redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

[media] af9035: do not use buffers from stack for usb_bulk_msg() 

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
hifive-unleashed-5.1
Antti Palosaari 2013-02-26 13:56:34 -03:00 committed by Mauro Carvalho Chehab
parent aff8c2d475
commit 3484d37a66
2 changed files with 24 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
drivers/media/usb/dvb-usb-v2/af9035.c
View File

@ -41,43 +41,45 @@ static u16 af9035_checksum(const u8 *buf, size_t len)
static int af9035_ctrl_msg(struct dvb_usb_device *d, struct usb_req *req)
{
#define BUF_LEN 64
#define REQ_HDR_LEN 4 /* send header size */
#define ACK_HDR_LEN 3 /* rece header size */
#define CHECKSUM_LEN 2
#define USB_TIMEOUT 2000
struct state *state = d_to_priv(d);
int ret, wlen, rlen;
u8 buf[BUF_LEN];
u16 checksum, tmp_checksum;
mutex_lock(&d->usb_mutex);
/* buffer overflow check */
if (req->wlen > (BUF_LEN - REQ_HDR_LEN - CHECKSUM_LEN) ||
req->rlen > (BUF_LEN - ACK_HDR_LEN - CHECKSUM_LEN)) {
dev_err(&d->udev->dev, "%s: too much data wlen=%d rlen=%d\n",
__func__, req->wlen, req->rlen);
return -EINVAL;
ret = -EINVAL;
goto err;
}
buf[0] = REQ_HDR_LEN + req->wlen + CHECKSUM_LEN - 1;
buf[1] = req->mbox;
buf[2] = req->cmd;
buf[3] = state->seq++;
memcpy(&buf[REQ_HDR_LEN], req->wbuf, req->wlen);
state->buf[0] = REQ_HDR_LEN + req->wlen + CHECKSUM_LEN - 1;
state->buf[1] = req->mbox;
state->buf[2] = req->cmd;
state->buf[3] = state->seq++;
memcpy(&state->buf[REQ_HDR_LEN], req->wbuf, req->wlen);
wlen = REQ_HDR_LEN + req->wlen + CHECKSUM_LEN;
rlen = ACK_HDR_LEN + req->rlen + CHECKSUM_LEN;
/* calc and add checksum */
checksum = af9035_checksum(buf, buf[0] - 1);
buf[buf[0] - 1] = (checksum >> 8);
buf[buf[0] - 0] = (checksum & 0xff);
checksum = af9035_checksum(state->buf, state->buf[0] - 1);
state->buf[state->buf[0] - 1] = (checksum >> 8);
state->buf[state->buf[0] - 0] = (checksum & 0xff);
/* no ack for these packets */
if (req->cmd == CMD_FW_DL)
rlen = 0;
ret = dvb_usbv2_generic_rw(d, buf, wlen, buf, rlen);
ret = dvb_usbv2_generic_rw_locked(d,
state->buf, wlen, state->buf, rlen);
if (ret)
goto err;
@ -86,8 +88,8 @@ static int af9035_ctrl_msg(struct dvb_usb_device *d, struct usb_req *req)
goto exit;
/* verify checksum */
checksum = af9035_checksum(buf, rlen - 2);
tmp_checksum = (buf[rlen - 2] << 8) | buf[rlen - 1];
checksum = af9035_checksum(state->buf, rlen - 2);
tmp_checksum = (state->buf[rlen - 2] << 8) | state->buf[rlen - 1];
if (tmp_checksum != checksum) {
dev_err(&d->udev->dev, "%s: command=%02x checksum mismatch " \
"(%04x != %04x)\n", KBUILD_MODNAME, req->cmd,
@ -97,23 +99,21 @@ static int af9035_ctrl_msg(struct dvb_usb_device *d, struct usb_req *req)
}
/* check status */
if (buf[2]) {
if (state->buf[2]) {
dev_dbg(&d->udev->dev, "%s: command=%02x failed fw error=%d\n",
__func__, req->cmd, buf[2]);
__func__, req->cmd, state->buf[2]);
ret = -EIO;
goto err;
}
/* read request, copy returned data to return buf */
if (req->rlen)
memcpy(req->rbuf, &buf[ACK_HDR_LEN], req->rlen);
memcpy(req->rbuf, &state->buf[ACK_HDR_LEN], req->rlen);
exit:
return 0;
err:
dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
mutex_unlock(&d->usb_mutex);
if (ret)
dev_dbg(&d->udev->dev, "%s: failed=%d\n", __func__, ret);
return ret;
}

2
drivers/media/usb/dvb-usb-v2/af9035.h
View File

@ -52,6 +52,8 @@ struct usb_req {
};
struct state {
#define BUF_LEN 64
u8 buf[BUF_LEN];
u8 seq; /* packet sequence number */
bool dual_mode;
struct af9033_config af9033_config[2];