TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[media] rtl28xxu: fix control message flaws

Browse Source 
Add lock to prevent concurrent access for control message as control
message function uses shared buffer. Without the lock there may be
remote control polling which messes the buffer causing IO errors.
Increase buffer size and add check for maximum supported message
length.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=103391
Fixes: c56222a6b25c ("[media] rtl28xxu: move usb buffers to state")

Cc: <stable@vger.kernel.org> # 4.0+
Signed-off-by: Antti Palosaari <crope@iki.fi>
This commit is contained in:
Antti Palosaari 2015-10-06 00:22:23 -03:00 committed by Mauro Carvalho Chehab
parent 17f3882203
commit d18ca5b7ce
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/media/usb/dvb-usb-v2/rtl28xxu.c
View File

@ -34,6 +34,14 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req)
unsigned int pipe;
u8 requesttype;
mutex_lock(&d->usb_mutex);
if (req->size > sizeof(dev->buf)) {
dev_err(&d->intf->dev, "too large message %u\n", req->size);
ret = -EINVAL;
goto err_mutex_unlock;
}
if (req->index & CMD_WR_FLAG) {
/* write */
memcpy(dev->buf, req->data, req->size);
@ -50,14 +58,17 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req)
dvb_usb_dbg_usb_control_msg(d->udev, 0, requesttype, req->value,
req->index, dev->buf, req->size);
if (ret < 0)
goto err;
goto err_mutex_unlock;
/* read request, copy returned data to return buf */
if (requesttype == (USB_TYPE_VENDOR | USB_DIR_IN))
memcpy(req->data, dev->buf, req->size);
mutex_unlock(&d->usb_mutex);
return 0;
err:
err_mutex_unlock:
mutex_unlock(&d->usb_mutex);
dev_dbg(&d->intf->dev, "failed=%d\n", ret);
return ret;
}

2
drivers/media/usb/dvb-usb-v2/rtl28xxu.h
View File

@ -71,7 +71,7 @@
struct rtl28xxu_dev {
u8 buf[28];
u8 buf[128];
u8 chip_id;
u8 tuner;
char *tuner_name;