fix safety and correctness bugs in hostmot2 drivers

docs/src/man/man3/hm2_pktuart.3.adoc

@@ -150,11 +150,13 @@ This is typically a multi-step process:
 1. rxstatus indicates that there are packets of data, but at this point we need to know how big each packet is (and reading two much or two little data from the FIFOs will cause problems).
 2. Queue a read of the frame sizes. **hm2_pktuart_queue_get_frame_sizes(name, fsizes[])**
 On return, the fsizes[] array will have been loaded with the frame sizes (size in bytes).
+The function returns the number of frame-size reads queued, or a negative error code.
 If fsizes are [8] [7] [6] and you only read 1 frame from the data FIFO then on the next call to get_frame_sizes the returned array would be [7] [6].
 3. Wait one thread cycle to get the data.  Note that there is no serial latency here, the data is already on the FPGA but we can only know how much data to request once we know the packet size
 4. Queue enough data reads to get all the data frames that the packet is spread over.
 int hm2_pktuart_queue_read_data(name, data, bytes)
 On return the data[] array will have been loaded with enough 32-bit frames to include "bytes" bytes.
+The function returns the number of 32-bit data reads queued, or a negative error code.
 5. Parse the data.
 
 === Data Formats ===

src/hal/drivers/mesa-hostmot2/abs_encoder.c

@@ -262,13 +262,20 @@ int hm2_absenc_parse_format(hm2_sserial_remote_t *chan,  hm2_absenc_format_t *de
                         "not get the pins you expected\n");
             }
             else if (strchr("bBuUsSeEfFpPgGhHlLmM", *format)){
+                hm2_sserial_data_t *confs;
                 hm2_sserial_data_t *conf;
-                chan->num_confs++;
-                chan->confs = (hm2_sserial_data_t *)rtapi_krealloc(chan->confs,
-                        chan->num_confs * sizeof(hm2_sserial_data_t),
+
+                if (q > RTAPI_UINT8_MAX) {
+                    HM2_ERR_NO_LL("Field length %d exceeds the supported maximum\n", q);
+                    return -EINVAL;
+                }
+                confs = rtapi_krealloc(chan->confs,
+                        (chan->num_confs + 1) * sizeof(*confs),
                         RTAPI_GFP_KERNEL);
+                if (confs == NULL) return -ENOMEM;
+                chan->confs = confs;
 
-                conf = &(chan->confs[chan->num_confs - 1]);
+                conf = &(chan->confs[chan->num_confs++]);
                 conf->DataDir = LBP_IN;
                 conf->DataLength = q;
                 rtapi_strxcpy(conf->NameString, name);
@@ -357,6 +364,10 @@ int hm2_absenc_parse_format(hm2_sserial_remote_t *chan,  hm2_absenc_format_t *de
         else
         {
             // Not a % format, append name
+            if (nameptr == &name[sizeof(name) - 1]) {
+                HM2_ERR_NO_LL("Absolute encoder field name is too long\n");
+                return -EINVAL;
+            }
             *nameptr++ = *format++;
             *nameptr = 0;
         }
@@ -400,12 +411,6 @@ int hm2_absenc_parse_md(hostmot2_t *hm2, int md_index) {
 
     if (hm2->absenc.num_chans == 0) { // first time though
         hm2->absenc.clock_frequency = md->clock_freq;
-        hm2->absenc.ssi_busy_flags = rtapi_kmalloc(sizeof(rtapi_u32), RTAPI_GFP_KERNEL);
-        *hm2->absenc.ssi_busy_flags = 0;
-        hm2->absenc.biss_busy_flags = rtapi_kmalloc(sizeof(rtapi_u32), RTAPI_GFP_KERNEL);
-        *hm2->absenc.biss_busy_flags = 0;
-        hm2->absenc.fabs_busy_flags = rtapi_kmalloc(sizeof(rtapi_u32), RTAPI_GFP_KERNEL);
-        *hm2->absenc.fabs_busy_flags = 0;
     }
 
     for (index = 0 ; index < md->instances ; index ++){
@@ -422,12 +427,18 @@ int hm2_absenc_parse_md(hostmot2_t *hm2, int md_index) {
                 goto fail1;
             }
             if (index == def->index && md->gtag == def->gtag){
+                hm2_sserial_remote_t *chans;
+
                 has_format = true;
-                hm2->absenc.num_chans += 1;
-                hm2->absenc.chans = rtapi_krealloc(hm2->absenc.chans,
-                        hm2->absenc.num_chans * sizeof(hm2_sserial_remote_t),
+                chans = rtapi_krealloc(hm2->absenc.chans,
+                        (hm2->absenc.num_chans + 1) * sizeof(*chans),
                         RTAPI_GFP_KERNEL);
-                chan = &hm2->absenc.chans[hm2->absenc.num_chans - 1];
+                if (chans == NULL) {
+                    HM2_ERR("out of memory allocating absolute encoder channel\n");
+                    goto fail1;
+                }
+                hm2->absenc.chans = chans;
+                chan = &hm2->absenc.chans[hm2->absenc.num_chans++];
                 memset(chan, 0, sizeof(hm2_sserial_remote_t));
                 chan->index = index;
                 chan->myinst = md->gtag;
@@ -517,6 +528,8 @@ void hm2_absenc_process_tram_read(hostmot2_t *hm2, long period) {
                 err_tag[i] = 1;
             }    
         } 
+        // These pointers are supplied by hm2_absenc_register_tram() whenever
+        // the corresponding global-start address enables this dereference.
         if (((chan->myinst == HM2_GTAG_SSI)
                 && (*hm2->absenc.ssi_busy_flags & (1 << chan->index)))
                 || ((chan->myinst == HM2_GTAG_BISS)

src/hal/drivers/mesa-hostmot2/bspi.c

@@ -121,6 +121,10 @@ int hm2_tram_add_bspi_frame(char *name, int chan, rtapi_u32 **wbuff, rtapi_u32 *
         HM2_ERR_NO_LL("Can not find BSPI instance %s.\n", name);
         return -1;
     }
+    if (chan < 0 || chan > 15) {
+        HM2_ERR("BSPI %s: channel number %i is out of range\n", name, chan);
+        return -1;
+    }
     if (hm2->bspi.instance[i].conf_flag[chan] != true){
         HM2_ERR("The selected write channel (%i) on bspi instance %s.\n" 
                 "Has not been configured.\n", chan, name);
@@ -205,6 +209,10 @@ int hm2_bspi_write_chan(char* name, int chan, rtapi_u32 val)
         HM2_ERR_NO_LL("Can not find BSPI instance %s.\n", name);
         return -1;
     }
+    if (chan < 0 || chan > 15) {
+        HM2_ERR("BSPI %s: channel number %i is out of range\n", name, chan);
+        return -1;
+    }
     if (hm2->bspi.instance[i].conf_flag[chan] != true){
         HM2_ERR("The selected write channel (%i) on bspi instance %s.\n" 
                 "Has not been configured.\n", chan, name);
@@ -247,6 +255,10 @@ int hm2_bspi_setup_chan(char *name, int chan, int cs, int bits, double mhz,
                 "BSPI only supports 1-64 bits\n", name, chan, bits);
         return -1;
     }
+    if (mhz <= 0) {
+        HM2_ERR("BSPI %s: clock frequency must be greater than zero\n", name);
+        return -1;
+    }
     if (delay < 0 || delay > 1e6){
         HM2_ERR("The requested frame delay on channel %i of %inS seems "
                 "rather implausible for an SPI device. Exiting.\n", delay, chan);
@@ -388,6 +400,3 @@ void hm2_bspi_write(hostmot2_t *hm2)
 {
     (void)hm2;
 }
-
-
-