From patchwork Wed Jun 16 12:28:27 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 461727 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05C96C49361 for ; Wed, 16 Jun 2021 12:28:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DE534613E9 for ; Wed, 16 Jun 2021 12:28:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232971AbhFPMa5 (ORCPT ); Wed, 16 Jun 2021 08:30:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:49294 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232535AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 94CE2613C7; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=oqjheYG9h6Tj93iYGW/qpgENpt3aGXsa0799OrvQ9yI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AlcLOffiFWXL5cRggUltDdgmSWK6JreQRh0+Olh8oMZfUiMTrMymEZkeseIhwfBaU +4wOSWMtGOqYlVuXi6TIHcO5OS7ZZ88Ljk0RDP19GXhLkXPYeldowC46VDcU7cTN4x c+gklEMaGu5KuWBPOuHjQogcSzK85fqYjSC1Qj1kjW7K27PTlBeTHmiczYkQ25WR4Q 2n4xyNQFOV8+8n6rvMJkDcMOlqBmblJdt4IWXba6Hkfvq27iAPCv5B5SLzuKmeinZN LmqCGUb3AJATNlhbI4+lTaU4mNgUZmotnNWdcuLAdfj0WTmx25hMRnDmUfTKQPl6T/ kGUS7Pq7VboEw== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oiP-7C; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 01/11] media: dvb_ca_en50221: avoid speculation from CA slot Date: Wed, 16 Jun 2021 14:28:27 +0200 Message-Id: <77322db90902cd2c9d25fa3d614bf25809e9c609.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org As warned by smatch: drivers/media/dvb-core/dvb_ca_en50221.c:1392 dvb_ca_en50221_io_do_ioctl() warn: potential spectre issue 'ca->slot_info' [r] (local cap) There's a potential of using a CAM ioctl for speculation. The risk here is minimum, as only a small subset of DVB boards have CI, with a CAM module installed. Also, exploiting it would require an user capable of starting a DVB application. There are probably a lot of easier ways to try to exploit. Yet, it doesn't harm addressing it. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_ca_en50221.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index b7e4a3371176..15a08d8c69ef 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -1386,6 +1386,7 @@ static int dvb_ca_en50221_io_do_ioctl(struct file *file, err = -EINVAL; goto out_unlock; } + slot = array_index_nospec(slot, ca->slot_count); info->type = CA_CI_LINK; info->flags = 0; From patchwork Wed Jun 16 12:28:28 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 461732 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E075C48BE6 for ; Wed, 16 Jun 2021 12:28:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4C9C1613DC for ; Wed, 16 Jun 2021 12:28:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232421AbhFPMas (ORCPT ); Wed, 16 Jun 2021 08:30:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:49222 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230283AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7DF5B61359; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=nqOi7exA2OYkFrttpEgptdFAZL2FSfg8ZJVmqK1EC10=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W7s5YjzDLCJAnl3xLIFrS2/DOCq9zs+J42zFZHceYDblpR5xDiSrEqu9zbB2BVWR7 XQ0B7H4EeuCRskAE5HcoVTRQFYn8sqgDWxSrLoE3h/McIqbcdIriEyUTGKknjduqNK /2GbnclE7DQBgwNZkVLCxPpD6v7VKHYR4RMDMZlz7gKQbs5Bop9S6xzO11AmalWPdb CyTZahGB7NDX/eSwgQtTjBn7VxqiNag+fvbyNC9+sMR4X7W9MclHRbp4tmcaO+UhDf NwzqbPZka9o5RRKTGe/zi7AHCBp0a0vDP83AUMLz813W8567JY8bw4cV8ecUiU2Ae6 fZkuWde92fWeQ== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oiS-8D; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , "Gustavo A. R. Silva" , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 02/11] media: dvb_net: avoid speculation from net slot Date: Wed, 16 Jun 2021 14:28:28 +0200 Message-Id: <9b1948f067df308cf875a3d8ec85aaa6b7340a65.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org The risk of especulation is actually almost-non-existing here, as there are very few users of TCP/IP using the DVB stack, as, this is mainly used with DVB-S/S2 cards, and only by people that receives TCP/IP from satellite connections, which limits a lot the number of users of such feature(*). (*) In thesis, DVB-C cards could also benefit from it, but I'm yet to see a hardware that supports it. Yet, fixing it is trivial. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_net.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c index 89620da983ba..dddebea644bb 100644 --- a/drivers/media/dvb-core/dvb_net.c +++ b/drivers/media/dvb-core/dvb_net.c @@ -45,6 +45,7 @@ #include #include #include +#include #include #include #include @@ -1462,14 +1463,20 @@ static int dvb_net_do_ioctl(struct file *file, struct net_device *netdev; struct dvb_net_priv *priv_data; struct dvb_net_if *dvbnetif = parg; + int if_num = dvbnetif->if_num; - if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX || - !dvbnet->state[dvbnetif->if_num]) { + if (if_num >= DVB_NET_DEVICES_MAX) { ret = -EINVAL; goto ioctl_error; } + if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX); - netdev = dvbnet->device[dvbnetif->if_num]; + if (!dvbnet->state[if_num]) { + ret = -EINVAL; + goto ioctl_error; + } + + netdev = dvbnet->device[if_num]; priv_data = netdev_priv(netdev); dvbnetif->pid=priv_data->pid; @@ -1522,14 +1529,20 @@ static int dvb_net_do_ioctl(struct file *file, struct net_device *netdev; struct dvb_net_priv *priv_data; struct __dvb_net_if_old *dvbnetif = parg; + int if_num = dvbnetif->if_num; - if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX || - !dvbnet->state[dvbnetif->if_num]) { + if (if_num >= DVB_NET_DEVICES_MAX) { ret = -EINVAL; goto ioctl_error; } + if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX); - netdev = dvbnet->device[dvbnetif->if_num]; + if (!dvbnet->state[if_num]) { + ret = -EINVAL; + goto ioctl_error; + } + + netdev = dvbnet->device[if_num]; priv_data = netdev_priv(netdev); dvbnetif->pid=priv_data->pid; From patchwork Wed Jun 16 12:28:29 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 462556 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BAD77C48BE5 for ; Wed, 16 Jun 2021 12:28:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 90F1F61400 for ; Wed, 16 Jun 2021 12:28:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232656AbhFPMar (ORCPT ); Wed, 16 Jun 2021 08:30:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:49230 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231179AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8731A61356; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=DzuXxK/L6L29nZjYPejhCPD+EXffrWanY9DtdBFUzHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fhQOAShvNZjN60DXwljR4nweOGTtAFZkmpxoqazHz2NKexrPctvIleK7jG0i349a8 4Fp5Mq9TbF/Un6n+1k3jkKovA7O/GbxYJxBZcqj3n1Ft5mtCkZSXXoKhBIh40h024s skoypPmN02+w+pKV2a5hGzwoE9Ej0l5Ihn5W6JG2rcY6s0Rs4tgffI34NgM8BUhCZo tqAEO1o7sxl96S5/bBI3bWBLmIi4f/wDSAvEC9D4LHgN9/AbAEyjGg4UXrH4ZfslLc 2wCCx2vBmLcCDF+984IMqcDxhcdeseY9qFn/Hz/koqXWWsoAXNyo4QhMhTWttbNIlg JmU3qqaaYtJEw== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oiV-9G; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Dinghao Liu , Mauro Carvalho Chehab , Peilin Ye , Sean Young , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 03/11] media: dvbdev: fix error logic at dvb_register_device() Date: Wed, 16 Jun 2021 14:28:29 +0200 Message-Id: <56a94235a78b2313661154d6802dd8d3b9864de7.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org As reported by smatch: drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:510 dvb_register_device() warn: '&dvbdev->list_head' not removed from list drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:530 dvb_register_device() warn: '&dvbdev->list_head' not removed from list drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:545 dvb_register_device() warn: '&dvbdev->list_head' not removed from list The error logic inside dvb_register_device() doesn't remove devices from the dvb_adapter_list in case of errors. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvbdev.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index 3862ddc86ec4..795d9bfaba5c 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -506,6 +506,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, break; if (minor == MAX_DVB_MINORS) { + list_del (&dvbdev->list_head); kfree(dvbdevfops); kfree(dvbdev); up_write(&minor_rwsem); @@ -526,6 +527,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, __func__); dvb_media_device_free(dvbdev); + list_del (&dvbdev->list_head); kfree(dvbdevfops); kfree(dvbdev); mutex_unlock(&dvbdev_register_lock); @@ -541,6 +543,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, pr_err("%s: failed to create device dvb%d.%s%d (%ld)\n", __func__, adap->num, dnames[type], id, PTR_ERR(clsdev)); dvb_media_device_free(dvbdev); + list_del (&dvbdev->list_head); kfree(dvbdevfops); kfree(dvbdev); return PTR_ERR(clsdev); From patchwork Wed Jun 16 12:28:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 461731 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05FEBC49EA2 for ; Wed, 16 Jun 2021 12:28:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E45AB613D5 for ; Wed, 16 Jun 2021 12:28:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232708AbhFPMat (ORCPT ); Wed, 16 Jun 2021 08:30:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:49238 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231812AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 89F22613B9; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=CSld2s/3tHC+Jh6gkwfRLXdviGut2t9E50vJJvDQ1A4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dYGXaBhaFZk2fxz4aSbTx5GpCXeLb7MdS6tVsUZZexzYIFVrVlsMaNKZQIHDNGtrW oeHkiYmliklw8HBxUwxu21lnz38Y6U6tQKMAjZzo8R6N4w/5r7/7RotuGLkZNr/bWS EE+8qZu2B/0f+gNO4FTlNuZO4l9YSTDNPn4azOvSMPjlq/MRVk7/4Rl8wulyiYRQ11 pVrcYDl04PvTDPUzoHmBdNibWU9weVAE8t73wHlC+icegaueEgOJ1gdqFpkIncHE0o ZL4CgnHoXDaNRDC2iG/zLbAvTVrjFhjV1QXWJ7HFyKJaZHSrIBH2AfPQMyFRYoCJZe IDK7zL+SX48KA== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oib-AH; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Chen-Yu Tsai , Jernej Skrabec , Mauro Carvalho Chehab , Maxime Ripard , Yong Deng , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linux-sunxi@lists.linux.dev Subject: [PATCH 04/11] media: sun6i-csi: add a missing return code Date: Wed, 16 Jun 2021 14:28:30 +0200 Message-Id: <525bad50008338d96fb71e724675061ffa07ff87.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org As pointed by smatch, there's a missing return code: drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c:485 sun6i_video_open() warn: missing error code 'ret' Signed-off-by: Mauro Carvalho Chehab --- drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c index 3181d0781b61..07b2161392d2 100644 --- a/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c +++ b/drivers/media/platform/sunxi/sun6i-csi/sun6i_video.c @@ -481,8 +481,10 @@ static int sun6i_video_open(struct file *file) goto fh_release; /* check if already powered */ - if (!v4l2_fh_is_singular_file(file)) + if (!v4l2_fh_is_singular_file(file)) { + ret = -EBUSY; goto unlock; + } ret = sun6i_csi_set_power(video->csi, true); if (ret < 0) From patchwork Wed Jun 16 12:28:31 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 462553 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.0 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, UNWANTED_LANGUAGE_BODY, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE577C48BE8 for ; Wed, 16 Jun 2021 12:28:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A58BF613CD for ; Wed, 16 Jun 2021 12:28:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232895AbhFPMav (ORCPT ); Wed, 16 Jun 2021 08:30:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:49290 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232358AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9260E613C2; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=Q1tDTioMTTZyxPq0ma5epEY3ATz4aAl7ortadL2eJ7A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mn87QQQH/cJ4jb1weI81ynCyYRgGJocYY3+nkO7OSkUTzN2Whg+jXMACEKxEXpf7N TwDZBSBBbm/G0sQTJe9QQZwaRQV82ey666VdlFmSU8kRHM/X7JvnzWhdpg8QgLUemr dm/WL69mTVvAVtu5qg2o1xary3LEMzgqIGt/uL/VikIltqpU2Ge+Q2xCSfaxtMm/Tg 81yDN0FouronFeQPRI37VFvHxg/ZADwPaNStHpr42mEth1I5rtPZ9q2Cik3TYjnYF9 /eb/FX79eRovv4yk9VJWf1FRYml0rAMo08NRz8HjJW660/EnZg1Io21wWOrg399mSz i8zUGUrIJjd/Q== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oif-BK; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Hans Verkuil , Julia Lawall , Mauro Carvalho Chehab , Tasos Sahanidis , Vaibhav Gupta , Yang Yingliang , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 05/11] media: saa7134: use more meaninful goto labels Date: Wed, 16 Jun 2021 14:28:31 +0200 Message-Id: <92d976c1f716aaa632719ed089423487c80a57dc.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Instead of just numbering fail0 to fail4, use more meaninful goto labels. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/pci/saa7134/saa7134-core.c | 34 ++++++++++++------------ 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c index ec8dd41f9ebb..97b1767f1fff 100644 --- a/drivers/media/pci/saa7134/saa7134-core.c +++ b/drivers/media/pci/saa7134/saa7134-core.c @@ -1031,7 +1031,7 @@ static int saa7134_initdev(struct pci_dev *pci_dev, dev->media_dev = kzalloc(sizeof(*dev->media_dev), GFP_KERNEL); if (!dev->media_dev) { err = -ENOMEM; - goto fail0; + goto err_free_dev; } media_device_pci_init(dev->media_dev, pci_dev, dev->name); dev->v4l2_dev.mdev = dev->media_dev; @@ -1039,13 +1039,13 @@ static int saa7134_initdev(struct pci_dev *pci_dev, err = v4l2_device_register(&pci_dev->dev, &dev->v4l2_dev); if (err) - goto fail0; + goto err_free_dev; /* pci init */ dev->pci = pci_dev; if (pci_enable_device(pci_dev)) { err = -EIO; - goto fail1; + goto err_v4l2_unregister; } /* pci quirks */ @@ -1095,7 +1095,7 @@ static int saa7134_initdev(struct pci_dev *pci_dev, err = pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32)); if (err) { pr_warn("%s: Oops: no 32bit PCI DMA ???\n", dev->name); - goto fail1; + goto err_v4l2_unregister; } /* board config */ @@ -1129,7 +1129,7 @@ static int saa7134_initdev(struct pci_dev *pci_dev, err = -EBUSY; pr_err("%s: can't get MMIO memory @ 0x%llx\n", dev->name,(unsigned long long)pci_resource_start(pci_dev,0)); - goto fail1; + goto err_v4l2_unregister; } dev->lmmio = ioremap(pci_resource_start(pci_dev, 0), pci_resource_len(pci_dev, 0)); @@ -1138,7 +1138,7 @@ static int saa7134_initdev(struct pci_dev *pci_dev, err = -EIO; pr_err("%s: can't ioremap() MMIO memory\n", dev->name); - goto fail2; + goto err_release_mem_reg; } /* initialize hardware #1 */ @@ -1151,7 +1151,7 @@ static int saa7134_initdev(struct pci_dev *pci_dev, if (err < 0) { pr_err("%s: can't get IRQ %d\n", dev->name,pci_dev->irq); - goto fail3; + goto err_iounmap; } /* wait a bit, register i2c bus */ @@ -1217,7 +1217,7 @@ static int saa7134_initdev(struct pci_dev *pci_dev, if (err < 0) { pr_info("%s: can't register video device\n", dev->name); - goto fail4; + goto err_unregister_video; } pr_info("%s: registered device %s [v4l2]\n", dev->name, video_device_node_name(dev->video_dev)); @@ -1234,7 +1234,7 @@ static int saa7134_initdev(struct pci_dev *pci_dev, err = video_register_device(dev->vbi_dev,VFL_TYPE_VBI, vbi_nr[dev->nr]); if (err < 0) - goto fail4; + goto err_unregister_video; pr_info("%s: registered device %s\n", dev->name, video_device_node_name(dev->vbi_dev)); @@ -1248,7 +1248,7 @@ static int saa7134_initdev(struct pci_dev *pci_dev, err = video_register_device(dev->radio_dev,VFL_TYPE_RADIO, radio_nr[dev->nr]); if (err < 0) - goto fail4; + goto err_unregister_video; pr_info("%s: registered device %s\n", dev->name, video_device_node_name(dev->radio_dev)); } @@ -1259,7 +1259,7 @@ static int saa7134_initdev(struct pci_dev *pci_dev, err = v4l2_mc_create_media_graph(dev->media_dev); if (err) { pr_err("failed to create media graph\n"); - goto fail4; + goto err_unregister_video; } #endif /* everything worked */ @@ -1278,24 +1278,24 @@ static int saa7134_initdev(struct pci_dev *pci_dev, #ifdef CONFIG_MEDIA_CONTROLLER err = media_device_register(dev->media_dev); if (err) - goto fail4; + goto err_unregister_video; #endif return 0; - fail4: +err_unregister_video: saa7134_unregister_video(dev); saa7134_i2c_unregister(dev); free_irq(pci_dev->irq, dev); - fail3: +err_iounmap: saa7134_hwfini(dev); iounmap(dev->lmmio); - fail2: +err_release_mem_reg: release_mem_region(pci_resource_start(pci_dev,0), pci_resource_len(pci_dev,0)); - fail1: +err_v4l2_unregister: v4l2_device_unregister(&dev->v4l2_dev); - fail0: +err_free_dev: #ifdef CONFIG_MEDIA_CONTROLLER kfree(dev->media_dev); #endif From patchwork Wed Jun 16 12:28:32 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 462554 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 010EAC48BE5 for ; Wed, 16 Jun 2021 12:28:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D9634613DF for ; Wed, 16 Jun 2021 12:28:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232750AbhFPMau (ORCPT ); Wed, 16 Jun 2021 08:30:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:49254 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232217AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8F9EC613BD; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=IZjqD2I+8Bdj62sCZmrApsPeQG82LsZGKTUJEvkz6E4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gJFUbmbEzqThmvQJg+a64/ryAPKBUgu6E+Q5YMtaygXjDp4wsYJWpZoM9Kxh+cXoZ w18vX5dcTxGdUFk39EgEzAI85i9rBMiJxX3KUtrZ+OXuZbuJzSzoww7rH0NKC3y25E zZpXHSWIU/MAWLpOeuyyb8r2/0bCdpwgL/nsLELVAydYh0eu7htjrfNufuGWFKzsjR 4JrdhqYAz/sI+oi2yG+IHYppk2QxVra1tfREYUHkfl2PnczYPxknBhWPL4xcw8KrW4 CEzmvmMsgXP/jyoo1IGLcnAH8yhWovwPFGx7jkklVMddn6t9De36neIfCxlL6gjbHM I6EzKdf94Pa2Q== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oij-CV; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Hans Verkuil , Julia Lawall , Mauro Carvalho Chehab , Tasos Sahanidis , Vaibhav Gupta , Yang Yingliang , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 06/11] media: saa7134: fix saa7134_initdev error handling logic Date: Wed, 16 Jun 2021 14:28:32 +0200 Message-Id: <9e1b48aeaf261e37aa99d868c44acfe7df0d7fc4.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Smatch reported an issue there: drivers/media/pci/saa7134/saa7134-core.c:1302 saa7134_initdev() warn: '&dev->devlist' not removed from list But besides freeing the list, the media controller graph also needs to be cleaned up on errors. Address those issues. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/pci/saa7134/saa7134-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c index 97b1767f1fff..47158ab3956b 100644 --- a/drivers/media/pci/saa7134/saa7134-core.c +++ b/drivers/media/pci/saa7134/saa7134-core.c @@ -1277,14 +1277,17 @@ static int saa7134_initdev(struct pci_dev *pci_dev, */ #ifdef CONFIG_MEDIA_CONTROLLER err = media_device_register(dev->media_dev); - if (err) + if (err) { + media_device_cleanup(dev->media_dev); goto err_unregister_video; + } #endif return 0; err_unregister_video: saa7134_unregister_video(dev); + list_del(&dev->devlist); saa7134_i2c_unregister(dev); free_irq(pci_dev->irq, dev); err_iounmap: From patchwork Wed Jun 16 12:28:33 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 462552 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CBA9C48BE6 for ; Wed, 16 Jun 2021 12:28:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 63427613B9 for ; Wed, 16 Jun 2021 12:28:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232935AbhFPMay (ORCPT ); Wed, 16 Jun 2021 08:30:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:49302 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232620AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9A353613CB; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=nBySG9GXlvUgri5A+5P6So4wWVqRbxFEOGnkkfBp9EU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CCcXMRBVhARM2ANw/W7/WRNnQtye4EnwW+IasEd+/pfCkOUxjPJZsgL4oi1KXmoJc 7VIoxryt4qcIWfa8AIAn8BS1xxYNsIKtHUntksfBrVkC53hi8p5TkdDa6agEH4h2PB sm7iR/TywQYIvfUFT6ISKgluK81W+wwNVZghEFLzF1GabvIsSn40HftwT1VvCY/UE6 QGZbo+sfOkwsq9s97EJVxkO8Tos+xD6F73y3+lZkG5Qq8TCP02Kth6gSIF90P7cjbL 66daJgmUr/eRo4g5WQ7mP+CW+cirUOclKBlRFj3AazGhHng/OFL0n/7CSwPq+XdyFB 5yczfHRUtSsSg== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oin-DV; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Davidlohr Bueso , Keita Suzuki , Mauro Carvalho Chehab , Nicolas Stuardo Diaz , Sean Young , Ye Bin , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 07/11] media: siano: fix device register error path Date: Wed, 16 Jun 2021 14:28:33 +0200 Message-Id: <73a7f08bb84ce2bd27045822fb66ad1f9c372dde.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org As reported by smatch: drivers/media/common/siano/smsdvb-main.c:1231 smsdvb_hotplug() warn: '&client->entry' not removed from list If an error occur at the end of the registration logic, it won't drop the device from the list. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/common/siano/smsdvb-main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c index b8a163a47d09..f80caaa333da 100644 --- a/drivers/media/common/siano/smsdvb-main.c +++ b/drivers/media/common/siano/smsdvb-main.c @@ -1212,6 +1212,10 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev, return 0; media_graph_error: + mutex_lock(&g_smsdvb_clientslock); + list_del(&client->entry); + mutex_unlock(&g_smsdvb_clientslock); + smsdvb_debugfs_release(client); client_error: From patchwork Wed Jun 16 12:28:34 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 461730 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F20ADC49EA4 for ; Wed, 16 Jun 2021 12:28:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CF709613CD for ; Wed, 16 Jun 2021 12:28:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232827AbhFPMav (ORCPT ); Wed, 16 Jun 2021 08:30:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:49292 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232430AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8CE0E613BF; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=5xE3IwwXuxM1BbQOm8ouU3VOutGE5pmZml00Zbft4vo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wynh6cAEEtZcmoAvQ7U1c+jm8dk1emJPtqjEGMM9iNO3/wFwJ+8sn2IHse1Gx3Si1 soo3emmhNvkyEMUYfhQeK5KkrrsSb2+YfI5nO0CIcpX2PfJeYhzTT5F9dWmTLAVG/r to5ET8UsmbeYeZuahZwYIqF/pWEWUThydrFRu6RaMRcfnaCmZkfBJBcQn/AwJGXrSD hFCUEqfsguCdu6tkY+Snc9wYaObDy7rdbjRWSTiwSYtcugMikNb1DcVirVel9LmMo5 Bb6cQ/VG9npDLy9IpoEKLcVDrAML67GR3f2W5cm7AYKR3lQwHmG3N///cfmcP7HZ58 u9Loou2Ip8njw== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oir-ET; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 08/11] media: adv7842: better document EDID block size Date: Wed, 16 Jun 2021 14:28:34 +0200 Message-Id: <6bed7a69367856080a62e3ee89df6a2a3d0d5f20.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org While the logic there is correct, it leads to smatch warnings: /home/hans/work/build/media-git/drivers/media/i2c/adv7842.c:2538 adv7842_set_edid() error: memcpy() '&state->vga_edid.edid' too small (128 vs 512) Because the code tricks static analyzers by doing: memcpy(&state->hdmi_edid.edid, e->edid, 128 * e->blocks); for ADV7842_EDID_PORT_VGA, where a logic before that makes e->blocks being either 0 or 1. Yet, it is ugly to see the "128" magic number all spread about the EDID code. So, while here, replace 128 (and 4 x 128) by macros: And ensure that the logic which copy into the VGA block will use EDID_MAX_VGA_BLOCKS. Signed-off-by: Mauro Carvalho Chehab Nacked-by: Hans Verkuil Reported-by: kernel test robot Reported-by: kernel test robot --- drivers/media/i2c/adv7842.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c index 78e61fe6f2f0..30bddab320b9 100644 --- a/drivers/media/i2c/adv7842.c +++ b/drivers/media/i2c/adv7842.c @@ -85,6 +85,10 @@ struct adv7842_format_info { u8 op_format_sel; }; +#define EDID_BLOCK_SIZE 128 +#define EDID_MAX_HDMI_BLOCKS 4 +#define EDID_MAX_VGA_BLOCKS 1 + struct adv7842_state { struct adv7842_platform_data pdata; struct v4l2_subdev sd; @@ -98,12 +102,12 @@ struct adv7842_state { v4l2_std_id norm; struct { - u8 edid[512]; + u8 edid[EDID_BLOCK_SIZE * EDID_MAX_HDMI_BLOCKS]; u32 blocks; u32 present; } hdmi_edid; struct { - u8 edid[128]; + u8 edid[EDID_MAX_VGA_BLOCKS * EDID_MAX_VGA_BLOCKS]; u32 blocks; u32 present; } vga_edid; @@ -732,12 +736,13 @@ static int edid_write_vga_segment(struct v4l2_subdev *sd) /* edid segment pointer '1' for VGA port */ rep_write_and_or(sd, 0x77, 0xef, 0x10); - for (i = 0; !err && i < blocks * 128; i += I2C_SMBUS_BLOCK_MAX) + for (i = 0; && i < blocks * EDID_BLOCK_SIZE; i += I2C_SMBUS_BLOCK_MAX) { err = i2c_smbus_write_i2c_block_data(state->i2c_edid, i, I2C_SMBUS_BLOCK_MAX, edid + i); - if (err) - return err; + if (err) + return err; + } /* Calculates the checksums and enables I2C access * to internal EDID ram from VGA DDC port. @@ -785,7 +790,7 @@ static int edid_write_hdmi_segment(struct v4l2_subdev *sd, u8 port) return 0; } - pa = v4l2_get_edid_phys_addr(edid, blocks * 128, &spa_loc); + pa = v4l2_get_edid_phys_addr(edid, blocks * EDID_BLOCK_SIZE, &spa_loc); err = v4l2_phys_addr_validate(pa, &parent_pa, NULL); if (err) return err; @@ -800,7 +805,7 @@ static int edid_write_hdmi_segment(struct v4l2_subdev *sd, u8 port) } - for (i = 0; !err && i < blocks * 128; i += I2C_SMBUS_BLOCK_MAX) { + for (i = 0; !err && i < blocks * EDID_BLOCK_SIZE; i += I2C_SMBUS_BLOCK_MAX) { /* set edid segment pointer for HDMI ports */ if (i % 256 == 0) rep_write_and_or(sd, 0x77, 0xef, i >= 256 ? 0x10 : 0x00); @@ -2491,7 +2496,9 @@ static int adv7842_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid) if (edid->start_block + edid->blocks > blocks) edid->blocks = blocks - edid->start_block; - memcpy(edid->edid, data + edid->start_block * 128, edid->blocks * 128); + memcpy(edid->edid, + data + edid->start_block * EDID_BLOCK_SIZE, + edid->blocks * EDID_BLOCK_SIZE); return 0; } @@ -2506,9 +2513,12 @@ static int adv7842_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid) static int adv7842_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *e) { struct adv7842_state *state = to_state(sd); - unsigned int max_blocks = e->pad == ADV7842_EDID_PORT_VGA ? 1 : 4; + unsigned int max_blocks; int err = 0; + max_blocks = e->pad == ADV7842_EDID_PORT_VGA ? + EDID_MAX_VGA_BLOCKS : EDID_MAX_HDMI_BLOCKS; + memset(e->reserved, 0, sizeof(e->reserved)); if (e->pad > ADV7842_EDID_PORT_VGA) @@ -2535,7 +2545,7 @@ static int adv7842_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *e) state->vga_edid.blocks = e->blocks; state->vga_edid.present = e->blocks ? 0x1 : 0x0; if (e->blocks) - memcpy(&state->vga_edid.edid, e->edid, 128 * e->blocks); + memcpy(&state->vga_edid.edid, e->edid, EDID_BLOCK_SIZE); err = edid_write_vga_segment(sd); break; case ADV7842_EDID_PORT_A: @@ -2544,7 +2554,8 @@ static int adv7842_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *e) state->hdmi_edid.blocks = e->blocks; if (e->blocks) { state->hdmi_edid.present |= 0x04 << e->pad; - memcpy(&state->hdmi_edid.edid, e->edid, 128 * e->blocks); + memcpy(&state->hdmi_edid.edid, e->edid, + EDID_BLOCK_SIZE * e->blocks); } else { state->hdmi_edid.present &= ~(0x04 << e->pad); adv7842_s_detect_tx_5v_ctrl(sd); From patchwork Wed Jun 16 12:28:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 461728 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E06A0C49361 for ; Wed, 16 Jun 2021 12:28:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CF249613D0 for ; Wed, 16 Jun 2021 12:28:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232951AbhFPMay (ORCPT ); Wed, 16 Jun 2021 08:30:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:49304 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232623AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9F401613D3; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=qiN1R/jymLRTb35TqMu2Vqi01KiKSp/t9ibnV3ARPpY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CKAJ8xCB6m+t0PmJyd97NrWc8V/6eSVq0EvSS0idBcB1dSYcQuv3qV2r4s/z+9pR8 SswpRbBTTn9KRYiDFVzF6loRCeVjJKGqnbDDM3AIEvB89qLiKvs2ftP5+k7iPBDpLF t0S7VmTsqg+GbW9676pPmMYTRvYuX5JM31DHPDXymfn4G9gJMvn6fuNOLZf7EdBcx6 NgaHfLa8+yNaJc7Pp+HgeulYPZwP8CSBK+moq3jl9Hb2SNNnDNZ/noQmzdJrzWhIMz k++YoTrA26R4ygZNP5YVcTmV94cya5mxjR0ucHFtmtCrE1OYxTo/poKIzC1quKj57C bBNL8nLYRMWCw== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oiv-FW; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Allen Pais , Hans Verkuil , Mauro Carvalho Chehab , Romain Perier , dingsenjie , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 09/11] media: ttusb-dec: cleanup an error handling logic Date: Wed, 16 Jun 2021 14:28:35 +0200 Message-Id: <9d098284e97a5687f857671d1aa8e5716658d50a.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Simplify the logic at ttusb_dec_send_command(). Besides avoiding some code duplication, as a side effect, this could remove this false positive return with spatch: drivers/media/usb/ttusb-dec/ttusb_dec.c:380 ttusb_dec_send_command() warn: inconsistent returns '&dec->usb_mutex'. Locked on : 330 Unlocked on: 354,365,380 Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/ttusb-dec/ttusb_dec.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c index a852ee5f7ac9..bfda46a36dc5 100644 --- a/drivers/media/usb/ttusb-dec/ttusb_dec.c +++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c @@ -324,10 +324,10 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, if (!b) return -ENOMEM; - if ((result = mutex_lock_interruptible(&dec->usb_mutex))) { - kfree(b); + result = mutex_lock_interruptible(&dec->usb_mutex); + if (result) { printk("%s: Failed to lock usb mutex.\n", __func__); - return result; + goto err; } b[0] = 0xaa; @@ -349,9 +349,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, if (result) { printk("%s: command bulk message failed: error %d\n", __func__, result); - mutex_unlock(&dec->usb_mutex); - kfree(b); - return result; + goto err; } result = usb_bulk_msg(dec->udev, dec->result_pipe, b, @@ -360,9 +358,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, if (result) { printk("%s: result bulk message failed: error %d\n", __func__, result); - mutex_unlock(&dec->usb_mutex); - kfree(b); - return result; + goto err; } else { if (debug) { printk(KERN_DEBUG "%s: result: %*ph\n", @@ -373,12 +369,13 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, *result_length = b[3]; if (cmd_result && b[3] > 0) memcpy(cmd_result, &b[4], b[3]); - - mutex_unlock(&dec->usb_mutex); - - kfree(b); - return 0; } + +err: + mutex_unlock(&dec->usb_mutex); + + kfree(b); + return result; } static int ttusb_dec_get_stb_state (struct ttusb_dec *dec, unsigned int *mode, From patchwork Wed Jun 16 12:28:36 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 462551 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,UPPERCASE_50_75,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 213ECC48BE6 for ; Wed, 16 Jun 2021 12:28:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0B2996135C for ; Wed, 16 Jun 2021 12:28:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232947AbhFPMa4 (ORCPT ); Wed, 16 Jun 2021 08:30:56 -0400 Received: from mail.kernel.org ([198.145.29.99]:49310 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232628AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 83533613B4; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=qKUbLk0xtnNadKlXdn/EeO4oDJ93Ar0xXfQmBBziOFs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LJBiwanojbjXEXQ1rsgZyz8GPR5HEiyli45zosz5ZYXdP8vToDNOM/5o6uI12mqxl 7NBcSooKly+DENF273JuXeFepx8edWo/hQpTY3oq1U/XXeTCt1AM+X6U7T3llQSKNd QvzDccmMqsmQDq1MpsVqSNhLia7YaYWj4U3UqjEXoS2aF7V8JXP+9YBN0rpC9LOvBM ya2bMTBOXc8V52PgclWb3n28M9JSqxUAyGA7k4cCfxBiT7ehor6GOGGrLzb16oEaSK jnWyEUMkWwj/9h7Xa/sKunN1tY6kWJW5xz/DBkKvTLUnaL5Jqx2DD+rLgksq9VOiND F4OrLKK0+k7gw== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oiz-Gn; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , "Gustavo A. R. Silva" , Hans Verkuil , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 10/11] media: dvb-core: frontend: make GET/SET safer Date: Wed, 16 Jun 2021 14:28:36 +0200 Message-Id: <85bf8ff8a08f9c716ab856465f9939957f901f06.1623846327.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org The implementation for FE_SET_PROPERTY/FE_GET_PROPERTY has a debug code that might be explored via spectre. Improve the logic in order to mitigate such risk. It should be noticed that, before this patch, the logic which implements FE_GET_PROPERTY doesn't check the length passed by the user, which might lead to expose some information. This is probably not exploitable, though, as the frontend drivers won't rely on the buffer length value set by userspace, but it helps to return a valid value back to userspace. The code was changed to only try to access an array based on userspace values only when DVB debug is turned on, helping to reduce the attack surface, as a speculation attack would work only if DVB dev_dbg() macros are enabled, which is usually enabled only on test Kernels or by the root user. As a side effect, a const array size can now be reduced by ~570 bytes, as it now needs to contain just the name of each DTV command. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_frontend.c | 213 ++++++++++++++------------ 1 file changed, 113 insertions(+), 100 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index a6915582d1a6..3dccd3af385e 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -23,6 +23,7 @@ #include #include #include +#include #include #include #include @@ -1063,107 +1064,98 @@ static int dvb_frontend_clear_cache(struct dvb_frontend *fe) return 0; } -#define _DTV_CMD(n, s, b) \ -[n] = { \ - .name = #n, \ - .cmd = n, \ - .set = s,\ - .buffer = b \ -} +#define _DTV_CMD(n) \ + [n] = #n -struct dtv_cmds_h { - char *name; /* A display name for debugging purposes */ - - __u32 cmd; /* A unique ID */ - - /* Flags */ - __u32 set:1; /* Either a set or get property */ - __u32 buffer:1; /* Does this property use the buffer? */ - __u32 reserved:30; /* Align */ -}; - -static struct dtv_cmds_h dtv_cmds[DTV_MAX_COMMAND + 1] = { - _DTV_CMD(DTV_TUNE, 1, 0), - _DTV_CMD(DTV_CLEAR, 1, 0), +static char *dtv_cmds[DTV_MAX_COMMAND + 1] = { + _DTV_CMD(DTV_TUNE), + _DTV_CMD(DTV_CLEAR), /* Set */ - _DTV_CMD(DTV_FREQUENCY, 1, 0), - _DTV_CMD(DTV_BANDWIDTH_HZ, 1, 0), - _DTV_CMD(DTV_MODULATION, 1, 0), - _DTV_CMD(DTV_INVERSION, 1, 0), - _DTV_CMD(DTV_DISEQC_MASTER, 1, 1), - _DTV_CMD(DTV_SYMBOL_RATE, 1, 0), - _DTV_CMD(DTV_INNER_FEC, 1, 0), - _DTV_CMD(DTV_VOLTAGE, 1, 0), - _DTV_CMD(DTV_TONE, 1, 0), - _DTV_CMD(DTV_PILOT, 1, 0), - _DTV_CMD(DTV_ROLLOFF, 1, 0), - _DTV_CMD(DTV_DELIVERY_SYSTEM, 1, 0), - _DTV_CMD(DTV_HIERARCHY, 1, 0), - _DTV_CMD(DTV_CODE_RATE_HP, 1, 0), - _DTV_CMD(DTV_CODE_RATE_LP, 1, 0), - _DTV_CMD(DTV_GUARD_INTERVAL, 1, 0), - _DTV_CMD(DTV_TRANSMISSION_MODE, 1, 0), - _DTV_CMD(DTV_INTERLEAVING, 1, 0), + _DTV_CMD(DTV_FREQUENCY), + _DTV_CMD(DTV_BANDWIDTH_HZ), + _DTV_CMD(DTV_MODULATION), + _DTV_CMD(DTV_INVERSION), + _DTV_CMD(DTV_DISEQC_MASTER), + _DTV_CMD(DTV_SYMBOL_RATE), + _DTV_CMD(DTV_INNER_FEC), + _DTV_CMD(DTV_VOLTAGE), + _DTV_CMD(DTV_TONE), + _DTV_CMD(DTV_PILOT), + _DTV_CMD(DTV_ROLLOFF), + _DTV_CMD(DTV_DELIVERY_SYSTEM), + _DTV_CMD(DTV_HIERARCHY), + _DTV_CMD(DTV_CODE_RATE_HP), + _DTV_CMD(DTV_CODE_RATE_LP), + _DTV_CMD(DTV_GUARD_INTERVAL), + _DTV_CMD(DTV_TRANSMISSION_MODE), + _DTV_CMD(DTV_INTERLEAVING), - _DTV_CMD(DTV_ISDBT_PARTIAL_RECEPTION, 1, 0), - _DTV_CMD(DTV_ISDBT_SOUND_BROADCASTING, 1, 0), - _DTV_CMD(DTV_ISDBT_SB_SUBCHANNEL_ID, 1, 0), - _DTV_CMD(DTV_ISDBT_SB_SEGMENT_IDX, 1, 0), - _DTV_CMD(DTV_ISDBT_SB_SEGMENT_COUNT, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYER_ENABLED, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERA_FEC, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERA_MODULATION, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERA_SEGMENT_COUNT, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERA_TIME_INTERLEAVING, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERB_FEC, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERB_MODULATION, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERB_SEGMENT_COUNT, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERB_TIME_INTERLEAVING, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERC_FEC, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERC_MODULATION, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERC_SEGMENT_COUNT, 1, 0), - _DTV_CMD(DTV_ISDBT_LAYERC_TIME_INTERLEAVING, 1, 0), + _DTV_CMD(DTV_ISDBT_PARTIAL_RECEPTION), + _DTV_CMD(DTV_ISDBT_SOUND_BROADCASTING), + _DTV_CMD(DTV_ISDBT_SB_SUBCHANNEL_ID), + _DTV_CMD(DTV_ISDBT_SB_SEGMENT_IDX), + _DTV_CMD(DTV_ISDBT_SB_SEGMENT_COUNT), + _DTV_CMD(DTV_ISDBT_LAYER_ENABLED), + _DTV_CMD(DTV_ISDBT_LAYERA_FEC), + _DTV_CMD(DTV_ISDBT_LAYERA_MODULATION), + _DTV_CMD(DTV_ISDBT_LAYERA_SEGMENT_COUNT), + _DTV_CMD(DTV_ISDBT_LAYERA_TIME_INTERLEAVING), + _DTV_CMD(DTV_ISDBT_LAYERB_FEC), + _DTV_CMD(DTV_ISDBT_LAYERB_MODULATION), + _DTV_CMD(DTV_ISDBT_LAYERB_SEGMENT_COUNT), + _DTV_CMD(DTV_ISDBT_LAYERB_TIME_INTERLEAVING), + _DTV_CMD(DTV_ISDBT_LAYERC_FEC), + _DTV_CMD(DTV_ISDBT_LAYERC_MODULATION), + _DTV_CMD(DTV_ISDBT_LAYERC_SEGMENT_COUNT), + _DTV_CMD(DTV_ISDBT_LAYERC_TIME_INTERLEAVING), - _DTV_CMD(DTV_STREAM_ID, 1, 0), - _DTV_CMD(DTV_DVBT2_PLP_ID_LEGACY, 1, 0), - _DTV_CMD(DTV_SCRAMBLING_SEQUENCE_INDEX, 1, 0), - _DTV_CMD(DTV_LNA, 1, 0), + _DTV_CMD(DTV_STREAM_ID), + _DTV_CMD(DTV_DVBT2_PLP_ID_LEGACY), + _DTV_CMD(DTV_SCRAMBLING_SEQUENCE_INDEX), + _DTV_CMD(DTV_LNA), /* Get */ - _DTV_CMD(DTV_DISEQC_SLAVE_REPLY, 0, 1), - _DTV_CMD(DTV_API_VERSION, 0, 0), + _DTV_CMD(DTV_DISEQC_SLAVE_REPLY), + _DTV_CMD(DTV_API_VERSION), - _DTV_CMD(DTV_ENUM_DELSYS, 0, 0), + _DTV_CMD(DTV_ENUM_DELSYS), - _DTV_CMD(DTV_ATSCMH_PARADE_ID, 1, 0), - _DTV_CMD(DTV_ATSCMH_RS_FRAME_ENSEMBLE, 1, 0), + _DTV_CMD(DTV_ATSCMH_PARADE_ID), + _DTV_CMD(DTV_ATSCMH_RS_FRAME_ENSEMBLE), - _DTV_CMD(DTV_ATSCMH_FIC_VER, 0, 0), - _DTV_CMD(DTV_ATSCMH_NOG, 0, 0), - _DTV_CMD(DTV_ATSCMH_TNOG, 0, 0), - _DTV_CMD(DTV_ATSCMH_SGN, 0, 0), - _DTV_CMD(DTV_ATSCMH_PRC, 0, 0), - _DTV_CMD(DTV_ATSCMH_RS_FRAME_MODE, 0, 0), - _DTV_CMD(DTV_ATSCMH_RS_CODE_MODE_PRI, 0, 0), - _DTV_CMD(DTV_ATSCMH_RS_CODE_MODE_SEC, 0, 0), - _DTV_CMD(DTV_ATSCMH_SCCC_BLOCK_MODE, 0, 0), - _DTV_CMD(DTV_ATSCMH_SCCC_CODE_MODE_A, 0, 0), - _DTV_CMD(DTV_ATSCMH_SCCC_CODE_MODE_B, 0, 0), - _DTV_CMD(DTV_ATSCMH_SCCC_CODE_MODE_C, 0, 0), - _DTV_CMD(DTV_ATSCMH_SCCC_CODE_MODE_D, 0, 0), + _DTV_CMD(DTV_ATSCMH_FIC_VER), + _DTV_CMD(DTV_ATSCMH_NOG), + _DTV_CMD(DTV_ATSCMH_TNOG), + _DTV_CMD(DTV_ATSCMH_SGN), + _DTV_CMD(DTV_ATSCMH_PRC), + _DTV_CMD(DTV_ATSCMH_RS_FRAME_MODE), + _DTV_CMD(DTV_ATSCMH_RS_CODE_MODE_PRI), + _DTV_CMD(DTV_ATSCMH_RS_CODE_MODE_SEC), + _DTV_CMD(DTV_ATSCMH_SCCC_BLOCK_MODE), + _DTV_CMD(DTV_ATSCMH_SCCC_CODE_MODE_A), + _DTV_CMD(DTV_ATSCMH_SCCC_CODE_MODE_B), + _DTV_CMD(DTV_ATSCMH_SCCC_CODE_MODE_C), + _DTV_CMD(DTV_ATSCMH_SCCC_CODE_MODE_D), /* Statistics API */ - _DTV_CMD(DTV_STAT_SIGNAL_STRENGTH, 0, 0), - _DTV_CMD(DTV_STAT_CNR, 0, 0), - _DTV_CMD(DTV_STAT_PRE_ERROR_BIT_COUNT, 0, 0), - _DTV_CMD(DTV_STAT_PRE_TOTAL_BIT_COUNT, 0, 0), - _DTV_CMD(DTV_STAT_POST_ERROR_BIT_COUNT, 0, 0), - _DTV_CMD(DTV_STAT_POST_TOTAL_BIT_COUNT, 0, 0), - _DTV_CMD(DTV_STAT_ERROR_BLOCK_COUNT, 0, 0), - _DTV_CMD(DTV_STAT_TOTAL_BLOCK_COUNT, 0, 0), + _DTV_CMD(DTV_STAT_SIGNAL_STRENGTH), + _DTV_CMD(DTV_STAT_CNR), + _DTV_CMD(DTV_STAT_PRE_ERROR_BIT_COUNT), + _DTV_CMD(DTV_STAT_PRE_TOTAL_BIT_COUNT), + _DTV_CMD(DTV_STAT_POST_ERROR_BIT_COUNT), + _DTV_CMD(DTV_STAT_POST_TOTAL_BIT_COUNT), + _DTV_CMD(DTV_STAT_ERROR_BLOCK_COUNT), + _DTV_CMD(DTV_STAT_TOTAL_BLOCK_COUNT), }; +static char *dtv_cmd_name(u32 cmd) +{ + cmd = array_index_nospec(cmd, DTV_MAX_COMMAND); + return dtv_cmds[cmd]; +} + + /* Synchronise the legacy tuning parameters into the cache, so that demodulator * drivers can use a single set_frontend tuning function, regardless of whether * it's being used for the legacy or new API, reducing code and complexity. @@ -1346,6 +1338,7 @@ static int dtv_property_process_get(struct dvb_frontend *fe, struct file *file) { int ncaps; + unsigned int len = 1; switch (tvp->cmd) { case DTV_ENUM_DELSYS: @@ -1355,6 +1348,7 @@ static int dtv_property_process_get(struct dvb_frontend *fe, ncaps++; } tvp->u.buffer.len = ncaps; + len = ncaps; break; case DTV_FREQUENCY: tvp->u.data = c->frequency; @@ -1532,27 +1526,51 @@ static int dtv_property_process_get(struct dvb_frontend *fe, /* Fill quality measures */ case DTV_STAT_SIGNAL_STRENGTH: tvp->u.st = c->strength; + if (tvp->u.buffer.len > MAX_DTV_STATS * sizeof(u32)) + tvp->u.buffer.len = MAX_DTV_STATS * sizeof(u32); + len = tvp->u.buffer.len; break; case DTV_STAT_CNR: tvp->u.st = c->cnr; + if (tvp->u.buffer.len > MAX_DTV_STATS * sizeof(u32)) + tvp->u.buffer.len = MAX_DTV_STATS * sizeof(u32); + len = tvp->u.buffer.len; break; case DTV_STAT_PRE_ERROR_BIT_COUNT: tvp->u.st = c->pre_bit_error; + if (tvp->u.buffer.len > MAX_DTV_STATS * sizeof(u32)) + tvp->u.buffer.len = MAX_DTV_STATS * sizeof(u32); + len = tvp->u.buffer.len; break; case DTV_STAT_PRE_TOTAL_BIT_COUNT: tvp->u.st = c->pre_bit_count; + if (tvp->u.buffer.len > MAX_DTV_STATS * sizeof(u32)) + tvp->u.buffer.len = MAX_DTV_STATS * sizeof(u32); + len = tvp->u.buffer.len; break; case DTV_STAT_POST_ERROR_BIT_COUNT: tvp->u.st = c->post_bit_error; + if (tvp->u.buffer.len > MAX_DTV_STATS * sizeof(u32)) + tvp->u.buffer.len = MAX_DTV_STATS * sizeof(u32); + len = tvp->u.buffer.len; break; case DTV_STAT_POST_TOTAL_BIT_COUNT: tvp->u.st = c->post_bit_count; + if (tvp->u.buffer.len > MAX_DTV_STATS * sizeof(u32)) + tvp->u.buffer.len = MAX_DTV_STATS * sizeof(u32); + len = tvp->u.buffer.len; break; case DTV_STAT_ERROR_BLOCK_COUNT: tvp->u.st = c->block_error; + if (tvp->u.buffer.len > MAX_DTV_STATS * sizeof(u32)) + tvp->u.buffer.len = MAX_DTV_STATS * sizeof(u32); + len = tvp->u.buffer.len; break; case DTV_STAT_TOTAL_BLOCK_COUNT: tvp->u.st = c->block_count; + if (tvp->u.buffer.len > MAX_DTV_STATS * sizeof(u32)) + tvp->u.buffer.len = MAX_DTV_STATS * sizeof(u32); + len = tvp->u.buffer.len; break; default: dev_dbg(fe->dvb->device, @@ -1561,18 +1579,13 @@ static int dtv_property_process_get(struct dvb_frontend *fe, return -EINVAL; } - if (!dtv_cmds[tvp->cmd].buffer) - dev_dbg(fe->dvb->device, - "%s: GET cmd 0x%08x (%s) = 0x%08x\n", - __func__, tvp->cmd, dtv_cmds[tvp->cmd].name, - tvp->u.data); - else - dev_dbg(fe->dvb->device, - "%s: GET cmd 0x%08x (%s) len %d: %*ph\n", - __func__, - tvp->cmd, dtv_cmds[tvp->cmd].name, - tvp->u.buffer.len, - tvp->u.buffer.len, tvp->u.buffer.data); + if (len < 1) + len = 1; + + dev_dbg(fe->dvb->device, + "%s: GET cmd 0x%08x (%s) len %d: %*ph\n", + __func__, tvp->cmd, dtv_cmd_name(tvp->cmd), + tvp->u.buffer.len, tvp->u.buffer.len, tvp->u.buffer.data); return 0; } @@ -1870,7 +1883,7 @@ static int dtv_property_process_set(struct dvb_frontend *fe, else dev_dbg(fe->dvb->device, "%s: SET cmd 0x%08x (%s) to 0x%08x\n", - __func__, cmd, dtv_cmds[cmd].name, data); + __func__, cmd, dtv_cmd_name(cmd), data); switch (cmd) { case DTV_CLEAR: /* From patchwork Wed Jun 16 12:28:37 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 461729 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3585C49EA2 for ; Wed, 16 Jun 2021 12:28:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 98AA76135C for ; Wed, 16 Jun 2021 12:28:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232915AbhFPMax (ORCPT ); Wed, 16 Jun 2021 08:30:53 -0400 Received: from mail.kernel.org ([198.145.29.99]:49300 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232543AbhFPMaq (ORCPT ); Wed, 16 Jun 2021 08:30:46 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9825D613C1; Wed, 16 Jun 2021 12:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1623846520; bh=6esczEUC+IAp1wiH2+5uojr1T2m2zz+t/CuNq/KViCQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K4zuMsVGPMOi3SVQn90yWK7XUuLc/v436/GjGpW7KhK3WcvVWEnZmDMFSbBmvxCS3 vxgHiHl/GdHe1JRORqirVkCgFAy4EvHkl2o/UZtwznki4ChPk92vAkzc3TsoyGf4Xp mHnCrH16I58Fn2bw0+MppGVKqI4Zybs1oI5vGa6mwhn6We0KYW1SmgSXBehLOuTXwy KvmuPtVL8+swAgQ7dWnKzuGb1ymso+zhybCXODvn0QLs/uVP5vD6MyoVAVa/poACl0 FnRx0vNVCbdEhIedt2lBU6nKm31yt2h34usvCVmkZzNV7366Ri/R/Ap21CeNVXsQyr py0l8vtepZnzQ== Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1ltUes-004oj3-Hz; Wed, 16 Jun 2021 14:28:38 +0200 From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Hyun Kwon , Laurent Pinchart , Mauro Carvalho Chehab , Michal Simek , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 11/11] media: xilinx: simplify get fourcc logic Date: Wed, 16 Jun 2021 14:28:37 +0200 Message-Id: X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Right now, there are two calls for xvip_get_format_by_fourcc(). If the first one fails, it is called again in order to pick the first available format: V4L2_PIX_FMT_YUYV. This ends by producing a smatch warnings: drivers/media/platform/xilinx/xilinx-dma.c:555 __xvip_dma_try_format() error: 'info' dereferencing possible ERR_PTR() drivers/media/platform/xilinx/xilinx-dma.c: drivers/media/platform/xilinx/xilinx-dma.c:664 xvip_dma_init() error: 'dma->fmtinfo' dereferencing possible ERR_PTR() as it is hard for an static analyzer to ensure that calling xvip_get_format_by_fourcc(XVIP_DMA_DEF_FORMAT) won't return an error. So, better to optimize the logic, ensuring that the function will never return an error. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/platform/xilinx/xilinx-dma.c | 5 +---- drivers/media/platform/xilinx/xilinx-vip.c | 6 +++--- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/drivers/media/platform/xilinx/xilinx-dma.c b/drivers/media/platform/xilinx/xilinx-dma.c index 2a56201cb853..338c3661d809 100644 --- a/drivers/media/platform/xilinx/xilinx-dma.c +++ b/drivers/media/platform/xilinx/xilinx-dma.c @@ -26,7 +26,6 @@ #include "xilinx-vip.h" #include "xilinx-vipp.h" -#define XVIP_DMA_DEF_FORMAT V4L2_PIX_FMT_YUYV #define XVIP_DMA_DEF_WIDTH 1920 #define XVIP_DMA_DEF_HEIGHT 1080 @@ -549,8 +548,6 @@ __xvip_dma_try_format(struct xvip_dma *dma, struct v4l2_pix_format *pix, * requested format isn't supported. */ info = xvip_get_format_by_fourcc(pix->pixelformat); - if (IS_ERR(info)) - info = xvip_get_format_by_fourcc(XVIP_DMA_DEF_FORMAT); pix->pixelformat = info->fourcc; pix->field = V4L2_FIELD_NONE; @@ -660,7 +657,7 @@ int xvip_dma_init(struct xvip_composite_device *xdev, struct xvip_dma *dma, INIT_LIST_HEAD(&dma->queued_bufs); spin_lock_init(&dma->queued_lock); - dma->fmtinfo = xvip_get_format_by_fourcc(XVIP_DMA_DEF_FORMAT); + dma->fmtinfo = xvip_get_format_by_fourcc(V4L2_PIX_FMT_YUYV); dma->format.pixelformat = dma->fmtinfo->fourcc; dma->format.colorspace = V4L2_COLORSPACE_SRGB; dma->format.field = V4L2_FIELD_NONE; diff --git a/drivers/media/platform/xilinx/xilinx-vip.c b/drivers/media/platform/xilinx/xilinx-vip.c index 6ad61b08a31a..a4eb57683411 100644 --- a/drivers/media/platform/xilinx/xilinx-vip.c +++ b/drivers/media/platform/xilinx/xilinx-vip.c @@ -70,8 +70,8 @@ EXPORT_SYMBOL_GPL(xvip_get_format_by_code); * @fourcc: the format 4CC * * Return: a pointer to the format information structure corresponding to the - * given V4L2 format @fourcc, or ERR_PTR if no corresponding format can be - * found. + * given V4L2 format @fourcc. If not found, return a pointer to the first + * available format (V4L2_PIX_FMT_YUYV). */ const struct xvip_video_format *xvip_get_format_by_fourcc(u32 fourcc) { @@ -84,7 +84,7 @@ const struct xvip_video_format *xvip_get_format_by_fourcc(u32 fourcc) return format; } - return ERR_PTR(-EINVAL); + return &xvip_video_formats[0]; } EXPORT_SYMBOL_GPL(xvip_get_format_by_fourcc);