From patchwork Sat May 13 17:57:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240281 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44E50C7EE26 for ; Sat, 13 May 2023 17:58:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234752AbjEMR57 (ORCPT ); Sat, 13 May 2023 13:57:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36094 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233461AbjEMR5u (ORCPT ); Sat, 13 May 2023 13:57:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A95DE273F; Sat, 13 May 2023 10:57:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6D49461C28; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3696BC433A8; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=1qTBZIy/0s0rnJPtyTEqiDh0a/SvnY8Eo2eM/Rkf/i0=; h=From:To:Cc:Subject:Date:From; b=dR/m4fFTbTZvr+QfxNN98GnzkeguwI3JEAJWtSOMPjk6Lm1NO4KHMb7PSYsiP2EWs KF1hrEZzjMtl349HfMlFJtQQ8eSI80uZp7ehJkmcvV2R+5e1h0rrkrSQM1Qogfafh/ S7oG/jFyShwI87BCxRkOSgefHEHg+39hDwwIKee32IsY/KXjJZi8ztPKn/vR32b2vQ MNma0NGsc4DSqvLUHDlpdHw6268DTH/Z+H2/J42cxVtC1xDCiYnfN2W6Crmwtt+gHP yUd7/nSNtfjyQH0ZgrIf3tOZdvHNC1i2+xWFwvN0uyA7GAGnbYI+RBXcjqKk5Q05e+ gYjQolSHSNipA== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txS-0k; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Arnd Bergmann , Hans Verkuil , Lecopzer Chen , Mauro Carvalho Chehab , Mike Isely , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 01/24] media: pvrusb2: fix DVB_CORE dependency Date: Sat, 13 May 2023 18:57:18 +0100 Message-Id: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Arnd Bergmann Now that DVB_CORE can be a loadable module, pvrusb2 can run into a link error: ld.lld: error: undefined symbol: dvb_module_probe >>> referenced by pvrusb2-devattr.c >>> drivers/media/usb/pvrusb2/pvrusb2-devattr.o:(pvr2_lgdt3306a_attach) in archive vmlinux.a ld.lld: error: undefined symbol: dvb_module_release >>> referenced by pvrusb2-devattr.c >>> drivers/media/usb/pvrusb2/pvrusb2-devattr.o:(pvr2_dual_fe_attach) in archive vmlinux.a Refine the Kconfig dependencies to avoid this case. Link: https://lore.kernel.org/linux-media/20230117171055.2714621-1-arnd@kernel.org Fixes: 7655c342dbc4 ("media: Kconfig: Make DVB_CORE=m possible when MEDIA_SUPPORT=y") Signed-off-by: Arnd Bergmann Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/pvrusb2/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/pvrusb2/Kconfig b/drivers/media/usb/pvrusb2/Kconfig index 9501b10b31aa..0df10270dbdf 100644 --- a/drivers/media/usb/pvrusb2/Kconfig +++ b/drivers/media/usb/pvrusb2/Kconfig @@ -37,6 +37,7 @@ config VIDEO_PVRUSB2_DVB bool "pvrusb2 ATSC/DVB support" default y depends on VIDEO_PVRUSB2 && DVB_CORE + depends on VIDEO_PVRUSB2=m || DVB_CORE=y select DVB_LGDT330X if MEDIA_SUBDRV_AUTOSELECT select DVB_S5H1409 if MEDIA_SUBDRV_AUTOSELECT select DVB_S5H1411 if MEDIA_SUBDRV_AUTOSELECT From patchwork Sat May 13 17:57:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240284 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57033C77B7A for ; Sat, 13 May 2023 17:58:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236152AbjEMR6D (ORCPT ); Sat, 13 May 2023 13:58:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36092 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233142AbjEMR5u (ORCPT ); Sat, 13 May 2023 13:57:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 46F3F2D48; Sat, 13 May 2023 10:57:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3DA5361BD9; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 253B0C433A0; Sat, 13 May 2023 17:57:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=ZWmeJZ/Ufh5VsGOpRReQ7tvdGJoDfmcW2OUU8dlQK1I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=leHrrPU4L07+sI6wLbyavIKomP2AKvmdOe63+HW74g73HPOWUbWq3dIQmzZO7VvJn 4BiQmCq4lP7gLorBprdEXyGgurm6vlZdYtQ0sTrOQLbq2ZKmG+DGDAaekJxH3W5Osx ZIXiENzPTdgU3oX7VAE5OA419pTSUssEwSo4TThvIoZvPC9Qr6ZxlSG59Dr35rYMDh oIao6auS8kJDyeR1LCHMUjkJRtPPWA4TgKavMLusEX2658UB3dvYzmKAqoafvyLxCG ijkJiViZzDSfqAKVZ7/wfy8jlSiUEDXIuvyisdZACLqCDwoG1TDuZTqVY/DmuR6Xfi EDJQDN581wXhw== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txV-0s; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: YongSu Yoo , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 02/24] media: dvb_demux: fix a bug for the continuity counter Date: Sat, 13 May 2023 18:57:19 +0100 Message-Id: <7efb10d8dc70ea3000cc70dca53407c52488acd1.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: YongSu Yoo In dvb_demux.c, some logics exist which compare the expected continuity counter and the real continuity counter. If they are not matched each other, both of the expected continuity counter and the real continuity counter should be printed. But there exists a bug that the expected continuity counter is not correctly printed. The expected continuity counter is replaced with the real countinuity counter + 1 so that the epected continuity counter is not correclty printed. This is wrong. This bug is fixed. Link: https://lore.kernel.org/linux-media/20230305212519.499-1-yongsuyoo0215@gmail.com Signed-off-by: YongSu Yoo Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_demux.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c index 398c86279b5b..7c4d86bfdd6c 100644 --- a/drivers/media/dvb-core/dvb_demux.c +++ b/drivers/media/dvb-core/dvb_demux.c @@ -115,12 +115,12 @@ static inline int dvb_dmx_swfilter_payload(struct dvb_demux_feed *feed, cc = buf[3] & 0x0f; ccok = ((feed->cc + 1) & 0x0f) == cc; - feed->cc = cc; if (!ccok) { set_buf_flags(feed, DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED); dprintk_sect_loss("missed packet: %d instead of %d!\n", cc, (feed->cc + 1) & 0x0f); } + feed->cc = cc; if (buf[1] & 0x40) // PUSI ? feed->peslen = 0xfffa; @@ -300,7 +300,6 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed, cc = buf[3] & 0x0f; ccok = ((feed->cc + 1) & 0x0f) == cc; - feed->cc = cc; if (buf[3] & 0x20) { /* adaption field present, check for discontinuity_indicator */ @@ -336,6 +335,7 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed, feed->pusi_seen = false; dvb_dmx_swfilter_section_new(feed); } + feed->cc = cc; if (buf[1] & 0x40) { /* PUSI=1 (is set), section boundary is here */ From patchwork Sat May 13 17:57:20 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240279 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42A09C7EE26 for ; Sat, 13 May 2023 17:57:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234013AbjEMR5z (ORCPT ); Sat, 13 May 2023 13:57:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36062 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232629AbjEMR5t (ORCPT ); Sat, 13 May 2023 13:57:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6DEA22133; Sat, 13 May 2023 10:57:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D8B2161BCB; Sat, 13 May 2023 17:57:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A783C4339C; Sat, 13 May 2023 17:57:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=17CypJr+LuSnQyYNvIQktRqRkHT7zYk/k1QXGCJ3q9w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y5jYsmm9xtSDqVJlFGyQ5KonuJ6Lz3Lc0k1c6mH18rxQgtEdpIhT1t9LsUbj6Pdco M5CFD9SKG2lvhd6kINZJ1TsRD1YGGvl3dtB4UO4imTDi/AvghUMX4Kyn/F5Iz7nTFu jfDAqXbHai1vbxChXJ63nskR78OxPIET0vJaAhvqq+GD4Pi+SeXaOvuwqOiumyuYki JJWWK/c1SaPASUCVBL+zubA227ghwvVWRe0CqRq9UJGAnLtbAWul9ZHFiv4cEK0ANv g4iwpjhZk3NQ/BlmpCQNs8Hq0Wqxinok/zqwBxwjYKfTLKOpU9pFdfspf0twKHLEEr XTY1pSSEubAxQ== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txY-0z; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Duoming Zhou , Abylay Ospan , Mauro Carvalho Chehab , Sergey Kozlov , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 03/24] media: netup_unidvb: fix use-after-free bug caused by del_timer() Date: Sat, 13 May 2023 18:57:20 +0100 Message-Id: <0d23dfd380ba4466d8e6208dcbf40a250a734099.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Duoming Zhou When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below: (cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | | ndev->pci_dev->dev //USE Fix by changing del_timer() to del_timer_sync(). Link: https://lore.kernel.org/linux-media/20230308125514.4208-1-duoming@zju.edu.cn Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver") Signed-off-by: Duoming Zhou Signed-off-by: Mauro Carvalho Chehab --- drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c index 8287851b5ffd..aaa1d2dedebd 100644 --- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c @@ -697,7 +697,7 @@ static void netup_unidvb_dma_fini(struct netup_unidvb_dev *ndev, int num) netup_unidvb_dma_enable(dma, 0); msleep(50); cancel_work_sync(&dma->work); - del_timer(&dma->timeout); + del_timer_sync(&dma->timeout); } static int netup_unidvb_dma_setup(struct netup_unidvb_dev *ndev) From patchwork Sat May 13 17:57:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240292 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 416AAC7EE26 for ; Sat, 13 May 2023 17:58:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237200AbjEMR6S (ORCPT ); Sat, 13 May 2023 13:58:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36120 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233483AbjEMR5u (ORCPT ); Sat, 13 May 2023 13:57:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ABE9F2D4F; Sat, 13 May 2023 10:57:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6FF7961C55; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3DBEBC433AE; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=5VWVO7uCqtpTtyq7WX0BHcu+gdmJb2AfY2VtJgOfah4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W1DGKgy/izDBaJnf5WSQPcpX+BfLT9gdqK2xVJsT7nXqk2z3vx30fxRyGCZJ6Oy4G Nz8i8BalrjvE53PvsKkGDi0p/o9/mg8gm8wsfjoToZjCdHsas9FTQ8ocZBNjwjke7Q trkSR3FcIJjcJ9iJ0w3hM4ZrrfehG80KGgHkipeESwciLvGi9XTTpk2ETRjkBXRvWK GXDEpk/lFtM9q4yzzZdbzQhvtJhsNxo8LsPegJsS/4ysUvaz/jiDBFkZtmzN8bBhXU AGI5kiY4vjO+HA2SZ/zME8FqBLdJ3F0IPMV/g/wl4LwYmZonMEcB1f5Wh98Z7snddp Z1qt//DhzU8ZA== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txb-13; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Wei Chen , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 04/24] media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() Date: Sat, 13 May 2023 18:57:21 +0100 Message-Id: X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Wei Chen In az6027_i2c_xfer, msg is controlled by user. When msg[i].buf is null, commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") fix the null-ptr-deref bug when msg[i].addr is 0x99. However, null-ptr-deref also happens when msg[i].addr is 0xd0 and 0xc0. We add check on msg[i].len to prevent null-ptr-deref. Link: https://lore.kernel.org/linux-media/20230310165604.3093483-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb/az6027.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c index 7d78ee09be5e..a31c6f82f4e9 100644 --- a/drivers/media/usb/dvb-usb/az6027.c +++ b/drivers/media/usb/dvb-usb/az6027.c @@ -988,6 +988,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n /* write/read request */ if (i + 1 < num && (msg[i + 1].flags & I2C_M_RD)) { req = 0xB9; + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff)); value = msg[i].addr + (msg[i].len << 8); length = msg[i + 1].len + 6; @@ -1001,6 +1005,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n /* demod 16bit addr */ req = 0xBD; + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff)); value = msg[i].addr + (2 << 8); length = msg[i].len - 2; @@ -1026,6 +1034,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n } else { req = 0xBD; + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } index = msg[i].buf[0] & 0x00FF; value = msg[i].addr + (1 << 8); length = msg[i].len - 1; From patchwork Sat May 13 17:57:22 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240282 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CDB9C77B7A for ; Sat, 13 May 2023 17:58:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235216AbjEMR6A (ORCPT ); Sat, 13 May 2023 13:58:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233374AbjEMR5u (ORCPT ); Sat, 13 May 2023 13:57:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7D9272D4A; Sat, 13 May 2023 10:57:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 731F661C77; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E801C433AF; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=CTfRhQWQn7pm6EUBrySW+mwubKxnJtOio7Fb/AJ6iKM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kboJz1TEgai/9EZySh70l5D9V/kejQeCLlgt4nrnfXRjvxPfg3usiRyd9LSrs2GHU Uj2cLKKPvrusPuYTieqDNXLaroDjqEnYR1RX2n9KdLrx82Cuwg4q5i5bo4ykkBIdAS r6PZKdQDNXqpxUrYhyK7jWVSBLrQBQYXH1oWxBO3ufNcj9Ma1WBMmnfdtKq6bFAaBr e59p36M8Zmfy84DHhDlVU5FFchglvaDA4HtZPtrQJwmHTg+ryaBx21zRdm00A1YNSG iyCMhROx5Asd/2VpMBJQ/qULgHJw3o60FEcO6TRE/rJxr6P/srCGJN4GxRUutCc6KN k8P0BIb4W00hA== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txe-16; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Wei Chen , Antti Palosaari , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 05/24] media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() Date: Sat, 13 May 2023 18:57:22 +0100 Message-Id: <7ced9f219d36cb0d3319b556dc0b0f4f81247fa6.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Wei Chen In ec168_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. If accessing msg[i].buf[0] without sanity check, null pointer deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/20230313085853.3252349-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb-v2/ec168.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c index 7ed0ab9e429b..0e4773fc025c 100644 --- a/drivers/media/usb/dvb-usb-v2/ec168.c +++ b/drivers/media/usb/dvb-usb-v2/ec168.c @@ -115,6 +115,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], while (i < num) { if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) { if (msg[i].addr == ec168_ec100_config.demod_address) { + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } req.cmd = READ_DEMOD; req.value = 0; req.index = 0xff00 + msg[i].buf[0]; /* reg */ @@ -131,6 +135,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], } } else { if (msg[i].addr == ec168_ec100_config.demod_address) { + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } req.cmd = WRITE_DEMOD; req.value = msg[i].buf[1]; /* val */ req.index = 0xff00 + msg[i].buf[0]; /* reg */ @@ -139,6 +147,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret = ec168_ctrl_msg(d, &req); i += 1; } else { + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } req.cmd = WRITE_I2C; req.value = msg[i].buf[0]; /* val */ req.index = 0x0100 + msg[i].addr; /* I2C addr */ From patchwork Sat May 13 17:57:23 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240278 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B6C6C7EE24 for ; Sat, 13 May 2023 17:57:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233644AbjEMR5w (ORCPT ); Sat, 13 May 2023 13:57:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36066 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232846AbjEMR5t (ORCPT ); Sat, 13 May 2023 13:57:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6E14F273F; Sat, 13 May 2023 10:57:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EA68F61BD5; Sat, 13 May 2023 17:57:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 261F7C433A1; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=AobujLsjg+9WUQDOtPi3QpnUN+pCkaFzFNpt8y5ouZI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HzzaiWOJLRDLeAs/iKYsZTgBhGzGCDXquQtMQiq70xUzv10n4JLC3NmJWtU1vnTCE XosG4ZrEj31xqAX+EJextwjLmcA1EofzWH2lMNcjhF/Ow2Tv3n6/Fb+JChDqAeDGeC Bdt2xjzy2q3Uh2928nuMqT9KIsZ1SCjQ+sSri3GCodPb2fX+i6nE+xp8TwoKG3Z+K5 bO9fN6KgyPZME/rzPbUy4Ydgln8l4HOC4iF5bIqhwwBk5eG06OwZVl7CoK6EK/Q/t0 OgbtruFu/Lmfe02PUSafZ1LZnJpIBqmd6n7u3Rthk4WWSxUQn0mPklAVKZ03rfVGDD 4WjM32uJOfUIg== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txh-19; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Wei Chen , Antti Palosaari , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 06/24] media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() Date: Sat, 13 May 2023 18:57:23 +0100 Message-Id: <663aac154527f5d905fe84ae6e9c97fccd061655.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Wei Chen In ce6230_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach ce6230_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/20230313092751.209496-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb-v2/ce6230.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/media/usb/dvb-usb-v2/ce6230.c b/drivers/media/usb/dvb-usb-v2/ce6230.c index 44540de1a206..d3b5cb4a24da 100644 --- a/drivers/media/usb/dvb-usb-v2/ce6230.c +++ b/drivers/media/usb/dvb-usb-v2/ce6230.c @@ -101,6 +101,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap, if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) { if (msg[i].addr == ce6230_zl10353_config.demod_address) { + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } req.cmd = DEMOD_READ; req.value = msg[i].addr >> 1; req.index = msg[i].buf[0]; @@ -117,6 +121,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap, } else { if (msg[i].addr == ce6230_zl10353_config.demod_address) { + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } req.cmd = DEMOD_WRITE; req.value = msg[i].addr >> 1; req.index = msg[i].buf[0]; From patchwork Sat May 13 17:57:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240290 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB542C7EE24 for ; Sat, 13 May 2023 17:58:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230205AbjEMR6O (ORCPT ); Sat, 13 May 2023 13:58:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36094 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233605AbjEMR5v (ORCPT ); Sat, 13 May 2023 13:57:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0AD8C2D51; Sat, 13 May 2023 10:57:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 76CD161C7B; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41287C433AA; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=h+o86lYY6wYE6F/X5RXOjriZlUayPYV89Y5aQCR8DXg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WfAh0T3wyDbyj4r2sqFXHZUdf/gOi/wRXDcJ6WLUns/SgLlhOTiERjWa9XUYk63SF ++Vlzb2X1bOpNat2Relb+G9w4qp3KxLpCGMSHMLn2yDpwvi4fw7YKJsbqlEz/R0MsL FB2v75bydLO7R5VsNWgGhAjCgc1HcFwS2IzpCju078uIMR9dOFGTKZGOk19SUwRNZQ 3OlbX11SEydMzCfwCWRDJdWtNu4ErzS/rD087xuKtdR4+GB0V9jRGFaEAlHCmUy+xC 7VpCL2GGgYNFmzqYyQXTtAFfjy+U4eNPENSramrxX5u8J5CoH2zjiu7GElpUIpCbDd SpOjaYEYuyzbA== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txk-1C; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Zhang Shurong , Antti Palosaari , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 07/24] media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer Date: Sat, 13 May 2023 18:57:24 +0100 Message-Id: <77c81598e4c5abbc444844108f71cabc562a50d7.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Zhang Shurong In rtl28xxu_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach rtl28xxu_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/tencent_3623572106754AC2F266B316798B0F6CCA05@qq.com Signed-off-by: Zhang Shurong Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c index 795a012d4020..f7884bb56fcc 100644 --- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c +++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c @@ -176,6 +176,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret = -EOPNOTSUPP; goto err_mutex_unlock; } else if (msg[0].addr == 0x10) { + if (msg[0].len < 1 || msg[1].len < 1) { + ret = -EOPNOTSUPP; + goto err_mutex_unlock; + } /* method 1 - integrated demod */ if (msg[0].buf[0] == 0x00) { /* return demod page from driver cache */ @@ -189,6 +193,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret = rtl28xxu_ctrl_msg(d, &req); } } else if (msg[0].len < 2) { + if (msg[0].len < 1) { + ret = -EOPNOTSUPP; + goto err_mutex_unlock; + } /* method 2 - old I2C */ req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1); req.index = CMD_I2C_RD; @@ -217,8 +225,16 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret = -EOPNOTSUPP; goto err_mutex_unlock; } else if (msg[0].addr == 0x10) { + if (msg[0].len < 1) { + ret = -EOPNOTSUPP; + goto err_mutex_unlock; + } /* method 1 - integrated demod */ if (msg[0].buf[0] == 0x00) { + if (msg[0].len < 2) { + ret = -EOPNOTSUPP; + goto err_mutex_unlock; + } /* save demod page for later demod access */ dev->page = msg[0].buf[1]; ret = 0; @@ -231,6 +247,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret = rtl28xxu_ctrl_msg(d, &req); } } else if ((msg[0].len < 23) && (!dev->new_i2c_write)) { + if (msg[0].len < 1) { + ret = -EOPNOTSUPP; + goto err_mutex_unlock; + } /* method 2 - old I2C */ req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1); req.index = CMD_I2C_WR; From patchwork Sat May 13 17:57:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240276 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27050C77B7D for ; Sat, 13 May 2023 17:57:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233528AbjEMR5u (ORCPT ); Sat, 13 May 2023 13:57:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36052 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229482AbjEMR5s (ORCPT ); Sat, 13 May 2023 13:57:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 431591727; Sat, 13 May 2023 10:57:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C821A61BC5; Sat, 13 May 2023 17:57:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F940C4339B; Sat, 13 May 2023 17:57:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=CMDkEplk7SwUbCVMsf6DA2exjxBJ4jdP0rE7gAI0KQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=o6TQx+CtcfUS5lhy76YLTxbGgBg1XLqLr7mHpR+r1daC0tqTcCRDuIHR5Wec1n8XE pW4zncwIT0yFjUNyLqklxkSUU327YpKQ4VR/vKIfwdf7N+HMf4m3koUUJOc7nKjGWr 1EabB5SZvLDktSRZq19KHKybvyHypT8zvAbsWpvgPmpucTwiq5esjkiWAVD9AgN5PA vPzQ31XzDo9DeBGbKNFsPXUrhgTMAHL1otGxT5YEQ1cFSDN+cZ2PKLk18uVazwQ96t cnavQROP72STzUrgHRc6sDuMP8H5KGUmzZvBLiRtkbWTrnVdZs5/6jJ/3Sc2W7AOIw 1pF9YYx5Ub5ZQ== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txn-1G; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Wei Chen , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 08/24] media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() Date: Sat, 13 May 2023 18:57:25 +0100 Message-Id: X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Wei Chen In digitv_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach digitv_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/20230313095008.1039689-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb/digitv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c index 2756815a780b..32134be16914 100644 --- a/drivers/media/usb/dvb-usb/digitv.c +++ b/drivers/media/usb/dvb-usb/digitv.c @@ -63,6 +63,10 @@ static int digitv_i2c_xfer(struct i2c_adapter *adap,struct i2c_msg msg[],int num warn("more than 2 i2c messages at a time is not handled yet. TODO."); for (i = 0; i < num; i++) { + if (msg[i].len < 1) { + i = -EOPNOTSUPP; + break; + } /* write/read request */ if (i+1 < num && (msg[i+1].flags & I2C_M_RD)) { if (digitv_ctrl_msg(d, USB_READ_COFDM, msg[i].buf[0], NULL, 0, From patchwork Sat May 13 17:57:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240275 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BFC1C77B7A for ; Sat, 13 May 2023 17:57:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233033AbjEMR5t (ORCPT ); Sat, 13 May 2023 13:57:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36040 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229473AbjEMR5r (ORCPT ); Sat, 13 May 2023 13:57:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DA94171E; Sat, 13 May 2023 10:57:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A6BC261B63; Sat, 13 May 2023 17:57:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ECB52C433D2; Sat, 13 May 2023 17:57:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=4ClBQusFX5qbjQJdkZxV7kXoxd/BNCXo2EIL6LRfVUs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XsaTnx9umsYFitFXysEcek55CQeQ2z0EWmkTpKI+7Kjfwyn7ni62AfUOOXA2uKnkU V5gprOVVqyi4wMTkdpLCOvgmF4cHu4RSl2yguauMUYiGSUqk8FsODiUb+jgWKfrEXT RYLhE/n4wFQcfIfsIN4nGX2gfbiuKO3SbxhLHv3+sjIc/+FhkOZ+h3ynIXg+drkhQw Mpnsgfuculsd6HgDPMRSp7Zq+PEsI9ykyLk8BFk1UoAqhI0PsjzEPu9Qvm1bbI3xG6 8TFHEEcgert5XqJodMeEPvFl4LZIZC2nEWZZIbZBnShKeKGiVHmP5PtYiQ5gJadZzp Rc4Ue6Oo/TH9Q== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txq-1J; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Wei Chen , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 09/24] media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address Date: Sat, 13 May 2023 18:57:26 +0100 Message-Id: <949b355d0b9233a30bfaf94f43437a14cba495ae.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Wei Chen In su3000_read_mac_address, if i2c_transfer fails to execute two messages, array mac address will not be initialized. Without handling such error, later in function dvb_usb_adapter_dvb_init, proposed_mac is accessed before initialization. Fix this error by returning a negative value if message execution fails. Link: https://lore.kernel.org/linux-media/20230328124416.560889-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb/dw2102.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c index 0ca764282c76..8747960e6146 100644 --- a/drivers/media/usb/dvb-usb/dw2102.c +++ b/drivers/media/usb/dvb-usb/dw2102.c @@ -946,7 +946,7 @@ static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6]) for (i = 0; i < 6; i++) { obuf[1] = 0xf0 + i; if (i2c_transfer(&d->i2c_adap, msg, 2) != 2) - break; + return -1; else mac[i] = ibuf[0]; } From patchwork Sat May 13 17:57:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240293 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B322C77B7A for ; Sat, 13 May 2023 17:58:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230501AbjEMR6X (ORCPT ); Sat, 13 May 2023 13:58:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233204AbjEMR5u (ORCPT ); Sat, 13 May 2023 13:57:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EFE38171E; Sat, 13 May 2023 10:57:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 643A761C1E; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D152C433AC; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=yQfwCtVjVXbhqdFYDDKUyOgpP+XXnDSG6KjAUO86uGc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JTySK0yVWeZE4Ml1TTG2ri+HumyVMW53jX2NPJnp2zj+Tz+tyNfU3EbE6RZ1Hi0nI k1uLz5ylk5RFZF486AVoZ4fBU8NRvcNZ9PB9tFxw+VJ8lWJVFKXFUZEs2YG+hu5QOK pwUYRRebAI7cqHH/n0NHlk+Q7bkVHfFBgOT8h1rfMYMhqCSZh+k9gDrf1HtHfP0HE/ 5vu2yjuyhfPhn8+B7eVuIvMFtg//WikGVkML07Gz/W9lTgJOJkQe0GkRqFNVF5+eiE QpeqFLhEtn2IjhO/hPP8g9oip53r3p9dI6/A4F6muuZHFokNqeESQRGDo55TCLrhk2 y2pzr9woK8E0A== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txt-1M; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Wei Chen , Abylay Ospan , Mauro Carvalho Chehab , Sergey Kozlov , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 10/24] media: netup_unidvb: fix irq init by register it at the end of probe Date: Sat, 13 May 2023 18:57:27 +0100 Message-Id: <615e0136c78dc025a6e8b0033068d7fdc9100d85.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Wei Chen IRQ handler netup_spi_interrupt() takes spinlock spi->lock. The lock is initialized in netup_spi_init(). However, irq handler is registered before initializing the lock. Spinlock dma->lock and i2c->lock suffer from the same problem. Fix this by registering the irq at the end of probe. Link: https://lore.kernel.org/linux-media/20230315134518.1074497-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab --- .../media/pci/netup_unidvb/netup_unidvb_core.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c index aaa1d2dedebd..d85bfbb77a25 100644 --- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c @@ -887,12 +887,7 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev, ndev->lmmio0, (u32)pci_resource_len(pci_dev, 0), ndev->lmmio1, (u32)pci_resource_len(pci_dev, 1), pci_dev->irq); - if (request_irq(pci_dev->irq, netup_unidvb_isr, IRQF_SHARED, - "netup_unidvb", pci_dev) < 0) { - dev_err(&pci_dev->dev, - "%s(): can't get IRQ %d\n", __func__, pci_dev->irq); - goto irq_request_err; - } + ndev->dma_size = 2 * 188 * NETUP_DMA_BLOCKS_COUNT * NETUP_DMA_PACKETS_COUNT; ndev->dma_virt = dma_alloc_coherent(&pci_dev->dev, @@ -933,6 +928,14 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev, dev_err(&pci_dev->dev, "netup_unidvb: DMA setup failed\n"); goto dma_setup_err; } + + if (request_irq(pci_dev->irq, netup_unidvb_isr, IRQF_SHARED, + "netup_unidvb", pci_dev) < 0) { + dev_err(&pci_dev->dev, + "%s(): can't get IRQ %d\n", __func__, pci_dev->irq); + goto dma_setup_err; + } + dev_info(&pci_dev->dev, "netup_unidvb: device has been initialized\n"); return 0; @@ -951,8 +954,6 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev, dma_free_coherent(&pci_dev->dev, ndev->dma_size, ndev->dma_virt, ndev->dma_phys); dma_alloc_err: - free_irq(pci_dev->irq, pci_dev); -irq_request_err: iounmap(ndev->lmmio1); pci_bar1_error: iounmap(ndev->lmmio0); From patchwork Sat May 13 17:57:28 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240280 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 511E4C77B7A for ; Sat, 13 May 2023 17:57:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234163AbjEMR55 (ORCPT ); Sat, 13 May 2023 13:57:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36074 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232990AbjEMR5t (ORCPT ); Sat, 13 May 2023 13:57:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4827C2125; Sat, 13 May 2023 10:57:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CFEFA61B86; Sat, 13 May 2023 17:57:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15BE8C433EF; Sat, 13 May 2023 17:57:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=c6woXOkPTNb3xhZya6YGx5eYYf5xdfTlpr93ZKM/zE8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QkovVvpv5xz93urGKjjc7mHNxj5nsU+noiJ+1XHWxWFRsXK5iNKckcvyfauH3MVai r3ZCGvOB4ua1ez7gV9SALLHWRE7TtAAZ0sqGur5V7ycK7kpMiBF5RexAXv1UmopzS+ GPGGSGR9aERYaEvX4PCt2bcSLFAkNmfE9qr5Mbtu5AlVRmkiwSUSS80/dp9gAsusxx PX+igp7eoPcEiE2J6cZnHPYlLCCz0bWffNFRpCbbH7mOqjjFFHm/HVNTT0W94IjUaP 8TitpBS8eCd9OHi1JIQNJpe1PM/6YrTQOwJs7pJqzbIf1ycayoaQY8lN4/4at/DiYT V9M1KphuqHp4w== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txw-1Q; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: YongSu Yoo , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 11/24] media: dvb_ca_en50221: fix a size write bug Date: Sat, 13 May 2023 18:57:28 +0100 Message-Id: <9548a43e8934564309ae22d35c501073358776b4.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: YongSu Yoo The function of "dvb_ca_en50221_write_data" at source/drivers/media /dvb-core/dvb_ca_en50221.c is used for two cases. The first case is for writing APDU data in the function of "dvb_ca_en50221_io_write" at source/drivers/media/dvb-core/ dvb_ca_en50221.c. The second case is for writing the host link buf size on the Command Register in the function of "dvb_ca_en50221_link_init" at source/drivers/media/dvb-core/dvb_ca_en50221.c. In the second case, there exists a bug like followings. In the function of the "dvb_ca_en50221_link_init", after a TV host calculates the host link buf_size, the TV host writes the calculated host link buf_size on the Size Register. Accroding to the en50221 Spec (the page 60 of https://dvb.org/wp-content/uploads/2020/02/En50221.V1.pdf), before this writing operation, the "SW(CMDREG_SW)" flag in the Command Register should be set. We can see this setting operation in the function of the "dvb_ca_en50221_link_init" like below. ... if ((ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_SW)) != 0) return ret; ... But, after that, the real writing operation is implemented using the function of the "dvb_ca_en50221_write_data" in the function of "dvb_ca_en50221_link_init", and the "dvb_ca_en50221_write_data" includes the function of "ca->pub->write_cam_control", and the function of the "ca->pub->write_cam_control" in the function of the "dvb_ca_en50221_wrte_data" does not include "CMDREG_SW" flag like below. ... if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_HC)) != 0) ... In the above source code, we can see only the "IRQEN | CMDREG_HC", but we cannot see the "CMDREG_SW". The "CMDREG_SW" flag which was set in the function of the "dvb_ca_en50221_link_init" was rollbacked by the follwoing function of the "dvb_ca_en50221_write_data". This is a bug. and this bug causes that the calculated host link buf_size is not properly written in the CI module. Through this patch, we fix this bug. Link: https://lore.kernel.org/linux-media/20220818125027.1131-1-yongsuyoo0215@gmail.com Signed-off-by: YongSu Yoo Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_ca_en50221.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index c2d2792227f8..b6ca29dfb184 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -187,7 +187,7 @@ static void dvb_ca_en50221_thread_wakeup(struct dvb_ca_private *ca); static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, u8 *ebuf, int ecount); static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, - u8 *ebuf, int ecount); + u8 *ebuf, int ecount, int size_write_flag); /** * findstr - Safely find needle in haystack. @@ -370,7 +370,7 @@ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot) ret = dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_FR, HZ / 10); if (ret) return ret; - ret = dvb_ca_en50221_write_data(ca, slot, buf, 2); + ret = dvb_ca_en50221_write_data(ca, slot, buf, 2, CMDREG_SW); if (ret != 2) return -EIO; ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN); @@ -778,11 +778,13 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, * @buf: The data in this buffer is treated as a complete link-level packet to * be written. * @bytes_write: Size of ebuf. + * @size_write_flag: A flag on Command Register which says whether the link size + * information will be writen or not. * * return: Number of bytes written, or < 0 on error. */ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, - u8 *buf, int bytes_write) + u8 *buf, int bytes_write, int size_write_flag) { struct dvb_ca_slot *sl = &ca->slot_info[slot]; int status; @@ -817,7 +819,7 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, /* OK, set HC bit */ status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, - IRQEN | CMDREG_HC); + IRQEN | CMDREG_HC | size_write_flag); if (status) goto exit; @@ -1508,7 +1510,7 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file, mutex_lock(&sl->slot_lock); status = dvb_ca_en50221_write_data(ca, slot, fragbuf, - fraglen + 2); + fraglen + 2, 0); mutex_unlock(&sl->slot_lock); if (status == (fraglen + 2)) { written = 1; From patchwork Sat May 13 17:57:29 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240277 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A03A6C77B7A for ; Sat, 13 May 2023 17:57:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233677AbjEMR5x (ORCPT ); Sat, 13 May 2023 13:57:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36068 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232868AbjEMR5t (ORCPT ); Sat, 13 May 2023 13:57:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3F8EC2D47; Sat, 13 May 2023 10:57:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4387561BD4; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31992C433A7; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=J1xoW9gW0spcZlEaPWtrphQr2z//OomZ0xML5nO1YK0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=raff74dCv9qtXOKIad6sxVVbphnmh3fiAjDaMlT7px1upF5vwUl+g4cBd2kdpDCtD LgDe9/mbg4/3UJt/MTz+Y33ZoORcye+jrvhIrPWoNmxf7EXV2/CdFJp6anMHt9p3Jc /JggJ8JJnF6D/cD/E7R2AbJAbB+Tds/eGJVOUiheqT2el2UJy06mMwkeKpjh5uHJVH 7Hx2l2ktiFCq/EbPUJoiplvBBu3NjWZWZwdwVrRoRGCZwg1uYk8xrIJOmnscbBjC4p YbDMJST5zP2vZlhGs4C0VPkbx18kJ2ArFXdLuwVVHt85xy/3ZMSJ1b+yq6ZlyQw3GZ i5Ly+Af/c0fOw== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001txz-1T; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Hyunwoo Kim , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 12/24] media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() Date: Sat, 13 May 2023 18:57:29 +0100 Message-Id: X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Hyunwoo Kim Since dvb_frontend_detach() is not called in ttusb_dec_exit_dvb(), which is called when the device is disconnected, dvb_frontend_free() is not finally called. This causes a memory leak just by repeatedly plugging and unplugging the device. Fix this issue by adding dvb_frontend_detach() to ttusb_dec_exit_dvb(). Link: https://lore.kernel.org/linux-media/20221117045925.14297-5-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/ttusb-dec/ttusb_dec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c index 38822cedd93a..c4474d4c44e2 100644 --- a/drivers/media/usb/ttusb-dec/ttusb_dec.c +++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c @@ -1544,8 +1544,7 @@ static void ttusb_dec_exit_dvb(struct ttusb_dec *dec) dvb_dmx_release(&dec->demux); if (dec->fe) { dvb_unregister_frontend(dec->fe); - if (dec->fe->ops.release) - dec->fe->ops.release(dec->fe); + dvb_frontend_detach(dec->fe); } dvb_unregister_adapter(&dec->adapter); } From patchwork Sat May 13 17:57:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240285 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5709C7EE24 for ; Sat, 13 May 2023 17:58:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236661AbjEMR6F (ORCPT ); Sat, 13 May 2023 13:58:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36094 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233149AbjEMR5u (ORCPT ); Sat, 13 May 2023 13:57:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 010881727; Sat, 13 May 2023 10:57:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 65CEA61C2A; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3974AC433A4; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=IIMCf/miL10vsMshEbVANxAXddzcrgVpTcdSmeKpZHk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ngsmn7oFxiA3OG+Ap7idnFCNjmCf2BtXuXoo7iQz8Q30O0NdMfZRy0sY1Uv2BYdvf qdj/ChUFigOaadsEd0LMtgso555UePJo7eCO29k1TdPXdVSspkYB2/eQ5WprJkBCI/ klR8GQRuc8cE4lNTnwTjhfLiIJK+0NK9QztTAUIDTLxPHZHIft0CSljLSiVQ8SxoxM cVl2wkQi2HLPwFjPoLT3XHDCJGW27HRMaa+vYzbnUPObULw1S9M/+LQ6yRDEYpWtqI zbo5ky17SSmpUEs4FRQQ/P2A7qpTa+cawQi6ESE7PovgllgvgxW/whbHjGSS9NOQ+b i+bSlWvOizCJw== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001ty2-1X; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Krzysztof Kozlowski , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 13/24] media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table Date: Sat, 13 May 2023 18:57:30 +0100 Message-Id: <9af01d8b5a1dacb369dc966e6c52fe968337098c.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Krzysztof Kozlowski The driver will match mostly by DT table (even thought there is regular ID table) so there is little benefit in of_match_ptr (this also allows ACPI matching via PRP0001, even though it might not be relevant here). This also fixes !CONFIG_OF error: drivers/media/dvb-frontends/mn88443x.c:782:34: error: ‘mn88443x_of_match’ defined but not used [-Werror=unused-const-variable=] Link: https://lore.kernel.org/linux-media/20230312131318.351173-28-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-frontends/mn88443x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/mn88443x.c b/drivers/media/dvb-frontends/mn88443x.c index 1f1753f2ab1a..0782f8377eb2 100644 --- a/drivers/media/dvb-frontends/mn88443x.c +++ b/drivers/media/dvb-frontends/mn88443x.c @@ -798,7 +798,7 @@ MODULE_DEVICE_TABLE(i2c, mn88443x_i2c_id); static struct i2c_driver mn88443x_driver = { .driver = { .name = "mn88443x", - .of_match_table = of_match_ptr(mn88443x_of_match), + .of_match_table = mn88443x_of_match, }, .probe_new = mn88443x_probe, .remove = mn88443x_remove, From patchwork Sat May 13 17:57:31 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240291 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C60FC77B7A for ; Sat, 13 May 2023 17:58:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229482AbjEMR6Q (ORCPT ); Sat, 13 May 2023 13:58:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233590AbjEMR5v (ORCPT ); Sat, 13 May 2023 13:57:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9D8C2D47; Sat, 13 May 2023 10:57:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6A19361C36; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A94CC43442; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=wQLhhjc/nu1gKQyvfutHSjiIwSyWN5kCMhdc5rNzry4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CNaozJB/E/zHWbvpcNPvBHIW0aqcrTtLeI37AkOeiH/20A4MsmVtVRXp3WSsBwqn2 MIrNv2vrL469S3HtuMNcZ+bP3lZrdvVvQxHtQ/TAEVGuEPlRM601PnGW4eZQ87zFx5 O/ckYQuVjqodt/wo/yhI5we7z3xl78C40I//CM4A1I+pakpZHa6/9Sbn5Bn9PBzbib rs26QpXas9fV6/tTTufIMcrp4vZX6FUpV++yNVjeeHBTmPVEXTWxiTsOkbxdWJa0Lv cyecYxPd/PMLKpgkbqegbwfF3o8OYQuT8QBm4yGmpKNMTVVF/X6YxOY6W7aS24+7Cq A8DTz0ulGkI5w== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001ty5-1b; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Hyunwoo Kim , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 14/24] media: dvb-core: Fix use-after-free due to race condition occurring in dvb_frontend Date: Sat, 13 May 2023 18:57:31 +0100 Message-Id: X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Hyunwoo Kim If the device node of dvb_frontend is open() and the device is disconnected, many kinds of UAFs may occur when calling close() on the device node. The root cause of this is that wake_up() for dvbdev->wait_queue is implemented in the dvb_frontend_release() function, but wait_event() is not implemented in the dvb_frontend_stop() function. So, implement wait_event() function in dvb_frontend_stop() and add 'remove_mutex' which prevents race condition for 'fe->exit'. [mchehab: fix a couple of checkpatch warnings] Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_frontend.c | 39 ++++++++++++++++++++++++--- include/media/dvb_frontend.h | 6 ++++- 2 files changed, 40 insertions(+), 5 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index cc0a789f09ae..375eb255df9e 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -809,6 +809,8 @@ static void dvb_frontend_stop(struct dvb_frontend *fe) dev_dbg(fe->dvb->device, "%s:\n", __func__); + mutex_lock(&fe->remove_mutex); + if (fe->exit != DVB_FE_DEVICE_REMOVED) fe->exit = DVB_FE_NORMAL_EXIT; mb(); @@ -818,6 +820,13 @@ static void dvb_frontend_stop(struct dvb_frontend *fe) kthread_stop(fepriv->thread); + mutex_unlock(&fe->remove_mutex); + + if (fepriv->dvbdev->users < -1) { + wait_event(fepriv->dvbdev->wait_queue, + fepriv->dvbdev->users == -1); + } + sema_init(&fepriv->sem, 1); fepriv->state = FESTATE_IDLE; @@ -2761,9 +2770,13 @@ static int dvb_frontend_open(struct inode *inode, struct file *file) struct dvb_adapter *adapter = fe->dvb; int ret; + mutex_lock(&fe->remove_mutex); + dev_dbg(fe->dvb->device, "%s:\n", __func__); - if (fe->exit == DVB_FE_DEVICE_REMOVED) + if (fe->exit == DVB_FE_DEVICE_REMOVED) { + mutex_unlock(&fe->remove_mutex); return -ENODEV; + } if (adapter->mfe_shared == 2) { mutex_lock(&adapter->mfe_lock); @@ -2794,8 +2807,10 @@ static int dvb_frontend_open(struct inode *inode, struct file *file) while (mferetry-- && (mfedev->users != -1 || mfepriv->thread)) { if (msleep_interruptible(500)) { - if (signal_pending(current)) + if (signal_pending(current)) { + mutex_unlock(&fe->remove_mutex); return -EINTR; + } } } @@ -2807,6 +2822,7 @@ static int dvb_frontend_open(struct inode *inode, struct file *file) if (mfedev->users != -1 || mfepriv->thread) { mutex_unlock(&adapter->mfe_lock); + mutex_unlock(&fe->remove_mutex); return -EBUSY; } adapter->mfe_dvbdev = dvbdev; @@ -2866,6 +2882,8 @@ static int dvb_frontend_open(struct inode *inode, struct file *file) if (adapter->mfe_shared) mutex_unlock(&adapter->mfe_lock); + + mutex_unlock(&fe->remove_mutex); return ret; err3: @@ -2887,6 +2905,8 @@ static int dvb_frontend_open(struct inode *inode, struct file *file) err0: if (adapter->mfe_shared) mutex_unlock(&adapter->mfe_lock); + + mutex_unlock(&fe->remove_mutex); return ret; } @@ -2897,6 +2917,8 @@ static int dvb_frontend_release(struct inode *inode, struct file *file) struct dvb_frontend_private *fepriv = fe->frontend_priv; int ret; + mutex_lock(&fe->remove_mutex); + dev_dbg(fe->dvb->device, "%s:\n", __func__); if ((file->f_flags & O_ACCMODE) != O_RDONLY) { @@ -2918,10 +2940,18 @@ static int dvb_frontend_release(struct inode *inode, struct file *file) } mutex_unlock(&fe->dvb->mdev_lock); #endif - if (fe->exit != DVB_FE_NO_EXIT) - wake_up(&dvbdev->wait_queue); if (fe->ops.ts_bus_ctrl) fe->ops.ts_bus_ctrl(fe, 0); + + if (fe->exit != DVB_FE_NO_EXIT) { + mutex_unlock(&fe->remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { + mutex_unlock(&fe->remove_mutex); + } + + } else { + mutex_unlock(&fe->remove_mutex); } dvb_frontend_put(fe); @@ -3022,6 +3052,7 @@ int dvb_register_frontend(struct dvb_adapter *dvb, fepriv = fe->frontend_priv; kref_init(&fe->refcount); + mutex_init(&fe->remove_mutex); /* * After initialization, there need to be two references: one diff --git a/include/media/dvb_frontend.h b/include/media/dvb_frontend.h index e7c44870f20d..367d5381217b 100644 --- a/include/media/dvb_frontend.h +++ b/include/media/dvb_frontend.h @@ -686,7 +686,10 @@ struct dtv_frontend_properties { * @id: Frontend ID * @exit: Used to inform the DVB core that the frontend * thread should exit (usually, means that the hardware - * got disconnected. + * got disconnected). + * @remove_mutex: mutex that avoids a race condition between a callback + * called when the hardware is disconnected and the + * file_operations of dvb_frontend. */ struct dvb_frontend { @@ -704,6 +707,7 @@ struct dvb_frontend { int (*callback)(void *adapter_priv, int component, int cmd, int arg); int id; unsigned int exit; + struct mutex remove_mutex; }; /** From patchwork Sat May 13 17:57:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240289 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F6D3C77B7D for ; Sat, 13 May 2023 17:58:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236997AbjEMR6M (ORCPT ); Sat, 13 May 2023 13:58:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36092 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233655AbjEMR5w (ORCPT ); Sat, 13 May 2023 13:57:52 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 515F7171E; Sat, 13 May 2023 10:57:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D592761D18; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A555C43321; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=PXB8g8OwRVp5vTtA+di89yda0JZvQHWqqIcZtmTI8Cs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=csGG/ewUYTt9aedR/ML62VAPd2h9WyQnXTnYgQTfBw5QoJtR/u2cA4SmkfKZbm00i 2Gi8UH6YigeS9I8r4rrK+kM6wwRMRAIEBL1SDqfWpdPBMSk+/mPZhe/9tSax0YDQcL NcJoW+567qPtMJx/ObJXB7pixDObMGdfYcw+b7q5Bs0axkg1RKTq7pTWugeeRwA9KO h7IXTC9VPeQulLgmKQP8K1q83kB7aKbpBXddgvzZIlm7Iv7hn5KXThRpxRSUF37mMq Zcg6lRbkYJ4c/nkNY0gMVeDx8Tspa7m6SndqUZgN0WalqdqT7oRJZu+toW+Bo5+RvW nPIhEvemRFEgQ== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001ty8-1e; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Hyunwoo Kim , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 15/24] media: dvb-core: Fix use-after-free due to race condition occurring in dvb_net Date: Sat, 13 May 2023 18:57:32 +0100 Message-Id: <1ae42fd55196b955283f6884f87d77607f588d45.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Hyunwoo Kim A race condition may occur between the .disconnect function, which is called when the device is disconnected, and the dvb_device_open() function, which is called when the device node is open()ed. This results in several types of UAFs. The root cause of this is that you use the dvb_device_open() function, which does not implement a conditional statement that checks 'dvbnet->exit'. So, add 'remove_mutex` to protect 'dvbnet->exit' and use locked_dvb_net_open() function to check 'dvbnet->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221117045925.14297-3-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_net.c | 38 +++++++++++++++++++++++++++++--- include/media/dvb_net.h | 4 ++++ 2 files changed, 39 insertions(+), 3 deletions(-) diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c index 8a2febf33ce2..8bb8dd34c223 100644 --- a/drivers/media/dvb-core/dvb_net.c +++ b/drivers/media/dvb-core/dvb_net.c @@ -1564,15 +1564,43 @@ static long dvb_net_ioctl(struct file *file, return dvb_usercopy(file, cmd, arg, dvb_net_do_ioctl); } +static int locked_dvb_net_open(struct inode *inode, struct file *file) +{ + struct dvb_device *dvbdev = file->private_data; + struct dvb_net *dvbnet = dvbdev->priv; + int ret; + + if (mutex_lock_interruptible(&dvbnet->remove_mutex)) + return -ERESTARTSYS; + + if (dvbnet->exit) { + mutex_unlock(&dvbnet->remove_mutex); + return -ENODEV; + } + + ret = dvb_generic_open(inode, file); + + mutex_unlock(&dvbnet->remove_mutex); + + return ret; +} + static int dvb_net_close(struct inode *inode, struct file *file) { struct dvb_device *dvbdev = file->private_data; struct dvb_net *dvbnet = dvbdev->priv; + mutex_lock(&dvbnet->remove_mutex); + dvb_generic_release(inode, file); - if(dvbdev->users == 1 && dvbnet->exit == 1) + if (dvbdev->users == 1 && dvbnet->exit == 1) { + mutex_unlock(&dvbnet->remove_mutex); wake_up(&dvbdev->wait_queue); + } else { + mutex_unlock(&dvbnet->remove_mutex); + } + return 0; } @@ -1580,7 +1608,7 @@ static int dvb_net_close(struct inode *inode, struct file *file) static const struct file_operations dvb_net_fops = { .owner = THIS_MODULE, .unlocked_ioctl = dvb_net_ioctl, - .open = dvb_generic_open, + .open = locked_dvb_net_open, .release = dvb_net_close, .llseek = noop_llseek, }; @@ -1599,10 +1627,13 @@ void dvb_net_release (struct dvb_net *dvbnet) { int i; + mutex_lock(&dvbnet->remove_mutex); dvbnet->exit = 1; + mutex_unlock(&dvbnet->remove_mutex); + if (dvbnet->dvbdev->users < 1) wait_event(dvbnet->dvbdev->wait_queue, - dvbnet->dvbdev->users==1); + dvbnet->dvbdev->users == 1); dvb_unregister_device(dvbnet->dvbdev); @@ -1621,6 +1652,7 @@ int dvb_net_init (struct dvb_adapter *adap, struct dvb_net *dvbnet, int i; mutex_init(&dvbnet->ioctl_mutex); + mutex_init(&dvbnet->remove_mutex); dvbnet->demux = dmx; for (i=0; i X-Patchwork-Id: 13240296 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9AAECC7EE26 for ; Sat, 13 May 2023 17:58:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233142AbjEMR63 (ORCPT ); Sat, 13 May 2023 13:58:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36180 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229473AbjEMR5x (ORCPT ); Sat, 13 May 2023 13:57:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 910611727; Sat, 13 May 2023 10:57:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 375E961D23; Sat, 13 May 2023 17:57:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 55FE4C4331E; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=dgB14+iz6FbPYgmVWLZVRDLBjVluOaQjs5SXz28xSko=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dOp47qDJu/oFfuHqjzRxy5uF8Fp8ByE0imV/mhAKXO4/RuyIN+FQhDgESZyMGlYyS b/21hzXl1Tmk3mW2YAdUwHU4WVShiL1ncyBKbdYa2rnKZY1Lcav6nN5pNAQ0Va2uup FUvCxL1TTAcBNf8fA0XBbZ0QvBlf5T4cZWy7i7zZfBP973ulutVB2z5mVW/lbVFcqD o3q2uUnl5XWl7nxBSUKhWSDHWR0GsCyIyWwiMeO8bhvosJ1Im3TE+Jl8Uio1TUASfB DwVnNzMgbDNukXeh3uSL041hcbgjLkIz4qTcjN+2rklYODTzQMsp7S+T0CBPId+ubJ gBOTKst61IuCg== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001tyB-1h; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Hyunwoo Kim , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, kernel test robot , Dan Carpenter Subject: [PATCH 16/24] media: dvb-core: Fix use-after-free due to race condition occurring in dvb_register_device() Date: Sat, 13 May 2023 18:57:33 +0100 Message-Id: X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Hyunwoo Kim dvb_register_device() dynamically allocates fops with kmemdup() to set the fops->owner. And these fops are registered in 'file->f_ops' using replace_fops() in the dvb_device_open() process, and kfree()d in dvb_free_device(). However, it is not common to use dynamically allocated fops instead of 'static const' fops as an argument of replace_fops(), and UAF may occur. These UAFs can occur on any dvb type using dvb_register_device(), such as dvb_dvr, dvb_demux, dvb_frontend, dvb_net, etc. So, instead of kfree() the fops dynamically allocated in dvb_register_device() in dvb_free_device() called during the .disconnect() process, kfree() it collectively in exit_dvbdev() called when the dvbdev.c module is removed. Link: https://lore.kernel.org/linux-media/20221117045925.14297-4-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvbdev.c | 84 ++++++++++++++++++++++++--------- include/media/dvbdev.h | 15 ++++++ 2 files changed, 78 insertions(+), 21 deletions(-) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index e9b3ce09e534..a4b05e366ccc 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -27,6 +27,7 @@ #include static DEFINE_MUTEX(dvbdev_mutex); +static LIST_HEAD(dvbdevfops_list); static int dvbdev_debug; module_param(dvbdev_debug, int, 0644); @@ -453,14 +454,15 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, enum dvb_device_type type, int demux_sink_pads) { struct dvb_device *dvbdev; - struct file_operations *dvbdevfops; + struct file_operations *dvbdevfops = NULL; + struct dvbdevfops_node *node = NULL, *new_node = NULL; struct device *clsdev; int minor; int id, ret; mutex_lock(&dvbdev_register_lock); - if ((id = dvbdev_get_free_id (adap, type)) < 0){ + if ((id = dvbdev_get_free_id (adap, type)) < 0) { mutex_unlock(&dvbdev_register_lock); *pdvbdev = NULL; pr_err("%s: couldn't find free device id\n", __func__); @@ -468,18 +470,45 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, } *pdvbdev = dvbdev = kzalloc(sizeof(*dvbdev), GFP_KERNEL); - if (!dvbdev){ mutex_unlock(&dvbdev_register_lock); return -ENOMEM; } - dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL); + /* + * When a device of the same type is probe()d more than once, + * the first allocated fops are used. This prevents memory leaks + * that can occur when the same device is probe()d repeatedly. + */ + list_for_each_entry(node, &dvbdevfops_list, list_head) { + if (node->fops->owner == adap->module && + node->type == type && + node->template == template) { + dvbdevfops = node->fops; + break; + } + } - if (!dvbdevfops){ - kfree (dvbdev); - mutex_unlock(&dvbdev_register_lock); - return -ENOMEM; + if (dvbdevfops == NULL) { + dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL); + if (!dvbdevfops) { + kfree(dvbdev); + mutex_unlock(&dvbdev_register_lock); + return -ENOMEM; + } + + new_node = kzalloc(sizeof(struct dvbdevfops_node), GFP_KERNEL); + if (!new_node) { + kfree(dvbdevfops); + kfree(dvbdev); + mutex_unlock(&dvbdev_register_lock); + return -ENOMEM; + } + + new_node->fops = dvbdevfops; + new_node->type = type; + new_node->template = template; + list_add_tail (&new_node->list_head, &dvbdevfops_list); } memcpy(dvbdev, template, sizeof(struct dvb_device)); @@ -490,20 +519,20 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvbdev->priv = priv; dvbdev->fops = dvbdevfops; init_waitqueue_head (&dvbdev->wait_queue); - dvbdevfops->owner = adap->module; - list_add_tail (&dvbdev->list_head, &adap->device_list); - down_write(&minor_rwsem); #ifdef CONFIG_DVB_DYNAMIC_MINORS for (minor = 0; minor < MAX_DVB_MINORS; minor++) if (dvb_minors[minor] == NULL) break; - if (minor == MAX_DVB_MINORS) { + if (new_node) { + list_del (&new_node->list_head); + kfree(dvbdevfops); + kfree(new_node); + } list_del (&dvbdev->list_head); - kfree(dvbdevfops); kfree(dvbdev); up_write(&minor_rwsem); mutex_unlock(&dvbdev_register_lock); @@ -512,41 +541,47 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, #else minor = nums2minor(adap->num, type, id); #endif - dvbdev->minor = minor; dvb_minors[minor] = dvb_device_get(dvbdev); up_write(&minor_rwsem); - ret = dvb_register_media_device(dvbdev, type, minor, demux_sink_pads); if (ret) { pr_err("%s: dvb_register_media_device failed to create the mediagraph\n", __func__); - + if (new_node) { + list_del (&new_node->list_head); + kfree(dvbdevfops); + kfree(new_node); + } dvb_media_device_free(dvbdev); list_del (&dvbdev->list_head); - kfree(dvbdevfops); kfree(dvbdev); mutex_unlock(&dvbdev_register_lock); return ret; } - mutex_unlock(&dvbdev_register_lock); - clsdev = device_create(dvb_class, adap->device, MKDEV(DVB_MAJOR, minor), dvbdev, "dvb%d.%s%d", adap->num, dnames[type], id); if (IS_ERR(clsdev)) { pr_err("%s: failed to create device dvb%d.%s%d (%ld)\n", __func__, adap->num, dnames[type], id, PTR_ERR(clsdev)); + if (new_node) { + list_del (&new_node->list_head); + kfree(dvbdevfops); + kfree(new_node); + } dvb_media_device_free(dvbdev); list_del (&dvbdev->list_head); - kfree(dvbdevfops); kfree(dvbdev); + mutex_unlock(&dvbdev_register_lock); return PTR_ERR(clsdev); } + dprintk("DVB: register adapter%d/%s%d @ minor: %i (0x%02x)\n", adap->num, dnames[type], id, minor, minor); + mutex_unlock(&dvbdev_register_lock); return 0; } EXPORT_SYMBOL(dvb_register_device); @@ -575,7 +610,6 @@ static void dvb_free_device(struct kref *ref) { struct dvb_device *dvbdev = container_of(ref, struct dvb_device, ref); - kfree (dvbdev->fops); kfree (dvbdev); } @@ -1081,9 +1115,17 @@ static int __init init_dvbdev(void) static void __exit exit_dvbdev(void) { + struct dvbdevfops_node *node, *next; + class_destroy(dvb_class); cdev_del(&dvb_device_cdev); unregister_chrdev_region(MKDEV(DVB_MAJOR, 0), MAX_DVB_MINORS); + + list_for_each_entry_safe(node, next, &dvbdevfops_list, list_head) { + list_del (&node->list_head); + kfree(node->fops); + kfree(node); + } } subsys_initcall(init_dvbdev); diff --git a/include/media/dvbdev.h b/include/media/dvbdev.h index 29d25c8a6f13..8958e5e2fc5b 100644 --- a/include/media/dvbdev.h +++ b/include/media/dvbdev.h @@ -193,6 +193,21 @@ struct dvb_device { void *priv; }; +/** + * struct dvbdevfops_node - fops nodes registered in dvbdevfops_list + * + * @fops: Dynamically allocated fops for ->owner registration + * @type: type of dvb_device + * @template: dvb_device used for registration + * @list_head: list_head for dvbdevfops_list + */ +struct dvbdevfops_node { + struct file_operations *fops; + enum dvb_device_type type; + const struct dvb_device *template; + struct list_head list_head; +}; + /** * dvb_device_get - Increase dvb_device reference * From patchwork Sat May 13 17:57:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240283 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82097C77B7D for ; Sat, 13 May 2023 17:58:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236090AbjEMR6C (ORCPT ); Sat, 13 May 2023 13:58:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233454AbjEMR5u (ORCPT ); Sat, 13 May 2023 13:57:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A0E7F2D4D; Sat, 13 May 2023 10:57:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 728A561C67; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 611CAC43322; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=dFOoold9GKTSodC+PeDDguWht9y1iSueQLSe4Te7lpM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iSXnl6RIk6AtZkklDEBkULpy2HWbFsa4N09S318WdiYOaEOgJK43Uf+lxUnu1Oxvk /1YTblZ0cNO0wK8Vt0AmaemcjJZOpMsR+a+mgeWwNE4bIUaESRn/dQE3Czl5M5J7Xn BfYPTus6nH1Zsn9kgBQKCTE+6pXXoF1sVZR48cNZT86gbDn5hvef5kx4aQMHV3eq9J P/Ek5Osvj/etg2UYyABrhJeuXVI99Texte2DCixu/Yyzpxqb6GY5bK2Ewvs2Ol1310 xMjseJfxO3Ml1nbVSlj+GAeO6qSJ6CwnvzxEWEIO5PZCjED7N+6r6mk4IO7T3khL9c ZcFdrkjl/G90A== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001tyE-1l; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Takashi Iwai , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, Yu Hao Subject: [PATCH 17/24] media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() Date: Sat, 13 May 2023 18:57:34 +0100 Message-Id: <7a9e7df217675449e47c752bbbe5455252e6d2cb.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Takashi Iwai Using a semaphore in the wait_event*() condition is no good idea. It hits a kernel WARN_ON() at prepare_to_wait_event() like: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait_event+0x6d/0x690 For avoiding the potential deadlock, rewrite to an open-coded loop instead. Unlike the loop in wait_event*(), this uses wait_woken() after the condition check, hence the task state stays consistent. CVE-2023-31084 was assigned to this bug. Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/ Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@suse.de Reported-by: Yu Hao Signed-off-by: Takashi Iwai Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_frontend.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index 375eb255df9e..461f5b49ae0e 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -293,14 +293,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe, } if (events->eventw == events->eventr) { - int ret; + struct wait_queue_entry wait; + int ret = 0; if (flags & O_NONBLOCK) return -EWOULDBLOCK; - ret = wait_event_interruptible(events->wait_queue, - dvb_frontend_test_event(fepriv, events)); - + init_waitqueue_entry(&wait, current); + add_wait_queue(&events->wait_queue, &wait); + while (!dvb_frontend_test_event(fepriv, events)) { + wait_woken(&wait, TASK_INTERRUPTIBLE, 0); + if (signal_pending(current)) { + ret = -ERESTARTSYS; + break; + } + } + remove_wait_queue(&events->wait_queue, &wait); if (ret < 0) return ret; } From patchwork Sat May 13 17:57:35 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240295 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5ED49C77B7A for ; Sat, 13 May 2023 17:58:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237293AbjEMR62 (ORCPT ); Sat, 13 May 2023 13:58:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233748AbjEMR5x (ORCPT ); Sat, 13 May 2023 13:57:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3CB6C2125; Sat, 13 May 2023 10:57:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9C4AD61CE4; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D2A3C43324; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=u9kFggnQr7LxDCGoBJEsqutlWdxLNmjiS8oxIp04Bi0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jhi9BQd7V17leMQ1zYh9SV53benuySIO1sOsNLiVW4v3Mradzm5ycJtcfj7UwZb8k ubTpgIohNug1KedyKV4jBZD67BTCkguarXT8nJyo4aBo6Ulg7I/7Igu1exc06MT+4h 9TzNt/8Q0ZfIe7IVSl/OXbUi7uoToXgS8XfVkpDcBwbwFe8jQ1IrF1XPVQdBwvuXiw tOOr0wLtlX4rKO/9jh87PI4X7MIR/P/Mf4ZuRKl+CKnfxAVHvLRgiN8EEU94g9PAhh 0xUmatu8QawxBdDEVjpvEXcYFfEtaIaCKbNj0bCdVxxG1dWnPfMwMO7T4vpO9nS07e xMh4jW3XfmGmQ== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001tyH-1o; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 18/24] media: dvbdev: fix most coding style issues Date: Sat, 13 May 2023 18:57:35 +0100 Message-Id: <8dfc633c041c038631085cb02d8aac619ee647c9.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org As we're doing several changes here, address coding style issues, as reported by checkpatch.pl. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvbdev.c | 157 +++++++++++++++----------------- 1 file changed, 74 insertions(+), 83 deletions(-) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index a4b05e366ccc..fb81fa46d92e 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -61,21 +61,21 @@ static const char * const dnames[] = { #define DVB_MAX_IDS 4 static const u8 minor_type[] = { - [DVB_DEVICE_VIDEO] = 0, - [DVB_DEVICE_AUDIO] = 1, - [DVB_DEVICE_SEC] = 2, - [DVB_DEVICE_FRONTEND] = 3, - [DVB_DEVICE_DEMUX] = 4, - [DVB_DEVICE_DVR] = 5, - [DVB_DEVICE_CA] = 6, - [DVB_DEVICE_NET] = 7, - [DVB_DEVICE_OSD] = 8, + [DVB_DEVICE_VIDEO] = 0, + [DVB_DEVICE_AUDIO] = 1, + [DVB_DEVICE_SEC] = 2, + [DVB_DEVICE_FRONTEND] = 3, + [DVB_DEVICE_DEMUX] = 4, + [DVB_DEVICE_DVR] = 5, + [DVB_DEVICE_CA] = 6, + [DVB_DEVICE_NET] = 7, + [DVB_DEVICE_OSD] = 8, }; #define nums2minor(num, type, id) \ - (((num) << 6) | ((id) << 4) | minor_type[type]) + (((num) << 6) | ((id) << 4) | minor_type[type]) -#define MAX_DVB_MINORS (DVB_MAX_ADAPTERS*64) +#define MAX_DVB_MINORS (DVB_MAX_ADAPTERS * 64) #endif static struct class *dvb_class; @@ -112,9 +112,7 @@ static int dvb_device_open(struct inode *inode, struct file *file) return -ENODEV; } - -static const struct file_operations dvb_device_fops = -{ +static const struct file_operations dvb_device_fops = { .owner = THIS_MODULE, .open = dvb_device_open, .llseek = noop_llseek, @@ -147,7 +145,6 @@ int dvb_generic_open(struct inode *inode, struct file *file) } EXPORT_SYMBOL(dvb_generic_open); - int dvb_generic_release(struct inode *inode, struct file *file) { struct dvb_device *dvbdev = file->private_data; @@ -155,11 +152,10 @@ int dvb_generic_release(struct inode *inode, struct file *file) if (!dvbdev) return -ENODEV; - if ((file->f_flags & O_ACCMODE) == O_RDONLY) { + if ((file->f_flags & O_ACCMODE) == O_RDONLY) dvbdev->readers++; - } else { + else dvbdev->writers++; - } dvbdev->users++; @@ -169,7 +165,6 @@ int dvb_generic_release(struct inode *inode, struct file *file) } EXPORT_SYMBOL(dvb_generic_release); - long dvb_generic_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { @@ -185,13 +180,13 @@ long dvb_generic_ioctl(struct file *file, } EXPORT_SYMBOL(dvb_generic_ioctl); - -static int dvbdev_get_free_id (struct dvb_adapter *adap, int type) +static int dvbdev_get_free_id(struct dvb_adapter *adap, int type) { u32 id = 0; while (id < DVB_MAX_IDS) { struct dvb_device *dev; + list_for_each_entry(dev, &adap->device_list, list_head) if (dev->type == type && dev->id == id) goto skip; @@ -245,7 +240,7 @@ static void dvb_media_device_free(struct dvb_device *dvbdev) #if defined(CONFIG_MEDIA_CONTROLLER_DVB) static int dvb_create_tsout_entity(struct dvb_device *dvbdev, - const char *name, int npads) + const char *name, int npads) { int i; @@ -387,7 +382,7 @@ static int dvb_create_media_entity(struct dvb_device *dvbdev, static int dvb_register_media_device(struct dvb_device *dvbdev, int type, int minor, - unsigned demux_sink_pads) + unsigned int demux_sink_pads) { #if defined(CONFIG_MEDIA_CONTROLLER_DVB) struct media_link *link; @@ -462,7 +457,8 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, mutex_lock(&dvbdev_register_lock); - if ((id = dvbdev_get_free_id (adap, type)) < 0) { + id = dvbdev_get_free_id(adap, type); + if (id < 0) { mutex_unlock(&dvbdev_register_lock); *pdvbdev = NULL; pr_err("%s: couldn't find free device id\n", __func__); @@ -470,7 +466,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, } *pdvbdev = dvbdev = kzalloc(sizeof(*dvbdev), GFP_KERNEL); - if (!dvbdev){ + if (!dvbdev) { mutex_unlock(&dvbdev_register_lock); return -ENOMEM; } @@ -482,14 +478,13 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, */ list_for_each_entry(node, &dvbdevfops_list, list_head) { if (node->fops->owner == adap->module && - node->type == type && - node->template == template) { + node->type == type && node->template == template) { dvbdevfops = node->fops; break; } } - if (dvbdevfops == NULL) { + if (!dvbdevfops) { dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL); if (!dvbdevfops) { kfree(dvbdev); @@ -497,7 +492,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, return -ENOMEM; } - new_node = kzalloc(sizeof(struct dvbdevfops_node), GFP_KERNEL); + new_node = kzalloc(sizeof(*new_node), GFP_KERNEL); if (!new_node) { kfree(dvbdevfops); kfree(dvbdev); @@ -508,7 +503,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, new_node->fops = dvbdevfops; new_node->type = type; new_node->template = template; - list_add_tail (&new_node->list_head, &dvbdevfops_list); + list_add_tail(&new_node->list_head, &dvbdevfops_list); } memcpy(dvbdev, template, sizeof(struct dvb_device)); @@ -518,21 +513,21 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvbdev->adapter = adap; dvbdev->priv = priv; dvbdev->fops = dvbdevfops; - init_waitqueue_head (&dvbdev->wait_queue); + init_waitqueue_head(&dvbdev->wait_queue); dvbdevfops->owner = adap->module; - list_add_tail (&dvbdev->list_head, &adap->device_list); + list_add_tail(&dvbdev->list_head, &adap->device_list); down_write(&minor_rwsem); #ifdef CONFIG_DVB_DYNAMIC_MINORS for (minor = 0; minor < MAX_DVB_MINORS; minor++) - if (dvb_minors[minor] == NULL) + if (!dvb_minors[minor]) break; if (minor == MAX_DVB_MINORS) { if (new_node) { - list_del (&new_node->list_head); + list_del(&new_node->list_head); kfree(dvbdevfops); kfree(new_node); } - list_del (&dvbdev->list_head); + list_del(&dvbdev->list_head); kfree(dvbdev); up_write(&minor_rwsem); mutex_unlock(&dvbdev_register_lock); @@ -547,14 +542,14 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, ret = dvb_register_media_device(dvbdev, type, minor, demux_sink_pads); if (ret) { pr_err("%s: dvb_register_media_device failed to create the mediagraph\n", - __func__); + __func__); if (new_node) { - list_del (&new_node->list_head); + list_del(&new_node->list_head); kfree(dvbdevfops); kfree(new_node); } dvb_media_device_free(dvbdev); - list_del (&dvbdev->list_head); + list_del(&dvbdev->list_head); kfree(dvbdev); mutex_unlock(&dvbdev_register_lock); return ret; @@ -567,12 +562,12 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, pr_err("%s: failed to create device dvb%d.%s%d (%ld)\n", __func__, adap->num, dnames[type], id, PTR_ERR(clsdev)); if (new_node) { - list_del (&new_node->list_head); + list_del(&new_node->list_head); kfree(dvbdevfops); kfree(new_node); } dvb_media_device_free(dvbdev); - list_del (&dvbdev->list_head); + list_del(&dvbdev->list_head); kfree(dvbdev); mutex_unlock(&dvbdev_register_lock); return PTR_ERR(clsdev); @@ -586,7 +581,6 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, } EXPORT_SYMBOL(dvb_register_device); - void dvb_remove_device(struct dvb_device *dvbdev) { if (!dvbdev) @@ -601,19 +595,17 @@ void dvb_remove_device(struct dvb_device *dvbdev) device_destroy(dvb_class, MKDEV(DVB_MAJOR, dvbdev->minor)); - list_del (&dvbdev->list_head); + list_del(&dvbdev->list_head); } EXPORT_SYMBOL(dvb_remove_device); - static void dvb_free_device(struct kref *ref) { struct dvb_device *dvbdev = container_of(ref, struct dvb_device, ref); - kfree (dvbdev); + kfree(dvbdev); } - struct dvb_device *dvb_device_get(struct dvb_device *dvbdev) { kref_get(&dvbdev->ref); @@ -621,14 +613,12 @@ struct dvb_device *dvb_device_get(struct dvb_device *dvbdev) } EXPORT_SYMBOL(dvb_device_get); - void dvb_device_put(struct dvb_device *dvbdev) { if (dvbdev) kref_put(&dvbdev->ref, dvb_free_device); } - void dvb_unregister_device(struct dvb_device *dvbdev) { dvb_remove_device(dvbdev); @@ -636,7 +626,6 @@ void dvb_unregister_device(struct dvb_device *dvbdev) } EXPORT_SYMBOL(dvb_unregister_device); - #ifdef CONFIG_MEDIA_CONTROLLER_DVB static int dvb_create_io_intf_links(struct dvb_adapter *adap, @@ -669,9 +658,9 @@ int dvb_create_media_graph(struct dvb_adapter *adap, struct media_entity *demux = NULL, *ca = NULL; struct media_link *link; struct media_interface *intf; - unsigned demux_pad = 0; - unsigned dvr_pad = 0; - unsigned ntuner = 0, ndemod = 0; + unsigned int demux_pad = 0; + unsigned int dvr_pad = 0; + unsigned int ntuner = 0, ndemod = 0; int ret, pad_source, pad_sink; static const char *connector_name = "Television"; @@ -795,18 +784,18 @@ int dvb_create_media_graph(struct dvb_adapter *adap, media_device_for_each_entity(entity, mdev) { if (entity->function == MEDIA_ENT_F_IO_DTV) { if (!strncmp(entity->name, DVR_TSOUT, - strlen(DVR_TSOUT))) { + strlen(DVR_TSOUT))) { ret = media_create_pad_link(demux, - ++dvr_pad, - entity, 0, 0); + ++dvr_pad, + entity, 0, 0); if (ret) return ret; } if (!strncmp(entity->name, DEMUX_TSOUT, - strlen(DEMUX_TSOUT))) { + strlen(DEMUX_TSOUT))) { ret = media_create_pad_link(demux, - ++demux_pad, - entity, 0, 0); + ++demux_pad, + entity, 0, 0); if (ret) return ret; } @@ -864,8 +853,10 @@ EXPORT_SYMBOL_GPL(dvb_create_media_graph); static int dvbdev_check_free_adapter_num(int num) { struct list_head *entry; + list_for_each(entry, &dvb_adapter_list) { struct dvb_adapter *adap; + adap = list_entry(entry, struct dvb_adapter, list_head); if (adap->num == num) return 0; @@ -873,7 +864,7 @@ static int dvbdev_check_free_adapter_num(int num) return 1; } -static int dvbdev_get_free_adapter_num (void) +static int dvbdev_get_free_adapter_num(void) { int num = 0; @@ -886,7 +877,6 @@ static int dvbdev_get_free_adapter_num (void) return -ENFILE; } - int dvb_register_adapter(struct dvb_adapter *adap, const char *name, struct module *module, struct device *device, short *adapter_nums) @@ -913,8 +903,8 @@ int dvb_register_adapter(struct dvb_adapter *adap, const char *name, return -ENFILE; } - memset (adap, 0, sizeof(struct dvb_adapter)); - INIT_LIST_HEAD (&adap->device_list); + memset(adap, 0, sizeof(struct dvb_adapter)); + INIT_LIST_HEAD(&adap->device_list); pr_info("DVB: registering new adapter (%s)\n", name); @@ -924,13 +914,13 @@ int dvb_register_adapter(struct dvb_adapter *adap, const char *name, adap->device = device; adap->mfe_shared = 0; adap->mfe_dvbdev = NULL; - mutex_init (&adap->mfe_lock); + mutex_init(&adap->mfe_lock); #ifdef CONFIG_MEDIA_CONTROLLER_DVB mutex_init(&adap->mdev_lock); #endif - list_add_tail (&adap->list_head, &dvb_adapter_list); + list_add_tail(&adap->list_head, &dvb_adapter_list); mutex_unlock(&dvbdev_register_lock); @@ -938,25 +928,26 @@ int dvb_register_adapter(struct dvb_adapter *adap, const char *name, } EXPORT_SYMBOL(dvb_register_adapter); - int dvb_unregister_adapter(struct dvb_adapter *adap) { mutex_lock(&dvbdev_register_lock); - list_del (&adap->list_head); + list_del(&adap->list_head); mutex_unlock(&dvbdev_register_lock); return 0; } EXPORT_SYMBOL(dvb_unregister_adapter); -/* if the miracle happens and "generic_usercopy()" is included into - the kernel, then this can vanish. please don't make the mistake and - define this as video_usercopy(). this will introduce a dependency - to the v4l "videodev.o" module, which is unnecessary for some - cards (ie. the budget dvb-cards don't need the v4l module...) */ +/* + * if the miracle happens and "generic_usercopy()" is included into + * the kernel, then this can vanish. please don't make the mistake and + * define this as video_usercopy(). this will introduce a dependency + * to the v4l "videodev.o" module, which is unnecessary for some + * cards (ie. the budget dvb-cards don't need the v4l module...) + */ int dvb_usercopy(struct file *file, - unsigned int cmd, unsigned long arg, - int (*func)(struct file *file, - unsigned int cmd, void *arg)) + unsigned int cmd, unsigned long arg, + int (*func)(struct file *file, + unsigned int cmd, void *arg)) { char sbuf[128]; void *mbuf = NULL; @@ -970,7 +961,7 @@ int dvb_usercopy(struct file *file, * For this command, the pointer is actually an integer * argument. */ - parg = (void *) arg; + parg = (void *)arg; break; case _IOC_READ: /* some v4l ioctls are marked wrong ... */ case _IOC_WRITE: @@ -980,7 +971,7 @@ int dvb_usercopy(struct file *file, } else { /* too big to allocate from stack */ mbuf = kmalloc(_IOC_SIZE(cmd), GFP_KERNEL); - if (NULL == mbuf) + if (!mbuf) return -ENOMEM; parg = mbuf; } @@ -992,15 +983,15 @@ int dvb_usercopy(struct file *file, } /* call driver */ - if ((err = func(file, cmd, parg)) == -ENOIOCTLCMD) + err = func(file, cmd, parg); + if (err == -ENOIOCTLCMD) err = -ENOTTY; if (err < 0) goto out; /* Copy results into user buffer */ - switch (_IOC_DIR(cmd)) - { + switch (_IOC_DIR(cmd)) { case _IOC_READ: case (_IOC_WRITE | _IOC_READ): if (copy_to_user((void __user *)arg, parg, _IOC_SIZE(cmd))) @@ -1080,19 +1071,20 @@ static char *dvb_devnode(const struct device *dev, umode_t *mode) dvbdev->adapter->num, dnames[dvbdev->type], dvbdev->id); } - static int __init init_dvbdev(void) { int retval; dev_t dev = MKDEV(DVB_MAJOR, 0); - if ((retval = register_chrdev_region(dev, MAX_DVB_MINORS, "DVB")) != 0) { + retval = register_chrdev_region(dev, MAX_DVB_MINORS, "DVB"); + if (retval != 0) { pr_err("dvb-core: unable to get major %d\n", DVB_MAJOR); return retval; } cdev_init(&dvb_device_cdev, &dvb_device_fops); - if ((retval = cdev_add(&dvb_device_cdev, dev, MAX_DVB_MINORS)) != 0) { + retval = cdev_add(&dvb_device_cdev, dev, MAX_DVB_MINORS); + if (retval != 0) { pr_err("dvb-core: unable register character device\n"); goto error; } @@ -1112,7 +1104,6 @@ static int __init init_dvbdev(void) return retval; } - static void __exit exit_dvbdev(void) { struct dvbdevfops_node *node, *next; @@ -1122,7 +1113,7 @@ static void __exit exit_dvbdev(void) unregister_chrdev_region(MKDEV(DVB_MAJOR, 0), MAX_DVB_MINORS); list_for_each_entry_safe(node, next, &dvbdevfops_list, list_head) { - list_del (&node->list_head); + list_del(&node->list_head); kfree(node->fops); kfree(node); } From patchwork Sat May 13 17:57:36 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240287 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 58F38C7EE26 for ; Sat, 13 May 2023 17:58:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236807AbjEMR6I (ORCPT ); Sat, 13 May 2023 13:58:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36092 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233552AbjEMR5v (ORCPT ); Sat, 13 May 2023 13:57:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B12D2D52; Sat, 13 May 2023 10:57:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 856F061CB1; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4577BC433B4; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=6CuqLMQiacBTAI5w3xjsfm0X5Hpovbdiy3/b17aiww8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m4JXMw+HBStUnuVsn29oAAHAlFH2iZPow7WevxUXMPEvj2oJofU6Q2pHucRcllGGG aRsNa+pB2MsfMONwmvzMJjt+tLzEgdNsqhNdLd0Hya8ZCA0lEvuMQ6ilbcJuK8fXtH 7gT4vEb52pi7HVgbB8gpJmsha3sdPval9L9ItggPyjU9p99LSKFkuQSnprxbrSFMYw Znwy/MrrPnIKrL5d0FzvU4H1SiELBhLxNB9PnKtvt0WMar8ohRwEuWVv0xz+4hWA8m Uml5eeh93jbsGG4EzO5SVKtaOFo1bTC5u2ZMcs9vbWJLMstCiz15ZNVHtHk1UmU2KX CQltketXd3ztA== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001tyK-1r; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, Randy Dunlap Subject: [PATCH 19/24] media: dvbdev.h: do some kernel-doc cleanups Date: Sat, 13 May 2023 18:57:36 +0100 Message-Id: <09c80cb59d5f9f45714bec8e0d0b1254c7846d83.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Some kernel-doc warnings in were introduced. A fixup patch addressed them was already merged, but Randy's approach from: https://lore.kernel.org/linux-media/20221203060931.19953-1-rdunlap@infradead.org Had some advantages, as it moves the @dvbdev to the right place inside dvb_remove_device() documentation and it makes clearer about what refcounter struct dvb_device refers to. So, apply the changes suggested by Randy. Suggested-by: Randy Dunlap Signed-off-by: Mauro Carvalho Chehab --- include/media/dvbdev.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/media/dvbdev.h b/include/media/dvbdev.h index 8958e5e2fc5b..e5a00d126612 100644 --- a/include/media/dvbdev.h +++ b/include/media/dvbdev.h @@ -130,7 +130,7 @@ struct dvb_adapter { * struct dvb_device - represents a DVB device node * * @list_head: List head with all DVB devices - * @ref: reference counter + * @ref: reference count for this device * @fops: pointer to struct file_operations * @adapter: pointer to the adapter that holds this device node * @type: type of the device, as defined by &enum dvb_device_type. @@ -266,10 +266,10 @@ int dvb_register_device(struct dvb_adapter *adap, /** * dvb_remove_device - Remove a registered DVB device * + * @dvbdev: pointer to struct dvb_device + * * This does not free memory. dvb_free_device() will do that when * reference counter is empty - * - * @dvbdev: pointer to struct dvb_device */ void dvb_remove_device(struct dvb_device *dvbdev); From patchwork Sat May 13 17:57:37 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240297 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6503FC77B7D for ; Sat, 13 May 2023 17:58:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237303AbjEMR6b (ORCPT ); Sat, 13 May 2023 13:58:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36182 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233685AbjEMR5x (ORCPT ); Sat, 13 May 2023 13:57:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C1E992D5A; Sat, 13 May 2023 10:57:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D1AE061D04; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B327C4331D; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=9d2D3D1eC1/26QEllvQ7nKdRq6JmajOkZGz/mFRHdaw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LJTWbaG5iZ2gzCJvdquQBhL579HYPCDwB2jbaKsOVkcq0Spu3Q+1POteYbjjJDzov OTBqML1disR7BAuR2Eav0D6yd02Gk87LZmDwqYBmZaHAmJK5+h82cVGKopwInIVr+j IaMsci9l5i+9J29pZxIM5fceTVZuPs3FVQvKrq24zvKFt+OOAze+Iabfw0BF52Aajn qQGSxdY19q+ttzlgoXBUeV8D5W45EexwuD18BF+ZdrQRtfaSA2iD967bE83HTu28EB JeJZpFQ47l5Ao+S+7QeojoT2JuYP4GDGPwY8INM/1zSehwdH7PxFfjUtfx8fXNpSE0 eO1pm4wikV3uw== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001tyN-1v; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Yu Zhe , Mauro Carvalho Chehab , Patrice Chotard , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 20/24] media: c8sectpfe: dvb: remove unnecessary (void*) conversions Date: Sat, 13 May 2023 18:57:37 +0100 Message-Id: <929cc69a6474e14a619b216706aefa8b3876ccaa.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Yu Zhe Pointer variables of void * type do not require type cast. Link: https://lore.kernel.org/linux-media/20230320070828.13322-1-yuzhe@nfschina.com Signed-off-by: Yu Zhe Signed-off-by: Mauro Carvalho Chehab --- drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c index 45ade7210d26..120830973d22 100644 --- a/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c +++ b/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-core.c @@ -135,7 +135,7 @@ static void channel_swdemux_tsklet(struct tasklet_struct *t) static int c8sectpfe_start_feed(struct dvb_demux_feed *dvbdmxfeed) { struct dvb_demux *demux = dvbdmxfeed->demux; - struct stdemux *stdemux = (struct stdemux *)demux->priv; + struct stdemux *stdemux = demux->priv; struct c8sectpfei *fei = stdemux->c8sectpfei; struct channel_info *channel; u32 tmp; @@ -256,7 +256,7 @@ static int c8sectpfe_stop_feed(struct dvb_demux_feed *dvbdmxfeed) { struct dvb_demux *demux = dvbdmxfeed->demux; - struct stdemux *stdemux = (struct stdemux *)demux->priv; + struct stdemux *stdemux = demux->priv; struct c8sectpfei *fei = stdemux->c8sectpfei; struct channel_info *channel; int idlereq; From patchwork Sat May 13 17:57:38 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240298 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05619C77B7A for ; Sat, 13 May 2023 17:58:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237327AbjEMR6d (ORCPT ); Sat, 13 May 2023 13:58:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36196 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233927AbjEMR5y (ORCPT ); Sat, 13 May 2023 13:57:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B5A3D2D48; Sat, 13 May 2023 10:57:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 974D561CCF; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 607F8C43326; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=ghEPnmKSURwfpwiTzrGTNQFmgy7I2n4yUutlf3ADrFA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=H/Q/4Myv1vuO7E3DAPpTm/XzCyyYcIzphjEhDjoiJ/9Aeg01vfT6tVQr5YqEqPe3D 4Hznjh4CX/DQnbPV7XdX8kI9ZQ6FE9FKjMDmgwUFqkhc9i53ESzNu+sjqCk4yPVhJX OrG/reEuZ/SN9xCbHoBEgtAqlDClEO3j21QfkqVWj3sPpm82AajSERfAE6PpplZP0e 2STlsa5rV4tSesjCUNN50KJicOUNuQTqUwaDAU/NAZ71IDTdsNR+hF34hW9gPgP1KR LPjB6GSO7yyNmwtR+E/xf5ptL5R7OpTBvIbs7djjwYDfPO9K1L34F+dQkIOVJZh0Qe 4TqTrS0aI75RA== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001tyQ-1y; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Yu Zhe , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 21/24] media: dvb-usb: remove unnecessary (void*) conversions Date: Sat, 13 May 2023 18:57:38 +0100 Message-Id: X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Yu Zhe Pointer variables of void * type do not require type cast. Link: https://lore.kernel.org/linux-media/20230320064039.5670-1-yuzhe@nfschina.com Signed-off-by: Yu Zhe Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb/af9005-fe.c | 3 +-- drivers/media/usb/dvb-usb/az6027.c | 34 +++++++++++++------------- drivers/media/usb/dvb-usb/dtt200u-fe.c | 2 +- drivers/media/usb/dvb-usb/dw2102.c | 20 ++++++--------- drivers/media/usb/dvb-usb/opera1.c | 3 +-- drivers/media/usb/dvb-usb/pctv452e.c | 20 +++++++-------- 6 files changed, 38 insertions(+), 44 deletions(-) diff --git a/drivers/media/usb/dvb-usb/af9005-fe.c b/drivers/media/usb/dvb-usb/af9005-fe.c index 9d6fa0556d7b..404e56b32145 100644 --- a/drivers/media/usb/dvb-usb/af9005-fe.c +++ b/drivers/media/usb/dvb-usb/af9005-fe.c @@ -1412,8 +1412,7 @@ static int af9005_fe_get_frontend(struct dvb_frontend *fe, static void af9005_fe_release(struct dvb_frontend *fe) { - struct af9005_fe_state *state = - (struct af9005_fe_state *)fe->demodulator_priv; + struct af9005_fe_state *state = fe->demodulator_priv; kfree(state); } diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c index a31c6f82f4e9..2bc27710427d 100644 --- a/drivers/media/usb/dvb-usb/az6027.c +++ b/drivers/media/usb/dvb-usb/az6027.c @@ -407,8 +407,8 @@ static int az6027_ci_read_attribute_mem(struct dvb_ca_en50221 *ca, int slot, int address) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; - struct az6027_device_state *state = (struct az6027_device_state *)d->priv; + struct dvb_usb_device *d = ca->data; + struct az6027_device_state *state = d->priv; int ret; u8 req; @@ -449,8 +449,8 @@ static int az6027_ci_write_attribute_mem(struct dvb_ca_en50221 *ca, int address, u8 value) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; - struct az6027_device_state *state = (struct az6027_device_state *)d->priv; + struct dvb_usb_device *d = ca->data; + struct az6027_device_state *state = d->priv; int ret; u8 req; @@ -480,8 +480,8 @@ static int az6027_ci_read_cam_control(struct dvb_ca_en50221 *ca, int slot, u8 address) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; - struct az6027_device_state *state = (struct az6027_device_state *)d->priv; + struct dvb_usb_device *d = ca->data; + struct az6027_device_state *state = d->priv; int ret; u8 req; @@ -526,8 +526,8 @@ static int az6027_ci_write_cam_control(struct dvb_ca_en50221 *ca, u8 address, u8 value) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; - struct az6027_device_state *state = (struct az6027_device_state *)d->priv; + struct dvb_usb_device *d = ca->data; + struct az6027_device_state *state = d->priv; int ret; u8 req; @@ -557,7 +557,7 @@ static int az6027_ci_write_cam_control(struct dvb_ca_en50221 *ca, static int CI_CamReady(struct dvb_ca_en50221 *ca, int slot) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; + struct dvb_usb_device *d = ca->data; int ret; u8 req; @@ -588,8 +588,8 @@ static int CI_CamReady(struct dvb_ca_en50221 *ca, int slot) static int az6027_ci_slot_reset(struct dvb_ca_en50221 *ca, int slot) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; - struct az6027_device_state *state = (struct az6027_device_state *)d->priv; + struct dvb_usb_device *d = ca->data; + struct az6027_device_state *state = d->priv; int ret, i; u8 req; @@ -644,8 +644,8 @@ static int az6027_ci_slot_shutdown(struct dvb_ca_en50221 *ca, int slot) static int az6027_ci_slot_ts_enable(struct dvb_ca_en50221 *ca, int slot) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; - struct az6027_device_state *state = (struct az6027_device_state *)d->priv; + struct dvb_usb_device *d = ca->data; + struct az6027_device_state *state = d->priv; int ret; u8 req; @@ -673,8 +673,8 @@ static int az6027_ci_slot_ts_enable(struct dvb_ca_en50221 *ca, int slot) static int az6027_ci_poll_slot_status(struct dvb_ca_en50221 *ca, int slot, int open) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; - struct az6027_device_state *state = (struct az6027_device_state *)d->priv; + struct dvb_usb_device *d = ca->data; + struct az6027_device_state *state = d->priv; int ret; u8 req; u16 value; @@ -719,7 +719,7 @@ static void az6027_ci_uninit(struct dvb_usb_device *d) if (NULL == d) return; - state = (struct az6027_device_state *)d->priv; + state = d->priv; if (NULL == state) return; @@ -735,7 +735,7 @@ static void az6027_ci_uninit(struct dvb_usb_device *d) static int az6027_ci_init(struct dvb_usb_adapter *a) { struct dvb_usb_device *d = a->dev; - struct az6027_device_state *state = (struct az6027_device_state *)d->priv; + struct az6027_device_state *state = d->priv; int ret; deb_info("%s", __func__); diff --git a/drivers/media/usb/dvb-usb/dtt200u-fe.c b/drivers/media/usb/dvb-usb/dtt200u-fe.c index 9f83560ba63d..586afe22d817 100644 --- a/drivers/media/usb/dvb-usb/dtt200u-fe.c +++ b/drivers/media/usb/dvb-usb/dtt200u-fe.c @@ -195,7 +195,7 @@ static int dtt200u_fe_get_frontend(struct dvb_frontend* fe, static void dtt200u_fe_release(struct dvb_frontend* fe) { - struct dtt200u_fe_state *state = (struct dtt200u_fe_state*) fe->demodulator_priv; + struct dtt200u_fe_state *state = fe->demodulator_priv; kfree(state); } diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c index 8747960e6146..2a048499468b 100644 --- a/drivers/media/usb/dvb-usb/dw2102.c +++ b/drivers/media/usb/dvb-usb/dw2102.c @@ -903,7 +903,7 @@ static int su3000_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff) static int su3000_power_ctrl(struct dvb_usb_device *d, int i) { - struct dw2102_state *state = (struct dw2102_state *)d->priv; + struct dw2102_state *state = d->priv; int ret = 0; info("%s: %d, initialized %d", __func__, i, state->initialized); @@ -978,8 +978,7 @@ static int dw210x_set_voltage(struct dvb_frontend *fe, .len = 2, }; - struct dvb_usb_adapter *udev_adap = - (struct dvb_usb_adapter *)(fe->dvb->priv); + struct dvb_usb_adapter *udev_adap = fe->dvb->priv; if (voltage == SEC_VOLTAGE_18) msg.buf = command_18v; else if (voltage == SEC_VOLTAGE_13) @@ -993,9 +992,8 @@ static int dw210x_set_voltage(struct dvb_frontend *fe, static int s660_set_voltage(struct dvb_frontend *fe, enum fe_sec_voltage voltage) { - struct dvb_usb_adapter *d = - (struct dvb_usb_adapter *)(fe->dvb->priv); - struct dw2102_state *st = (struct dw2102_state *)d->dev->priv; + struct dvb_usb_adapter *d = fe->dvb->priv; + struct dw2102_state *st = d->dev->priv; dw210x_set_voltage(fe, voltage); if (st->old_set_voltage) @@ -1014,8 +1012,7 @@ static void dw210x_led_ctrl(struct dvb_frontend *fe, int offon) .buf = led_off, .len = 1 }; - struct dvb_usb_adapter *udev_adap = - (struct dvb_usb_adapter *)(fe->dvb->priv); + struct dvb_usb_adapter *udev_adap = fe->dvb->priv; if (offon) msg.buf = led_on; @@ -1025,9 +1022,8 @@ static void dw210x_led_ctrl(struct dvb_frontend *fe, int offon) static int tt_s2_4600_read_status(struct dvb_frontend *fe, enum fe_status *status) { - struct dvb_usb_adapter *d = - (struct dvb_usb_adapter *)(fe->dvb->priv); - struct dw2102_state *st = (struct dw2102_state *)d->dev->priv; + struct dvb_usb_adapter *d = fe->dvb->priv; + struct dw2102_state *st = d->dev->priv; int ret; ret = st->fe_read_status(fe, status); @@ -2576,7 +2572,7 @@ static int dw2102_probe(struct usb_interface *intf, static void dw2102_disconnect(struct usb_interface *intf) { struct dvb_usb_device *d = usb_get_intfdata(intf); - struct dw2102_state *st = (struct dw2102_state *)d->priv; + struct dw2102_state *st = d->priv; struct i2c_client *client; /* remove I2C client for tuner */ diff --git a/drivers/media/usb/dvb-usb/opera1.c b/drivers/media/usb/dvb-usb/opera1.c index 0da86f58aff6..98b2177667d2 100644 --- a/drivers/media/usb/dvb-usb/opera1.c +++ b/drivers/media/usb/dvb-usb/opera1.c @@ -172,8 +172,7 @@ static int opera1_set_voltage(struct dvb_frontend *fe, struct i2c_msg msg[] = { {.addr = ADDR_B600_VOLTAGE_13V,.flags = 0,.buf = command_13v,.len = 1}, }; - struct dvb_usb_adapter *udev_adap = - (struct dvb_usb_adapter *)(fe->dvb->priv); + struct dvb_usb_adapter *udev_adap = fe->dvb->priv; if (voltage == SEC_VOLTAGE_18) { msg[0].addr = ADDR_B601_VOLTAGE_18V; msg[0].buf = command_18v; diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c index da42c989e071..2aab49003493 100644 --- a/drivers/media/usb/dvb-usb/pctv452e.c +++ b/drivers/media/usb/dvb-usb/pctv452e.c @@ -108,7 +108,7 @@ struct pctv452e_state { static int tt3650_ci_msg(struct dvb_usb_device *d, u8 cmd, u8 *data, unsigned int write_len, unsigned int read_len) { - struct pctv452e_state *state = (struct pctv452e_state *)d->priv; + struct pctv452e_state *state = d->priv; u8 *buf; u8 id; unsigned int rlen; @@ -159,8 +159,8 @@ static int tt3650_ci_msg_locked(struct dvb_ca_en50221 *ca, u8 cmd, u8 *data, unsigned int write_len, unsigned int read_len) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; - struct pctv452e_state *state = (struct pctv452e_state *)d->priv; + struct dvb_usb_device *d = ca->data; + struct pctv452e_state *state = d->priv; int ret; mutex_lock(&state->ca_mutex); @@ -292,8 +292,8 @@ static int tt3650_ci_slot_ts_enable(struct dvb_ca_en50221 *ca, int slot) static int tt3650_ci_slot_reset(struct dvb_ca_en50221 *ca, int slot) { - struct dvb_usb_device *d = (struct dvb_usb_device *)ca->data; - struct pctv452e_state *state = (struct pctv452e_state *)d->priv; + struct dvb_usb_device *d = ca->data; + struct pctv452e_state *state = d->priv; u8 buf[1]; int ret; @@ -361,7 +361,7 @@ static void tt3650_ci_uninit(struct dvb_usb_device *d) if (NULL == d) return; - state = (struct pctv452e_state *)d->priv; + state = d->priv; if (NULL == state) return; @@ -379,7 +379,7 @@ static void tt3650_ci_uninit(struct dvb_usb_device *d) static int tt3650_ci_init(struct dvb_usb_adapter *a) { struct dvb_usb_device *d = a->dev; - struct pctv452e_state *state = (struct pctv452e_state *)d->priv; + struct pctv452e_state *state = d->priv; int ret; ci_dbg("%s", __func__); @@ -417,7 +417,7 @@ static int pctv452e_i2c_msg(struct dvb_usb_device *d, u8 addr, const u8 *snd_buf, u8 snd_len, u8 *rcv_buf, u8 rcv_len) { - struct pctv452e_state *state = (struct pctv452e_state *)d->priv; + struct pctv452e_state *state = d->priv; u8 *buf; u8 id; int ret; @@ -516,7 +516,7 @@ static u32 pctv452e_i2c_func(struct i2c_adapter *adapter) static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i) { - struct pctv452e_state *state = (struct pctv452e_state *)d->priv; + struct pctv452e_state *state = d->priv; u8 *b0, *rx; int ret; @@ -567,7 +567,7 @@ static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i) static int pctv452e_rc_query(struct dvb_usb_device *d) { - struct pctv452e_state *state = (struct pctv452e_state *)d->priv; + struct pctv452e_state *state = d->priv; u8 *b, *rx; int ret, i; u8 id; From patchwork Sat May 13 17:57:39 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240288 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55550C7EE24 for ; Sat, 13 May 2023 17:58:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229624AbjEMR6K (ORCPT ); Sat, 13 May 2023 13:58:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36152 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233621AbjEMR5v (ORCPT ); Sat, 13 May 2023 13:57:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E04A2133; Sat, 13 May 2023 10:57:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 89DE861CAE; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 44B0BC433B0; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=2fRqwV2foJ6Q8LqJQ6YyRlrbT2AHforZWBmSS4FXU48=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bjAAUFrJkuIB3s8CX6Mj989yLIQjYixjIi9Q7wFneImPFc7hF8g7ZpmWVaMORVdYn HB9gJ6jNzvpFkWDOV7jQsj4wPEpR9+tYZus1tf6PTH7US9pScv9h0tsbKKKdGTWgBI FKB4AZEh7RmY1qXFRtW8WSe7u3nin7rFxh6xEX2EK23JkzAjESxjau6tWKLSQ7kXtQ Eg9/dlGZhNDGpYdbNjZSOv2gTZ6z6uzCBxHrkRfM8rv2rcTfHxJIZCpdGw99sGc07E /wFDmDU5UQppGCSHXtsLiW9/8abFHLZVpXx56LP3MDtaC/zUYQ2wHSBMUSZjjHhBab camKcsOee+rpw== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001tyT-21; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 22/24] media: dw2102: return -EIO instead of -1 for mac address read errors Date: Sat, 13 May 2023 18:57:39 +0100 Message-Id: X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org The dvb-usb core function only checks if the returned value is zero, so it doesn't actually matter the error code. Still, returning -1 as an error condition is something that we don't do upstream. So, change the logic to return -EIO in case of I2C transfer failures. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/dvb-usb/dw2102.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c index 2a048499468b..970b84c3f0b5 100644 --- a/drivers/media/usb/dvb-usb/dw2102.c +++ b/drivers/media/usb/dvb-usb/dw2102.c @@ -830,7 +830,7 @@ static int dw210x_read_mac_address(struct dvb_usb_device *d, u8 mac[6]) for (i = 0; i < 256; i++) { if (dw210x_op_rw(d->udev, 0xb6, 0xa0 , i, ibuf, 2, DW210X_READ_MSG) < 0) { err("read eeprom failed."); - return -1; + return -EIO; } else { eepromline[i%16] = ibuf[0]; eeprom[i] = ibuf[0]; @@ -869,7 +869,7 @@ static int s6x0_read_mac_address(struct dvb_usb_device *d, u8 mac[6]) ret = s6x0_i2c_transfer(&d->i2c_adap, msg, 2); if (ret != 2) { err("read eeprom failed."); - return -1; + return -EIO; } else { eepromline[i % 16] = ibuf[0]; eeprom[i] = ibuf[0]; @@ -946,7 +946,7 @@ static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6]) for (i = 0; i < 6; i++) { obuf[1] = 0xf0 + i; if (i2c_transfer(&d->i2c_adap, msg, 2) != 2) - return -1; + return -EIO; else mac[i] = ibuf[0]; } From patchwork Sat May 13 17:57:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240294 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D691C7EE26 for ; Sat, 13 May 2023 17:58:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233454AbjEMR60 (ORCPT ); Sat, 13 May 2023 13:58:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233666AbjEMR5w (ORCPT ); Sat, 13 May 2023 13:57:52 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 767C62D58; Sat, 13 May 2023 10:57:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9410D61CBD; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 618F6C43328; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=yG8vDtqqiK1WK8TQCMHYUP1uYhOMaAO3Fiu7oP+/IRs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G3UmBtBzYujtAOToBHXQB5QQh/9ETooV61MrDh8iy0QgQneHpvy3jnDOqLNPZOSKU /HsMAtr3gTg8Os3IZiUzfxuzpy5qSqPKOCWIYgiLckh6vRPxKBuPFgqUDbaRDozUf7 M7IPOfJ2Bjh6N+OhzirSW9ekJ7c6MKgSY4wxzzxWRign0W9vH1D2lw2ukmfzjNIvU6 HsaJqZf3tawNNbieThBUQ+jRhWz0fYa+1xC3PGkXF1cHqh7fKprEYlqLjc1qCV0gPQ TzuNBywmqgrxRrT2flCj4hp0n9AFF9jFsauRgsx198R9hStHVekBO75k+nibHwiRFO DpBuFASF2JDqA== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001tyW-25; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Athanasios Oikonomou , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, Robert Schlabbach , Tom Richardson Subject: [PATCH 23/24] media: dvb: add missing DVB-S2X FEC parameter values Date: Sat, 13 May 2023 18:57:40 +0100 Message-Id: <66236dd06ca793f89c940bd6f6c9c0e10a7aa2c7.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Athanasios Oikonomou This commit is adding the missing short FEC Missed on commit 6508a50fe84f9858e8b59b53dce3847aaeeab744 More info: https://dvb.org/wp-content/uploads/2021/02/A083-2r2_DVB-S2X_Draft-EN-302-307-2-v131_Feb_2021.pdf Table 1: S2X System configurations and application areas Please note that 128APSK, 256APSK and 256APSK-L and FEC 29/45, 31/45 are still missing from enums. Link: https://lore.kernel.org/linux-media/20230111194608.1853-1-athoik@gmail.com Cc: Robert Schlabbach Cc: Tom Richardson Signed-off-by: Athanasios Oikonomou Signed-off-by: Mauro Carvalho Chehab --- include/uapi/linux/dvb/frontend.h | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/include/uapi/linux/dvb/frontend.h b/include/uapi/linux/dvb/frontend.h index 326f6a53f1f2..7e0983b987c2 100644 --- a/include/uapi/linux/dvb/frontend.h +++ b/include/uapi/linux/dvb/frontend.h @@ -296,6 +296,10 @@ enum fe_spectral_inversion { * @FEC_28_45: Forward Error Correction Code 28/45 * @FEC_32_45: Forward Error Correction Code 32/45 * @FEC_77_90: Forward Error Correction Code 77/90 + * @FEC_11_45: Forward Error Correction Code 11/45 + * @FEC_4_15: Forward Error Correction Code 4/15 + * @FEC_14_45: Forward Error Correction Code 14/45 + * @FEC_7_15: Forward Error Correction Code 7/15 * * Please note that not all FEC types are supported by a given standard. */ @@ -329,6 +333,10 @@ enum fe_code_rate { FEC_28_45, FEC_32_45, FEC_77_90, + FEC_11_45, + FEC_4_15, + FEC_14_45, + FEC_7_15, }; /** From patchwork Sat May 13 17:57:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13240286 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A0B4C77B7A for ; Sat, 13 May 2023 17:58:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236786AbjEMR6G (ORCPT ); Sat, 13 May 2023 13:58:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233538AbjEMR5v (ORCPT ); Sat, 13 May 2023 13:57:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 114232D55; Sat, 13 May 2023 10:57:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8F85661CB6; Sat, 13 May 2023 17:57:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A15AC4331F; Sat, 13 May 2023 17:57:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1684000666; bh=eGtNYpD/XyyRkJDa/Og4mUl11WDE9M+dRjzmaPlkuV4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KuIA5/cO9Tm+H+/t6AZ8omfIsBFLtHlrJWRzUKGbr+bPEFMJ56WP2poDE9Ppj03Dv Tydbuyn5mqtIsJuzAESckgd8lfFFnF30RGrh4kIMHoTlvsewGbzt8TyVp7qWyCTmMc AexQK9OR6+Sb1IJRCAaDph5QRqtKA4aUxDlF7MJxdjvR2S73lvZzJbsJ+6gcfXef7p rgOrvg0hxogtYqAEdAH5xbvEBBJOvP5XqVcKlxuS6cJ3LmWwWHTmtolANovoU6cY1W nmDaW4NliCgozrwvjTyDyY8ckBrAvDbQCPm4VSbkLOyA3U++SyaPoa8KIIQs7le3/f UKfOeKsNU5Baw== Received: from mchehab by mail.kernel.org with local (Exim 4.96) (envelope-from ) id 1pxtV1-001tya-28; Sat, 13 May 2023 18:57:43 +0100 From: Mauro Carvalho Chehab Cc: Athanasios Oikonomou , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, Robert Schlabbach Subject: [PATCH 24/24] media: dvb: bump DVB API version Date: Sat, 13 May 2023 18:57:41 +0100 Message-Id: <1a18c0512de2f4002e8b0084ad28cce662bb57e7.1684000646.git.mchehab@kernel.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> References: <53558de2b5c4f4ee6bfcfbe34e27071c2d0073d5.1684000646.git.mchehab@kernel.org> MIME-Version: 1.0 To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Athanasios Oikonomou Bump the DVB API version in order userspace to be aware of the changes recently implemented in enumerations for DVB-S2(X) and DVB-C2. Related: commit 6508a50fe84f ("media: dvb: add DVB-C2 and DVB-S2X parameter values") Link: https://lore.kernel.org/linux-media/20230110071421.31498-1-athoik@gmail.com Cc: Robert Schlabbach Signed-off-by: Athanasios Oikonomou Signed-off-by: Mauro Carvalho Chehab --- include/uapi/linux/dvb/version.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/uapi/linux/dvb/version.h b/include/uapi/linux/dvb/version.h index 1a8cd038aa0b..20bc874de321 100644 --- a/include/uapi/linux/dvb/version.h +++ b/include/uapi/linux/dvb/version.h @@ -10,6 +10,6 @@ #define _DVBVERSION_H_ #define DVB_API_VERSION 5 -#define DVB_API_VERSION_MINOR 11 +#define DVB_API_VERSION_MINOR 12 #endif /*_DVBVERSION_H_*/