media/drx39xyj: fix DJH_DEBUG path null pointer dereferences, and compile errors.

This patch series fixes null pointer dereference boot failure as well as compile errors.

Shuah Khan (3):
media/drx39xyj: fix pr_dbg undefined compile errors when DJH_DEBUG is
defined
media/drx39xyj: remove return that prevents DJH_DEBUG code to run media/drx39xyj: fix boot failure due to null pointer dereference

 drivers/media/dvb-frontends/drx39xyj/drxj.c | 31 ++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 12 deletions(-)

1.8.3.2

drxj.c fails to compile with the following errors when DJH_DEBUG is defined.

drivers/media/dvb-frontends/drx39xyj/drxj.c:1567:2: error: implicit declaration of function ‘pr_dbg’ [-Werror=implicit-function-declaration]
pr_dbg("drx3933 i2c operation addr=%x i2c=%p, wc=%x rc=%x\n",
^

---
 drivers/media/dvb-frontends/drx39xyj/drxj.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index ed68c52..a78af4e 100644
@@ -1562,7 +1562,7 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
 		 .flags = I2C_M_RD, .buf = r_data, .len = r_count},
 	};
 
-	pr_dbg("drx3933 i2c operation addr=%x i2c=%p, wc=%x rc=%x\n",
+	pr_debug("drx3933 i2c operation addr=%x i2c=%p, wc=%x rc=%x\n",
 	       w_dev_addr->i2c_addr, state->i2c, w_count, r_count);
 
 	if (i2c_transfer(state->i2c, msg, 2) != 2) {

@@ -20640,7 +20640,7 @@ static int drx39xxj_set_frontend(struct dvb_frontend *fe)
 	for (i = 0; i < 2000; i++) {
 		fe_status_t status;
 		drx39xxj_read_status(fe, &status);
-		pr_dbg("i=%d status=%d\n", i, status);
+		pr_debug("i=%d status=%d\n", i, status);
 		msleep(100);
 		i += 100;
 	}

@@ -20663,7 +20663,7 @@ static int drx39xxj_i2c_gate_ctrl(struct dvb_frontend *fe, int enable)
 	int result;
 
 #ifdef DJH_DEBUG
-	pr_dbg("i2c gate call: enable=%d state=%d\n", enable,
+	pr_debug("i2c gate call: enable=%d state=%d\n", enable,
 	       state->i2c_gate_open);
 #endif
 

1.8.3.2

drxbsp_i2c_write_read() has return that prevents DJH_DEBUG code to run. Remove it.

---
 drivers/media/dvb-frontends/drx39xyj/drxj.c | 2 --
 1 file changed, 2 deletions(-)

index a78af4e..72c541a 100644
@@ -1550,8 +1550,6 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
 		return -EREMOTEIO;
 	}
 
-	return 0;
-
 #ifdef DJH_DEBUG
 	struct drx39xxj_state *state = w_dev_addr->user_data;
 

1.8.3.2

DJH_DEBUG only code path in drxbsp_i2c_write_read() dereferences w_dev_addr and subsequently w_dev_addr->user_data->i2c which results in failure during boot. This patch fixes the null pointer derefence bug as well as the following compile errors:

LD arch/x86/built-in.o
CC drivers/media/dvb-frontends/drx39xyj/drxj.o
drivers/media/dvb-frontends/drx39xyj/drxj.c: In function ‘drxbsp_i2c_write_read’:
drivers/media/dvb-frontends/drx39xyj/drxj.c:1558:25: error: redeclaration of ‘state’ with no linkage

  struct drx39xxj_state *state = w_dev_addr->user_data;
                         ^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1512:25: note: previous declaration of ‘state’ was here
  struct drx39xxj_state *state;
                         ^

drivers/media/dvb-frontends/drx39xyj/drxj.c:1558:2: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
struct drx39xxj_state *state = w_dev_addr->user_data;
^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1560:17: error: redeclaration of ‘msg’ with no linkage

  struct i2c_msg msg[2] = {
                 ^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1513:17: note: previous declaration of ‘msg’ was here
  struct i2c_msg msg[2];
                 ^

---
 drivers/media/dvb-frontends/drx39xyj/drxj.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

index 72c541a..585d891 100644
@@ -1551,14 +1551,23 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
 	}
 
 #ifdef DJH_DEBUG
-	struct drx39xxj_state *state = w_dev_addr->user_data;
+	if (w_dev_addr == NULL || r_dev_addr == NULL)
+		return 0;
 
-	struct i2c_msg msg[2] = {
-		{.addr = w_dev_addr->i2c_addr,
-		 .flags = 0, .buf = wData, .len = w_count},
-		{.addr = r_dev_addr->i2c_addr,
-		 .flags = I2C_M_RD, .buf = r_data, .len = r_count},
-	};
+	state = w_dev_addr->user_data;
+
+	if (state->i2c == NULL)
+		return 0;
+
+	msg[0].addr = w_dev_addr->i2c_addr;
+	msg[0].flags = 0;
+	msg[0].buf = wData;
+	msg[0].len = w_count;
+	msg[1].addr = r_dev_addr->i2c_addr;
+	msg[1].flags = I2C_M_RD;
+	msg[1].buf = r_data;
+	msg[1].len = r_count;
+	num_msgs = 2;
 
 	pr_debug("drx3933 i2c operation addr=%x i2c=%p, wc=%x rc=%x\n",
 	       w_dev_addr->i2c_addr, state->i2c, w_count, r_count);

1.8.3.2

Seems kind of strange that I wasn't on the CC for this, since I was the original author of all that code (in fact, DJH are my initials).

Mauro, did you strip off my authorship when you pulled the patches from my tree?

The patches themselves look sane, and I will send a formal Acked-by once I can get in front of a real computer.

Devin

Devin J. Heitmueller - Kernel Labs
http://www.kernellabs.com

Thanks for the ack. I will include you on the cc for future patches. I am working in Mauro's experimental git and probably that explains why get_maintainer.pl just showed linux-media and Mauro.

-- Shuah

Shuah Khan
Senior Linux Kernel Developer - Open Source Group
Samsung Research America(Silicon Valley)
[email protected] | (970) 672-0658

Hi Devin,

Em Fri, 28 Feb 2014 19:13:16 -0500
Devin Heitmueller <[email protected]> escreveu:

Thanks for warning me about that!

Not sure what happened there. The original branch were added back in 2012, with the sole reason to provide a way for Patrick Dickey to catch a few patches I made on that time with some CodingStyle fixes:
http://git.linuxtv.org/mchehab/experimental.git/shortlog/refs/heads/drx-j

There, your name was there as an extra weird "Committer" tag on those changesets:

	http://git.linuxtv.org/mchehab/experimental.git/commit/24d5ed7b19cc19f807264d7d4d56ab48e5cab230
	http://git.linuxtv.org/mchehab/experimental.git/commit/0440897f72b9cf82b8f576fae292b0567ad88239

The second one also contained a "Tag: tip" on it. So, I suspect that something wrong happened when I imported it (either from your tree or from some email sent by you or by Patrick). Probably, some broken hg-import scripting.

Anyway, I rebased my tree, fixing those issues, at:
http://git.linuxtv.org/mchehab/experimental.git/shortlog/refs/heads/drx-j-v3

I also added a credit at the first patch for Patrick's fixes that I suspect it was merged somehow there, based on the comments he posted at the mailing list when he sent his 25-patches series:

	https://lwn.net/Articles/467301/

Please let me know if you find any other issues on it. Anyway, I'll post the patches from my experimental branch at the ML before merging them upstream, in order to get a proper review.

Before that happen, however, I need to fix a serious bug that is preventing to watch TV with this frontend, that it is there since the first patch.

To be sure that this is a driver issue, I tested the driver on another OS using the original PCTV driver, and it worked.

However, since the first working version of this driver, it is randomly losing MPEG TS packets.

The bug is intermittent: every time it sets up VSB reception, it loses different MPEG TS tables. Sometimes, not a single TS packet is received, but, most of the time, it gets ~ 1/10 of the expected number of packets.

It behaves like letting a hardware PID filtering on some random state, inspecting the traffic using dvbv5-zap at monitor mode shows just a small set of the MPEG TS PIDs, but I'm starting to suspect that it could be due to something else, like an improper ISOC setting at em28xx or due to some clock initialized with the wrong value.

I'm even tried to compare what's the original driver is doing with the Linux one, but the original driver provided by PCTV was compiled using a different firmware version, so it uses a different drxj_map.h.

I would need to get in hands the drxj_map.h used by PCTV, in order to be able to properly see what initialization is being done by the PCTV driver and see what sequence is missing.

I won't be merging this driver upstream while this bug is not fixed.

It would help a lot if I could get the original tree you worked with, as maybe this bug might not be present there. In such case, then the bug is likely at em28xx side.

Do you still have a copy of your old hg tree? Do you have some contact at PCTV that could help me either getting a binary driver using the same version as the one you used here, or getting me the newer drxj_map.h file?

Thanks,
Mauro

Cheers,
Mauro

Em Sat, 01 Mar 2014 07:57:42 -0300
Mauro Carvalho Chehab <[email protected]> escreveu:

Partially found and fixed it with this patch:

	http://git.linuxtv.org/mchehab/experimental.git/commitdiff/5cc6dca273e51494c17df5e488aaf223732edb38

After that, it properly receives data at the right rate (~19Mbps) as generated by DTA-2111.

However, there are still some weird things happening there... While the bit rate is ~ 19 Mbps, and adding a printk just before calling dvb_dmx_swfilter() to print the rate is showing the right bitrate (The signal generator shows it as 19.392.659 bps):

[86213.084891] em28xx_dvb_urb_data_copy: 19428.672 kbps
[86214.087737] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86215.090586] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86216.093433] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86217.096280] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86218.099126] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86219.101971] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86220.104814] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86221.107659] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86222.110519] em28xx_dvb_urb_data_copy: 19430.176 kbps
[86223.113351] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86224.116200] em28xx_dvb_urb_data_copy: 19431.680 kbps
[86225.119047] em28xx_dvb_urb_data_copy: 19431.680 kbps

Using dvbv5-zap on monitor mode only shows about 6.3 Mbps:

PID FREQ SPEED TOTAL

05b6      1.33 p/s      2.0 Kbps        2 KB
06a5      4.57 p/s      6.7 Kbps       10 KB
07cf      4.40 p/s      6.5 Kbps        9 KB
0a93   1200.38 p/s   1763.1 Kbps     2651 KB
0f75      2.66 p/s      3.9 Kbps        5 KB
1743      5.49 p/s      8.1 Kbps       12 KB
18c4   1205.04 p/s   1769.9 Kbps     2661 KB
197a      4.65 p/s      6.8 Kbps       10 KB
1c15      4.99 p/s      7.3 Kbps       11 KB
1c68   1286.40 p/s   1889.4 Kbps     2841 KB
1d4b      4.32 p/s      6.3 Kbps        9 KB
1fb2      4.07 p/s      6.0 Kbps        8 KB
1fff      2.33 p/s      3.4 Kbps        5 KB

TOT 4319.15 p/s 6343.7 Kbps 9541 KB

Lock (0x1f) Signal= 71.00% C/N= 0.42% UCB= 273 postBER= 0

It seems that most of the packets are without the 0x47 sync byte there.

In order to compare with another frontend, this is what it is seen with WinTV Aero-A (model 72251, rev D3F0):

 PID          FREQ         SPEED       TOTAL
0000     15.87 p/s     23.3 Kbps       29 KB
0010      6.39 p/s      9.4 Kbps       11 KB
0011  11754.82 p/s  17264.9 Kbps    21617 KB
0014    312.27 p/s    458.6 Kbps      574 KB
0015    156.03 p/s    229.2 Kbps      286 KB
001f      1.70 p/s      2.5 Kbps        3 KB
0200    430.07 p/s    631.7 Kbps      790 KB
0630      6.39 p/s      9.4 Kbps       11 KB
1053      7.19 p/s     10.6 Kbps       13 KB
1054      2.40 p/s      3.5 Kbps        4 KB
1055      2.40 p/s      3.5 Kbps        4 KB
1056      1.70 p/s      2.5 Kbps        3 KB
112d      4.79 p/s      7.0 Kbps        8 KB
112e      1.60 p/s      2.3 Kbps        2 KB
112f      1.60 p/s      2.3 Kbps        2 KB

1ffb 14.97 p/s 22.0 Kbps 27 KB
1fff 159.43 p/s 234.2 Kbps 293 KB
TOT 12880.50 p/s 18918.2 Kbps 23688 KB

Lock (0x1f) Signal= 71.43% C/N= 0.38% UCB= 250 postBER= 0

The net result is that it is impossible to watch TV with PCTV 80e, as most of the MPEG TS packages got discarded, but it works fine with WinTV Aero.

So, there's something causing packet corruption there at drx-j.

No sure yet how to fix it.

Regards,

Cheers,
Mauro