mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-02-15 14:25:03 -05:00
The `COMEDI_RANGEINFO` ioctl does not work properly for subdevice
indices above 15. Currently, the only in-tree COMEDI drivers that
support more than 16 subdevices are the "8255" driver and the
"comedi_bond" driver. Making the ioctl work for subdevice indices up to
255 is achievable. It needs minor changes to the handling of the
`COMEDI_RANGEINFO` and `COMEDI_CHANINFO` ioctls that should be mostly
harmless to user-space, apart from making them less broken. Details
follow...
The `COMEDI_RANGEINFO` ioctl command gets the list of supported ranges
(usually with units of volts or milliamps) for a COMEDI subdevice or
channel. (Only some subdevices have per-channel range tables, indicated
by the `SDF_RANGETYPE` flag in the subdevice information.) It uses a
`range_type` value and a user-space pointer, both supplied by
user-space, but the `range_type` value should match what was obtained
using the `COMEDI_CHANINFO` ioctl (if the subdevice has per-channel
range tables) or `COMEDI_SUBDINFO` ioctl (if the subdevice uses a
single range table for all channels). Bits 15 to 0 of the `range_type`
value contain the length of the range table, which is the only part that
user-space should care about (so it can use a suitably sized buffer to
fetch the range table). Bits 23 to 16 store the channel index, which is
assumed to be no more than 255 if the subdevice has per-channel range
tables, and is set to 0 if the subdevice has a single range table. For
`range_type` values produced by the `COMEDI_SUBDINFO` ioctl, bits 31 to
24 contain the subdevice index, which is assumed to be no more than 255.
But for `range_type` values produced by the `COMEDI_CHANINFO` ioctl,
bits 27 to 24 contain the subdevice index, which is assumed to be no
more than 15, and bits 31 to 28 contain the COMEDI device's minor device
number for some unknown reason lost in the mists of time. The
`COMEDI_RANGEINFO` ioctl extract the length from bits 15 to 0 of the
user-supplied `range_type` value, extracts the channel index from bits
23 to 16 (only used if the subdevice has per-channel range tables),
extracts the subdevice index from bits 27 to 24, and ignores bits 31 to
28. So for subdevice indices 16 to 255, the `COMEDI_SUBDINFO` or
`COMEDI_CHANINFO` ioctl will report a `range_type` value that doesn't
work with the `COMEDI_RANGEINFO` ioctl. It will either get the range
table for the subdevice index modulo 16, or will fail with `-EINVAL`.
To fix this, always use bits 31 to 24 of the `range_type` value to hold
the subdevice index (assumed to be no more than 255). This affects the
`COMEDI_CHANINFO` and `COMEDI_RANGEINFO` ioctls. There should not be
anything in user-space that depends on the old, broken usage, although
it may now see different values in bits 31 to 28 of the `range_type`
values reported by the `COMEDI_CHANINFO` ioctl for subdevices that have
per-channel subdevices. User-space should not be trying to decode bits
31 to 16 of the `range_type` values anyway.
Fixes: ed9eccbe89 ("Staging: add comedi core")
Cc: stable@vger.kernel.org #5.17+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20251203162438.176841-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
132 lines
3.8 KiB
C
132 lines
3.8 KiB
C
// SPDX-License-Identifier: GPL-2.0+
|
|
/*
|
|
* comedi/range.c
|
|
* comedi routines for voltage ranges
|
|
*
|
|
* COMEDI - Linux Control and Measurement Device Interface
|
|
* Copyright (C) 1997-8 David A. Schleef <ds@schleef.org>
|
|
*/
|
|
|
|
#include <linux/uaccess.h>
|
|
#include <linux/comedi/comedidev.h>
|
|
#include "comedi_internal.h"
|
|
|
|
const struct comedi_lrange range_bipolar10 = { 1, {BIP_RANGE(10)} };
|
|
EXPORT_SYMBOL_GPL(range_bipolar10);
|
|
const struct comedi_lrange range_bipolar5 = { 1, {BIP_RANGE(5)} };
|
|
EXPORT_SYMBOL_GPL(range_bipolar5);
|
|
const struct comedi_lrange range_bipolar2_5 = { 1, {BIP_RANGE(2.5)} };
|
|
EXPORT_SYMBOL_GPL(range_bipolar2_5);
|
|
const struct comedi_lrange range_unipolar10 = { 1, {UNI_RANGE(10)} };
|
|
EXPORT_SYMBOL_GPL(range_unipolar10);
|
|
const struct comedi_lrange range_unipolar5 = { 1, {UNI_RANGE(5)} };
|
|
EXPORT_SYMBOL_GPL(range_unipolar5);
|
|
const struct comedi_lrange range_unipolar2_5 = { 1, {UNI_RANGE(2.5)} };
|
|
EXPORT_SYMBOL_GPL(range_unipolar2_5);
|
|
const struct comedi_lrange range_0_20mA = { 1, {RANGE_mA(0, 20)} };
|
|
EXPORT_SYMBOL_GPL(range_0_20mA);
|
|
const struct comedi_lrange range_4_20mA = { 1, {RANGE_mA(4, 20)} };
|
|
EXPORT_SYMBOL_GPL(range_4_20mA);
|
|
const struct comedi_lrange range_0_32mA = { 1, {RANGE_mA(0, 32)} };
|
|
EXPORT_SYMBOL_GPL(range_0_32mA);
|
|
const struct comedi_lrange range_unknown = { 1, {{0, 1000000, UNIT_none} } };
|
|
EXPORT_SYMBOL_GPL(range_unknown);
|
|
|
|
/*
|
|
* COMEDI_RANGEINFO ioctl
|
|
* range information
|
|
*
|
|
* arg:
|
|
* pointer to comedi_rangeinfo structure
|
|
*
|
|
* reads:
|
|
* comedi_rangeinfo structure
|
|
*
|
|
* writes:
|
|
* array of comedi_krange structures to rangeinfo->range_ptr pointer
|
|
*/
|
|
int do_rangeinfo_ioctl(struct comedi_device *dev,
|
|
struct comedi_rangeinfo *it)
|
|
{
|
|
int subd, chan;
|
|
const struct comedi_lrange *lr;
|
|
struct comedi_subdevice *s;
|
|
|
|
subd = (it->range_type >> 24) & 0xff;
|
|
chan = (it->range_type >> 16) & 0xff;
|
|
|
|
if (!dev->attached)
|
|
return -EINVAL;
|
|
if (subd >= dev->n_subdevices)
|
|
return -EINVAL;
|
|
s = &dev->subdevices[subd];
|
|
if (s->range_table) {
|
|
lr = s->range_table;
|
|
} else if (s->range_table_list) {
|
|
if (chan >= s->n_chan)
|
|
return -EINVAL;
|
|
lr = s->range_table_list[chan];
|
|
} else {
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (RANGE_LENGTH(it->range_type) != lr->length) {
|
|
dev_dbg(dev->class_dev,
|
|
"wrong length %d should be %d (0x%08x)\n",
|
|
RANGE_LENGTH(it->range_type),
|
|
lr->length, it->range_type);
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (copy_to_user(it->range_ptr, lr->range,
|
|
sizeof(struct comedi_krange) * lr->length))
|
|
return -EFAULT;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* comedi_check_chanlist() - Validate each element in a chanlist.
|
|
* @s: comedi_subdevice struct
|
|
* @n: number of elements in the chanlist
|
|
* @chanlist: the chanlist to validate
|
|
*
|
|
* Each element consists of a channel number, a range index, an analog
|
|
* reference type and some flags, all packed into an unsigned int.
|
|
*
|
|
* This checks that the channel number and range index are supported by
|
|
* the comedi subdevice. It does not check whether the analog reference
|
|
* type and the flags are supported. Drivers that care should check those
|
|
* themselves.
|
|
*
|
|
* Return: %0 if all @chanlist elements are valid (success),
|
|
* %-EINVAL if one or more elements are invalid.
|
|
*/
|
|
int comedi_check_chanlist(struct comedi_subdevice *s, int n,
|
|
unsigned int *chanlist)
|
|
{
|
|
struct comedi_device *dev = s->device;
|
|
unsigned int chanspec;
|
|
int chan, range_len, i;
|
|
|
|
for (i = 0; i < n; i++) {
|
|
chanspec = chanlist[i];
|
|
chan = CR_CHAN(chanspec);
|
|
if (s->range_table)
|
|
range_len = s->range_table->length;
|
|
else if (s->range_table_list && chan < s->n_chan)
|
|
range_len = s->range_table_list[chan]->length;
|
|
else
|
|
range_len = 0;
|
|
if (chan >= s->n_chan ||
|
|
CR_RANGE(chanspec) >= range_len) {
|
|
dev_warn(dev->class_dev,
|
|
"bad chanlist[%d]=0x%08x chan=%d range length=%d\n",
|
|
i, chanspec, chan, range_len);
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL_GPL(comedi_check_chanlist);
|