Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f50cebb9 authored by H Hartley Sweeten's avatar H Hartley Sweeten Committed by Greg Kroah-Hartman
Browse files

staging: comedi: drivers: properly validate cmd->scan_end_arg 



When the async command 'scan_end_src' is TRIG_COUNT the 'scan_end_arg'
is the cmd->chanlist_len. Fix a couple open-coded drivers. Add the
check to the drivers that do not validate this command argument.

The core validates that the cmd->chanlist_len is <= s->len_chanlist.
During the post config after the attach the core also make sure that
the s->len_chanlist is initialized. For clarity, initialize the
s->len_chanlist in a couple drivers that are relying on the core to
initialize it to '1'.

Signed-off-by: default avatarH Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: default avatarIan Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 860b7c39

drivers/staging/comedi/drivers/8255.c

+2 −1
Original line number Diff line number Diff line
@@ -231,7 +231,7 @@ static int subdev_8255_cmdtest(struct comedi_device *dev, 
	err |= cfc_check_trigger_arg_is(&cmd->start_arg, 0);

	err |= cfc_check_trigger_arg_is(&cmd->scan_begin_arg, 0);

	err |= cfc_check_trigger_arg_is(&cmd->convert_arg, 0);

	err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, 1);

	err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, cmd->chanlist_len);

	err |= cfc_check_trigger_arg_is(&cmd->stop_arg, 0);



	if (err)
@@ -298,6 +298,7 @@ int subdev_8255_init_irq(struct comedi_device *dev, struct comedi_subdevice *s, 
	if (ret)

		return ret;



	s->len_chanlist	= 1;

	s->do_cmdtest	= subdev_8255_cmdtest;

	s->do_cmd	= subdev_8255_cmd;

	s->cancel	= subdev_8255_cancel;

drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c

+1 −0
Original line number Diff line number Diff line
@@ -778,6 +778,7 @@ static int apci3120_ai_cmdtest(struct comedi_device *dev, 
	}



	err |= cfc_check_trigger_arg_min(&cmd->chanlist_len, 1);

	err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, cmd->chanlist_len);



	if (cmd->stop_src == TRIG_COUNT)

		err |= cfc_check_trigger_arg_min(&cmd->stop_arg, 1);

drivers/staging/comedi/drivers/addi-data/hwdrv_apci3200.c

+5 −0
Original line number Diff line number Diff line
@@ -2270,6 +2270,11 @@ static int apci3200_ai_cmdtest(struct comedi_device *dev, 
		apci3200_reset(dev);

		return 2;

	}



	/* Step 3: check if arguments are trivially valid */



	err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, cmd->chanlist_len);



	/* i_FirstChannel=cmd->chanlist[0]; */

	s_BoardInfos[dev->minor].i_FirstChannel = cmd->chanlist[0];

	/* i_LastChannel=cmd->chanlist[1]; */

drivers/staging/comedi/drivers/addi_apci_1032.c

+2 −1
Original line number Diff line number Diff line
@@ -198,7 +198,7 @@ static int apci1032_cos_cmdtest(struct comedi_device *dev, 
	err |= cfc_check_trigger_arg_is(&cmd->start_arg, 0);

	err |= cfc_check_trigger_arg_is(&cmd->scan_begin_arg, 0);

	err |= cfc_check_trigger_arg_is(&cmd->convert_arg, 0);

	err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, 1);

	err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, cmd->chanlist_len);

	err |= cfc_check_trigger_arg_is(&cmd->stop_arg, 0);



	if (err)
@@ -332,6 +332,7 @@ static int apci1032_auto_attach(struct comedi_device *dev, 
		s->range_table	= &range_digital;

		s->insn_config	= apci1032_cos_insn_config;

		s->insn_bits	= apci1032_cos_insn_bits;

		s->len_chanlist	= 1;

		s->do_cmdtest	= apci1032_cos_cmdtest;

		s->do_cmd	= apci1032_cos_cmd;

		s->cancel	= apci1032_cos_cancel;

drivers/staging/comedi/drivers/amplc_pc236.c

+2 −1
Original line number Diff line number Diff line
@@ -314,7 +314,7 @@ static int pc236_intr_cmdtest(struct comedi_device *dev, 
	err |= cfc_check_trigger_arg_is(&cmd->start_arg, 0);

	err |= cfc_check_trigger_arg_is(&cmd->scan_begin_arg, 0);

	err |= cfc_check_trigger_arg_is(&cmd->convert_arg, 0);

	err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, 1);

	err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, cmd->chanlist_len);

	err |= cfc_check_trigger_arg_is(&cmd->stop_arg, 0);



	if (err)
@@ -402,6 +402,7 @@ static int pc236_common_attach(struct comedi_device *dev, unsigned long iobase, 
			s->maxdata = 1;

			s->range_table = &range_digital;

			s->insn_bits = pc236_intr_insn;

			s->len_chanlist	= 1;

			s->do_cmdtest = pc236_intr_cmdtest;

			s->do_cmd = pc236_intr_cmd;

			s->cancel = pc236_intr_cancel;