Skip to contentSkip to conversation

Patch "media: dvb-usb-v2: lmedm04: Improve logic checking of warm start" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Feb 13, 2018

Subsystems (3)
Stable branch Media (V4L/DVB) LME2510 media driver
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

media: dvb-usb-v2: lmedm04: Improve logic checking of warm start

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
media-dvb-usb-v2-lmedm04-improve-logic-checking-of-warm-start.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 3d932ee27e852e4904647f15b64dedca51187ad7 Mon Sep 17 00:00:00 2001

From: Malcolm Priestley <[email protected]>
Date: Tue, 26 Sep 2017 17:10:20 -0400
Subject: media: dvb-usb-v2: lmedm04: Improve logic checking of warm start

From: Malcolm Priestley <[email protected]>

commit 3d932ee27e852e4904647f15b64dedca51187ad7 upstream.

Warm start has no check as whether a genuine device has connected and proceeds to next execution path.

Check device should read 0x47 at offset of 2 on USB descriptor read and it is the amount requested of 6 bytes.

Fix for
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access as

Reported-by Andrey Konovalov <[email protected]>
Signed-off-by Malcolm Priestley <[email protected]>
Signed-off-by Mauro Carvalho Chehab <[email protected]>
Cc Ben Hutchings <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/media/usb/dvb-usb-v2/lmedm04.c |   26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/media/usb/dvb-usb-v2/lmedm04.c +18 -8
@@ -504,18 +504,23 @@ static int lme2510_pid_filter(struct dvb
 
 static int lme2510_return_status(struct dvb_usb_device *d)
 {
-	int ret = 0;
+	int ret;
 	u8 *data;
 
-	data = kzalloc(10, GFP_KERNEL);
+	data = kzalloc(6, GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 
-	ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
-			0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200);
-	info("Firmware Status: %x (%x)", ret , data[2]);
+	ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
+			      0x06, 0x80, 0x0302, 0x00,
+			      data, 0x6, 200);
+	if (ret != 6)
+		ret = -EINVAL;
+	else
+		ret = data[2];
+
+	info("Firmware Status: %6ph", data);
 
-	ret = (ret < 0) ? -ENODEV : data[2];
 	kfree(data);
 	return ret;
 }

@@ -1200,6 +1205,7 @@ static int lme2510_get_adapter_count(str
 static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
 {
 	struct lme2510_state *st = d->priv;
+	int status;
 
 	usb_reset_configuration(d->udev);
 

@@ -1208,12 +1214,16 @@ static int lme2510_identify_state(struct
 
 	st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware;
 
-	if (lme2510_return_status(d) == 0x44) {
+	status = lme2510_return_status(d);
+	if (status == 0x44) {
 		*name = lme_firmware_switch(d, 0);
 		return COLD;
 	}
 
-	return 0;
+	if (status != 0x47)
+		return -EINVAL;
+
+	return WARM;
 }
 
 static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/media-dvb-usb-v2-lmedm04-move-ts2020-attach-to-dm04_lme2510_tuner.patch queue-4.9/media-dvb-usb-v2-lmedm04-improve-logic-checking-of-warm-start.patch