Skip to contentSkip to conversation

saa7164: fix endian conversion in saa7164_bus_set()

PATCH Superseded Dan Carpenter 2 participants 4 messages Nov 23, 2011 – Nov 28, 2011

Subsystems (2)
Media (V4L/DVB) Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 saa7164: fix endian conversion in saa7164_bus_set()

The msg->command field is 32 bits, and we should fill it with a call to cpu_to_le32(). The current code is broken on big endian systems, and on little endian systems it just truncates the 32 bit value to 16 bits.

Signed-off-by Dan Carpenter <[email protected]>

---
This is a static checker bug. I haven't tested it.

drivers/media/video/saa7164/saa7164-bus.c +1 -1
index 466e1b0..8f853d1 100644
@@ -149,7 +149,7 @@ int saa7164_bus_set(struct saa7164_dev *dev, struct tmComResInfo* msg,
 	saa7164_bus_verify(dev);
 
 	msg->size = cpu_to_le16(msg->size);
-	msg->command = cpu_to_le16(msg->command);
+	msg->command = cpu_to_le32(msg->command);
 	msg->controlselector = cpu_to_le16(msg->controlselector);
 
 	if (msg->size > dev->bus.m_wMaxReqSize) {
#1 lore raw

Em 23-11-2011 05:09, Dan Carpenter escreveu:

Quoted 14 lines

The msg->command field is 32 bits, and we should fill it with a call to cpu_to_le32(). The current code is broken on big endian systems, and on little endian systems it just truncates the 32 bit value to 16 bits.

Signed-off-by Dan Carpenter <[email protected]>

---
This is a static checker bug. I haven't tested it.

drivers/media/video/saa7164/saa7164-bus.c +0 -0
index 466e1b0..8f853d1 100644

drivers/media/video/saa7164/saa7164-bus.c int saa7164_bus_set(struct saa7164_dev *dev, struct tmComResInfo* msg, · line 155

Quoted 8 lines
drivers/media/video/saa7164/saa7164-bus.c +1 -1
@@ -149,7 +149,7 @@ int saa7164_bus_set(struct saa7164_dev *dev, struct tmComResInfo* msg,
 	saa7164_bus_verify(dev);
 
 	msg->size = cpu_to_le16(msg->size);
-	msg->command = cpu_to_le16(msg->command);
+	msg->command = cpu_to_le32(msg->command);
 	msg->controlselector = cpu_to_le16(msg->controlselector);
 
 	if (msg->size > dev->bus.m_wMaxReqSize) {

Hmm... I don't have this hardware, but:

peekout:

        msg->size = le16_to_cpu(msg->size);
        msg->command = le16_to_cpu(msg->command);
        msg->controlselector = le16_to_cpu(msg->controlselector);
        ret = SAA_OK;
out:
        mutex_unlock(&bus->lock);
        saa7164_bus_verify(dev);
        return ret;
}

le16_to_cpu() is used for command. If one place needs fix, so the other one also requires it.

Regards,
Mauro

author
#2 lore raw

Re: [patch] [media] saa7164: fix endian conversion in

Quoted 3 lines · Mauro Carvalho Chehab

le16_to_cpu() is used for command. If one place needs fix, so the other one also requires it.

Ah yeah. I should have looked for that. I'll take another look and see if there was anything else I missed and resend.

regards,
dan carpenter

author
#3 lore raw

PATCH v2 1/1 saa7164: fix endian conversion in

In reply to Mauro Carvalho Chehab

The msg->command field is 32 bits, and we should fill it with a call to cpu_to_le32(). The current code is broke on big endian systems. On little endian systems it truncates the 32 bit value to 16 bits which probably still works fine.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: Mauro pointed out that I missed the conversion back to cpu endian.

This is a static checker bug. The current code is definitely broken on big endian systems. I'm pretty sure my fix is correct, but I don't have the hardware to test it.

drivers/media/video/saa7164/saa7164-bus.c +2 -2
index 466e1b0..a7f58a9 100644
@@ -149,7 +149,7 @@ int saa7164_bus_set(struct saa7164_dev *dev, struct tmComResInfo* msg,
 	saa7164_bus_verify(dev);
 
 	msg->size = cpu_to_le16(msg->size);
-	msg->command = cpu_to_le16(msg->command);
+	msg->command = cpu_to_le32(msg->command);
 	msg->controlselector = cpu_to_le16(msg->controlselector);
 
 	if (msg->size > dev->bus.m_wMaxReqSize) {

@@ -464,7 +464,7 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
 
 peekout:
 	msg->size = le16_to_cpu(msg->size);
-	msg->command = le16_to_cpu(msg->command);
+	msg->command = le32_to_cpu(msg->command);
 	msg->controlselector = le16_to_cpu(msg->controlselector);
 	ret = SAA_OK;
 out: