linux-kernel - Re: [PATCH] media: cec: core: remove length check of Timer Status

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <852dea56-336a-4484-8754-ee735af7bdaf@xs4all.nl>
Date: Wed, 21 Feb 2024 10:02:01 +0100
From: Hans Verkuil <hverkuil-cisco@...all.nl>
To: Nini Song (宋宛妮) <Nini.Song@...iatek.com>
Cc: "linux-mediatek@...ts.infradead.org"
 <linux-mediatek@...ts.infradead.org>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
 "linux-media@...r.kernel.org" <linux-media@...r.kernel.org>,
 CI Wu (伍倉億) <ci.wu@...iatek.com>,
 "mchehab@...nel.org" <mchehab@...nel.org>,
 "stable@...r.kernel.org" <stable@...r.kernel.org>,
 "nicolas@...sle.eu" <nicolas@...sle.eu>,
 "linux-arm-kernel@...ts.infradead.org"
 <linux-arm-kernel@...ts.infradead.org>,
 "matthias.bgg@...il.com" <matthias.bgg@...il.com>,
 "angelogioacchino.delregno@...labora.com"
 <angelogioacchino.delregno@...labora.com>,
 "jani.nikula@...el.com" <jani.nikula@...el.com>
Subject: Re: [PATCH] media: cec: core: remove length check of Timer Status

Dear Nini,

Unfortunately I forgot to add a 'Fixes' tag to the patch, if I had, then it would
have happened automatically.

Please remind me of this once kernel 6.9-rc1 is released since that will contain
the fix. Then I can post the same patch to the stable mailinglist for inclusion in
older kernels.

It has to wait until 6.9-rc1 is release though, patches need to be in mainline first
before they can be backported.

Regards,

	Hans

On 21/02/2024 07:30, Nini Song (宋宛妮) wrote:
> Dear Hans,
> 
> Thank your reply.
> Could you also help to marge solution into v5.15? Our customer used v5.15 for MP production, which requires this solution.
> 
> 
> BR,
> Nini Song
> On Mon, 2024-02-05 at 13:00 +0100, Hans Verkuil wrote:
>> 	
>>
>> External email : Please do not click links or open attachments until you have verified the sender or the content.
>>
>> On 25/01/2024 14:28, nini.song@...iatek.com wrote:
>> > From: "nini.song" <nini.song@...iatek.com>
>> > 
>> > The valid_la is used to check the length requirements,
>> > including special cases of Timer Status. If the length is
>> > shorter than 5, that means no Duration Available is returned,
>> > the message will be forced to be invalid.
>> > 
>> > However, the description of Duration Available in the spec
>> > is that this parameter may be returned when these cases, or
>> > that it can be optionally return when these cases. The key
>> > words in the spec description are flexible choices.
>>
>> Good catch, the spec indeed says 'may', so dropping the check
>> in this patch is the correct thing to do.
>>
>> It's merged in our staging tree and it will appear in v6.9.
>>
>> Regards,
>>
>> Hans
>>
>> > 
>> > Remove the special length check of Timer Status to fit the
>> > spec which is not compulsory about that.
>> > 
>> > Signed-off-by: Nini Song <nini.song@...iatek.com>
>> > ---
>> >  drivers/media/cec/core/cec-adap.c | 14 --------------
>> >  1 file changed, 14 deletions(-)
>> > 
>> > diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
>> > index 5741adf09a2e..559a172ebc6c 100644
>> > --- a/drivers/media/cec/core/cec-adap.c
>> > +++ b/drivers/media/cec/core/cec-adap.c
>> > @@ -1151,20 +1151,6 @@ void cec_received_msg_ts(struct cec_adapter *adap,
>> >  if (valid_la && min_len) {
>> >  /* These messages have special length requirements */
>> >  switch (cmd) {
>> > -case CEC_MSG_TIMER_STATUS:
>> > -if (msg->msg[2] & 0x10) {
>> > -switch (msg->msg[2] & 0xf) {
>> > -case CEC_OP_PROG_INFO_NOT_ENOUGH_SPACE:
>> > -case CEC_OP_PROG_INFO_MIGHT_NOT_BE_ENOUGH_SPACE:
>> > -if (msg->len < 5)
>> > -valid_la = false;
>> > -break;
>> > -}
>> > -} else if ((msg->msg[2] & 0xf) == CEC_OP_PROG_ERROR_DUPLICATE) {
>> > -if (msg->len < 5)
>> > -valid_la = false;
>> > -}
>> > -break;
>> >  case CEC_MSG_RECORD_ON:
>> >  switch (msg->msg[2]) {
>> >  case CEC_OP_RECORD_SRC_OWN:
>>
>>