Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 860b7c39 authored by H Hartley Sweeten's avatar H Hartley Sweeten Committed by Greg Kroah-Hartman
Browse files

staging: comedi: drivers: core validates chanlist_len max 



The comedi core checks if the (cmd->chanlist_len > s->len_chanlist) when the
comedi_cmd is copied from user to kernel space by __comedi_get_user_cmd().
If so, the core returns -EINVAL and will not call the subdevice (*do_cmdtest)
and (*do_cmd).

Remove the unnecessary "max" checks in the comedi driver (*do_cmdtest) and
helper functions.

Signed-off-by: default avatarH Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: default avatarIan Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5089b058

drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c

+0 −3
Original line number Diff line number Diff line
@@ -734,7 +734,6 @@ static int apci3120_ai_cmdtest(struct comedi_device *dev, 
			       struct comedi_subdevice *s,

			       struct comedi_cmd *cmd)

{

	const struct addi_board *this_board = comedi_board(dev);

	int err = 0;



	/* Step 1 : check if triggers are trivially valid */
@@ -779,8 +778,6 @@ static int apci3120_ai_cmdtest(struct comedi_device *dev, 
	}



	err |= cfc_check_trigger_arg_min(&cmd->chanlist_len, 1);

	err |= cfc_check_trigger_arg_max(&cmd->chanlist_len,

					 this_board->i_AiChannelList);



	if (cmd->stop_src == TRIG_COUNT)

		err |= cfc_check_trigger_arg_min(&cmd->stop_arg, 1);

drivers/staging/comedi/drivers/adl_pci9118.c

+0 −2
Original line number Diff line number Diff line
@@ -1259,8 +1259,6 @@ static int pci9118_ai_cmdtest(struct comedi_device *dev, 
		err |= cfc_check_trigger_arg_is(&cmd->stop_arg, 0);



	err |= cfc_check_trigger_arg_min(&cmd->chanlist_len, 1);

	err |= cfc_check_trigger_arg_max(&cmd->chanlist_len,

					 this_board->n_aichanlist);



	err |= cfc_check_trigger_arg_min(&cmd->scan_end_arg,

					 cmd->chanlist_len);

drivers/staging/comedi/drivers/pcl812.c

+0 −1
Original line number Diff line number Diff line
@@ -761,7 +761,6 @@ static int pcl812_ai_cmdtest(struct comedi_device *dev, 
		err |= cfc_check_trigger_arg_is(&cmd->convert_arg, 0);



	err |= cfc_check_trigger_arg_min(&cmd->chanlist_len, 1);

	err |= cfc_check_trigger_arg_max(&cmd->chanlist_len, MAX_CHANLIST_LEN);

	err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, cmd->chanlist_len);



	if (cmd->stop_src == TRIG_COUNT)

drivers/staging/comedi/drivers/rtd520.c

+0 −4
Original line number Diff line number Diff line
@@ -891,10 +891,6 @@ static int rtd_ai_cmdtest(struct comedi_device *dev, 


	/* step 4: fix up any arguments */



	if (cmd->chanlist_len > RTD_MAX_CHANLIST) {

		cmd->chanlist_len = RTD_MAX_CHANLIST;

		err++;

	}

	if (cmd->scan_begin_src == TRIG_TIMER) {

		tmp = cmd->scan_begin_arg;

		rtd_ns_to_timer(&cmd->scan_begin_arg,