lkml.org 
[lkml]   [2015]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2 023/110] [media] rtl28xxu: fix control message flaws
    Date
    4.2-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Antti Palosaari <crope@iki.fi>

    commit d18ca5b7ceca0e9674cb4bb2ed476b0fcbb23ba2 upstream.

    Add lock to prevent concurrent access for control message as control
    message function uses shared buffer. Without the lock there may be
    remote control polling which messes the buffer causing IO errors.
    Increase buffer size and add check for maximum supported message
    length.

    Link: https://bugzilla.kernel.org/show_bug.cgi?id=103391
    Fixes: c56222a6b25c ("[media] rtl28xxu: move usb buffers to state")

    Signed-off-by: Antti Palosaari <crope@iki.fi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 15 +++++++++++++--
    drivers/media/usb/dvb-usb-v2/rtl28xxu.h | 2 +-
    2 files changed, 14 insertions(+), 3 deletions(-)

    --- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
    +++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
    @@ -34,6 +34,14 @@ static int rtl28xxu_ctrl_msg(struct dvb_
    unsigned int pipe;
    u8 requesttype;

    + mutex_lock(&d->usb_mutex);
    +
    + if (req->size > sizeof(dev->buf)) {
    + dev_err(&d->intf->dev, "too large message %u\n", req->size);
    + ret = -EINVAL;
    + goto err_mutex_unlock;
    + }
    +
    if (req->index & CMD_WR_FLAG) {
    /* write */
    memcpy(dev->buf, req->data, req->size);
    @@ -50,14 +58,17 @@ static int rtl28xxu_ctrl_msg(struct dvb_
    dvb_usb_dbg_usb_control_msg(d->udev, 0, requesttype, req->value,
    req->index, dev->buf, req->size);
    if (ret < 0)
    - goto err;
    + goto err_mutex_unlock;

    /* read request, copy returned data to return buf */
    if (requesttype == (USB_TYPE_VENDOR | USB_DIR_IN))
    memcpy(req->data, dev->buf, req->size);

    + mutex_unlock(&d->usb_mutex);
    +
    return 0;
    -err:
    +err_mutex_unlock:
    + mutex_unlock(&d->usb_mutex);
    dev_dbg(&d->intf->dev, "failed=%d\n", ret);
    return ret;
    }
    --- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
    +++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
    @@ -71,7 +71,7 @@


    struct rtl28xxu_dev {
    - u8 buf[28];
    + u8 buf[128];
    u8 chip_id;
    u8 tuner;
    char *tuner_name;



    \
     
     \ /
      Last update: 2015-11-06 22:01    [W:4.276 / U:0.440 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site