summaryrefslogtreecommitdiff
path: root/drivers/media/pci/b2c2 (follow)
Commit message (Collapse)AuthorAge
* media: b2c2: Add missing check in flexcop_pci_isr:Zheyu Ma2022-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit b13203032e679674c7c518f52a7ec0801ca3a829 ] A out-of-bounds bug can be triggered by an interrupt, the reason for this bug is the lack of checking of register values. In flexcop_pci_isr, the driver reads value from a register and uses it as a dma address. Finally, this address will be passed to the count parameter of find_next_packet. If this value is larger than the size of dma, the index of buffer will be out-of-bounds. Fix this by adding a check after reading the value of the register. The following KASAN report reveals it: BUG: KASAN: slab-out-of-bounds in find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] BUG: KASAN: slab-out-of-bounds in _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] BUG: KASAN: slab-out-of-bounds in dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 Read of size 1 at addr ffff8880608c00a0 by task swapper/2/0 CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xec/0x156 lib/dump_stack.c:118 print_address_description+0x78/0x290 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x25b/0x380 mm/kasan/report.c:412 __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:430 find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 flexcop_pass_dmx_data+0x2e/0x40 drivers/media/common/b2c2/flexcop.c:167 flexcop_pci_isr+0x3d1/0x5d0 drivers/media/pci/b2c2/flexcop-pci.c:212 __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149 handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189 handle_irq_event+0xac/0x140 kernel/irq/handle.c:206 handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87 do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 </IRQ> RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61 Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 62 2f 8c 48 89 e5 e8 fb 31 e8 f8 8b 05 75 4f 8e 03 85 c0 7e 07 0f 00 2d 8a 61 66 00 fb f4 <5d> c3 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde RAX: 0000000000000000 RBX: ffffffff8bde44c8 RCX: ffffffff88a11285 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2f6200 RBP: ffff88806b71fcc8 R08: fffffbfff185ec40 R09: fffffbfff185ec40 R10: 0000000000000001 R11: fffffbfff185ec40 R12: 0000000000000002 R13: ffffffff8be9d6e0 R14: 0000000000000000 R15: 0000000000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x6f/0x360 arch/x86/kernel/process.c:557 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548 default_idle_call+0x3b/0x60 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369 start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Allocated by task 1: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2741 [inline] slab_alloc mm/slub.c:2749 [inline] kmem_cache_alloc+0xeb/0x280 mm/slub.c:2754 kmem_cache_zalloc include/linux/slab.h:699 [inline] __kernfs_new_node+0xe2/0x6f0 fs/kernfs/dir.c:633 kernfs_new_node+0x9a/0x120 fs/kernfs/dir.c:693 __kernfs_create_file+0x5f/0x340 fs/kernfs/file.c:992 sysfs_add_file_mode_ns+0x22a/0x4e0 fs/sysfs/file.c:306 create_files fs/sysfs/group.c:63 [inline] internal_create_group+0x34e/0xc30 fs/sysfs/group.c:147 sysfs_create_group fs/sysfs/group.c:173 [inline] sysfs_create_groups+0x9c/0x140 fs/sysfs/group.c:200 driver_add_groups+0x3e/0x50 drivers/base/driver.c:129 bus_add_driver+0x3a5/0x790 drivers/base/bus.c:684 driver_register+0x1cd/0x410 drivers/base/driver.c:170 __pci_register_driver+0x197/0x200 drivers/pci/pci-driver.c:1411 cx88_audio_pci_driver_init+0x23/0x25 drivers/media/pci/cx88/cx88-alsa.c: 1017 do_one_initcall+0xe0/0x610 init/main.c:884 do_initcall_level init/main.c:952 [inline] do_initcalls init/main.c:960 [inline] do_basic_setup init/main.c:978 [inline] kernel_init_freeable+0x4d0/0x592 init/main.c:1145 kernel_init+0x18/0x190 init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8880608c0000 which belongs to the cache kernfs_node_cache of size 160 The buggy address is located 0 bytes to the right of 160-byte region [ffff8880608c0000, ffff8880608c00a0) The buggy address belongs to the page: page:ffffea0001823000 count:1 mapcount:0 mapping:ffff88806bed1e00 index:0x0 compound_mapcount: 0 flags: 0x100000000008100(slab|head) raw: 0100000000008100 dead000000000100 dead000000000200 ffff88806bed1e00 raw: 0000000000000000 0000000000240024 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880608bff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880608c0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880608c0080: 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 ^ ffff8880608c0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880608c0180: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 ================================================================== Link: https://lore.kernel.org/linux-media/1620723603-30912-1-git-send-email-zheyuma97@gmail.com Reported-by: Zheyu Ma <zheyuma97@gmail.com> Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
* [media] pci: flexcop: Remove redundant pci_set_drvdataSachin Kamat2013-10-17
| | | | | | | | | Driver core sets driver data to NULL upon failure or remove. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
* [media] drivers/media/pci/dm1105/dm1105: Convert to module_pci_driverLibo Chen2013-06-17
| | | | | | | use module_pci_driver instead of init/exit, make code clean. Signed-off-by: Libo Chen <libo.chen@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* [media] Kconfig: Fix b2c2 common code selectionMauro Carvalho Chehab2012-08-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | As reported by Randy: > flexcop-pci.c:(.text+0x19af63): undefined reference to `flexcop_device_exit' > flexcop-pci.c:(.text+0x19af77): undefined reference to `flexcop_device_kfree' > flexcop-pci.c:(.text+0x19b10f): undefined reference to `flexcop_pass_dmx_packets' > flexcop-pci.c:(.text+0x19b182): undefined reference to `flexcop_pass_dmx_data' > flexcop-pci.c:(.text+0x19b1ae): undefined reference to `flexcop_pass_dmx_data' > flexcop-pci.c:(.text+0x19b1f8): undefined reference to `flexcop_device_kmalloc' > flexcop-pci.c:(.text+0x19b256): undefined reference to `flexcop_i2c_request' > flexcop-pci.c:(.text+0x19b261): undefined reference to `flexcop_eeprom_check_mac_addr' > flexcop-pci.c:(.text+0x19b2c6): undefined reference to `flexcop_device_initialize' > flexcop-pci.c:(.text+0x19b332): undefined reference to `flexcop_sram_set_dest' > flexcop-pci.c:(.text+0x19b348): undefined reference to `flexcop_sram_set_dest' > flexcop-pci.c:(.text+0x19b3f8): undefined reference to `flexcop_device_exit' > flexcop-pci.c:(.text+0x19b408): undefined reference to `flexcop_device_kfree' > flexcop-pci.c:(.text+0x19b4a2): undefined reference to `flexcop_pid_feed_control' > flexcop-pci.c:(.text+0x19b4d7): undefined reference to `flexcop_pid_feed_control' > > since it is possible to enable DVB_B2C2_FLEXCOP_PCI > when CONFIG_I2C is not enabled, but then DVB_B2C2_FLEXCOP > is not enabled because I2C is not enabled. Reported-by: Randy Dunlap <rdunlap@xenotime.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* [media] flexcop: Show the item to enable debug after the driverMauro Carvalho Chehab2012-08-21
| | | | | | | Instead of showing the option to show debug at the end, show it after each driver. Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* [media] b2c2: fix driver's build due to the lack of pci DMA codeMauro Carvalho Chehab2012-08-15
| | | | | | | | | | | | | | | | | | | | | | | Fix a one-character typo at the makefile. drivers/built-in.o: In function `flexcop_pci_remove': flexcop-pci.c:(.text+0x20d1a28): undefined reference to `flexcop_dma_free' flexcop-pci.c:(.text+0x20d1a3e): undefined reference to `flexcop_dma_free' drivers/built-in.o: In function `flexcop_pci_stream_control': flexcop-pci.c:(.text+0x20d2396): undefined reference to `flexcop_dma_config' flexcop-pci.c:(.text+0x20d23b3): undefined reference to `flexcop_dma_config' flexcop-pci.c:(.text+0x20d23cf): undefined reference to `flexcop_dma_config_timer' flexcop-pci.c:(.text+0x20d23f5): undefined reference to `flexcop_dma_xfer_control' flexcop-pci.c:(.text+0x20d244c): undefined reference to `flexcop_dma_control_timer_irq' flexcop-pci.c:(.text+0x20d24b0): undefined reference to `flexcop_dma_control_timer_irq' flexcop-pci.c:(.text+0x20d2507): undefined reference to `flexcop_dma_xfer_control' drivers/built-in.o: In function `flexcop_pci_probe': flexcop-pci.c:(.text+0x20d28d2): undefined reference to `flexcop_dma_allocate' flexcop-pci.c:(.text+0x20d2907): undefined reference to `flexcop_dma_allocate' flexcop-pci.c:(.text+0x20d2923): undefined reference to `flexcop_dma_free' Reported-by: Fengguang Wu <wfg@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* [media] b2c2: frontends/tuners are not needed at the bridge bindingMauro Carvalho Chehab2012-08-13
| | | | | | The frontends/tuners are used inside the common part of the driver. Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* [media] b2c2: break it into common/pci/usb directoriesMauro Carvalho Chehab2012-08-13
| | | | | | | b2c2 is, in fact, 2 drivers: one for PCI and one for USB, plus a common bus-independent code. Break it accordingly. Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* [media] Rename media/dvb as media/pciMauro Carvalho Chehab2012-08-13
The remaining dvb drivers are pci, so rename them to match the bus. Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-04-22 06:38:39 +0000