Fix for some DMA on stack with DVB devices (rhbz 1417829)
Enable CONFIG_SENSORS_JC42 (rhbz 1417454)
This commit is contained in:
Laura Abbott
parent
9e68bb52f7
commit
9e0078ee54
|
|
@ -0,0 +1,63 @@
|
|||
From patchwork Sun Feb 5 14:57:59 2017
|
||||
Content-Type: text/plain; charset="utf-8"
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: 8bit
|
||||
Subject: [1/2,media] cxusb: Use a dma capable buffer also for reading
|
||||
From: =?utf-8?q?Stefan_Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
|
||||
X-Patchwork-Id: 39207
|
||||
Message-Id: <b638428812af41e080ccfc7cf7ad6963@rwthex-w2-b.rwth-ad.de>
|
||||
To: <linux-media@vger.kernel.org>
|
||||
Cc: <linux-kernel@vger.kernel.org>, Mauro Carvalho Chehab <mchehab@kernel.org>,
|
||||
Michael Krufky <mkrufky@linuxtv.org>,
|
||||
=?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
|
||||
Date: Sun, 5 Feb 2017 15:57:59 +0100
|
||||
|
||||
Commit 17ce039b4e54 ("[media] cxusb: don't do DMA on stack")
|
||||
added a kmalloc'ed bounce buffer for writes, but missed to do the same
|
||||
for reads. As the read only happens after the write is finished, we can
|
||||
reuse the same buffer.
|
||||
|
||||
As dvb_usb_generic_rw handles a read length of 0 by itself, avoid calling
|
||||
it using the dvb_usb_generic_read wrapper function.
|
||||
|
||||
Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
|
||||
---
|
||||
drivers/media/usb/dvb-usb/cxusb.c | 15 ++++++++-------
|
||||
1 file changed, 8 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
|
||||
index 9b8c82d94b3f..8f28a63597bd 100644
|
||||
--- a/drivers/media/usb/dvb-usb/cxusb.c
|
||||
+++ b/drivers/media/usb/dvb-usb/cxusb.c
|
||||
@@ -59,23 +59,24 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
|
||||
u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
|
||||
{
|
||||
struct cxusb_state *st = d->priv;
|
||||
- int ret, wo;
|
||||
+ int ret;
|
||||
|
||||
if (1 + wlen > MAX_XFER_SIZE) {
|
||||
warn("i2c wr: len=%d is too big!\n", wlen);
|
||||
return -EOPNOTSUPP;
|
||||
}
|
||||
|
||||
- wo = (rbuf == NULL || rlen == 0); /* write-only */
|
||||
+ if (rlen > MAX_XFER_SIZE) {
|
||||
+ warn("i2c rd: len=%d is too big!\n", rlen);
|
||||
+ return -EOPNOTSUPP;
|
||||
+ }
|
||||
|
||||
mutex_lock(&d->data_mutex);
|
||||
st->data[0] = cmd;
|
||||
memcpy(&st->data[1], wbuf, wlen);
|
||||
- if (wo)
|
||||
- ret = dvb_usb_generic_write(d, st->data, 1 + wlen);
|
||||
- else
|
||||
- ret = dvb_usb_generic_rw(d, st->data, 1 + wlen,
|
||||
- rbuf, rlen, 0);
|
||||
+ ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, st->data, rlen, 0);
|
||||
+ if (!ret && rbuf && rlen)
|
||||
+ memcpy(rbuf, st->data, rlen);
|
||||
|
||||
mutex_unlock(&d->data_mutex);
|
||||
return ret;
|
||||
|
|
@ -0,0 +1,86 @@
|
|||
From patchwork Sun Feb 5 14:58:00 2017
|
||||
Content-Type: text/plain; charset="utf-8"
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: 8bit
|
||||
Subject: [2/2,media] dvb-usb-firmware: don't do DMA on stack
|
||||
From: =?utf-8?q?Stefan_Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
|
||||
X-Patchwork-Id: 39206
|
||||
Message-Id: <cfae2a63a36641bcab2ec298b21b5b06@rwthex-w2-b.rwth-ad.de>
|
||||
To: <linux-media@vger.kernel.org>
|
||||
Cc: <linux-kernel@vger.kernel.org>, Mauro Carvalho Chehab <mchehab@kernel.org>,
|
||||
Michael Krufky <mkrufky@linuxtv.org>,
|
||||
=?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
|
||||
Date: Sun, 5 Feb 2017 15:58:00 +0100
|
||||
|
||||
The USB control messages require DMA to work. We cannot pass
|
||||
a stack-allocated buffer, as it is not warranted that the
|
||||
stack would be into a DMA enabled area.
|
||||
|
||||
Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
|
||||
---
|
||||
drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 30 ++++++++++++++++------------
|
||||
1 file changed, 17 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
|
||||
index dd048a7c461c..189b6725edd0 100644
|
||||
--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
|
||||
+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
|
||||
@@ -35,41 +35,45 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
|
||||
|
||||
int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
|
||||
{
|
||||
- struct hexline hx;
|
||||
- u8 reset;
|
||||
- int ret,pos=0;
|
||||
+ u8 *buf = kmalloc(sizeof(struct hexline), GFP_KERNEL);
|
||||
+ struct hexline *hx = (struct hexline *)buf;
|
||||
+ int ret, pos = 0;
|
||||
+ u16 cpu_cs_register = cypress[type].cpu_cs_register;
|
||||
|
||||
/* stop the CPU */
|
||||
- reset = 1;
|
||||
- if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
|
||||
+ buf[0] = 1;
|
||||
+ if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
|
||||
err("could not stop the USB controller CPU.");
|
||||
|
||||
- while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) {
|
||||
- deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk);
|
||||
- ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len);
|
||||
+ while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
|
||||
+ deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",
|
||||
+ hx->addr, hx->len, hx->chk);
|
||||
+ ret = usb_cypress_writemem(udev, hx->addr, hx->data, hx->len);
|
||||
|
||||
- if (ret != hx.len) {
|
||||
+ if (ret != hx->len) {
|
||||
err("error while transferring firmware "
|
||||
"(transferred size: %d, block size: %d)",
|
||||
- ret,hx.len);
|
||||
+ ret, hx->len);
|
||||
ret = -EINVAL;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (ret < 0) {
|
||||
- err("firmware download failed at %d with %d",pos,ret);
|
||||
+ err("firmware download failed at %d with %d", pos, ret);
|
||||
+ kfree(buf);
|
||||
return ret;
|
||||
}
|
||||
|
||||
if (ret == 0) {
|
||||
/* restart the CPU */
|
||||
- reset = 0;
|
||||
- if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
|
||||
+ buf[0] = 0;
|
||||
+ if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
|
||||
err("could not restart the USB controller CPU.");
|
||||
ret = -EINVAL;
|
||||
}
|
||||
} else
|
||||
ret = -EIO;
|
||||
+ kfree(buf);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
|
@ -2901,7 +2901,7 @@ CONFIG_SENSORS_ASC7621=m
|
|||
CONFIG_SENSORS_EMC1403=m
|
||||
CONFIG_SENSORS_TMP102=m
|
||||
CONFIG_SENSORS_LTC4261=m
|
||||
# CONFIG_SENSORS_JC42 is not set
|
||||
CONFIG_SENSORS_JC42=m
|
||||
# CONFIG_SENSORS_SMM665 is not set
|
||||
# CONFIG_SENSORS_EMC2103 is not set
|
||||
# CONFIG_SENSORS_GPIO_FAN is not set
|
||||
|
|
|
|||
|
|
@ -643,6 +643,10 @@ Patch856: PCI-ASPM-Handle-PCI-to-PCIe-bridges-as-roots-of-PCIe-hierarchies.patch
|
|||
#CVE-2017-5897 rhbz 1419848 1419851
|
||||
Patch857: ip6_gre-fix-ip6gre_err-invalid-reads.patch
|
||||
|
||||
#rhbz 1417829
|
||||
Patch858: 1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch
|
||||
Patch859: 2-2-media-dvb-usb-firmware-don-t-do-DMA-on-stack.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -2172,6 +2176,10 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Tue Feb 7 2017 Laura Abbott <labbott@fedoraproject.org>
|
||||
- Fix for some DMA on stack with DVB devices (rhbz 1417829)
|
||||
- Enable CONFIG_SENSORS_JC42 (rhbz 1417454)
|
||||
|
||||
* Tue Feb 7 2017 Justin M. Forbes <jforbes@fedoraproject.org>
|
||||
- CVE-2017-5897 ip6_gre: Invalid reads in ip6gre_err (rhbz 1419848 1419851)
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue