Re: [PATCH 6.10 288/809] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, Aug 03, 2024 at 06:08:52PM +0200, Stefan Lippers-Hollmann wrote:
> Hi
> 
> On 2024-08-03, Sean Young wrote:
> > On Thu, Aug 01, 2024 at 04:51:46PM +0200, Stefan Lippers-Hollmann wrote:
> > > Hi
> > >
> > > On 2024-07-30, Greg Kroah-Hartman wrote:
> > > > 6.10-stable review patch.  If anyone has any objections, please let me know.
> > > >
> > > > ------------------
> > > >
> > > > From: Zheng Yejian <zhengyejian1@xxxxxxxxxx>
> > > >
> > > > [ Upstream commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c ]
> > > >
> > > > Infinite log printing occurs during fuzz test:
> > > >
> > > >   rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
> > > >   ...
> > > >   dvb-usb: schedule remote query interval to 100 msecs.
> > > >   dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
> > > >   dvb-usb: bulk message failed: -22 (1/0)
> > > >   dvb-usb: bulk message failed: -22 (1/0)
> > > >   dvb-usb: bulk message failed: -22 (1/0)
> > > >   ...
> > > >   dvb-usb: bulk message failed: -22 (1/0)
> > > >
> > > > Looking into the codes, there is a loop in dvb_usb_read_remote_control(),
> > > > that is in rc_core_dvb_usb_remote_init() create a work that will call
> > > > dvb_usb_read_remote_control(), and this work will reschedule itself at
> > > > 'rc_interval' intervals to recursively call dvb_usb_read_remote_control(),
> > > > see following code snippet:
> > > [...]
> > >
> > > This patch, as part of v6.10.3-rc3 breaks my TeVii s480 dual DVB-S2
> > > card, reverting just this patch from v6.10-rc3 fixes the situation
> > > again (a co-installed Microsoft Xbox One Digital TV DVB-T2 Tuner
> > > keeps working).
> >
> > Thanks for reporting this ...
> >
> > So looking at the commit, it must be that one of the usb endpoints is
> > neither a send/receiver bulk endpoint. Would you mind sending a lusb -v
> > of the device, I think something like:
> >
> > 	lsusb -v -d 9022:d482
> >
> > Should do it, or -d 9022::d481
> 
> It doesn't show up as 9022:d482 or 9022:d481, but as two 9022:d660.
> 
> system 1, raptor-lake:
> 
> # lsusb -v -d 9022:d660
> 
> Bus 001 Device 003: ID 9022:d660 TeVii Technology Ltd. DVB-S2 S660

-snip-

>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x82  EP 2 IN
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0200  1x 512 bytes
>         bInterval               1
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x81  EP 1 IN
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0002  1x 2 bytes
>         bInterval               0

For this device, we do both a bulk snd/rcv to endpoint 1, but the descriptor
says it's an IN endpoint only. So, commit 
2052138b7da52ad5ccaf74f736d00f39a1c9198c rejects the device as being invalid.

At the moment, I'm not sure why this works without the patch, surely a bulk
send to endpoint 1 should fail; there is no out entry.

I'm poking around in the usb code, in the mean time if anyone has any ideas,
that would be appreciated.


Sean




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux