lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 025/563] media: dib0700: fix undefined behavior in tuner shutdown
    Date
    From: Michael Kuron <michael.kuron@gmail.com>

    commit f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 upstream.

    This fixes a problem where closing the tuner would leave it in a state
    where it would not tune to any channel when reopened. This problem was
    discovered as part of https://github.com/hselasky/webcamd/issues/16.

    Since adap->id is 0 or 1, this bit-shift overflows, which is undefined
    behavior. The driver still worked in practice as the overflow would in
    most environments result in 0, which rendered the line a no-op. When
    running the driver as part of webcamd however, the overflow could lead
    to 0xff due to optimizations by the compiler, which would, in the end,
    improperly shut down the tuner.

    The bug is a regression introduced in the commit referenced below. The
    present patch causes identical behavior to before that commit for
    adap->id equal to 0 or 1. The driver does not contain support for
    dib0700 devices with more adapters, assuming such even exist.

    Tests have been performed with the Xbox One Digital TV Tuner on amd64.
    Not all dib0700 devices are expected to be affected by the regression;
    this code path is only taken by those with incorrect endpoint numbers.

    Link: https://lore.kernel.org/linux-media/1d2fc36d94ced6f67c7cc21dcc469d5e5bdd8201.1632689033.git.mchehab+huawei@kernel.org

    Cc: stable@vger.kernel.org
    Fixes: 7757ddda6f4f ("[media] DiB0700: add function to change I2C-speed")
    Signed-off-by: Michael Kuron <michael.kuron@gmail.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/media/usb/dvb-usb/dib0700_core.c | 2 --
    1 file changed, 2 deletions(-)

    --- a/drivers/media/usb/dvb-usb/dib0700_core.c
    +++ b/drivers/media/usb/dvb-usb/dib0700_core.c
    @@ -618,8 +618,6 @@ int dib0700_streaming_ctrl(struct dvb_us
    deb_info("the endpoint number (%i) is not correct, use the adapter id instead", adap->fe_adap[0].stream.props.endpoint);
    if (onoff)
    st->channel_state |= 1 << (adap->id);
    - else
    - st->channel_state |= 1 << ~(adap->id);
    } else {
    if (onoff)
    st->channel_state |= 1 << (adap->fe_adap[0].stream.props.endpoint-2);

    \
     
     \ /
      Last update: 2022-01-24 21:11    [W:2.249 / U:1.388 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site