From patchwork Tue Sep 26 21:10:20 2017

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

Subject: [1/2] media: dvb-usb-v2: lmedm04: Improve logic checking of warm

 start.

From: Malcolm Priestley <tvboxspy@gmail.com>

X-Patchwork-Id: 44566

Message-Id: <20170926211021.11036-1-tvboxspy@gmail.com>

To: linux-media@vger.kernel.org

Cc: Andrey Konovalov <andreyknvl@google.com>,

 Malcolm Priestley <tvboxspy@gmail.com>

Date: Tue, 26 Sep 2017 22:10:20 +0100

Warm start has no check as whether a genuine device has

connected and proceeds to next execution path.

Check device should read 0x47 at offset of 2 on USB descriptor read

and it is the amount requested of 6 bytes.

Fix for

kasan: CONFIG_KASAN_INLINE enabled

kasan: GPF could be caused by NULL-ptr deref or user memory access as

Reported-by: Andrey Konovalov <andreyknvl@google.com>

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>

---

 drivers/media/usb/dvb-usb-v2/lmedm04.c | 26 ++++++++++++++++++--------

 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c

index 5e320fa4a795..992f2011a6ba 100644

--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c

+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c

@@ -494,18 +494,23 @@ static int lme2510_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid,

 static int lme2510_return_status(struct dvb_usb_device *d)

 {

-	int ret = 0;

+	int ret;

 	u8 *data;

-	data = kzalloc(10, GFP_KERNEL);

+	data = kzalloc(6, GFP_KERNEL);

 	if (!data)

 		return -ENOMEM;

-	ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),

-			0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200);

-	info("Firmware Status: %x (%x)", ret , data[2]);

+	ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),

+			      0x06, 0x80, 0x0302, 0x00,

+			      data, 0x6, 200);

+	if (ret != 6)

+		ret = -EINVAL;

+	else

+		ret = data[2];

+

+	info("Firmware Status: %6ph", data);

-	ret = (ret < 0) ? -ENODEV : data[2];

 	kfree(data);

 	return ret;

 }

@@ -1189,6 +1194,7 @@ static int lme2510_get_adapter_count(struct dvb_usb_device *d)

 static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)

 {

 	struct lme2510_state *st = d->priv;

+	int status;

 	usb_reset_configuration(d->udev);

@@ -1197,12 +1203,16 @@ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)

 	st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware;

-	if (lme2510_return_status(d) == 0x44) {

+	status = lme2510_return_status(d);

+	if (status == 0x44) {

 		*name = lme_firmware_switch(d, 0);

 		return COLD;

 	}

-	return 0;

+	if (status != 0x47)

+		return -EINVAL;

+

+	return WARM;

 }

 static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,

From patchwork Tue Sep 26 21:10:21 2017

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

Subject: [2/2] media: dvb-usb-v2: lmedm04: move ts2020 attach to

 dm04_lme2510_tuner

From: Malcolm Priestley <tvboxspy@gmail.com>

X-Patchwork-Id: 44567

Message-Id: <20170926211021.11036-2-tvboxspy@gmail.com>

To: linux-media@vger.kernel.org

Cc: Andrey Konovalov <andreyknvl@google.com>,

 Malcolm Priestley <tvboxspy@gmail.com>

Date: Tue, 26 Sep 2017 22:10:21 +0100

When the tuner was split from m88rs2000 the attach function is in wrong

place.

Move to dm04_lme2510_tuner to trap errors on failure and removing

a call to lme_coldreset.

Prevents driver starting up without any tuner connected.

Fixes to trap for ts2020 fail.

LME2510(C): FE Found M88RS2000

ts2020: probe of 0-0060 failed with error -11

...

LME2510(C): TUN Found RS2000 tuner

kasan: CONFIG_KASAN_INLINE enabled

kasan: GPF could be caused by NULL-ptr deref or user memory access

general protection fault: 0000 [#1] PREEMPT SMP KASAN

Reported-by: Andrey Konovalov <andreyknvl@google.com>

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>

Tested-by: Andrey Konovalov <andreyknvl@google.com>

---

 drivers/media/usb/dvb-usb-v2/lmedm04.c | 13 ++++++-------

 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c

index 992f2011a6ba..be26c029546b 100644

--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c

+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c

@@ -1076,8 +1076,6 @@ static int dm04_lme2510_frontend_attach(struct dvb_usb_adapter *adap)

 		if (adap->fe[0]) {

 			info("FE Found M88RS2000");

-			dvb_attach(ts2020_attach, adap->fe[0], &ts2020_config,

-					&d->i2c_adap);

 			st->i2c_tuner_gate_w = 5;

 			st->i2c_tuner_gate_r = 5;

 			st->i2c_tuner_addr = 0x60;

@@ -1143,17 +1141,18 @@ static int dm04_lme2510_tuner(struct dvb_usb_adapter *adap)

 			ret = st->tuner_config;

 		break;

 	case TUNER_RS2000:

-		ret = st->tuner_config;

+		if (dvb_attach(ts2020_attach, adap->fe[0],

+			       &ts2020_config, &d->i2c_adap))

+			ret = st->tuner_config;

 		break;

 	default:

 		break;

 	}

-	if (ret)

+	if (ret) {

 		info("TUN Found %s tuner", tun_msg[ret]);

-	else {

-		info("TUN No tuner found --- resetting device");

-		lme_coldreset(d);

+	} else {

+		info("TUN No tuner found");

 		return -ENODEV;

 	}