Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1570359
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 43/66] [media] pctv452e: move buffer to heap, no mutex |
| Date | 2017-01-31 06:50 +0100 |
| Message-ID | <t5zuj-5gO-55@gated-at.bofh.it> (permalink) |
| References | <t5zkB-5dd-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@gmail.com>
commit 48775cb73c2e26b7ca9d679875a6e570c8b8e124 upstream.
commit 73d5c5c864f4 ("[media] pctv452e: don't do DMA on stack") caused
a NULL pointer dereference which occurs when dvb_usb_init()
calls dvb_usb_device_power_ctrl() for the first time, before the
frontend has been attached. It also caused a recursive deadlock because
tt3650_ci_msg_locked() has already locked the mutex.
So, partially revert it, but move the buffer to the heap
(DMA capable), not to the stack (may not be DMA capable).
Instead of sharing one buffer which needs mutex protection,
do a new heap allocation for each call.
Fixes: commit 73d5c5c864f4 ("[media] pctv452e: don't do DMA on stack")
Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb/pctv452e.c | 133 ++++++++++++++++++-----------------
1 file changed, 72 insertions(+), 61 deletions(-)
--- a/drivers/media/usb/dvb-usb/pctv452e.c
+++ b/drivers/media/usb/dvb-usb/pctv452e.c
@@ -97,14 +97,13 @@ struct pctv452e_state {
u8 c; /* transaction counter, wraps around... */
u8 initialized; /* set to 1 if 0x15 has been sent */
u16 last_rc_key;
-
- unsigned char data[80];
};
static int tt3650_ci_msg(struct dvb_usb_device *d, u8 cmd, u8 *data,
unsigned int write_len, unsigned int read_len)
{
struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
+ u8 *buf;
u8 id;
unsigned int rlen;
int ret;
@@ -114,36 +113,39 @@ static int tt3650_ci_msg(struct dvb_usb_
return -EIO;
}
- mutex_lock(&state->ca_mutex);
+ buf = kmalloc(64, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
id = state->c++;
- state->data[0] = SYNC_BYTE_OUT;
- state->data[1] = id;
- state->data[2] = cmd;
- state->data[3] = write_len;
+ buf[0] = SYNC_BYTE_OUT;
+ buf[1] = id;
+ buf[2] = cmd;
+ buf[3] = write_len;
- memcpy(state->data + 4, data, write_len);
+ memcpy(buf + 4, data, write_len);
rlen = (read_len > 0) ? 64 : 0;
- ret = dvb_usb_generic_rw(d, state->data, 4 + write_len,
- state->data, rlen, /* delay_ms */ 0);
+ ret = dvb_usb_generic_rw(d, buf, 4 + write_len,
+ buf, rlen, /* delay_ms */ 0);
if (0 != ret)
goto failed;
ret = -EIO;
- if (SYNC_BYTE_IN != state->data[0] || id != state->data[1])
+ if (SYNC_BYTE_IN != buf[0] || id != buf[1])
goto failed;
- memcpy(data, state->data + 4, read_len);
+ memcpy(data, buf + 4, read_len);
- mutex_unlock(&state->ca_mutex);
+ kfree(buf);
return 0;
failed:
err("CI error %d; %02X %02X %02X -> %*ph.",
- ret, SYNC_BYTE_OUT, id, cmd, 3, state->data);
+ ret, SYNC_BYTE_OUT, id, cmd, 3, buf);
- mutex_unlock(&state->ca_mutex);
+ kfree(buf);
return ret;
}
@@ -410,53 +412,57 @@ static int pctv452e_i2c_msg(struct dvb_u
u8 *rcv_buf, u8 rcv_len)
{
struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
+ u8 *buf;
u8 id;
int ret;
- mutex_lock(&state->ca_mutex);
+ buf = kmalloc(64, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
id = state->c++;
ret = -EINVAL;
if (snd_len > 64 - 7 || rcv_len > 64 - 7)
goto failed;
- state->data[0] = SYNC_BYTE_OUT;
- state->data[1] = id;
- state->data[2] = PCTV_CMD_I2C;
- state->data[3] = snd_len + 3;
- state->data[4] = addr << 1;
- state->data[5] = snd_len;
- state->data[6] = rcv_len;
+ buf[0] = SYNC_BYTE_OUT;
+ buf[1] = id;
+ buf[2] = PCTV_CMD_I2C;
+ buf[3] = snd_len + 3;
+ buf[4] = addr << 1;
+ buf[5] = snd_len;
+ buf[6] = rcv_len;
- memcpy(state->data + 7, snd_buf, snd_len);
+ memcpy(buf + 7, snd_buf, snd_len);
- ret = dvb_usb_generic_rw(d, state->data, 7 + snd_len,
- state->data, /* rcv_len */ 64,
+ ret = dvb_usb_generic_rw(d, buf, 7 + snd_len,
+ buf, /* rcv_len */ 64,
/* delay_ms */ 0);
if (ret < 0)
goto failed;
/* TT USB protocol error. */
ret = -EIO;
- if (SYNC_BYTE_IN != state->data[0] || id != state->data[1])
+ if (SYNC_BYTE_IN != buf[0] || id != buf[1])
goto failed;
/* I2C device didn't respond as expected. */
ret = -EREMOTEIO;
- if (state->data[5] < snd_len || state->data[6] < rcv_len)
+ if (buf[5] < snd_len || buf[6] < rcv_len)
goto failed;
- memcpy(rcv_buf, state->data + 7, rcv_len);
- mutex_unlock(&state->ca_mutex);
+ memcpy(rcv_buf, buf + 7, rcv_len);
+ kfree(buf);
return rcv_len;
failed:
err("I2C error %d; %02X %02X %02X %02X %02X -> %*ph",
ret, SYNC_BYTE_OUT, id, addr << 1, snd_len, rcv_len,
- 7, state->data);
+ 7, buf);
- mutex_unlock(&state->ca_mutex);
+ kfree(buf);
return ret;
}
@@ -505,7 +511,7 @@ static u32 pctv452e_i2c_func(struct i2c_
static int pctv452e_power_ctrl(struct dvb_usb_device *d, int i)
{
struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
- u8 *rx;
+ u8 *b0, *rx;
int ret;
info("%s: %d\n", __func__, i);
@@ -516,11 +522,12 @@ static int pctv452e_power_ctrl(struct dv
if (state->initialized)
return 0;
- rx = kmalloc(PCTV_ANSWER_LEN, GFP_KERNEL);
- if (!rx)
+ b0 = kmalloc(5 + PCTV_ANSWER_LEN, GFP_KERNEL);
+ if (!b0)
return -ENOMEM;
- mutex_lock(&state->ca_mutex);
+ rx = b0 + 5;
+
/* hmm where shoud this should go? */
ret = usb_set_interface(d->udev, 0, ISOC_INTERFACE_ALTERNATIVE);
if (ret != 0)
@@ -528,66 +535,70 @@ static int pctv452e_power_ctrl(struct dv
__func__, ret);
/* this is a one-time initialization, dont know where to put */
- state->data[0] = 0xaa;
- state->data[1] = state->c++;
- state->data[2] = PCTV_CMD_RESET;
- state->data[3] = 1;
- state->data[4] = 0;
+ b0[0] = 0xaa;
+ b0[1] = state->c++;
+ b0[2] = PCTV_CMD_RESET;
+ b0[3] = 1;
+ b0[4] = 0;
/* reset board */
- ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0);
+ ret = dvb_usb_generic_rw(d, b0, 5, rx, PCTV_ANSWER_LEN, 0);
if (ret)
goto ret;
- state->data[1] = state->c++;
- state->data[4] = 1;
+ b0[1] = state->c++;
+ b0[4] = 1;
/* reset board (again?) */
- ret = dvb_usb_generic_rw(d, state->data, 5, rx, PCTV_ANSWER_LEN, 0);
+ ret = dvb_usb_generic_rw(d, b0, 5, rx, PCTV_ANSWER_LEN, 0);
if (ret)
goto ret;
state->initialized = 1;
ret:
- mutex_unlock(&state->ca_mutex);
- kfree(rx);
+ kfree(b0);
return ret;
}
static int pctv452e_rc_query(struct dvb_usb_device *d)
{
struct pctv452e_state *state = (struct pctv452e_state *)d->priv;
+ u8 *b, *rx;
int ret, i;
u8 id;
- mutex_lock(&state->ca_mutex);
+ b = kmalloc(CMD_BUFFER_SIZE + PCTV_ANSWER_LEN, GFP_KERNEL);
+ if (!b)
+ return -ENOMEM;
+
+ rx = b + CMD_BUFFER_SIZE;
+
id = state->c++;
/* prepare command header */
- state->data[0] = SYNC_BYTE_OUT;
- state->data[1] = id;
- state->data[2] = PCTV_CMD_IR;
- state->data[3] = 0;
+ b[0] = SYNC_BYTE_OUT;
+ b[1] = id;
+ b[2] = PCTV_CMD_IR;
+ b[3] = 0;
/* send ir request */
- ret = dvb_usb_generic_rw(d, state->data, 4,
- state->data, PCTV_ANSWER_LEN, 0);
+ ret = dvb_usb_generic_rw(d, b, 4, rx, PCTV_ANSWER_LEN, 0);
if (ret != 0)
goto ret;
if (debug > 3) {
- info("%s: read: %2d: %*ph: ", __func__, ret, 3, state->data);
- for (i = 0; (i < state->data[3]) && ((i + 3) < PCTV_ANSWER_LEN); i++)
- info(" %02x", state->data[i + 3]);
+ info("%s: read: %2d: %*ph: ", __func__, ret, 3, rx);
+ for (i = 0; (i < rx[3]) && ((i+3) < PCTV_ANSWER_LEN); i++)
+ info(" %02x", rx[i+3]);
info("\n");
}
- if ((state->data[3] == 9) && (state->data[12] & 0x01)) {
+ if ((rx[3] == 9) && (rx[12] & 0x01)) {
/* got a "press" event */
- state->last_rc_key = RC_SCANCODE_RC5(state->data[7], state->data[6]);
+ state->last_rc_key = RC_SCANCODE_RC5(rx[7], rx[6]);
if (debug > 2)
info("%s: cmd=0x%02x sys=0x%02x\n",
- __func__, state->data[6], state->data[7]);
+ __func__, rx[6], rx[7]);
rc_keydown(d->rc_dev, RC_TYPE_RC5, state->last_rc_key, 0);
} else if (state->last_rc_key) {
@@ -595,7 +606,7 @@ static int pctv452e_rc_query(struct dvb_
state->last_rc_key = 0;
}
ret:
- mutex_unlock(&state->ca_mutex);
+ kfree(b);
return ret;
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 00/66] 4.9.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 53/66] IB/umem: Release pid in error and ODP flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 40/66] NFSv4.0: always send mode in SETATTR after EXCLUSIVE4 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 43/66] [media] pctv452e: move buffer to heap, no mutex Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 28/66] s390/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 22/66] ISDN: eicon: silence misleading array-bounds warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 57/66] pinctrl: broxton: Use correct PADCFGLOCK offset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 41/66] SUNRPC: cleanup ida information when removing sunrpc module Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 35/66] ARC: udelay: fix inline assembler by adding LP_COUNT to clobber list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 44/66] [media] v4l: tvp5150: Reset device at probe time, not in get/set format handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 38/66] nfs: Dont increment lock sequence ID after NFS4ERR_MOVED Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 37/66] parisc: Dont use BITS_PER_LONG in userspace-exported swab.h header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 39/66] NFSv4.1: Fix a deadlock in layoutget Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 32/66] IB/srp: fix invalid indirect_sg_entries parameter value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 54/66] IB/rxe: Fix rxe dev insertion to rxe_dev_list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 48/66] drm/i915: prevent crash with .disable_display parameter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 06:50 +0100
[PATCH 4.9 03/66] drm: Schedule the output_poll_work with 1s delay if we have delayed event Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 56/66] [media] s5k4ecgx: select CRC32 helper Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 29/66] IB/cxgb3: fix misspelling in header guard Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 23/66] Btrfs: remove old tree_root case in btrfs_read_locked_inode() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 64/66] mm, memcg: do not retry precharge charges Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 12/66] mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 30/66] IB/iser: Fix sg_tablesize calculation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 15/66] mm, page_alloc: fix fast-path race with cpuset update or removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 01/66] fbdev: color map copying bounds checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 25/66] Btrfs: remove ->{get, set}_acl() from btrfs_dir_ro_inode_operations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 65/66] perf/core: Fix concurrent sys_perf_event_open() vs. move_group race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 13/66] mm/mempolicy.c: do not put mempolicy before using its nodemask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 46/66] [media] v4l: tvp5150: Dont override output pinmuxing at stream on/off time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 16/66] mm, page_alloc: move cpuset seqcount checking to slowpath Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 24/66] Btrfs: disable xattr operations on subvolume directories Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 55/66] IB/rxe: Prevent from completer to operate on non valid QP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 62/66] platform/x86: mlx-platform: free first dev on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 63/66] platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 11/66] drm/atomic: clear out fence when duplicating state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 61/66] virtio_mmio: Set DMA masks appropriately Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 07/66] drm/vc4: Fix an integer overflow in temporary allocation layout. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 59/66] pinctrl: baytrail: Rectify debounce support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 06/66] drm/vc4: Fix memory leak of the CRTC state. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 10/66] Revert "drm/radeon: always apply pci shutdown callbacks" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 14/66] mm, page_alloc: fix check for NULL preferred_zone Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 17/66] mm, page_alloc: fix premature OOM when racing with cpuset mems update Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
[PATCH 4.9 60/66] memory_hotplug: make zone_can_shift() return a boolean value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 07:00 +0100
Re: [PATCH 4.9 00/66] 4.9.7-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-31 19:30 +0100
Re: [PATCH 4.9 00/66] 4.9.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-31 21:20 +0100
Re: [PATCH 4.9 00/66] 4.9.7-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-01-31 23:20 +0100
Re: [PATCH 4.9 00/66] 4.9.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-01 08:30 +0100
csiph-web