Patch "media: dvb_ca_en50221: fix a size write bug" has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    media: dvb_ca_en50221: fix a size write bug

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-dvb_ca_en50221-fix-a-size-write-bug.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b862662a2374c8c2962d0b9519f9a3858e903aa6
Author: YongSu Yoo <yongsuyoo0215@xxxxxxxxx>
Date:   Thu Aug 18 13:50:27 2022 +0100

    media: dvb_ca_en50221: fix a size write bug
    
    [ Upstream commit a4315e5be7020aac9b24a8151caf4bb85224cd0e ]
    
    The function of "dvb_ca_en50221_write_data" at source/drivers/media
    /dvb-core/dvb_ca_en50221.c is used for two cases.
    The first case is for writing APDU data in the function of
    "dvb_ca_en50221_io_write" at source/drivers/media/dvb-core/
    dvb_ca_en50221.c.
    The second case is for writing the host link buf size on the
    Command Register in the function of "dvb_ca_en50221_link_init"
    at source/drivers/media/dvb-core/dvb_ca_en50221.c.
    In the second case, there exists a bug like following.
    In the function of the "dvb_ca_en50221_link_init",
    after a TV host calculates the host link buf_size,
    the TV host writes the calculated host link buf_size on the
    Size Register.
    Accroding to the en50221 Spec (the page 60 of
    https://dvb.org/wp-content/uploads/2020/02/En50221.V1.pdf),
    before this writing operation, the "SW(CMDREG_SW)" flag in the
    Command Register should be set. We can see this setting operation
    in the function of the "dvb_ca_en50221_link_init" like below.
    ...
            if ((ret = ca->pub->write_cam_control(ca->pub, slot,
    CTRLIF_COMMAND, IRQEN | CMDREG_SW)) != 0)
                    return ret;
    ...
    But, after that, the real writing operation is implemented using
    the function of the "dvb_ca_en50221_write_data" in the function of
    "dvb_ca_en50221_link_init", and the "dvb_ca_en50221_write_data"
    includes the function of "ca->pub->write_cam_control",
    and the function of the "ca->pub->write_cam_control" in the
    function of the "dvb_ca_en50221_wrte_data" does not include
    "CMDREG_SW" flag like below.
    ...
            if ((status = ca->pub->write_cam_control(ca->pub, slot,
    CTRLIF_COMMAND, IRQEN | CMDREG_HC)) != 0)
    ...
    In the above source code, we can see only the "IRQEN | CMDREG_HC",
    but we cannot see the "CMDREG_SW".
    The "CMDREG_SW" flag which was set in the function of the
    "dvb_ca_en50221_link_init" was rollbacked by the follwoing function
    of the "dvb_ca_en50221_write_data".
    This is a bug. and this bug causes that the calculated host link buf_size
    is not properly written in the CI module.
    Through this patch, we fix this bug.
    
    Link: https://lore.kernel.org/linux-media/20220818125027.1131-1-yongsuyoo0215@xxxxxxxxx
    Signed-off-by: YongSu Yoo <yongsuyoo0215@xxxxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index fd476536d32ed..b1a7b5f8b9aa4 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -187,7 +187,7 @@ static void dvb_ca_en50221_thread_wakeup(struct dvb_ca_private *ca);
 static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot,
 				    u8 *ebuf, int ecount);
 static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
-				     u8 *ebuf, int ecount);
+				     u8 *ebuf, int ecount, int size_write_flag);
 
 /**
  * Safely find needle in haystack.
@@ -370,7 +370,7 @@ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot)
 	ret = dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_FR, HZ / 10);
 	if (ret)
 		return ret;
-	ret = dvb_ca_en50221_write_data(ca, slot, buf, 2);
+	ret = dvb_ca_en50221_write_data(ca, slot, buf, 2, CMDREG_SW);
 	if (ret != 2)
 		return -EIO;
 	ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN);
@@ -778,11 +778,13 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot,
  * @buf: The data in this buffer is treated as a complete link-level packet to
  *	 be written.
  * @bytes_write: Size of ebuf.
+ * @size_write_flag: A flag on Command Register which says whether the link size
+ * information will be writen or not.
  *
  * return: Number of bytes written, or < 0 on error.
  */
 static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
-				     u8 *buf, int bytes_write)
+				     u8 *buf, int bytes_write, int size_write_flag)
 {
 	struct dvb_ca_slot *sl = &ca->slot_info[slot];
 	int status;
@@ -817,7 +819,7 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
 
 	/* OK, set HC bit */
 	status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND,
-					    IRQEN | CMDREG_HC);
+					    IRQEN | CMDREG_HC | size_write_flag);
 	if (status)
 		goto exit;
 
@@ -1505,7 +1507,7 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
 
 			mutex_lock(&sl->slot_lock);
 			status = dvb_ca_en50221_write_data(ca, slot, fragbuf,
-							   fraglen + 2);
+							   fraglen + 2, 0);
 			mutex_unlock(&sl->slot_lock);
 			if (status == (fraglen + 2)) {
 				written = 1;



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux