linux-kernel - Re: [PATCH 07/26] dib0700: be sure that dib0700_ctrl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 10 Oct 2016 08:38:18 +0200
From:   Patrick Boettcher <patrick.boettcher@...teo.de>
To:     Mauro Carvalho Chehab <mchehab@...pensource.com>
Cc:     Linux Media Mailing List <linux-media@...r.kernel.org>,
        Mauro Carvalho Chehab <mchehab@...radead.org>,
        Andy Lutomirski <luto@...capital.net>,
        Johannes Stezenbach <js@...uxtv.org>,
        Jiri Kosina <jikos@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...nel.org>,
        Michael Krufky <mkrufky@...uxtv.org>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Jörg Otte <jrg.otte@...il.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Kees Cook <keescook@...omium.org>,
        Wolfram Sang <wsa-dev@...g-engineering.com>,
        Sean Young <sean@...s.org>,
        Nicolas Sugino <nsugino@...y.com.ar>,
        Alejandro Torrado <aletorrado@...il.com>
Subject: Re: [PATCH 07/26] dib0700: be sure that dib0700_ctrl_rd() users can
 do DMA

On Fri,  7 Oct 2016 14:24:17 -0300
Mauro Carvalho Chehab <mchehab@...pensource.com> wrote:

> dib0700_ctrl_rd() takes a RX and a TX pointer. Be sure that
> both will point to a memory allocated via kmalloc().
> 
> Signed-off-by: Mauro Carvalho Chehab <mchehab@...pensource.com>
> ---
>  drivers/media/usb/dvb-usb/dib0700_core.c    |  4 +++-
>  drivers/media/usb/dvb-usb/dib0700_devices.c | 25
> +++++++++++++------------ 2 files changed, 16 insertions(+), 13
> deletions(-)
> 
> diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c
> b/drivers/media/usb/dvb-usb/dib0700_core.c index
> f3196658fb70..515f89dba199 100644 ---
> a/drivers/media/usb/dvb-usb/dib0700_core.c +++
> b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -292,13 +292,15 @@
> static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap, 
>  			/* special thing in the current firmware:
> when length is zero the read-failed */ len = dib0700_ctrl_rd(d,
> st->buf, msg[i].len + 2,
> -					msg[i+1].buf, msg[i+1].len);
> +					      st->buf, msg[i +
> 1].len); if (len <= 0) {
>  				deb_info("I2C read failed on address
> 0x%02x\n", msg[i].addr);
>  				break;
>  			}
>  
> +			memcpy(msg[i + 1].buf, st->buf, msg[i +
> 1].len); +
>  			msg[i+1].len = len;
>  
>  			i++;
> diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c
> b/drivers/media/usb/dvb-usb/dib0700_devices.c index
> 0857b56e652c..ef1b8ee75c57 100644 ---
> a/drivers/media/usb/dvb-usb/dib0700_devices.c +++
> b/drivers/media/usb/dvb-usb/dib0700_devices.c @@ -508,8 +508,6 @@
> static int stk7700ph_tuner_attach(struct dvb_usb_adapter *adap) 
>  #define DEFAULT_RC_INTERVAL 50
>  
> -static u8 rc_request[] = { REQUEST_POLL_RC, 0 };
> -
>  /*
>   * This function is used only when firmware is < 1.20 version. Newer
>   * firmwares use bulk mode, with functions implemented at
> dib0700_core, @@ -517,7 +515,6 @@ static u8 rc_request[] =
> { REQUEST_POLL_RC, 0 }; */
>  static int dib0700_rc_query_old_firmware(struct dvb_usb_device *d)
>  {
> -	u8 key[4];
>  	enum rc_type protocol;
>  	u32 scancode;
>  	u8 toggle;
> @@ -532,39 +529,43 @@ static int dib0700_rc_query_old_firmware(struct
> dvb_usb_device *d) return 0;
>  	}
>  
> -	i = dib0700_ctrl_rd(d, rc_request, 2, key, 4);
> +	st->buf[0] = REQUEST_POLL_RC;
> +	st->buf[1] = 0;
> +
> +	i = dib0700_ctrl_rd(d, st->buf, 2, st->buf, 4);
>  	if (i <= 0) {
>  		err("RC Query Failed");
> -		return -1;
> +		return -EIO;
>  	}
>  
>  	/* losing half of KEY_0 events from Philipps rc5 remotes.. */
> -	if (key[0] == 0 && key[1] == 0 && key[2] == 0 && key[3] == 0)
> +	if (st->buf[0] == 0 && st->buf[1] == 0
> +	    && st->buf[2] == 0 && st->buf[3] == 0)
>  		return 0;
>  
> -	/* info("%d: %2X %2X %2X
> %2X",dvb_usb_dib0700_ir_proto,(int)key[3-2],(int)key[3-3],(int)key[3-1],(int)key[3]);
> */
> +	/* info("%d: %2X %2X %2X
> %2X",dvb_usb_dib0700_ir_proto,(int)st->buf[3 - 2],(int)st->buf[3 -
> 3],(int)st->buf[3 - 1],(int)st->buf[3]);  */ dib0700_rc_setup(d,
> NULL); /* reset ir sensor data to prevent false events */ 
>  	switch (d->props.rc.core.protocol) {
>  	case RC_BIT_NEC:
>  		/* NEC protocol sends repeat code as 0 0 0 FF */
> -		if ((key[3-2] == 0x00) && (key[3-3] == 0x00) &&
> -		    (key[3] == 0xff)) {
> +		if ((st->buf[3 - 2] == 0x00) && (st->buf[3 - 3] ==
> 0x00) &&
> +		    (st->buf[3] == 0xff)) {
>  			rc_repeat(d->rc_dev);
>  			return 0;
>  		}
>  
>  		protocol = RC_TYPE_NEC;
> -		scancode = RC_SCANCODE_NEC(key[3-2], key[3-3]);
> +		scancode = RC_SCANCODE_NEC(st->buf[3 - 2], st->buf[3
> - 3]); toggle = 0;
>  		break;
>  
>  	default:
>  		/* RC-5 protocol changes toggle bit on new keypress
> */ protocol = RC_TYPE_RC5;
> -		scancode = RC_SCANCODE_RC5(key[3-2], key[3-3]);
> -		toggle = key[3-1];
> +		scancode = RC_SCANCODE_RC5(st->buf[3 - 2], st->buf[3
> - 3]);
> +		toggle = st->buf[3 - 1];
>  		break;
>  	}
>  

Reviewed-By: Patrick Boettcher <patrick.boettcher@...teo.de>