From 2e1f94f6e2c579d7fcc37c6952796ed5b1e45bc1 Mon Sep 17 00:00:00 2001
From: Luca Toniolo <10792599+grandixximo@users.noreply.github.com>
Date: Sun, 4 Oct 2026 21:10:36 +0800
Subject: [PATCH] hostmot2: check hal_malloc results in sserial and abs_encoder
 setup

The load path dereferenced hal_malloc results without a check. On HAL
shared-memory exhaustion, or on a garbage global/conf count read from
an unresponsive remote, the next statement wrote through NULL and
killed the loading process with no useful message. Fail with -ENOMEM
and the channel name instead.
---
 src/hal/drivers/mesa-hostmot2/abs_encoder.c | 12 ++++++++++++
 src/hal/drivers/mesa-hostmot2/sserial.c     | 21 +++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/src/hal/drivers/mesa-hostmot2/abs_encoder.c b/src/hal/drivers/mesa-hostmot2/abs_encoder.c
index 5b7b954bbb9..4ee291240b1 100644
--- a/src/hal/drivers/mesa-hostmot2/abs_encoder.c
+++ b/src/hal/drivers/mesa-hostmot2/abs_encoder.c
@@ -139,6 +139,10 @@ int hm2_absenc_setup_ssi(hostmot2_t *hm2, hm2_sserial_remote_t *chan,
     if ( hm2_sserial_create_pins(hm2, chan)) return -EINVAL;
     
     chan->params = hal_malloc(sizeof(*chan->params));
+    if (chan->params == NULL) {
+        HM2_ERR("out of HAL memory allocating absenc params on %s\n", chan->name);
+        return -ENOMEM;
+    }
     hm2->absenc.clock_frequency = md->clock_freq;
     hm2->absenc.ssi_version = md->version;
 
@@ -170,6 +174,10 @@ int hm2_absenc_setup_biss(hostmot2_t *hm2, hm2_sserial_remote_t *chan,
     if ( hm2_sserial_create_pins(hm2, chan)) return -EINVAL;
     
     chan->params = hal_malloc(sizeof(*chan->params));
+    if (chan->params == NULL) {
+        HM2_ERR("out of HAL memory allocating absenc params on %s\n", chan->name);
+        return -ENOMEM;
+    }
     hm2->absenc.clock_frequency = md->clock_freq;
     hm2->absenc.biss_version = md->version;
     
@@ -201,6 +209,10 @@ int hm2_absenc_setup_fabs(hostmot2_t *hm2, hm2_sserial_remote_t *chan,
     if ( hm2_sserial_create_pins(hm2, chan)) return -EINVAL;
     
     chan->params = hal_malloc(sizeof(*chan->params));
+    if (chan->params == NULL) {
+        HM2_ERR("out of HAL memory allocating absenc params on %s\n", chan->name);
+        return -ENOMEM;
+    }
     hm2->absenc.clock_frequency = md->clock_freq;
     hm2->absenc.fanuc_version = md->version;
 
diff --git a/src/hal/drivers/mesa-hostmot2/sserial.c b/src/hal/drivers/mesa-hostmot2/sserial.c
index d0030a214f3..23f948cf8d2 100644
--- a/src/hal/drivers/mesa-hostmot2/sserial.c
+++ b/src/hal/drivers/mesa-hostmot2/sserial.c
@@ -423,6 +423,11 @@ int hm2_sserial_create_params(hostmot2_t *hm2, hm2_sserial_remote_t *chan){
     int hal_dir;
 
     chan->params = hal_malloc(chan->num_globals * sizeof(*chan->params));
+    if (chan->params == NULL && chan->num_globals > 0) {
+        HM2_ERR("out of HAL memory allocating %i sserial params on %s\n",
+                chan->num_globals, chan->name);
+        return -ENOMEM;
+    }
     for (i = 0 ; i < chan->num_globals ; i++){
         global = chan->globals[i];
 
@@ -1099,6 +1104,11 @@ int hm2_sserial_create_pins(hostmot2_t *hm2, hm2_sserial_remote_t *chan){
     int r = 0;
     int data_dir;
     chan->pins = hal_malloc(chan->num_confs * sizeof(*chan->pins));
+    if (chan->pins == NULL && chan->num_confs > 0) {
+        HM2_ERR("out of HAL memory allocating %i sserial pin sets on %s\n",
+                chan->num_confs, chan->name);
+        return -ENOMEM;
+    }
 
     chan->num_read_bits = 0 ; chan->num_write_bits = 0;
 
@@ -1153,6 +1163,12 @@ int hm2_sserial_create_pins(hostmot2_t *hm2, hm2_sserial_remote_t *chan){
                 chan->pins[i].bit_pins = hal_malloc(chan->confs[i].DataLength * sizeof(*chan->pins[i].bit_pins));
                 chan->pins[i].bit_pins_not = hal_malloc(chan->confs[i].DataLength * sizeof(*chan->pins[i].bit_pins_not));
                 chan->pins[i].invert = hal_malloc(chan->confs[i].DataLength * sizeof(*chan->pins[i].invert));
+                if ((chan->pins[i].bit_pins == NULL || chan->pins[i].bit_pins_not == NULL
+                     || chan->pins[i].invert == NULL) && chan->confs[i].DataLength > 0) {
+                    HM2_ERR("out of HAL memory allocating %i bit pins on %s.%s\n",
+                            chan->confs[i].DataLength, chan->name, chan->confs[i].NameString);
+                    return -ENOMEM;
+                }
                 for (j = 0; j < chan->confs[i].DataLength ; j++){
 
                     r = hal_pin_new_bool(hm2->llio->comp_id, data_dir, &(chan->pins[i].bit_pins[j]),
@@ -1238,6 +1254,11 @@ int hm2_sserial_create_pins(hostmot2_t *hm2, hm2_sserial_remote_t *chan){
                 }
                 if (data_dir == HAL_IN) {
                     chan->pins[i].invert = hal_malloc(sizeof(*chan->pins[i].invert));
+                    if (chan->pins[i].invert == NULL) {
+                        HM2_ERR("out of HAL memory allocating invert param on %s.%s\n",
+                                chan->name, chan->confs[i].NameString);
+                        return -ENOMEM;
+                    }
                     r = hal_param_new_bool(hm2->llio->comp_id, HAL_RW, chan->pins[i].invert,
                                            0, "%s.%s-invert", chan->name, chan->confs[i].NameString);
                     if (r < 0) {