From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 52D952071E5; Wed, 16 Oct 2024 10:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=VHqyF6ktkdunPxKKJfsGqKsv73zLnbP2lMQasHIfDcakoWuPbZzGEQ0SofQTHcSfmYhVRRtjk+WMWm10wLd1jP7gAFL/ZyNwcuvSfR/i9joX0RfzlJnKVJSmPi55/BNYFG+BRVAF2B0EEieL47NLEv7gLnjOnX+e5J6jc+VTbII= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=r3DnZnXmOPL/1ov+qmgi5QK936wJgr1oE0kz+ynd/Pc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rBGsVlUgG+TDtYq/WnJvRRE5YV4OjyiG0M6RwzB2pYEbkzb/FXjH4WYf3JL6IbZbIU73280kJqQJgdtPGgR1R0QCHzBXfIdrPrr4I3yExKziEW7Wobo4J1J8Whw1l0pSN6VAlfVVxtSLtSmOiOrw+ziQAK4aqQi2c7CFirIsIp0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Zfl9cPRA; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Zfl9cPRA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D643CC4CED2; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=r3DnZnXmOPL/1ov+qmgi5QK936wJgr1oE0kz+ynd/Pc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zfl9cPRAhPfLv2wztu2p7KDgxgC1zyrb0Yi1d9nhG4Ukxxgvxz8xihuf9BFqPlKzE fm9Csc4XXTzWNPzAjX8r6UvXWtpKJpylLjhtm3hSP59expzEoX8piZoDxWk0zEZ6SA B33JhgyVNiAw842u+fambh/l66WyI9v+orXuyXGbxyqonNoR9H15lj+cQMXpjKmZ4k TJo6YeYCwEO+UoEMjTuEyr2KT/93EJG1WEUx1mDN3i1VDSmO6bYGmxgeUDLKXtInu3 sX32OlWqO56APgdVzciS7cSTQFlcsp82clCBp+AwA2vSWVPacjy/wZ2IrtER+55kXc lg5e66drb6Qbw== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004YmR-1o4r; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , Ricardo Ribalda , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 01/13] media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() Date: Wed, 16 Oct 2024 12:22:17 +0200 Message-ID: X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The error check logic at get_ctrl() is broken: if ptr_to_user() fails to fill a control due to an error, no errors are returned and v4l2_g_ctrl() returns success on a failed operation, which may cause applications to fail. Add an error check at get_ctrl() and ensure that it will be returned to userspace without filling the control value if get_ctrl() fails. Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/v4l2-ctrls-api.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/media/v4l2-core/v4l2-ctrls-api.c b/drivers/media/v4l2-= core/v4l2-ctrls-api.c index e5a364efd5e6..be32dccf9830 100644 --- a/drivers/media/v4l2-core/v4l2-ctrls-api.c +++ b/drivers/media/v4l2-core/v4l2-ctrls-api.c @@ -753,9 +753,10 @@ static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l= 2_ext_control *c) for (i =3D 0; i < master->ncontrols; i++) cur_to_new(master->cluster[i]); ret =3D call_op(master, g_volatile_ctrl); - new_to_user(c, ctrl); + if (!ret) + ret =3D new_to_user(c, ctrl); } else { - cur_to_user(c, ctrl); + ret =3D cur_to_user(c, ctrl); } v4l2_ctrl_unlock(master); return ret; @@ -770,7 +771,10 @@ int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct = v4l2_control *control) if (!ctrl || !ctrl->is_int) return -EINVAL; ret =3D get_ctrl(ctrl, &c); - control->value =3D c.value; + + if (!ret) + control->value =3D c.value; + return ret; } EXPORT_SYMBOL(v4l2_g_ctrl); --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D145206E84; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=Y2IXH+ulOn1VDknCYxJETbrIhk6G2Prq1qUE52przT7lAiMqH/rMotQN0IFuAh9DUrCixrSd028rMPlGquoo9jEnifiAkyNBye4yW5OPI77+JwlbYEdSoLOZt3H501VHL7pG0ogW5ce5UQS0FQkufkvcJzXoOBRZpzDO2QReErA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=Y+m0IthLg3u7yCjeAZDbNuZ1g4iek7tN6vPFOcl1koE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tmNoPhL09aWnW6eSFeD/GD7Hxmb6dWrPYgdTGnCmQciGW5fUQ3I70Lmwpq5TFg2nJgl6JPrMfdAXjnkEao+D5EXi2+grdUcPOzOVOgCvm+aQU7rIVaO+y0XVsrty6TOyf1FTRCcMNSax2pPw3tt1wmIIDqLDHoLDavvD9nrZCaE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Lstqbken; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Lstqbken" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D4073C4CED0; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=Y+m0IthLg3u7yCjeAZDbNuZ1g4iek7tN6vPFOcl1koE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LstqbkenFPU1P+OOL0SsFM+AsVqiV6wOxMSYEz/dPKEOcoC04Gl7gCWX1RrGrRrlu r65s0aq1C4u5173cWZvQwFanEl+wc5XVQkXAKtqKCpxSrWKObHGocSbzY0MYp5PcFs dE+4YrT5pq7k0WPy7f3NZQOV97qHWcO7stfRcxyTov//KIh1lyGb05UePMKmok/+gb 0O9H8ZXiPs8T5X/4yJyLOHTpA5KoE3TIZRJH5qV+i3yb3DeB/4C98igsq4tsvTZnBA yvZxsF8m5En/iuVlrXTK0M+hcHolH+tO/j2674ukaSLasmdBmVhME60Xe6b/u8ymuu r9bhJyVOisSwQ== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004YmU-1ulY; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , Zhipeng Lu , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 02/13] media: v4l2-tpg: prevent the risk of a division by zero Date: Wed, 16 Oct 2024 12:22:18 +0200 Message-ID: <953ea061a4fbe43b10f15308aa8d792afb493e44.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. If this ever happens, this will cause a division by zero. Instead, add a WARN_ON() to trigger such cases and return without doing any precalculation. Fixes: 63881df94d3e ("[media] vivid: add the Test Pattern Generator") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/= common/v4l2-tpg/v4l2-tpg-core.c index c86343a4d0bf..a22f31515d7e 100644 --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c @@ -1795,6 +1795,9 @@ static void tpg_precalculate_line(struct tpg_data *tp= g) unsigned p; unsigned x; =20 + if (WARN_ON(tpg->src_width =3D=3D 0)) + return; + switch (tpg->pattern) { case TPG_PAT_GREEN: contrast =3D TPG_COLOR_100_RED; --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8165220720D; Wed, 16 Oct 2024 10:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=fk31wpdW/jwWS7h5UbgFwZYDAzDOELt0ZVyyvQ/s0unEGO6+sF09KXVkrFdvD81yPL7R+24Dj5/M0jO3gfCClC4TGp3z1LIbXbYiXMdqBGExCtPycNM6Bo84gay8TMNftToqcshn7PX7lESYUck/JHxsab6N/OveIcGjvVdNg1M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=TkxiQZ67z39iRcOBi+pEl9tz3Z92UapKNSmknM4EeH8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Mvjflv+O18knZWUyw09pN38B7N+0oRSFvag2mQ42uktLiFgrwJI2Asg7Seat6VpavZaqCglODwBHkJUu6AHuFzB4BRi02PWgNAxmGQ9IRuqIwWE5HyqJGRwoiiBcDkwUGWcWtXaj1OSvc04gyrwlNGN/WVS7+H1wqhlbF4WdHi8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ZM2f2/GW; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZM2f2/GW" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D8910C4CED4; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=TkxiQZ67z39iRcOBi+pEl9tz3Z92UapKNSmknM4EeH8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZM2f2/GWuDRz9BkxagiAlhdizIGgSDskUyVBVsMevCTnXqVP446Fmm7lwsYA/QvJm u3FyQhd7FcY/xQ01XbOzcCoSwHhEcC2c6SwU+xWrx9qgxdfqNh3s8H1ZD7FKvMsH/P 0beKGDIfFm8lc/68ex0e59VfSds0Zldp1p5W+Uu/Q9JR/isKlQOlYFppe0yJMtLdRI aIWqPdsi2vBZeSZS6lUDXuSgWDY0ngE9o76ZpXsMNwLPfGy8b1EVRTgHAhXQkqIs0Z d5SZdEQKFyTQdsKx2P9myej7HgzTpPmTcTtX00jeG1q1L1qva9sjkW/KuYAtMMzbYu SIQEjTzLnDUdA== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004YmZ-21f1; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Andreas Oberritter , Dan Carpenter , Hans Verkuil , Mauro Carvalho Chehab , Ricardo Ribalda , Zhipeng Lu , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 03/13] media: dvbdev: prevent the risk of out of memory access Date: Wed, 16 Oct 2024 12:22:19 +0200 Message-ID: <3df78d0131f8f6730043df28a9e03ee955fdeb96.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The dvbdev contains a static variable used to store dvb minors. The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. When not set, dvb_register_device() won't check for boundaries, as it will rely that a previous call to dvb_register_adapter() would already be enforcing it. On a similar way, dvb_device_open() uses the assumption that the register functions already did the needed checks. This can be fragile if some device ends using different calls. This also generate warnings on static check analysers. So, add explicit guards to prevent potential risk of OOM issues. Fixes: 5dd3f3071070 ("V4L/DVB (9361): Dynamic DVB minor allocation") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvbdev.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbde= v.c index b43695bc51e7..14f323fbada7 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -86,10 +86,15 @@ static DECLARE_RWSEM(minor_rwsem); static int dvb_device_open(struct inode *inode, struct file *file) { struct dvb_device *dvbdev; + unsigned int minor =3D iminor(inode); + + if (minor >=3D MAX_DVB_MINORS) + return -ENODEV; =20 mutex_lock(&dvbdev_mutex); down_read(&minor_rwsem); - dvbdev =3D dvb_minors[iminor(inode)]; + + dvbdev =3D dvb_minors[minor]; =20 if (dvbdev && dvbdev->fops) { int err =3D 0; @@ -525,7 +530,7 @@ int dvb_register_device(struct dvb_adapter *adap, struc= t dvb_device **pdvbdev, for (minor =3D 0; minor < MAX_DVB_MINORS; minor++) if (!dvb_minors[minor]) break; - if (minor =3D=3D MAX_DVB_MINORS) { + if (minor >=3D MAX_DVB_MINORS) { if (new_node) { list_del(&new_node->list_head); kfree(dvbdevfops); @@ -540,6 +545,14 @@ int dvb_register_device(struct dvb_adapter *adap, stru= ct dvb_device **pdvbdev, } #else minor =3D nums2minor(adap->num, type, id); + if (minor >=3D MAX_DVB_MINORS) { + dvb_media_device_free(dvbdev); + list_del(&dvbdev->list_head); + kfree(dvbdev); + *pdvbdev =3D NULL; + mutex_unlock(&dvbdev_register_lock); + return ret; + } #endif dvbdev->minor =3D minor; dvb_minors[minor] =3D dvb_device_get(dvbdev); --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D01A206E65; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=XSZrCO/LYjsXk32icgCIG8QBYCwkxXyaIMpxg+swbRMsOLqrJOBlxHiAv27LsaUlIA6cgQANzjzHMlu2fgaHhrYtRaTHInKwWAN/1ag7r1g9XXyXc5STZS63avKL0tsNCPsszRQ3kNE/exc7CPJo0xXGPw7pFu2NzYTqPsEddUo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=T3NFsk7r7x26FUosflKVUEpxyxcH1IJFyRbpMefuXjE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tW6aZrILkovlDxROb9h55nxBBZdedju8D65FsVlPGqBvtsEiuwgskjQPxyvgOiVLfND5vXBFWBDVOhkPrSFGLvhKry+0kl+hC7zpfjNNcgpe6ZeAFuNv6oQTQydgAq6v+CVeuPrDDVn3/51j0ZsgAbpZAWVrH1MwP0RDGIrfL8Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DKrJbifu; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DKrJbifu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CFE68C4CECD; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=T3NFsk7r7x26FUosflKVUEpxyxcH1IJFyRbpMefuXjE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DKrJbifuRAS2Bf/DcIJlaIp1Ifjlr2axERW70LB55P5zEeyhu6gzGqibW93kS0HqA AvEPHiJV69/zr29QlrCsM/W/jXFbAe5hoob+VAPeUy1JX7xyX2O7xHFtOVGiN3v3Dq jFMTlFBtimpqj0RsZdOFTCND4jHWDuw3WoSGIMTPyx5g6WmePb5x/3q7T8kODSjMML Uatt5iG4MnXghFajEcxRlB/dgfQ6jDvJt9RN7xeZ+sOOb4CzCl0rDiR0VscaTE5fVy XmpIrTTE2iWlHlBkgmN+j12QsmepXrJvCtZXijf+OmN65rPyYSrIHC+U+lEEfDbl3Y Q0/wFs7tdbxgg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004Ymd-28Vn; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Kevin Hao , Mauro Carvalho Chehab , Philipp Stanner , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 04/13] media: dvb_frontend: don't play tricks with underflow values Date: Wed, 16 Oct 2024 12:22:20 +0200 Message-ID: <6b41097eec702cc61127ada9cf118c98a9e235c5.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" fepriv->auto_sub_step is unsigned. Setting it to -1 is just a trick to avoid calling continue. It relies to have this code just afterwards: if (!ready) fepriv->auto_sub_step++; Simplify the code by simply setting it to zero and use continue to return to the while loop. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_frontend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core= /dvb_frontend.c index d48f48fda87c..c9283100332a 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -443,8 +443,8 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_fr= ontend *fe, int check_wra =20 default: fepriv->auto_step++; - fepriv->auto_sub_step =3D -1; /* it'll be incremented to 0 in a moment = */ - break; + fepriv->auto_sub_step =3D 0; + continue; } =20 if (!ready) fepriv->auto_sub_step++; --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D07F206E66; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=MNHpc4sf+WjQCfdQ9gQpHjR6WIfLDoDDV+an4sYEww/iZlcK9DkyTdp3ZQDEH4st6WnggAs0gV2EaJh5xTRazW22XSUpUBX4LkZ1kOlPN4my2c01pTVzpouZYPLWWD6kP+to8EXDHZyBDQ3UOKF9vxlpoC7FvzmxHUJ8sbSvpCs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=ZgpHQI6GK409XtLuLgOrMuqhCtgYxGC5WDTbMjcGNCQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fz/FJU+saG0DtUaVGqrf47Rpcsp0mgJUDZwZ7DiiB+cbgi/ztClPhCtSYzmP8N7bfM1AByy4cL2R+tjmX3faBmc7Z2GUFIwDs/dswkRAiOsaybfCswpUt88EK3Km3eDCDdcS5ltMjjMNsoMDdHtPdfD2/Acs4QfjI0cfm00rNec= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=dNp90kIq; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="dNp90kIq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9C43C4CEC5; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=ZgpHQI6GK409XtLuLgOrMuqhCtgYxGC5WDTbMjcGNCQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dNp90kIqW6eaRwDQqDdml2VoOGQ3FJrQsvWIyRrY8m7PZR1MTTNxXOIt4IOwp6Zv6 Pv6jsrLUW5obGPukd6tm6T4yigUTXmIBDU1dghMRLAry2CYfvBCogdEm80vtKN5jRr 6AGbSbmLOhvAjD+hAkVHY5uRTEsPvzWOc+WV0s/0NLpxuLygcsnjZaC14PHJihx022 E/WrhiJal1MNMcPPYTCie/sQUIyiYvbvvO1gub2qnAGuKsAG+77abI2srR1Pm43vRy lBQOGwQjlAag0wFMkmLpPOHfQXDxdg7El4EsGByA1tw5u3t1DtzkdB/iBROwciGjxl mad3NNIHA9kzg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004Ymh-2F9J; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Martin Tuma , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 05/13] media: mgb4: protect driver against spectre Date: Wed, 16 Oct 2024 12:22:21 +0200 Message-ID: <4675c8e726c7d55bbecf9f4772370daa8b46ccd3.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" Frequency range is set from sysfs via frequency_range_store(), being vulnerable to spectre, as reported by smatch: drivers/media/pci/mgb4/mgb4_cmt.c:231 mgb4_cmt_set_vin_freq_range() warn: = potential spectre issue 'cmt_vals_in' [r] drivers/media/pci/mgb4/mgb4_cmt.c:238 mgb4_cmt_set_vin_freq_range() warn: = possible spectre second half. 'reg_set' Fix it. Fixes: 0ab13674a9bd ("media: pci: mgb4: Added Digiteq Automotive MGB4 drive= r") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Martin T=C5=AFma --- drivers/media/pci/mgb4/mgb4_cmt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/pci/mgb4/mgb4_cmt.c b/drivers/media/pci/mgb4/mgb= 4_cmt.c index 70dc78ef193c..a25b68403bc6 100644 --- a/drivers/media/pci/mgb4/mgb4_cmt.c +++ b/drivers/media/pci/mgb4/mgb4_cmt.c @@ -227,6 +227,8 @@ void mgb4_cmt_set_vin_freq_range(struct mgb4_vin_dev *v= indev, u32 config; size_t i; =20 + freq_range =3D array_index_nospec(freq_range, ARRAY_SIZE(cmt_vals_in)); + addr =3D cmt_addrs_in[vindev->config->id]; reg_set =3D cmt_vals_in[freq_range]; =20 --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D0E3206E68; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=IYOg0q7XJVOdo5jol8KgmNRG2R8grauPY/s3mXVDQ4NP315rXLfAUidWyZ9X7/LOgsWuivrqDw0eATx/pnjnwRP1NcyOJDrtYvatDeo/fXbmFrYTkSLLfeIT8KNIxLiuP05EPaRMiW0NE6UA5UlCAUmnKbpS0fz38bfoHDz31qA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=uwXxWFWVLKeBra7Pb/skSKfPY8KH3t9pzk1shDbiY6g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=odS9oX/Gzse3+13oD3jiPXdTAA1cOT1kAR/5hG4LRzsxnbxOo9N1zlXnr3YGZ8X4TrrxDsglhqascEFlap09lf+fSS7Ooa0y1Q7cg1/Go+rH79TUVVidgb2dly5lNGbSxfmzrrGLpZbV/D0f/dtHweexsB+cPJta+c3CT1X5hu4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TB8+PgGh; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TB8+PgGh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CD9EEC4CECF; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=uwXxWFWVLKeBra7Pb/skSKfPY8KH3t9pzk1shDbiY6g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TB8+PgGhm8QStzaRCd1VsOm0PypGd7cwX0GhD9yrP5GxTBQ3sGiscHYfpjJtTY91i AUUBJc4W9ewP33KdVWdmiGIxk/hnDIK16MmpwkayvF8WQFOT6kaS5tXZlCV2NTkImE Ox8ZNFJQsLZ3qoYv1Na2iMzT95dqZ30XoTqGpjYT6wJrj+jnjrDaBY7041HKc7w1VG 0VrTJZYfz9B6xUky/ypnSNfgrSbjhXoPoo3TObhap/fICGzkJA0n8cRgDWYzBvvj75 Mjs810tAioumlfHOK0o31ifKSM4xxUnKzjSYcSwxNl4cReenzBn0WiuA+/967KmcZC Nl3RWoN5/oQYw== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004Yml-2Lun; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Greg Kroah-Hartman , Hans Verkuil , Mauro Carvalho Chehab , Stefan Herdler , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linux-staging@lists.linux.dev, stable@vger.kernel.org Subject: [PATCH 06/13] media: av7110: fix a spectre vulnerability Date: Wed, 16 Oct 2024 12:22:22 +0200 Message-ID: <134996d99ff80e23fe895674cf640c9a5445798d.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potentia= l spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/av7110/av7110.h | 4 +++- drivers/staging/media/av7110/av7110_ca.c | 25 ++++++++++++++++-------- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/drivers/staging/media/av7110/av7110.h b/drivers/staging/media/= av7110/av7110.h index ec461fd187af..b584754f4be0 100644 --- a/drivers/staging/media/av7110/av7110.h +++ b/drivers/staging/media/av7110/av7110.h @@ -88,6 +88,8 @@ struct infrared { u32 ir_config; }; =20 +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { /* devices */ @@ -163,7 +165,7 @@ struct av7110 { =20 /* CA */ =20 - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; =20 enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/staging/media/av7110/av7110_ca.c b/drivers/staging/med= ia/av7110/av7110_ca.c index 6ce212c64e5d..fce4023c9dea 100644 --- a/drivers/staging/media/av7110/av7110_ca.c +++ b/drivers/staging/media/av7110/av7110_ca.c @@ -26,23 +26,28 @@ =20 void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n", av7110); =20 if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] !=3D 1 && data[2] !=3D 2) + if (data[2] !=3D 1 && data[2] !=3D MAX_CI_SLOTS) break; + + slot_num =3D array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags =3D 0; + av7110->ci_slot[slot_num].flags =3D 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |=3D CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |=3D CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |=3D CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |=3D CA_CI_MODULE_READY; break; } break; @@ -262,15 +267,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned i= nt cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info =3D (struct ca_slot_info *)parg; + unsigned int slot_num; =20 if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num =3D info->num; - av7110->ci_slot[info->num].type =3D FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num =3D array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num =3D info->num; + av7110->ci_slot[slot_num].type =3D FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } =20 --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D199206E95; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=lRcEdOxCr7rPjgc7hm0UrG2QI1HDbHZ52ETGD3WiSmaKTIw51vWatcwvhD3GoMxyDQ9v0gm//F6gSavT1KjtPGHJiMVmCyobxSl3feIBb7wUzHDVXKMyhvQ+Rl72AOh84hD3yoa35mXWVuQA+S6BgVV4lWgFuh3T9YRmiZQoBL4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=OwZ5oRre6Qvryx1HKm59rgRRdHOV74pHCRQsrCjAiZo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KOgD0uu98kPSVgO85WS/HLy1o9rgpsOq19brQM9zdd/Xa1sy2c9h1Q2+Vsbbb2RBxiGYTGIlfBOuAOYG+/0N74IMGsW4voHuAYPzLuRUmofkDd1mfaLC02JxmdV2O2XoqaVXHj6/Th2ohHuoibmpim+B1Q0C4FNt80qGFYHtBak= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=vRiOwBdO; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="vRiOwBdO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1FBAC4CED1; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=OwZ5oRre6Qvryx1HKm59rgRRdHOV74pHCRQsrCjAiZo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vRiOwBdOQnR56E9IFo6vSYnI0BAQADVHdAG+nZ55R50yOOJiOYxtPEO61tQWOONLr fC8QtBvHVTVp+1occ1ZxIjDqoTgF+/J0wB/d37FaWstaGML4TLH52bXR9RQioKWcam h8KiQuoy5fMKc1P/1xc6nz2ZYS3DCGufIrlh73lCR7X1WQSuWJQYQAOINtdT06uYV+ o6rzFAzbfbtFamw+NROgiSYqim+BvQtJEjXcM1Kcp51MlQzvs/cr4Cl69ee4kIC89J I8x9zvuDY41PchLrTph0FSAgOFmcPC0aoKU0QFat6bnByYy3NL2tYT/qeKuLw1TXTl zWxJZVm+VL38w== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004Ymp-2SnT; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Andrzej Pietrasiewicz , Hans Verkuil , Jacek Anaszewski , Mauro Carvalho Chehab , Sylwester Nawrocki , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 07/13] media: s5p-jpeg: prevent buffer overflows Date: Wed, 16 Oct 2024 12:22:23 +0200 Message-ID: <16ccf3d588665a5a0dda91cbb04374d6aea99ca6.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The current logic allows word to be less than 2. If this happens, there will be buffer overflows. Add extra checks to prevent it. While here, remove an unused word =3D 0 assignment. Fixes: 6c96dbbc2aa9 ("[media] s5p-jpeg: add support for 5433") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Jacek Anaszewski --- .../media/platform/samsung/s5p-jpeg/jpeg-core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c b/drivers/= media/platform/samsung/s5p-jpeg/jpeg-core.c index d2c4a0178b3c..1db4609b3557 100644 --- a/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c @@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5= p_jpeg_ctx *ctx) (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; jpeg_buffer.curr =3D 0; =20 - word =3D 0; - if (get_word_be(&jpeg_buffer, &word)) return; - jpeg_buffer.size =3D (long)word - 2; + + if (word < 2) + jpeg_buffer.size =3D 0; + else + jpeg_buffer.size =3D (long)word - 2; + jpeg_buffer.data +=3D 2; jpeg_buffer.curr =3D 0; =20 @@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, u= nsigned int *word) if (byte =3D=3D -1) return -1; *word =3D (unsigned int)byte | temp; + return 0; } =20 @@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data= *result, if (get_word_be(&jpeg_buffer, &word)) break; length =3D (long)word - 2; - if (!length) + if (length <=3D 0) return false; sof =3D jpeg_buffer.curr; /* after 0xffc0 */ sof_len =3D length; @@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data= *result, if (get_word_be(&jpeg_buffer, &word)) break; length =3D (long)word - 2; - if (!length) + if (length <=3D 0) return false; if (n_dqt >=3D S5P_JPEG_MAX_MARKER) return false; @@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data= *result, if (get_word_be(&jpeg_buffer, &word)) break; length =3D (long)word - 2; - if (!length) + if (length <=3D 0) return false; if (n_dht >=3D S5P_JPEG_MAX_MARKER) return false; @@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data= *result, if (get_word_be(&jpeg_buffer, &word)) break; length =3D (long)word - 2; + /* No need to check underflows as skip() does it */ skip(&jpeg_buffer, length); break; } --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63D612071F6; Wed, 16 Oct 2024 10:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=MZk0g0gm4zoAJGSk9YyNrG5Q/x1AJCEU1TZ09XcQLiSkWHL/bv9ixJ2aYDO3iAiLEfRQKJrzagAaHErMOuXyVPgkZwjnkF6SY2PgGpyLLUMXRImig0rbTep5aXYybkcq01UkrlATFaVX0X26CvFTi9qG3ceaS8Lu8typnjyTNpM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=vq7QJpYiMutw0B1hm8O24dEVpiMZEcoq2f2zZUsJPKk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ogPno82wIrTFns9B7mE0AWGU4JbsiH4Z6roIVESAnTu4ZoKyxVnBDfYLFQv9o1eCN7S51KCzxsZ4xpkiDVVj8FOrXZQEkv0Dd/0KX3cJM1W0S8x/34SmfU+KXogTIxhiqozq6pUT8QOD0z6h0fFfjsgs15rWUA+NM2IwTfhT79Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Tqetwn/j; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Tqetwn/j" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DFFBAC4CED8; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=vq7QJpYiMutw0B1hm8O24dEVpiMZEcoq2f2zZUsJPKk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Tqetwn/juQJdGucRqIq2PBHKkF6EhDe0jorxR1wAuGRT8x4mtvPN7XbotVG9V6Zas SDr1HPBnZtzyBTAfPvF6dzNlnlOUQeNR0QY7eTVU9dX6B6bxJL/o/QNNofN5shoixS NuD1fCyAGjZqaeaabqW7arDwj2rDYrF+cRr26k6aa4oWL/SYAgYwyR3HqSNPH9T+Z/ 4ERp9I5ylUvFxFLLXi0yR0nqLIIk6xGOv8zeW0mdcTd3/46kyg8jMvVduR4jbDYU7J rucX1GHCD7hafdpkKQFfigEkirt+8Z3apXboak1SqQJfOh18mvxcWcDRtqC0K3JPmb q8Z1SBAdukJMA== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004Ymt-2ZRN; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , =?UTF-8?q?Krzysztof=20Ha=C5=82asa?= , Mauro Carvalho Chehab , Sakari Ailus , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 08/13] media: ar0521: don't overflow when checking PLL values Date: Wed, 16 Oct 2024 12:22:24 +0200 Message-ID: <39b23d468eea2714a24a94cb6c20aef5aff492e6.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The PLL checks are comparing 64 bit integers with 32 bit ones. Depending on the values of the variables, this may underflow. Fix it ensuring that both sides of the expression are u64. Fixes: 852b50aeed15 ("media: On Semi AR0521 sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Acked-by: Sakari Ailus --- drivers/media/i2c/ar0521.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/ar0521.c b/drivers/media/i2c/ar0521.c index fc27238dd4d3..24873149096c 100644 --- a/drivers/media/i2c/ar0521.c +++ b/drivers/media/i2c/ar0521.c @@ -255,10 +255,10 @@ static u32 calc_pll(struct ar0521_dev *sensor, u32 fr= eq, u16 *pre_ptr, u16 *mult continue; /* Minimum value */ if (new_mult > 254) break; /* Maximum, larger pre won't work either */ - if (sensor->extclk_freq * (u64)new_mult < AR0521_PLL_MIN * + if (sensor->extclk_freq * (u64)new_mult < (u64)AR0521_PLL_MIN * new_pre) continue; - if (sensor->extclk_freq * (u64)new_mult > AR0521_PLL_MAX * + if (sensor->extclk_freq * (u64)new_mult > (u64)AR0521_PLL_MAX * new_pre) break; /* Larger pre won't work either */ new_pll =3D div64_round_up(sensor->extclk_freq * (u64)new_mult, --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 543272071E6; Wed, 16 Oct 2024 10:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=CnOWybx0/1mh+FJG3ctU8ENf+MgIboMUzZ2cGIhFFJKF7aCRxwU4/zKsqnNDu8FN4fRGerb3Jv0gTUtUf0f8zF+rcEQZaENpxe1oLiL3XV3dEtQgP45Sea6/zAzQkD4ERkWKuwus74j4SWNPjwz2I4G9HbJac7+g9xCxGAWDfYE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=Bn2f3bmb+9nMMRejNorJo9NsRZzQIn1Q3kUP79AKzdo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=F0ysCsMTk7cMsugps3FZiyxNA7LrtJ1uAkISHS983FreHODf1yW2OV9s5UsMZZgTSnvzJqtn3oo6uPYw1BlCCv3gCdl3sHTR32l/hnO5HHDbYzgFeot53/xSEeQp11x+hRTl8Mfpqu6nEIX4DmQWObp7RjZ2AT3jAz08Uxvnk2s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NxK6WtW9; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NxK6WtW9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DD5BDC4CED5; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=Bn2f3bmb+9nMMRejNorJo9NsRZzQIn1Q3kUP79AKzdo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NxK6WtW903tq2pITJtkGQe7E3238/Yrh4e9X53qcPnv2n335x6iJgZqglhp3YsU1U awUoSIS+NTxiReF0vwobovRaMXCvLmzJzyk3dX0rs4TfU/lV79SNgNr15RaceuKgFt fBzngsKUGd4Tfs0eU+DZdRySBm2fKVcJE9is/purQU984xcfQ5aWHL4b8iRGHzYPnw /r3SQnSOND2THFszDVKFLMpJ8fkQPsbsVMqbXT428J7+RJs75KLpbT6RZh2G+hBhyB 43yHirILOsLJsEbEaRtwxx1a2SekxaAaDHpicSn9H3xuZ5yxJDyHMub6upkxWOvVsh MAQqWurci5xUA== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004Ymx-2g4X; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Mauro Carvalho Chehab , Steven Toth , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 09/13] media: cx24116: prevent overflows on SNR calculus Date: Wed, 16 Oct 2024 12:22:25 +0200 Message-ID: <644e1a8c55b7cabad791c398e488e2a825fdefb9.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" If reading SNR registers fail, a negative number will be returned, causing an underflow when reading SNR registers. Prevent that. Fixes: 8953db793d5b ("V4L/DVB (9178): cx24116: Add module parameter to retu= rn SNR as ESNO.") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-frontends/cx24116.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-fron= tends/cx24116.c index 8b978a9f74a4..f5dd3a81725a 100644 --- a/drivers/media/dvb-frontends/cx24116.c +++ b/drivers/media/dvb-frontends/cx24116.c @@ -741,6 +741,7 @@ static int cx24116_read_snr_pct(struct dvb_frontend *fe= , u16 *snr) { struct cx24116_state *state =3D fe->demodulator_priv; u8 snr_reading; + int ret; static const u32 snr_tab[] =3D { /* 10 x Table (rounded up) */ 0x00000, 0x0199A, 0x03333, 0x04ccD, 0x06667, 0x08000, 0x0999A, 0x0b333, 0x0cccD, 0x0e667, @@ -749,7 +750,11 @@ static int cx24116_read_snr_pct(struct dvb_frontend *f= e, u16 *snr) =20 dprintk("%s()\n", __func__); =20 - snr_reading =3D cx24116_readreg(state, CX24116_REG_QUALITY0); + ret =3D cx24116_readreg(state, CX24116_REG_QUALITY0); + if (ret < 0) + return ret; + + snr_reading =3D ret; =20 if (snr_reading >=3D 0xa0 /* 100% */) *snr =3D 0xffff; --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64D842071F7; Wed, 16 Oct 2024 10:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=kRYF7+b3ouISpDfXa0+rWA36bXjegs7DxEijQFoWt2KteM+nqT/Q+FZ1tTPL5XNvrV77WeWleDfwx6KZMUJUNuXtML9d0Ta83GGQLFxIASkqWKhk4GMx1RFYvLCGFrpGwZTUaa+Mqi+QSZMJzAxqo4M1kLrHXtYxRAaUfhRptWQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=6DCqyEDP1eYPPtQ1JbTV1frxNx/jykhPfGF62FWOYy0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=crGuyUg9ubv5+Yx/1PLyHmUXSfY3dZdfrwHAuoURhqh5oW2NWLcyFoXOZxcdRM7fBaT1sfT/k8261K2cbAa4ZzVdsUCJ7uVLM6/aEiWDr97ndiJY3ESTFaXOYzI1/fHrX57V1BxM46xWfwGEP/J+1MVOtxKilr+U7hqVNSbCAh8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DqqBdHIf; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DqqBdHIf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E1CF9C4CED7; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=6DCqyEDP1eYPPtQ1JbTV1frxNx/jykhPfGF62FWOYy0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DqqBdHIfFic7shVPcz1idQtvB8DJggll64d52dgmZn2SepvdNI4jr8U7fu9NBv+bn rIbDjT2IcQ9PN4X1IWdhey7gPKjAZ6KkjqC4L+OnPrY9NECYpVE5pW1qmg06QL1+Vr gZM7SISvdS0JDFJ+8bHytsTgMO9hVKC9axmYzVbmXi7Cwe9yR+O7mYcY3T/mgvC/HE MnU2q98OODBs0ay7Mhiot93GzOZAyzuEarVgWp2QKXsX4e/oFtdvlMxvXt5ow515Of PFq/A7YqZo8BnsvvYxM8rPOI03yY4uQkiMrqFjU1Ha3yMSCQntJQgcZhTJpl1tC22Z mAPMvnhpfywKg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004Yn1-2mf4; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 10/13] media: adv7604 prevent underflow condition when reporting colorspace Date: Wed, 16 Oct 2024 12:22:26 +0200 Message-ID: <41d12c1afd6571f9cc56c1b920df6ba558d0b927.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" Currently, adv76xx_log_status() reads some date using io_read() which may return negative values. The current logi doesn't check such errors, causing colorspace to be reported on a wrong way at adv76xx_log_status(). If I/O error happens there, print a different message, instead of reporting bogus messages to userspace. Fixes: 54450f591c99 ("[media] adv7604: driver for the Analog Devices ADV760= 4 video decoder") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Hans Verkuil --- drivers/media/i2c/adv7604.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c index 48230d5109f0..272945a878b3 100644 --- a/drivers/media/i2c/adv7604.c +++ b/drivers/media/i2c/adv7604.c @@ -2519,10 +2519,10 @@ static int adv76xx_log_status(struct v4l2_subdev *s= d) const struct adv76xx_chip_info *info =3D state->info; struct v4l2_dv_timings timings; struct stdi_readback stdi; - u8 reg_io_0x02 =3D io_read(sd, 0x02); + int ret; + u8 reg_io_0x02; u8 edid_enabled; u8 cable_det; - static const char * const csc_coeff_sel_rb[16] =3D { "bypassed", "YPbPr601 -> RGB", "reserved", "YPbPr709 -> RGB", "reserved", "RGB -> YPbPr601", "reserved", "RGB -> YPbPr709", @@ -2621,13 +2621,21 @@ static int adv76xx_log_status(struct v4l2_subdev *s= d) v4l2_info(sd, "-----Color space-----\n"); v4l2_info(sd, "RGB quantization range ctrl: %s\n", rgb_quantization_range_txt[state->rgb_quantization_range]); - v4l2_info(sd, "Input color space: %s\n", - input_color_space_txt[reg_io_0x02 >> 4]); - v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n", - (reg_io_0x02 & 0x02) ? "RGB" : "YCbCr", - (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ? - "(16-235)" : "(0-255)", - (reg_io_0x02 & 0x08) ? "enabled" : "disabled"); + + ret =3D io_read(sd, 0x02); + if (ret < 0) { + v4l2_info(sd, "Can't read Input/Output color space\n"); + } else { + reg_io_0x02 =3D ret; + + v4l2_info(sd, "Input color space: %s\n", + input_color_space_txt[reg_io_0x02 >> 4]); + v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n", + (reg_io_0x02 & 0x02) ? "RGB" : "YCbCr", + (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ? + "(16-235)" : "(0-255)", + (reg_io_0x02 & 0x08) ? "enabled" : "disabled"); + } v4l2_info(sd, "Color space conversion: %s\n", csc_coeff_sel_rb[cp_read(sd, info->cp_csc) >> 4]); =20 --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 570AB2071E9; Wed, 16 Oct 2024 10:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=mzFh+D1Y1RPQ4n+Kut9m+DB98Y0r4AlYgY3uIsXXJuC1mN6JDxBFRWerv20t7BQ5+H4b4d98lzu7VetdRPs6RX/GvdZdCVr0QozvtmwPJbNWdei4fV8HYnhAqkBsa7Ym/S8HWG8EyE12O+E/Ug1V9Izmh0Vd5RSBx+OuxAM9P5E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=SLmUaXbraeATMVHmFTi+JPax/3jn/YG3CdMafhTLceU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IY+CIudelpi265KmbbMusYN6Fxsx+XRDOF1RdttwkzmnJaKfRUttMc6UG9jgJTSi1HvRUHJsosPQKboqv5v8u/FgTMF1KKuBrEYvilg8LtEDOYYGd4329ztRocLEPbdtgU+9UIEeL9va8DN96ztXNcrQwfLVUuoadXDBwyxC5jA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Aawmd90C; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Aawmd90C" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E4352C4CED9; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=SLmUaXbraeATMVHmFTi+JPax/3jn/YG3CdMafhTLceU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Aawmd90CzbQ6C/1SR6xMZAaWhZyacmr2jSouZGOf7tSmToo121gHJ9LVzRkiqP5a5 sZYPuSJdWeTgDS8KR6BEPfayb62Bp4EZvKYZZQ9ekG8J1qpY6V+WALl4+OEHB0+Cwm yvbkPo1Rd7itxpOBZFAMJ0d5/kXDm9n7uNn0qUJwaJHfPq6uTxVxv29yvczp7ivEDI 4QOBJMwujxLiroX9CiSRhyLFZB6p6RnmUv2esEvTe7+b5vDWHs+rYvLHfsjPx2UNKu TzDuZXxHLY3ls4obSxzm41vqpbBsZovGwHw9MRh+63HUJZu7St+1hxhQCQV+CRqTRT lRAaynNYT9d6A== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004Yn7-2tGA; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Manu Abraham , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 11/13] media: stb0899_algo: initialize cfr before using it Date: Wed, 16 Oct 2024 12:22:27 +0200 Message-ID: X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The loop at stb0899_search_carrier() starts with a random value for cfr. Initialize it to zero, just like stb0899_dvbs_algo() to ensure that carrier search won't bail out. Fixes: 8bd135bab91f ("V4L/DVB (9375): Add STB0899 support") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-frontends/stb0899_algo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/stb0899_algo.c b/drivers/media/dvb= -frontends/stb0899_algo.c index df89c33dac23..40537c4ccb0d 100644 --- a/drivers/media/dvb-frontends/stb0899_algo.c +++ b/drivers/media/dvb-frontends/stb0899_algo.c @@ -269,7 +269,7 @@ static enum stb0899_status stb0899_search_carrier(struc= t stb0899_state *state) =20 short int derot_freq =3D 0, last_derot_freq =3D 0, derot_limit, next_loop= =3D 3; int index =3D 0; - u8 cfr[2]; + u8 cfr[2] =3D {0}; u8 reg; =20 internal->status =3D NOCARRIER; --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 558352071E7; Wed, 16 Oct 2024 10:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=o5jmXKCgKPo6aZP0erUos4AbChlVNt14hUTTPMXs0xi7TtScX4t4aCjM+tvgUp7h/l361/0lkb31CchzzgEELuOg3fuwYGgLl57Vo731dAnn84+tR0D0L2HD9y5spcki6O5y96yg+t8dRSKFVPE79AvrYQX22omHlhOBUfuAY2o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=X/tpMzX5sWaZm7bI/IQfEVsIrHbC90ecUHkZSJsDhWQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rCCXDVyF1mnd1f63BXazl30qzSCam7p4GYKtDSa9VNqzGOr4aNOVp/iKCVhvVaJItO+jLqmTNH5wQqjB/Cd2bLqA0KRGFppNWlb10sYD67YoQGpRzjAJwowXFBYYJBSQSFkjA/fhQJcYdQa3TfaL7fTeBQglC+kzGkfjGHN2S4A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hgXpLv48; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hgXpLv48" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DADBEC4CED3; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=X/tpMzX5sWaZm7bI/IQfEVsIrHbC90ecUHkZSJsDhWQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hgXpLv48hBKuLrlVyWNEhsjguV17uqYvM3igvsfgGt+rO0plqekNBuDW2aSoph1Oh y4BbCXESQmGC/w5gsWBu9zTJBvCYy0xn8mUO3zm2WGLNYAxLsBOy8ZqEFID7Bgfmgn D6trMvK58fZFPgDyDltkaXICSKdqS0bPRoB9kjXGRWbSKNdZ4cQpXgNSrJWz2aYiWm Jmb2ZcOTXyTrMg/WMZi6YB1tFx1FiKbGIiFLLcb0nEoolsc19H4loIl3eUZRQYMESW K7pqTjazOr7sTNJVcG+9BK0dk6z7g/am2YSeJgJA+vQyO3dBo3YnUciCxbt8Tbm3Jm wSPbHuZtxR2Bg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004YnB-2zm7; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 12/13] media: cec: extron-da-hd-4k-plus: don't use -1 as an error code Date: Wed, 16 Oct 2024 12:22:28 +0200 Message-ID: <21a4b368b49aaa46e9d78cccd855bb11b49ab39c.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The logic at get_edid_tag_location() returns either an offset or an error condition. However, the error condition uses a non-standard "-1" value. Use instead -ENOENT to indicate that the tag was not found. Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA H= D 4K Plus CEC driver") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- .../cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plu= s.c b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c index a526464af88c..7d03a36df5cf 100644 --- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c +++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c @@ -348,12 +348,12 @@ static int get_edid_tag_location(const u8 *edid, unsi= gned int size, =20 /* Return if not a CTA-861 extension block */ if (size < 256 || edid[0] !=3D 0x02 || edid[1] !=3D 0x03) - return -1; + return -ENOENT; =20 /* search tag */ d =3D edid[0x02] & 0x7f; if (d <=3D 4) - return -1; + return -ENOENT; =20 i =3D 0x04; end =3D 0x00 + d; @@ -371,7 +371,7 @@ static int get_edid_tag_location(const u8 *edid, unsign= ed int size, return offset + i; i +=3D len + 1; } while (i < end); - return -1; + return -ENOENT; } =20 static void extron_edid_crc(u8 *edid) --=20 2.47.0 From nobody Tue Nov 26 19:14:42 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 665E22071F8; Wed, 16 Oct 2024 10:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; cv=none; b=uN122EBEbuEr43Ep/KWQz1Me1UvD+gxjI6ZF/xWrON+dfUVIBcy0UWcS7wCWgWW6veGs9rNY6F5uxrENuigrTEQSC3SsbnX+C9siREgcvO6nyyvrCU2URqvxINzH8/JGJF9F2GjsbfxXtql/kjEyc33QPqUnKhsCFX4ZIl3K3rg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729074158; c=relaxed/simple; bh=Cn5sdvVgySd2SkhlcB6D2dHU5pDMU4RvB8S/dtW3Ge4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RQZ0/UZp5IZaAJas8+b22k+wUNA1ZaI2po+6jBLPH5Wz0PKiM1niVNzwqhtGoG9MFBo/Xeegv0G9gPjCTxAIYVV/lVWyh9iVEMbedFBjnkuby1n6m8buDwI2A42zAk351LfP3OLaI+HJ3mI/cuKoZTyOUwWnohbPgrl0Q64iNHo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DrwtMAld; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DrwtMAld" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF8C5C4CED6; Wed, 16 Oct 2024 10:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729074157; bh=Cn5sdvVgySd2SkhlcB6D2dHU5pDMU4RvB8S/dtW3Ge4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DrwtMAldEiwsCGnw5o6X4y3LRrz9siEXi3jAEQ77C2u/+7C7L8wBEM3jNqgIim1yk c66U+yFzarA3Ze/f09jhRdPRxXAT0K6zS48SlTOEnDq9YckYxmjuZlWwky+9pXN6KK dpaDY2tgHrehE92gVxC2YsMItccNU/ClIfSll003XuFNY6d0jJL7BKlXvAii/kPH9c XXE6wdDGfnR0S8lSPc9NP8r9+E93hprLiR/9HyWaQCQZM1md3SEonA6Up5U58XtqCg XlnLiwT1q5XvZxytaxhXyt68gEdKgYqswOpct76kHvesoX9xucyYshqu6wefwtLpaE SBjkhJJ07ng3g== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t11Ap-00000004YnF-36Qm; Wed, 16 Oct 2024 12:22:35 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 13/13] media: pulse8-cec: fix data timestamp at pulse8_setup() Date: Wed, 16 Oct 2024 12:22:29 +0200 Message-ID: <8d5dfc87d297a92d5ccc750c5c002bbc4226d3ad.1729074076.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" There is a hidden overflow condition there. As date is signed and u8 is unsigned, doing: date =3D (data[0] << 24) With a value bigger than 07f will make all upper bits of date 0xffffffff. This can be demonstrated with this small code: typedef int64_t time64_t; typedef uint8_t u8; int main(void) { u8 data[] =3D { 0xde ,0xad , 0xbe, 0xef }; time64_t date; date =3D (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3]; printf("Invalid data =3D 0x%08lx\n", date); date =3D ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | da= ta[3]; printf("Expected data =3D 0x%08lx\n", date); return 0; } Fix it by converting the upper bit calculation to unsigned. Fixes: cea28e7a55e7 ("media: pulse8-cec: reorganize function order") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/cec/usb/pulse8/pulse8-cec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/cec/usb/pulse8/pulse8-cec.c b/drivers/media/cec/= usb/pulse8/pulse8-cec.c index ba67587bd43e..171366fe3544 100644 --- a/drivers/media/cec/usb/pulse8/pulse8-cec.c +++ b/drivers/media/cec/usb/pulse8/pulse8-cec.c @@ -685,7 +685,7 @@ static int pulse8_setup(struct pulse8 *pulse8, struct s= erio *serio, err =3D pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 4); if (err) return err; - date =3D (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3]; + date =3D ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | d= ata[3]; dev_info(pulse8->dev, "Firmware build date %ptT\n", &date); =20 dev_dbg(pulse8->dev, "Persistent config:\n"); --=20 2.47.0