releases/3.1.1/dib0700-protect-the-dib0700-buffer-access.patch

   1 From bff469f4167fdabfe15294f375577d7eadbaa1bb Mon Sep 17 00:00:00 2001
   2 From: Olivier Grenie <olivier.grenie@dibcom.fr>
   3 Date: Mon, 1 Aug 2011 12:45:58 -0300
   4 Subject: [media] dib0700: protect the dib0700 buffer access
   5
   6 From: Olivier Grenie <olivier.grenie@dibcom.fr>
   7
   8 commit bff469f4167fdabfe15294f375577d7eadbaa1bb upstream.
   9
  10 This patch protects the common buffer access inside the dib0700 in order
  11 to manage concurrent access. This protection is done using mutex.
  12
  13 Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
  14 Cc: Florian Mickler <florian@mickler.org>
  15 Signed-off-by: Javier Marcet <javier@marcet.info>
  16 Signed-off-by: Olivier Grenie <olivier.grenie@dibcom.fr>
  17 Signed-off-by: Patrick Boettcher <patrick.boettcher@dibcom.fr>
  18 [mchehab@redhat.com: dprint requires 3 arguments. Replaced by dib_info]
  19 Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  21
  22 ---
  23  drivers/media/dvb/dvb-usb/dib0700_core.c |   81 +++++++++++++++++++++++++++----
  24  1 file changed, 72 insertions(+), 9 deletions(-)
  25
  26 --- a/drivers/media/dvb/dvb-usb/dib0700_core.c
  27 +++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
  28 @@ -30,6 +30,11 @@ int dib0700_get_version(struct dvb_usb_d
  29         struct dib0700_state *st = d->priv;
  30         int ret;
  31
  32 +       if (mutex_lock_interruptible(&d->usb_mutex) < 0) {
  33 +               deb_info("could not acquire lock");
  34 +               return 0;
  35 +       }
  36 +
  37         ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
  38                                   REQUEST_GET_VERSION,
  39                                   USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
  40 @@ -46,6 +51,7 @@ int dib0700_get_version(struct dvb_usb_d
  41         if (fwtype != NULL)
  42                 *fwtype     = (st->buf[12] << 24) | (st->buf[13] << 16) |
  43                         (st->buf[14] << 8) | st->buf[15];
  44 +       mutex_unlock(&d->usb_mutex);
  45         return ret;
  46  }
  47
  48 @@ -108,7 +114,12 @@ int dib0700_ctrl_rd(struct dvb_usb_devic
  49  int dib0700_set_gpio(struct dvb_usb_device *d, enum dib07x0_gpios gpio, u8 gpio_dir, u8 gpio_val)
  50  {
  51         struct dib0700_state *st = d->priv;
  52 -       s16 ret;
  53 +       int ret;
  54 +
  55 +       if (mutex_lock_interruptible(&d->usb_mutex) < 0) {
  56 +               deb_info("could not acquire lock");
  57 +               return 0;
  58 +       }
  59
  60         st->buf[0] = REQUEST_SET_GPIO;
  61         st->buf[1] = gpio;
  62 @@ -116,6 +127,7 @@ int dib0700_set_gpio(struct dvb_usb_devi
  63
  64         ret = dib0700_ctrl_wr(d, st->buf, 3);
  65
  66 +       mutex_unlock(&d->usb_mutex);
  67         return ret;
  68  }
  69
  70 @@ -125,6 +137,11 @@ static int dib0700_set_usb_xfer_len(stru
  71         int ret;
  72
  73         if (st->fw_version >= 0x10201) {
  74 +               if (mutex_lock_interruptible(&d->usb_mutex) < 0) {
  75 +                       deb_info("could not acquire lock");
  76 +                       return 0;
  77 +               }
  78 +
  79                 st->buf[0] = REQUEST_SET_USB_XFER_LEN;
  80                 st->buf[1] = (nb_ts_packets >> 8) & 0xff;
  81                 st->buf[2] = nb_ts_packets & 0xff;
  82 @@ -132,6 +149,7 @@ static int dib0700_set_usb_xfer_len(stru
  83                 deb_info("set the USB xfer len to %i Ts packet\n", nb_ts_packets);
  84
  85                 ret = dib0700_ctrl_wr(d, st->buf, 3);
  86 +               mutex_unlock(&d->usb_mutex);
  87         } else {
  88                 deb_info("this firmware does not allow to change the USB xfer len\n");
  89                 ret = -EIO;
  90 @@ -208,6 +226,10 @@ static int dib0700_i2c_xfer_new(struct i
  91
  92                 } else {
  93                         /* Write request */
  94 +                       if (mutex_lock_interruptible(&d->usb_mutex) < 0) {
  95 +                               deb_info("could not acquire lock");
  96 +                               return 0;
  97 +                       }
  98                         st->buf[0] = REQUEST_NEW_I2C_WRITE;
  99                         st->buf[1] = msg[i].addr << 1;
 100                         st->buf[2] = (en_start << 7) | (en_stop << 6) |
 101 @@ -227,6 +249,7 @@ static int dib0700_i2c_xfer_new(struct i
 102                                                  USB_TYPE_VENDOR | USB_DIR_OUT,
 103                                                  0, 0, st->buf, msg[i].len + 4,
 104                                                  USB_CTRL_GET_TIMEOUT);
 105 +                       mutex_unlock(&d->usb_mutex);
 106                         if (result < 0) {
 107                                 deb_info("i2c write error (status = %d)\n", result);
 108                                 break;
 109 @@ -249,6 +272,10 @@ static int dib0700_i2c_xfer_legacy(struc
 110
 111         if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
 112                 return -EAGAIN;
 113 +       if (mutex_lock_interruptible(&d->usb_mutex) < 0) {
 114 +               deb_info("could not acquire lock");
 115 +               return 0;
 116 +       }
 117
 118         for (i = 0; i < num; i++) {
 119                 /* fill in the address */
 120 @@ -279,6 +306,7 @@ static int dib0700_i2c_xfer_legacy(struc
 121                                 break;
 122                 }
 123         }
 124 +       mutex_unlock(&d->usb_mutex);
 125         mutex_unlock(&d->i2c_mutex);
 126
 127         return i;
 128 @@ -337,7 +365,12 @@ static int dib0700_set_clock(struct dvb_
 129         u16 pll_loopdiv, u16 free_div, u16 dsuScaler)
 130  {
 131         struct dib0700_state *st = d->priv;
 132 -       s16 ret;
 133 +       int ret;
 134 +
 135 +       if (mutex_lock_interruptible(&d->usb_mutex) < 0) {
 136 +               deb_info("could not acquire lock");
 137 +               return 0;
 138 +       }
 139
 140         st->buf[0] = REQUEST_SET_CLOCK;
 141         st->buf[1] = (en_pll << 7) | (pll_src << 6) |
 142 @@ -352,6 +385,7 @@ static int dib0700_set_clock(struct dvb_
 143         st->buf[9] =  dsuScaler         & 0xff; /* LSB */
 144
 145         ret = dib0700_ctrl_wr(d, st->buf, 10);
 146 +       mutex_unlock(&d->usb_mutex);
 147
 148         return ret;
 149  }
 150 @@ -360,10 +394,16 @@ int dib0700_set_i2c_speed(struct dvb_usb
 151  {
 152         struct dib0700_state *st = d->priv;
 153         u16 divider;
 154 +       int ret;
 155
 156         if (scl_kHz == 0)
 157                 return -EINVAL;
 158
 159 +       if (mutex_lock_interruptible(&d->usb_mutex) < 0) {
 160 +               deb_info("could not acquire lock");
 161 +               return 0;
 162 +       }
 163 +
 164         st->buf[0] = REQUEST_SET_I2C_PARAM;
 165         divider = (u16) (30000 / scl_kHz);
 166         st->buf[1] = 0;
 167 @@ -379,7 +419,11 @@ int dib0700_set_i2c_speed(struct dvb_usb
 168         deb_info("setting I2C speed: %04x %04x %04x (%d kHz).",
 169                 (st->buf[2] << 8) | (st->buf[3]), (st->buf[4] << 8) |
 170                 st->buf[5], (st->buf[6] << 8) | st->buf[7], scl_kHz);
 171 -       return dib0700_ctrl_wr(d, st->buf, 8);
 172 +
 173 +       ret = dib0700_ctrl_wr(d, st->buf, 8);
 174 +       mutex_unlock(&d->usb_mutex);
 175 +
 176 +       return ret;
 177  }
 178
 179
 180 @@ -515,6 +559,11 @@ int dib0700_streaming_ctrl(struct dvb_us
 181                 }
 182         }
 183
 184 +       if (mutex_lock_interruptible(&adap->dev->usb_mutex) < 0) {
 185 +               deb_info("could not acquire lock");
 186 +               return 0;
 187 +       }
 188 +
 189         st->buf[0] = REQUEST_ENABLE_VIDEO;
 190         /* this bit gives a kind of command,
 191          * rather than enabling something or not */
 192 @@ -548,7 +597,10 @@ int dib0700_streaming_ctrl(struct dvb_us
 193
 194         deb_info("data for streaming: %x %x\n", st->buf[1], st->buf[2]);
 195
 196 -       return dib0700_ctrl_wr(adap->dev, st->buf, 4);
 197 +       ret = dib0700_ctrl_wr(adap->dev, st->buf, 4);
 198 +       mutex_unlock(&adap->dev->usb_mutex);
 199 +
 200 +       return ret;
 201  }
 202
 203  int dib0700_change_protocol(struct rc_dev *rc, u64 rc_type)
 204 @@ -557,6 +609,11 @@ int dib0700_change_protocol(struct rc_de
 205         struct dib0700_state *st = d->priv;
 206         int new_proto, ret;
 207
 208 +       if (mutex_lock_interruptible(&d->usb_mutex) < 0) {
 209 +               deb_info("could not acquire lock");
 210 +               return 0;
 211 +       }
 212 +
 213         st->buf[0] = REQUEST_SET_RC;
 214         st->buf[1] = 0;
 215         st->buf[2] = 0;
 216 @@ -567,23 +624,29 @@ int dib0700_change_protocol(struct rc_de
 217         else if (rc_type == RC_TYPE_NEC)
 218                 new_proto = 0;
 219         else if (rc_type == RC_TYPE_RC6) {
 220 -               if (st->fw_version < 0x10200)
 221 -                       return -EINVAL;
 222 +               if (st->fw_version < 0x10200) {
 223 +                       ret = -EINVAL;
 224 +                       goto out;
 225 +               }
 226
 227                 new_proto = 2;
 228 -       } else
 229 -               return -EINVAL;
 230 +       } else {
 231 +               ret = -EINVAL;
 232 +               goto out;
 233 +       }
 234
 235         st->buf[1] = new_proto;
 236
 237         ret = dib0700_ctrl_wr(d, st->buf, 3);
 238         if (ret < 0) {
 239                 err("ir protocol setup failed");
 240 -               return ret;
 241 +               goto out;
 242         }
 243
 244         d->props.rc.core.protocol = rc_type;
 245
 246 +out:
 247 +       mutex_unlock(&d->usb_mutex);
 248         return ret;
 249  }
 250