staging: comedi: COMEDI_BUFINFO: get amount freed, not amount allocated

The `COMEDI_BUFINFO` ioctl is used to advance the current position in
the buffer by a specified amount (which can be 0) and get the new
position.  On input, the `bytes_read` member of `struct comedi_bufinfo`
specifies the amount to advance the "read" position for an asynchronous
command in the "read" direction, and the `bytes_written` member
specifies the amount to advance the "write" position for a command in
the "write" direction.  The handler `do_bufinfo_ioctl()` may limit the
specified values according to amount of readable or writable space in
the buffer.  On output, the `struct comedi_bufinfo` is filled in with
the updated position information, along with the adjusted `bytes_read`
and `bytes_written` members.

Advancing the buffer position occurs in two steps: first, some buffer
space is allocated, and second, it is freed, advancing the current
"read" or "write" position.  Currently, `do_bufinfo_ioctl()` limits
`bytes_read` or `bytes_written` to the amount it could allocate in the
first step, but that is invisible and irrelevant to the ioctl user.
It's mostly irrelevant to the COMEDI internals as well, apart from
limiting how much can be freed in the second step.  Change it to ignore
how much it managed to allocate in the first step and just use the
amount that was actually freed in the second step, which is the amount
the current buffer position was actually moved by this ioctl call.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 4 insertions, 5 deletions

diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index d57fadef47fc..2cfb61e0f2b8 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1142,8 +1142,8 @@ static int do_bufinfo_ioctl(struct comedi_device *dev,
 		return -EACCES;
 
 	if (bi.bytes_read && !(async->cmd.flags & CMDF_WRITE)) {
-		bi.bytes_read = comedi_buf_read_alloc(s, bi.bytes_read);
-		comedi_buf_read_free(s, bi.bytes_read);
+		comedi_buf_read_alloc(s, bi.bytes_read);
+		bi.bytes_read = comedi_buf_read_free(s, bi.bytes_read);
 
 		if (comedi_is_subdevice_idle(s) &&
 		    comedi_buf_read_n_available(s) == 0) {
@@ -1152,9 +1152,8 @@ static int do_bufinfo_ioctl(struct comedi_device *dev,
 	}
 
 	if (bi.bytes_written && (async->cmd.flags & CMDF_WRITE)) {
-		bi.bytes_written =
-		    comedi_buf_write_alloc(s, bi.bytes_written);
-		comedi_buf_write_free(s, bi.bytes_written);
+		comedi_buf_write_alloc(s, bi.bytes_written);
+		bi.bytes_written = comedi_buf_write_free(s, bi.bytes_written);
 	}
 
 copyback_position: