staging: comedi: drivers: core validates chanlist_len max

The comedi core checks if the (cmd->chanlist_len > s->len_chanlist) when the
comedi_cmd is copied from user to kernel space by __comedi_get_user_cmd().
If so, the core returns -EINVAL and will not call the subdevice (*do_cmdtest)
and (*do_cmd).

Remove the unnecessary "max" checks in the comedi driver (*do_cmdtest) and
helper functions.

Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c
index 70e8f426285cd9ea63e992bbed4195c07c6c35ad..66c24e41d0ffa8367b1c908585740347c73bb90e 100644 (file)
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c
@@ -734,7 +734,6 @@ static int apci3120_ai_cmdtest(struct comedi_device *dev,
                               struct comedi_subdevice *s,
                               struct comedi_cmd *cmd)
 {
-       const struct addi_board *this_board = comedi_board(dev);
        int err = 0;
 
        /* Step 1 : check if triggers are trivially valid */
@@ -779,8 +778,6 @@ static int apci3120_ai_cmdtest(struct comedi_device *dev,
        }
 
        err |= cfc_check_trigger_arg_min(&cmd->chanlist_len, 1);
-       err |= cfc_check_trigger_arg_max(&cmd->chanlist_len,
-                                        this_board->i_AiChannelList);
 
        if (cmd->stop_src == TRIG_COUNT)
                err |= cfc_check_trigger_arg_min(&cmd->stop_arg, 1);

diff --git a/drivers/staging/comedi/drivers/adl_pci9118.c b/drivers/staging/comedi/drivers/adl_pci9118.c
index b6abef6ceab776e9aa4a1ce698b0ac10591f6cb0..53bbc59f617663be546093e0eb55fb8e0de2e3da 100644 (file)
--- a/drivers/staging/comedi/drivers/adl_pci9118.c
+++ b/drivers/staging/comedi/drivers/adl_pci9118.c
@@ -1259,8 +1259,6 @@ static int pci9118_ai_cmdtest(struct comedi_device *dev,
                err |= cfc_check_trigger_arg_is(&cmd->stop_arg, 0);
 
        err |= cfc_check_trigger_arg_min(&cmd->chanlist_len, 1);
-       err |= cfc_check_trigger_arg_max(&cmd->chanlist_len,
-                                        this_board->n_aichanlist);
 
        err |= cfc_check_trigger_arg_min(&cmd->scan_end_arg,
                                         cmd->chanlist_len);

diff --git a/drivers/staging/comedi/drivers/pcl812.c b/drivers/staging/comedi/drivers/pcl812.c
index 5cc01fe45cf2367f914009f411dd6a53be74680b..0cf115e54308b3670ebf708174f535cecb1064da 100644 (file)
--- a/drivers/staging/comedi/drivers/pcl812.c
+++ b/drivers/staging/comedi/drivers/pcl812.c
@@ -761,7 +761,6 @@ static int pcl812_ai_cmdtest(struct comedi_device *dev,
                err |= cfc_check_trigger_arg_is(&cmd->convert_arg, 0);
 
        err |= cfc_check_trigger_arg_min(&cmd->chanlist_len, 1);
-       err |= cfc_check_trigger_arg_max(&cmd->chanlist_len, MAX_CHANLIST_LEN);
        err |= cfc_check_trigger_arg_is(&cmd->scan_end_arg, cmd->chanlist_len);
 
        if (cmd->stop_src == TRIG_COUNT)

diff --git a/drivers/staging/comedi/drivers/rtd520.c b/drivers/staging/comedi/drivers/rtd520.c
index cd3fdf973bdd6b8d5856127e95736aea5e920773..1b1c166c8e9b1681301cd2d3e8f3a516fa896587 100644 (file)
--- a/drivers/staging/comedi/drivers/rtd520.c
+++ b/drivers/staging/comedi/drivers/rtd520.c
@@ -891,10 +891,6 @@ static int rtd_ai_cmdtest(struct comedi_device *dev,
 
        /* step 4: fix up any arguments */
 
-       if (cmd->chanlist_len > RTD_MAX_CHANLIST) {
-               cmd->chanlist_len = RTD_MAX_CHANLIST;
-               err++;
-       }
        if (cmd->scan_begin_src == TRIG_TIMER) {
                tmp = cmd->scan_begin_arg;
                rtd_ns_to_timer(&cmd->scan_begin_arg,