On Wed, 2016-08-17 at 14:39 +0300, Binyamin Sharet wrote:
> On 08/16/2016 04:52 PM, Binyamin Sharet wrote:
> > Kernel version: raspberrypi 4.4.6-v7+ #871
> > Driver source file: drivers/media/usb/dvb-usb/dw2102.c
> > Umap2 command line: umap2vsscan -P <PHY> -s 9022:d483
> >
> > After connecting such a device, kernel oops: kernel is unable to handle
> > paging address.
> >
> > Also happens with 9022:d484.
> >
> > Binyamin Sharet
> > Cisco, STARE-C
> >
> > << Attached: 9022_d483_dmesg_1.log >>
> > << Attached: 9022_d483_dmesg_2.log >>
> > << Attached: 9022_d483_kernel.log >>
> kernel: 4.8-rc2
> result: reproduced
> attached an update dmesg log
>
Hi,
could you try the attached patch?
Regards
Oliver
From 7ac7f7f000b69c47a701276f6d9ef94081d11918 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@xxxxxxxx>
Date: Thu, 18 Aug 2016 12:37:36 +0200
Subject: [PATCH] dw2102: fix oops due to a malicious device
A malicious device can cause probe to fail to generate a valid
device. Check for that.
Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx>
---
drivers/media/usb/dvb-usb/dw2102.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 5fb0c65..f0e5903 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -1448,6 +1448,9 @@ static int tt_s2_4600_frontend_attach(struct dvb_usb_adapter *adap)
struct m88ds3103_platform_data m88ds3103_pdata = {};
struct ts2020_config ts2020_config = {};
+ if (!d)
+ return -ENODEV;
+
if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
err("command 0x0e transfer failed.");
--
2.1.4
