A command does not only end by COMEDI_CANCEL: when the
reader is too slow mite_sync_input_dma() sets COMEDI_CB_OVERFLOW, and
counter errors set COMEDI_CB_ERROR, and comedi_handle_events() then calls
->cancel() from the interrupt handler. That releases the channel and
clears counter->mite_chan, but s->busy stays set until the owner has read
the rest of the data and seen the end of the acquisition.
do_poll_ioctl() only looks at s->busy, so a COMEDI_POLL in that state
ends in mite_sync_dma(NULL, s), which dereferences the channel.
Test the channel like ni_pcidio_poll() and ni_sync_ai_dma() do. The
pointer only changes under dev->mutex, which the ioctl holds, or in the
interrupt handler under interrupt_lock, which is taken here.
Fixes: 894db1197347 ("Staging: Comedi: ni_600x: Added support for comedi_poll.")
Cc: stable <stable@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/comedi/drivers/ni_660x.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/comedi/drivers/ni_660x.c b/drivers/comedi/drivers/ni_660x.c
index 5508cdb1b0ba..9238475dda07 100644
--- a/drivers/comedi/drivers/ni_660x.c
+++ b/drivers/comedi/drivers/ni_660x.c
@@ -459,7 +459,8 @@ static int ni_660x_input_poll(struct comedi_device *dev,
/* lock to avoid race with comedi_poll */
spin_lock_irqsave(&devpriv->interrupt_lock, flags);
- mite_sync_dma(counter->mite_chan, s);
+ if (counter->mite_chan)
+ mite_sync_dma(counter->mite_chan, s);
spin_unlock_irqrestore(&devpriv->interrupt_lock, flags);
return comedi_buf_read_n_available(s);
}
--
2.56.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 4/5] comedi: ni_tio: Fix overflow of the clock period
2026-10-27 16:43 [PATCH 0/5] comedi: some small llm-found fixes Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-10-27 16:43 ` [PATCH 3/5] comedi: ni_660x: don't poll without a DMA channel Greg Kroah-Hartman
@ 2026-10-27 16:43 ` Greg Kroah-Hartman
2026-10-27 16:43 ` [PATCH 5/5] comedi: vmk80xx: report failed transfers of the K8061 Greg Kroah-Hartman
4 siblings, 0 replies; 6+ messages in thread
From: Greg Kroah-Hartman @ 2026-10-27 16:43 UTC (permalink / raw)
To: Ian Abbott, H Hartley Sweeten, Frank Mori Hess
Cc: Josef Bacik, linux-kernel, Greg Kroah-Hartman, stable
From: Josef Bacik <josef@toxicpanda.com>
ni_tio_set_clock_src() stores the period of the clock source, which the
user passes in nanoseconds, in picoseconds:
counter->clock_period_ps = period_ns * 1000;
period_ns is an unsigned int, so that the product is computed in 32
bits, although clock_period_ps is a u64. It wraps for periods above
4294967 ns, that is for external clocks slower than 233 Hz.
INSN_CONFIG_GET_CLOCK_SRC then reports a wrong period, and
ni_tio_set_sync_mode() decides on a wrong one: 4294968 ns become 704 ps,
which is below the limit of 25 ns under which the alternate
synchronization mode for fast clocks is switched on.
The multiplication was done in 64 bits until the constant
pico_per_nano, a uint64_t, was replaced by a literal. Widen again.
Fixes: 3e90b1c7ebe9 ("staging: comedi: ni_tio: tidy up ni_tio_set_clock_src() and helpers")
Cc: stable <stable@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/comedi/drivers/ni_tio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/comedi/drivers/ni_tio.c b/drivers/comedi/drivers/ni_tio.c
index c3a909abcfa7..b7ab70f34275 100644
--- a/drivers/comedi/drivers/ni_tio.c
+++ b/drivers/comedi/drivers/ni_tio.c
@@ -800,7 +800,7 @@ static int ni_tio_set_clock_src(struct ni_gpct *counter,
GI_PRESCALE_X2(counter_dev->variant) |
GI_PRESCALE_X8(counter_dev->variant), bits);
}
- counter->clock_period_ps = period_ns * 1000;
+ counter->clock_period_ps = (u64)period_ns * 1000;
ni_tio_set_sync_mode(counter);
return 0;
}
--
2.56.0
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 5/5] comedi: vmk80xx: report failed transfers of the K8061
2026-10-27 16:43 [PATCH 0/5] comedi: some small llm-found fixes Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-10-27 16:43 ` [PATCH 4/5] comedi: ni_tio: Fix overflow of the clock period Greg Kroah-Hartman
@ 2026-10-27 16:43 ` Greg Kroah-Hartman
4 siblings, 0 replies; 6+ messages in thread
From: Greg Kroah-Hartman @ 2026-10-27 16:43 UTC (permalink / raw)
To: Ian Abbott, H Hartley Sweeten, Frank Mori Hess
Cc: Josef Bacik, linux-kernel, Greg Kroah-Hartman, stable
From: Josef Bacik <josef@toxicpanda.com>
For the K8061 board vmk80xx_read_packet() and vmk80xx_write_packet() call
vmk80xx_do_bulk_msg(), which ignores the result of its two bulk transfers,
and return 0. After a timeout, a stall or an unplug the instruction
handlers therefore go on and hand the old content of usb_rx_buf to user
space as a fresh sample (analog and digital inputs, counters, PWM and
output read-back), and writes to the outputs are reported as done.
All callers check the result already, because the K8055 branch of the two
functions returns that of usb_interrupt_msg(). Return the error of the
bulk transfers as well, and don't wait for an answer to a command that
could not be sent.
Fixes: 985cafccbf9b ("Staging: Comedi: vmk80xx: Add k8061 support")
Cc: stable <stable@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/comedi/drivers/vmk80xx.c | 25 ++++++++++++-------------
1 file changed, 12 insertions(+), 13 deletions(-)
diff --git a/drivers/comedi/drivers/vmk80xx.c b/drivers/comedi/drivers/vmk80xx.c
index 84dce5184a77..ddb12b48c8a4 100644
--- a/drivers/comedi/drivers/vmk80xx.c
+++ b/drivers/comedi/drivers/vmk80xx.c
@@ -151,7 +151,7 @@ struct vmk80xx_private {
enum vmk80xx_model model;
};
-static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
+static int vmk80xx_do_bulk_msg(struct comedi_device *dev)
{
struct vmk80xx_private *devpriv = dev->private;
struct usb_device *usb = comedi_to_usb_dev(dev);
@@ -161,6 +161,7 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
unsigned int rx_pipe;
size_t tx_size;
size_t rx_size;
+ int ret;
tx_addr = devpriv->ep_tx->bEndpointAddress;
rx_addr = devpriv->ep_rx->bEndpointAddress;
@@ -169,11 +170,13 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
tx_size = usb_endpoint_maxp(devpriv->ep_tx);
rx_size = usb_endpoint_maxp(devpriv->ep_rx);
- usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL,
- PACKET_TIMEOUT);
+ ret = usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL,
+ PACKET_TIMEOUT);
+ if (ret)
+ return ret;
- usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL,
- PACKET_TIMEOUT);
+ return usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL,
+ PACKET_TIMEOUT);
}
static int vmk80xx_read_packet(struct comedi_device *dev)
@@ -183,10 +186,8 @@ static int vmk80xx_read_packet(struct comedi_device *dev)
struct usb_endpoint_descriptor *ep;
unsigned int pipe;
- if (devpriv->model == VMK8061_MODEL) {
- vmk80xx_do_bulk_msg(dev);
- return 0;
- }
+ if (devpriv->model == VMK8061_MODEL)
+ return vmk80xx_do_bulk_msg(dev);
ep = devpriv->ep_rx;
pipe = usb_rcvintpipe(usb, ep->bEndpointAddress);
@@ -204,10 +205,8 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
devpriv->usb_tx_buf[0] = cmd;
- if (devpriv->model == VMK8061_MODEL) {
- vmk80xx_do_bulk_msg(dev);
- return 0;
- }
+ if (devpriv->model == VMK8061_MODEL)
+ return vmk80xx_do_bulk_msg(dev);
ep = devpriv->ep_tx;
pipe = usb_sndintpipe(usb, ep->bEndpointAddress);
--
2.56.0
^ permalink raw reply [flat|nested] 6+ messages in thread