evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

media: dvb-usb-v2: lmedm04: Improve logic checking of warm start

Browse source 
commit 3d932ee27e852e4904647f15b64dedca51187ad7 upstream.

Warm start has no check as whether a genuine device has
connected and proceeds to next execution path.

Check device should read 0x47 at offset of 2 on USB descriptor read
and it is the amount requested of 6 bytes.

Fix for
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access as

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Malcolm Priestley 2017-09-26 17:10:20 -04:00 • committed by Greg Kroah-Hartman
parent 3196c1515e
commit ca48c81cff
1 changed files with 18 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
drivers/media/usb/dvb-usb-v2/lmedm04.c
View file

@ -503,18 +503,23 @@ static int lme2510_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid,
static int lme2510_return_status(struct dvb_usb_device *d) static int lme2510_return_status(struct dvb_usb_device *d)
{ {
int ret = 0; int ret;
u8 *data; u8 *data;
data = kzalloc(10, GFP_KERNEL); data = kzalloc(6, GFP_KERNEL);
if (!data) if (!data)
return -ENOMEM; return -ENOMEM;
ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200); 0x06, 0x80, 0x0302, 0x00,
info("Firmware Status: %x (%x)", ret , data[2]); data, 0x6, 200);
if (ret != 6)
ret = -EINVAL;
else
ret = data[2];
info("Firmware Status: %6ph", data);
ret = (ret < 0) ? -ENODEV : data[2];
kfree(data); kfree(data);
return ret; return ret;
} }
@ -1199,6 +1204,7 @@ static int lme2510_get_adapter_count(struct dvb_usb_device *d)
static int lme2510_identify_state(struct dvb_usb_device *d, const char **name) static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
{ {
struct lme2510_state *st = d->priv; struct lme2510_state *st = d->priv;
int status;
usb_reset_configuration(d->udev); usb_reset_configuration(d->udev);
@ -1207,12 +1213,16 @@ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware; st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware;
if (lme2510_return_status(d) == 0x44) { status = lme2510_return_status(d);
if (status == 0x44) {
*name = lme_firmware_switch(d, 0); *name = lme_firmware_switch(d, 0);
return COLD; return COLD;
} }
return 0; if (status != 0x47)
return -EINVAL;
return WARM;
} }
static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type, static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,