hostmot2: harden Smart Serial and absolute encoder handling

src/hal/drivers/mesa-hostmot2/abs_encoder.c

@@ -268,19 +268,26 @@ int hm2_absenc_parse_format(hm2_sserial_remote_t *chan,  hm2_absenc_format_t *de
 
     while(*format){
         if (*format == '%'){
-            int q = simple_strtol(++format, &format, 0);
+            long q = simple_strtol(++format, &format, 0);
             if (q == 0){
                 HM2_ERR_NO_LL("Invalid field length specification, you may "
                         "not get the pins you expected\n");
             }
             else if (strchr("bBuUsSeEfFpPgGhHlLmM", *format)){
+                hm2_sserial_data_t *confs;
                 hm2_sserial_data_t *conf;
-                chan->num_confs++;
-                chan->confs = (hm2_sserial_data_t *)rtapi_krealloc(chan->confs,
-                        chan->num_confs * sizeof(hm2_sserial_data_t),
+
+                if (q < 0 || q > RTAPI_UINT8_MAX) {
+                    HM2_ERR_NO_LL("Invalid field length %ld\n", q);
+                    return -EINVAL;
+                }
+                confs = rtapi_krealloc(chan->confs,
+                        (chan->num_confs + 1) * sizeof(*confs),
                         RTAPI_GFP_KERNEL);
+                if (confs == NULL) return -ENOMEM;
+                chan->confs = confs;
 
-                conf = &(chan->confs[chan->num_confs - 1]);
+                conf = &(chan->confs[chan->num_confs++]);
                 conf->DataDir = LBP_IN;
                 conf->DataLength = q;
                 rtapi_strxcpy(conf->NameString, name);
@@ -369,6 +376,10 @@ int hm2_absenc_parse_format(hm2_sserial_remote_t *chan,  hm2_absenc_format_t *de
         else
         {
             // Not a % format, append name
+            if (nameptr == &name[sizeof(name) - 1]) {
+                HM2_ERR_NO_LL("Absolute encoder field name is too long\n");
+                return -EINVAL;
+            }
             *nameptr++ = *format++;
             *nameptr = 0;
         }
@@ -412,12 +423,6 @@ int hm2_absenc_parse_md(hostmot2_t *hm2, int md_index) {
 
     if (hm2->absenc.num_chans == 0) { // first time though
         hm2->absenc.clock_frequency = md->clock_freq;
-        hm2->absenc.ssi_busy_flags = rtapi_kmalloc(sizeof(rtapi_u32), RTAPI_GFP_KERNEL);
-        *hm2->absenc.ssi_busy_flags = 0;
-        hm2->absenc.biss_busy_flags = rtapi_kmalloc(sizeof(rtapi_u32), RTAPI_GFP_KERNEL);
-        *hm2->absenc.biss_busy_flags = 0;
-        hm2->absenc.fabs_busy_flags = rtapi_kmalloc(sizeof(rtapi_u32), RTAPI_GFP_KERNEL);
-        *hm2->absenc.fabs_busy_flags = 0;
     }
 
     for (index = 0 ; index < md->instances ; index ++){
@@ -434,12 +439,18 @@ int hm2_absenc_parse_md(hostmot2_t *hm2, int md_index) {
                 goto fail1;
             }
             if (index == def->index && md->gtag == def->gtag){
+                hm2_sserial_remote_t *chans;
+
                 has_format = true;
-                hm2->absenc.num_chans += 1;
-                hm2->absenc.chans = rtapi_krealloc(hm2->absenc.chans,
-                        hm2->absenc.num_chans * sizeof(hm2_sserial_remote_t),
+                chans = rtapi_krealloc(hm2->absenc.chans,
+                        (hm2->absenc.num_chans + 1) * sizeof(*chans),
                         RTAPI_GFP_KERNEL);
-                chan = &hm2->absenc.chans[hm2->absenc.num_chans - 1];
+                if (chans == NULL) {
+                    HM2_ERR("out of memory allocating absolute encoder channel\n");
+                    goto fail1;
+                }
+                hm2->absenc.chans = chans;
+                chan = &hm2->absenc.chans[hm2->absenc.num_chans++];
                 memset(chan, 0, sizeof(hm2_sserial_remote_t));
                 chan->index = index;
                 chan->myinst = md->gtag;
@@ -529,6 +540,8 @@ void hm2_absenc_process_tram_read(hostmot2_t *hm2, long period) {
                 err_tag[i] = 1;
             }    
         } 
+        // These pointers are supplied by hm2_absenc_register_tram() whenever
+        // the corresponding global-start address enables this dereference.
         if (((chan->myinst == HM2_GTAG_SSI)
                 && (*hm2->absenc.ssi_busy_flags & (1 << chan->index)))
                 || ((chan->myinst == HM2_GTAG_BISS)

src/hal/drivers/mesa-hostmot2/setsserial.c

@@ -176,7 +176,7 @@ int sslbp_read_cookie(void){
     return res;
 }
 
-rtapi_u8 sslbp_read_byte(rtapi_u32 addr){
+int sslbp_read_byte(rtapi_u32 addr){
     rtapi_u32 buff = READ_REM_BYTE_CMD + addr;
     rtapi_u32 res;
     HM2WRITE(remote->reg_cs_addr, buff);
@@ -303,6 +303,7 @@ int sslbp_flash(char *fname){
     struct rtapi_device dev;
     int r;
     unsigned write_sz, erase_sz;
+    int write_exp, erase_exp;
 
     if (strstr("8i20", remote->name)){
         if (hm2->sserial.version < 37){
@@ -348,8 +349,17 @@ int sslbp_flash(char *fname){
 
     if (setup_start() < 0) goto fail0;
     flash_start();
-    write_sz = 1u << sslbp_read_byte(LBPFLASHWRITESIZELOC);
-    erase_sz = 1u << sslbp_read_byte(LBPFLASHERASESIZELOC);
+    write_exp = sslbp_read_byte(LBPFLASHWRITESIZELOC);
+    erase_exp = sslbp_read_byte(LBPFLASHERASESIZELOC);
+    if (write_exp < 3 || write_exp >= (int)(sizeof(write_sz) * 8)
+            || erase_exp < 0 || erase_exp < write_exp
+            || erase_exp >= (int)(sizeof(erase_sz) * 8)) {
+        HM2_ERR("Invalid flash geometry exponents write=%d erase=%d\n",
+                write_exp, erase_exp);
+        goto fail0;
+    }
+    write_sz = 1u << write_exp;
+    erase_sz = 1u << erase_exp;
     HM2_PRINT("Write Size = %x, Erase Size = %x\n", write_sz, erase_sz);
     flash_stop();
 
@@ -412,6 +422,7 @@ int sslbp_flash(char *fname){
 
 fail0:
     flash_stop();
+    rtapi_release_firmware(fw);
     return -1;
 }