lkml.org 
[lkml]   [2021]   [Dec]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 160/177] media: mxl111sf: change mutex_init() location
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    commit 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f upstream.

    Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized
    mutex. The problem was in wrong mutex_init() location.

    Previous mutex_init(&state->msg_lock) call was in ->init() function, but
    dvb_usbv2_init() has this order of calls:

    dvb_usbv2_init()
    dvb_usbv2_adapter_init()
    dvb_usbv2_adapter_frontend_init()
    props->frontend_attach()

    props->init()

    Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach()
    internally we need to initialize state->msg_lock before
    frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_*
    devices, which will simply initiaize mutex.

    Reported-and-tested-by: syzbot+5ca0bf339f13c4243001@syzkaller.appspotmail.com

    Fixes: 8572211842af ("[media] mxl111sf: convert to new DVB USB")
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: Sean Young <sean@mess.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/media/usb/dvb-usb-v2/mxl111sf.c | 16 ++++++++++++++--
    1 file changed, 14 insertions(+), 2 deletions(-)

    --- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
    +++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
    @@ -931,8 +931,6 @@ static int mxl111sf_init(struct dvb_usb_
    .len = sizeof(eeprom), .buf = eeprom },
    };

    - mutex_init(&state->msg_lock);
    -
    ret = get_chip_info(state);
    if (mxl_fail(ret))
    pr_err("failed to get chip info during probe");
    @@ -1074,6 +1072,14 @@ static int mxl111sf_get_stream_config_dv
    return 0;
    }

    +static int mxl111sf_probe(struct dvb_usb_device *dev)
    +{
    + struct mxl111sf_state *state = d_to_priv(dev);
    +
    + mutex_init(&state->msg_lock);
    + return 0;
    +}
    +
    static struct dvb_usb_device_properties mxl111sf_props_dvbt = {
    .driver_name = KBUILD_MODNAME,
    .owner = THIS_MODULE,
    @@ -1083,6 +1089,7 @@ static struct dvb_usb_device_properties
    .generic_bulk_ctrl_endpoint = 0x02,
    .generic_bulk_ctrl_endpoint_response = 0x81,

    + .probe = mxl111sf_probe,
    .i2c_algo = &mxl111sf_i2c_algo,
    .frontend_attach = mxl111sf_frontend_attach_dvbt,
    .tuner_attach = mxl111sf_attach_tuner,
    @@ -1124,6 +1131,7 @@ static struct dvb_usb_device_properties
    .generic_bulk_ctrl_endpoint = 0x02,
    .generic_bulk_ctrl_endpoint_response = 0x81,

    + .probe = mxl111sf_probe,
    .i2c_algo = &mxl111sf_i2c_algo,
    .frontend_attach = mxl111sf_frontend_attach_atsc,
    .tuner_attach = mxl111sf_attach_tuner,
    @@ -1165,6 +1173,7 @@ static struct dvb_usb_device_properties
    .generic_bulk_ctrl_endpoint = 0x02,
    .generic_bulk_ctrl_endpoint_response = 0x81,

    + .probe = mxl111sf_probe,
    .i2c_algo = &mxl111sf_i2c_algo,
    .frontend_attach = mxl111sf_frontend_attach_mh,
    .tuner_attach = mxl111sf_attach_tuner,
    @@ -1233,6 +1242,7 @@ static struct dvb_usb_device_properties
    .generic_bulk_ctrl_endpoint = 0x02,
    .generic_bulk_ctrl_endpoint_response = 0x81,

    + .probe = mxl111sf_probe,
    .i2c_algo = &mxl111sf_i2c_algo,
    .frontend_attach = mxl111sf_frontend_attach_atsc_mh,
    .tuner_attach = mxl111sf_attach_tuner,
    @@ -1311,6 +1321,7 @@ static struct dvb_usb_device_properties
    .generic_bulk_ctrl_endpoint = 0x02,
    .generic_bulk_ctrl_endpoint_response = 0x81,

    + .probe = mxl111sf_probe,
    .i2c_algo = &mxl111sf_i2c_algo,
    .frontend_attach = mxl111sf_frontend_attach_mercury,
    .tuner_attach = mxl111sf_attach_tuner,
    @@ -1381,6 +1392,7 @@ static struct dvb_usb_device_properties
    .generic_bulk_ctrl_endpoint = 0x02,
    .generic_bulk_ctrl_endpoint_response = 0x81,

    + .probe = mxl111sf_probe,
    .i2c_algo = &mxl111sf_i2c_algo,
    .frontend_attach = mxl111sf_frontend_attach_mercury_mh,
    .tuner_attach = mxl111sf_attach_tuner,

    \
     
     \ /
      Last update: 2021-12-20 16:19    [W:3.057 / U:0.508 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site