From patchwork Sun Sep 26 20:51:26 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 12518459 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1FD81C433F5 for ; Sun, 26 Sep 2021 20:51:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0275B60527 for ; Sun, 26 Sep 2021 20:51:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230148AbhIZUxI (ORCPT ); Sun, 26 Sep 2021 16:53:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:57612 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230088AbhIZUxH (ORCPT ); Sun, 26 Sep 2021 16:53:07 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 34EAB61019; Sun, 26 Sep 2021 20:51:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1632689491; bh=LaAstt3a2tNteoear8qqS4yJqMm/S16jSVvcgtTsn4Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wf5hhgfxCAvAGrbI1/YZK6T3MdnCMPPME9yrZGwnJCogAaJmyHru3yk9dfIoagZXn H3DMpuDS3NQBJVNSuJ8FJ3sOwSWMVcsK+/4fD+crIHrUumB+LJ/+aBQYrBC/7Hrq8Z AhSUqDZs79N6xpuMc0f9T7uFAP8omuPyEQ48r04kPP0liGShVJyk+JD4EhpTKn+zT7 t30cEu/OxeW5GM5VuoyVaRUeu8V4nnH44pjDdmdD5jQu3fMn214j/AKniqRipMa4rB 1LrgJ94ejI5QLKBSPYlahVAVdjxkEbhujnPg29DDa9cWu1JchG4MFsVw/9lrPUwz0K tx2DVbsOacwsQ== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1mUb7R-001Yb3-7Q; Sun, 26 Sep 2021 22:51:29 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Michael Kuron , Mauro Carvalho Chehab , Olivier Grenie , Patrick Boettcher , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, pb@linuxtv.org, stable@vger.kernel.org, Mauro Carvalho Chehab Subject: [PATCH 1/3] media: dib0700: fix undefined behavior in tuner shutdown Date: Sun, 26 Sep 2021 22:51:26 +0200 Message-Id: <1d2fc36d94ced6f67c7cc21dcc469d5e5bdd8201.1632689033.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Michael Kuron This fixes a problem where closing the tuner would leave it in a state where it would not tune to any channel when reopened. This problem was discovered as part of https://github.com/hselasky/webcamd/issues/16. Since adap->id is 0 or 1, this bit-shift overflows, which is undefined behavior. The driver still worked in practice as the overflow would in most environments result in 0, which rendered the line a no-op. When running the driver as part of webcamd however, the overflow could lead to 0xff due to optimizations by the compiler, which would, in the end, improperly shut down the tuner. The bug is a regression introduced in the commit referenced below. The present patch causes identical behavior to before that commit for adap->id equal to 0 or 1. The driver does not contain support for dib0700 devices with more adapters, assuming such even exist. Tests have been performed with the Xbox One Digital TV Tuner on amd64. Not all dib0700 devices are expected to be affected by the regression; this code path is only taken by those with incorrect endpoint numbers. Cc: stable@vger.kernel.org Fixes: 7757ddda6f4f ("[media] DiB0700: add function to change I2C-speed") Signed-off-by: Michael Kuron Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb/dib0700_core.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c index 70219b3e8566..7ea8f68b0f45 100644 --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -618,8 +618,6 @@ int dib0700_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) deb_info("the endpoint number (%i) is not correct, use the adapter id instead", adap->fe_adap[0].stream.props.endpoint); if (onoff) st->channel_state |= 1 << (adap->id); - else - st->channel_state |= 1 << ~(adap->id); } else { if (onoff) st->channel_state |= 1 << (adap->fe_adap[0].stream.props.endpoint-2); From patchwork Sun Sep 26 20:51:27 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 12518463 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 598AFC433FE for ; Sun, 26 Sep 2021 20:51:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3BDDB6044F for ; Sun, 26 Sep 2021 20:51:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230222AbhIZUxK (ORCPT ); Sun, 26 Sep 2021 16:53:10 -0400 Received: from mail.kernel.org ([198.145.29.99]:57618 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230112AbhIZUxH (ORCPT ); Sun, 26 Sep 2021 16:53:07 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 375616103B; Sun, 26 Sep 2021 20:51:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1632689491; bh=QIH0+cev8bo8hbGLg+SlpuLNpPmJX3/IrRwxc7ssKZk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TaQzjNHbVIQTyk0Qhayu5RyLDtHno1Vu0yybIvfo0SuuN1aSw4AqcbIsMtWrZYqTJ p5y9uawxECcvEvvRNJKzX91q/JibCHdbWxEcztuaj6Ki4nyj27XVJEfhYcKg3ryvvg Zg4EAqkwhvmcN8COHj4/7TPAtNKaJ6kPxRz7Jln2Nh9Vvn0iQ01s6CtOWLBpmpzZTf S07QtVxhRfppGvSb5vAN8J4sg/Qj3usGxraYmIiRilRkQf6yXrxU8JIPiQpWUUeJc3 NS9NE6VyvT5ER5bs4oG/3DalVwAkbe1deW8A6ypDvSh0SP++iaDnDLGgfNIRgMCLkT x9Odb00f6wM1Q== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1mUb7R-001Yb6-8T; Sun, 26 Sep 2021 22:51:29 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Mauro Carvalho Chehab , Michael Kuron , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, pb@linuxtv.org Subject: [PATCH 2/3] media: dib0700: cleanup start/stop streaming logic Date: Sun, 26 Sep 2021 22:51:27 +0200 Message-Id: <065a6fff925a42153671fa5202c81882ca12c59c.1632689033.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Having two different pathes to start/stop streaming, depending weather the USB endpoints are 0x82/0x83 or not makes it more prune to errors. Unify the logic. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb/dib0700_core.c | 26 +++++++++++++----------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c index 7ea8f68b0f45..d7c5836b9271 100644 --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -583,7 +583,7 @@ int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw int dib0700_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) { struct dib0700_state *st = adap->dev->priv; - int ret; + int ret, adapt_nr; if ((onoff != 0) && (st->fw_version >= 0x10201)) { /* for firmware later than 1.20.1, @@ -610,24 +610,26 @@ int dib0700_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) st->buf[3] = 0x00; - deb_info("modifying (%d) streaming state for %d\n", onoff, adap->id); - st->channel_state &= ~0x3; + if ((adap->fe_adap[0].stream.props.endpoint != 2) - && (adap->fe_adap[0].stream.props.endpoint != 3)) { - deb_info("the endpoint number (%i) is not correct, use the adapter id instead", adap->fe_adap[0].stream.props.endpoint); - if (onoff) - st->channel_state |= 1 << (adap->id); + && (adap->fe_adap[0].stream.props.endpoint != 3)) { + deb_info("the endpoint number (%i) is not correct, use the adapter id instead\n", + adap->fe_adap[0].stream.props.endpoint); + adapt_nr = adap->id; } else { - if (onoff) - st->channel_state |= 1 << (adap->fe_adap[0].stream.props.endpoint-2); - else - st->channel_state |= 1 << (3-adap->fe_adap[0].stream.props.endpoint); + adapt_nr = adap->fe_adap[0].stream.props.endpoint - 2; } + if (onoff) + st->channel_state |= 1 << adapt_nr; + else + st->channel_state |= 1 << (1 - adapt_nr); + st->buf[2] |= st->channel_state; - deb_info("data for streaming: %x %x\n", st->buf[1], st->buf[2]); + deb_info("adapter %d, streaming %s: %*ph\n", + adapt_nr, onoff ? "ON" : "OFF", 3, st->buf); ret = dib0700_ctrl_wr(adap->dev, st->buf, 4); mutex_unlock(&adap->dev->usb_mutex); From patchwork Sun Sep 26 20:51:28 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 12518461 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7444BC43219 for ; Sun, 26 Sep 2021 20:51:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 55C63610CA for ; Sun, 26 Sep 2021 20:51:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230088AbhIZUxL (ORCPT ); Sun, 26 Sep 2021 16:53:11 -0400 Received: from mail.kernel.org ([198.145.29.99]:57650 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230123AbhIZUxI (ORCPT ); Sun, 26 Sep 2021 16:53:08 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 93E0761100; Sun, 26 Sep 2021 20:51:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1632689491; bh=f2KuJJdq2qiMDAjb0OCH7k4yC2rZh+SiOFqxoQttMOs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kTsVPA0mURHLk6JG8FKxBlRFXAW2b1lxHlS7UGKgWpXi/+bRQNLPeMp3YTW3XBmyH sGah9GTV640/vIgDDN0Hil0yx3B89/J+Mf2vG7f7fwM1ppObF0TKvOGRoocKvvJKQI 2eHHKDsn2aVXr1CAQEo0CGLnVkwGk9nJkm9QSOQzCB6Uxqfv0ACrVOnASDrulXStZ5 UK1bZnp6wInp6nMJTBsc9m4v1TzsPPOqSgpyreO7iAM8GL37h+tvGd7hjGTsWTRr62 b78Jb5F1Lbz+5vXxjlYTjbJlumMz/IdtVxJ+eEppRknWeJMlYS5ws9Ms3GVlRpv8w2 U6EGf+pvA1VnQ== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1mUb7R-001YbB-AG; Sun, 26 Sep 2021 22:51:29 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Mauro Carvalho Chehab , Michael Kuron , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, pb@linuxtv.org Subject: [PATCH 3/3] media: dib0700: Only touch one bit when start/stop an adapter Date: Sun, 26 Sep 2021 22:51:28 +0200 Message-Id: <4214942f248baddec9cfd2b4b2424993ac356a51.1632689033.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Only touch the right bit to enable/disable an adapter channel, without touching the other adapter's one. Tested on Nova-TD. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb/dib0700_core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c index d7c5836b9271..1caabb51ea47 100644 --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -610,8 +610,6 @@ int dib0700_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) st->buf[3] = 0x00; - st->channel_state &= ~0x3; - if ((adap->fe_adap[0].stream.props.endpoint != 2) && (adap->fe_adap[0].stream.props.endpoint != 3)) { deb_info("the endpoint number (%i) is not correct, use the adapter id instead\n", @@ -624,7 +622,7 @@ int dib0700_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) if (onoff) st->channel_state |= 1 << adapt_nr; else - st->channel_state |= 1 << (1 - adapt_nr); + st->channel_state &= ~(1 << adapt_nr); st->buf[2] |= st->channel_state;