From patchwork Mon Dec 11 16:37:24 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 10105505 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E8EDE602B3 for ; Mon, 11 Dec 2017 16:37:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DA94A29597 for ; Mon, 11 Dec 2017 16:37:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CF4DF297A2; Mon, 11 Dec 2017 16:37:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 36BFE29597 for ; Mon, 11 Dec 2017 16:37:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752911AbdLKQhi (ORCPT ); Mon, 11 Dec 2017 11:37:38 -0500 Received: from osg.samsung.com ([64.30.133.232]:56486 "EHLO osg.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752894AbdLKQhf (ORCPT ); Mon, 11 Dec 2017 11:37:35 -0500 Received: from localhost (localhost [127.0.0.1]) by osg.samsung.com (Postfix) with ESMTP id 794771AAC5; Mon, 11 Dec 2017 08:37:33 -0800 (PST) X-Virus-Scanned: Debian amavisd-new at dev.s-opensource.com Received: from osg.samsung.com ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FJ7VYM-0UIYO; Mon, 11 Dec 2017 08:37:32 -0800 (PST) Received: from smtp.s-opensource.com (177.205.74.193.dynamic.adsl.gvt.net.br [177.205.74.193]) by osg.samsung.com (Postfix) with ESMTPSA id 3BE021AAAD; Mon, 11 Dec 2017 08:37:32 -0800 (PST) Received: from mchehab by smtp.s-opensource.com with local (Exim 4.89) (envelope-from ) id 1eOR57-0009G2-Ii; Mon, 11 Dec 2017 11:37:29 -0500 From: Mauro Carvalho Chehab Cc: Mauro Carvalho Chehab , Linux Media Mailing List , Mauro Carvalho Chehab , Ron Economos , Johannes Berg , "David S. Miller" , Sakari Ailus , Arnd Bergmann Subject: [PATCH 1/3] media: dvb_net: ensure that dvb_net_ule_handle is fully initialized Date: Mon, 11 Dec 2017 11:37:24 -0500 Message-Id: <3749c9084b647a3ca80e78a9f5a3bd83ecb1e4cb.1513010227.git.mchehab@s-opensource.com> X-Mailer: git-send-email 2.14.3 To: unlisted-recipients:; (no To-header on input) Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP changeset efb9ab67255f ("[media] dvb_net: prepare to split a very complex function") changed the ULE handling logic, simplifying it. However, it forgot to keep the initialization for .priv and to zero .ule_hist fields. The lack of .priv cause crashes if dvb_net_ule() is called, as the function assuems that .priv field to be initialized. With regards to .ule_hist, the current logic is broken and don't even compile if ULE_DEBUG. Fix it by making the debug vars static again, and be sure to pass iov parameter to dvb_net_ule_check_crc(). Fixes: efb9ab67255f ("[media] dvb_net: prepare to split a very complex function") Suggested-by: Ron Economos Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_net.c | 57 +++++++++++++++++++--------------------- 1 file changed, 27 insertions(+), 30 deletions(-) diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c index c018e3c06d5d..bff5cd908df6 100644 --- a/drivers/media/dvb-core/dvb_net.c +++ b/drivers/media/dvb-core/dvb_net.c @@ -82,6 +82,13 @@ static inline __u32 iov_crc32( __u32 c, struct kvec *iov, unsigned int cnt ) #ifdef ULE_DEBUG +/* + * The code inside ULE_DEBUG keeps a history of the + * last 100 TS cells processed. + */ +static unsigned char ule_hist[100*TS_SZ] = { 0 }; +static unsigned char *ule_where = ule_hist, ule_dump; + static void hexdump(const unsigned char *buf, unsigned short len) { print_hex_dump_debug("", DUMP_PREFIX_OFFSET, 16, 1, buf, len, true); @@ -320,14 +327,6 @@ struct dvb_net_ule_handle { const u8 *ts, *ts_end, *from_where; u8 ts_remain, how_much, new_ts; bool error; -#ifdef ULE_DEBUG - /* - * The code inside ULE_DEBUG keeps a history of the - * last 100 TS cells processed. - */ - static unsigned char ule_hist[100*TS_SZ]; - static unsigned char *ule_where = ule_hist, ule_dump; -#endif }; static int dvb_net_ule_new_ts_cell(struct dvb_net_ule_handle *h) @@ -335,14 +334,14 @@ static int dvb_net_ule_new_ts_cell(struct dvb_net_ule_handle *h) /* We are about to process a new TS cell. */ #ifdef ULE_DEBUG - if (h->ule_where >= &h->ule_hist[100*TS_SZ]) - h->ule_where = h->ule_hist; - memcpy(h->ule_where, h->ts, TS_SZ); - if (h->ule_dump) { - hexdump(h->ule_where, TS_SZ); - h->ule_dump = 0; + if (ule_where >= &ule_hist[100*TS_SZ]) + ule_where = ule_hist; + memcpy(ule_where, h->ts, TS_SZ); + if (ule_dump) { + hexdump(ule_where, TS_SZ); + ule_dump = 0; } - h->ule_where += TS_SZ; + ule_where += TS_SZ; #endif /* @@ -659,7 +658,7 @@ static int dvb_net_ule_should_drop(struct dvb_net_ule_handle *h) } -static void dvb_net_ule_check_crc(struct dvb_net_ule_handle *h, +static void dvb_net_ule_check_crc(struct dvb_net_ule_handle *h, struct kvec iov[3], u32 ule_crc, u32 expected_crc) { u8 dest_addr[ETH_ALEN]; @@ -677,17 +676,17 @@ static void dvb_net_ule_check_crc(struct dvb_net_ule_handle *h, hexdump(iov[1].iov_base, iov[1].iov_len); hexdump(iov[2].iov_base, iov[2].iov_len); - if (h->ule_where == h->ule_hist) { - hexdump(&h->ule_hist[98*TS_SZ], TS_SZ); - hexdump(&h->ule_hist[99*TS_SZ], TS_SZ); - } else if (h->ule_where == &h->ule_hist[TS_SZ]) { - hexdump(&h->ule_hist[99*TS_SZ], TS_SZ); - hexdump(h->ule_hist, TS_SZ); + if (ule_where == ule_hist) { + hexdump(&ule_hist[98*TS_SZ], TS_SZ); + hexdump(&ule_hist[99*TS_SZ], TS_SZ); + } else if (ule_where == &ule_hist[TS_SZ]) { + hexdump(&ule_hist[99*TS_SZ], TS_SZ); + hexdump(ule_hist, TS_SZ); } else { - hexdump(h->ule_where - TS_SZ - TS_SZ, TS_SZ); - hexdump(h->ule_where - TS_SZ, TS_SZ); + hexdump(ule_where - TS_SZ - TS_SZ, TS_SZ); + hexdump(ule_where - TS_SZ, TS_SZ); } - h->ule_dump = 1; + ule_dump = 1; #endif h->dev->stats.rx_errors++; @@ -779,6 +778,8 @@ static void dvb_net_ule(struct net_device *dev, const u8 *buf, size_t buf_len) int ret; struct dvb_net_ule_handle h = { .dev = dev, + .priv = netdev_priv(dev), + .ethh = NULL, .buf = buf, .buf_len = buf_len, .skipped = 0L, @@ -788,11 +789,7 @@ static void dvb_net_ule(struct net_device *dev, const u8 *buf, size_t buf_len) .ts_remain = 0, .how_much = 0, .new_ts = 1, - .ethh = NULL, .error = false, -#ifdef ULE_DEBUG - .ule_where = ule_hist, -#endif }; /* @@ -860,7 +857,7 @@ static void dvb_net_ule(struct net_device *dev, const u8 *buf, size_t buf_len) *(tail - 2) << 8 | *(tail - 1); - dvb_net_ule_check_crc(&h, ule_crc, expected_crc); + dvb_net_ule_check_crc(&h, iov, ule_crc, expected_crc); /* Prepare for next SNDU. */ reset_ule(h.priv);