From 3da4b290cb5b0b2b7b531ae9e8c654f459fb4de6 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:30:41 +0000 Subject: fix the roothole in av7110_av.c From: Al Viro direct dereferencing from user-supplied address Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/ttpci/av7110_av.c | 34 ++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/ttpci/av7110_av.c b/linux/drivers/media/dvb/ttpci/av7110_av.c index 3e6b650fb..ec55a968f 100644 --- a/linux/drivers/media/dvb/ttpci/av7110_av.c +++ b/linux/drivers/media/dvb/ttpci/av7110_av.c @@ -965,8 +965,9 @@ static u8 iframe_header[] = { 0x00, 0x00, 0x01, 0xe0, 0x00, 0x00, 0x80, 0x00, 0x static int play_iframe(struct av7110 *av7110, char __user *buf, unsigned int len, int nonblock) { - int i, n; + unsigned i, n; int progressive = 0; + int match = 0; dprintk(2, "av7110:%p, \n", av7110); @@ -975,12 +976,31 @@ static int play_iframe(struct av7110 *av7110, char __user *buf, unsigned int len return -EBUSY; } - for (i = 0; i < len - 5; i++) { - /* get progressive flag from picture extension */ - if (buf[i] == 0x00 && buf[i+1] == 0x00 && - buf[i+2] == 0x01 && (unsigned char)buf[i+3] == 0xb5 && - (buf[i+4] & 0xf0) == 0x10) - progressive = buf[i+5] & 0x08; + /* search in buf for instances of 00 00 01 b5 1? */ + for (i = 0; i < len; i++) { + unsigned char c; + if (get_user(c, buf + i)) + return -EFAULT; + if (match == 5) { + progressive = c & 0x08; + match = 0; + } + if (c == 0x00) { + match = (match == 1 || match == 2) ? 2 : 1; + continue; + } + switch (match++) { + case 2: if (c == 0x01) + continue; + break; + case 3: if (c == 0xb5) + continue; + break; + case 4: if ((c & 0xf0) == 0x10) + continue; + break; + } + match = 0; } /* setting n always > 1, fixes problems when playing stillframes -- cgit v1.2.3 From ef948745e7baa85547778eff9d3743d6c1092e89 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:30:51 +0000 Subject: fix unaligned access in av7110.c From: Al Viro Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/ttpci/av7110.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/ttpci/av7110.c b/linux/drivers/media/dvb/ttpci/av7110.c index 5a747a569..073ed350f 100644 --- a/linux/drivers/media/dvb/ttpci/av7110.c +++ b/linux/drivers/media/dvb/ttpci/av7110.c @@ -51,6 +51,7 @@ #include #include #include +#include #include @@ -1461,9 +1462,9 @@ static int check_firmware(struct av7110* av7110) ptr += 4; /* check dpram file */ - crc = ntohl(*(u32*) ptr); + crc = get_unaligned_be32(ptr); ptr += 4; - len = ntohl(*(u32*) ptr); + len = get_unaligned_be32(ptr); ptr += 4; if (len >= 512) { printk("dvb-ttpci: dpram file is way too big.\n"); @@ -1478,9 +1479,9 @@ static int check_firmware(struct av7110* av7110) ptr += len; /* check root file */ - crc = ntohl(*(u32*) ptr); + crc = get_unaligned_be32(ptr); ptr += 4; - len = ntohl(*(u32*) ptr); + len = get_unaligned_be32(ptr); ptr += 4; if (len <= 200000 || len >= 300000 || -- cgit v1.2.3 From 8f9fab33cee046fa5d38d1e0b6d08b7aaa11d62e Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:31:01 +0000 Subject: endianness fix in flexcop-usb.c From: Al Viro Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/b2c2/flexcop-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/b2c2/flexcop-usb.c b/linux/drivers/media/dvb/b2c2/flexcop-usb.c index 683217b0f..d523dd5bf 100644 --- a/linux/drivers/media/dvb/b2c2/flexcop-usb.c +++ b/linux/drivers/media/dvb/b2c2/flexcop-usb.c @@ -383,7 +383,7 @@ static void flexcop_usb_transfer_exit(struct flexcop_usb *fc_usb) static int flexcop_usb_transfer_init(struct flexcop_usb *fc_usb) { - u16 frame_size = fc_usb->uintf->cur_altsetting->endpoint[0].desc.wMaxPacketSize; + u16 frame_size = le16_to_cpu(fc_usb->uintf->cur_altsetting->endpoint[0].desc.wMaxPacketSize); int bufsize = B2C2_USB_NUM_ISO_URB * B2C2_USB_FRAMES_PER_ISO * frame_size,i,j,ret; int buffer_offset = 0; -- cgit v1.2.3 From 07e599640fc20601dc1d0eaf9cc13254e6de1022 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:31:11 +0000 Subject: net: endianness annotations From: Al Viro Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/dvb-core/dvb_net.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/dvb-core/dvb_net.c b/linux/drivers/media/dvb/dvb-core/dvb_net.c index 04c9e00b0..04b207fd7 100644 --- a/linux/drivers/media/dvb/dvb-core/dvb_net.c +++ b/linux/drivers/media/dvb/dvb-core/dvb_net.c @@ -177,7 +177,7 @@ struct dvb_net_priv { * stolen from eth.c out of the linux kernel, hacked for dvb-device * by Michael Holzt */ -static unsigned short dvb_net_eth_type_trans(struct sk_buff *skb, +static __be16 dvb_net_eth_type_trans(struct sk_buff *skb, struct net_device *dev) { struct ethhdr *eth; @@ -290,10 +290,10 @@ static int handle_one_ule_extension( struct dvb_net_priv *p ) if(ext_len >= 0) { p->ule_next_hdr += ext_len; if (!p->ule_bridged) { - p->ule_sndu_type = ntohs(*(unsigned short *)p->ule_next_hdr); + p->ule_sndu_type = ntohs(*(__be16 *)p->ule_next_hdr); p->ule_next_hdr += 2; } else { - p->ule_sndu_type = ntohs(*(unsigned short *)(p->ule_next_hdr + ((p->ule_dbit ? 2 : 3) * ETH_ALEN))); + p->ule_sndu_type = ntohs(*(__be16 *)(p->ule_next_hdr + ((p->ule_dbit ? 2 : 3) * ETH_ALEN))); /* This assures the extension handling loop will terminate. */ } } @@ -307,7 +307,7 @@ static int handle_one_ule_extension( struct dvb_net_priv *p ) if (ule_optional_ext_handlers[htype]) (void)ule_optional_ext_handlers[htype]( p ); p->ule_next_hdr += ext_len; - p->ule_sndu_type = ntohs( *(unsigned short *)(p->ule_next_hdr-2) ); + p->ule_sndu_type = ntohs( *(__be16 *)(p->ule_next_hdr-2) ); /* * note: the length of the next header type is included in the * length of THIS optional extension header @@ -607,8 +607,8 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len ) /* Check for complete payload. */ if (priv->ule_sndu_remain <= 0) { /* Check CRC32, we've got it in our skb already. */ - unsigned short ulen = htons(priv->ule_sndu_len); - unsigned short utype = htons(priv->ule_sndu_type); + __be16 ulen = htons(priv->ule_sndu_len); + __be16 utype = htons(priv->ule_sndu_type); #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22) const u8 *tail; #endif -- cgit v1.2.3 From 0c410f0783724c960f027e07b1a0eaddb515252f Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:31:21 +0000 Subject: fix endianness bug in dib0700_devices.c From: Al Viro Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/dvb-usb/dib0700_devices.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/dvb-usb/dib0700_devices.c b/linux/drivers/media/dvb/dvb-usb/dib0700_devices.c index 346223856..c4d40fe01 100644 --- a/linux/drivers/media/dvb/dvb-usb/dib0700_devices.c +++ b/linux/drivers/media/dvb/dvb-usb/dib0700_devices.c @@ -111,8 +111,8 @@ static int bristol_tuner_attach(struct dvb_usb_adapter *adap) struct i2c_adapter *tun_i2c = dib3000mc_get_tuner_i2c_master(adap->fe, 1); s8 a; int if1=1220; - if (adap->dev->udev->descriptor.idVendor == USB_VID_HAUPPAUGE && - adap->dev->udev->descriptor.idProduct == USB_PID_HAUPPAUGE_NOVA_T_500_2) { + if (adap->dev->udev->descriptor.idVendor == cpu_to_le16(USB_VID_HAUPPAUGE) && + adap->dev->udev->descriptor.idProduct == cpu_to_le16(USB_PID_HAUPPAUGE_NOVA_T_500_2)) { if (!eeprom_read(prim_i2c,0x59 + adap->id,&a)) if1=1220+a; } return dvb_attach(mt2060_attach,adap->fe, tun_i2c,&bristol_mt2060_config[adap->id], @@ -402,8 +402,8 @@ static int stk7700ph_frontend_attach(struct dvb_usb_adapter *adap) { struct usb_device_descriptor *desc = &adap->dev->udev->descriptor; - if (desc->idVendor == USB_VID_PINNACLE && - desc->idProduct == USB_PID_PINNACLE_EXPRESSCARD_320CX) + if (desc->idVendor == cpu_to_le16(USB_VID_PINNACLE) && + desc->idProduct == cpu_to_le16(USB_PID_PINNACLE_EXPRESSCARD_320CX)) dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0); else dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1); @@ -845,8 +845,8 @@ static int stk7700p_tuner_attach(struct dvb_usb_adapter *adap) struct i2c_adapter *tun_i2c; s8 a; int if1=1220; - if (adap->dev->udev->descriptor.idVendor == USB_VID_HAUPPAUGE && - adap->dev->udev->descriptor.idProduct == USB_PID_HAUPPAUGE_NOVA_T_STICK) { + if (adap->dev->udev->descriptor.idVendor == cpu_to_le16(USB_VID_HAUPPAUGE) && + adap->dev->udev->descriptor.idProduct == cpu_to_le16(USB_PID_HAUPPAUGE_NOVA_T_STICK)) { if (!eeprom_read(prim_i2c,0x58,&a)) if1=1220+a; } if (st->is_dib7000pc) @@ -990,11 +990,12 @@ static struct dib7000p_config dib7070p_dib7000p_config = { /* STK7070P */ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap) { - if (adap->dev->udev->descriptor.idVendor == USB_VID_PINNACLE && - adap->dev->udev->descriptor.idProduct == USB_PID_PINNACLE_PCTV72E) - dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0); + struct usb_device_descriptor *p = &adap->dev->udev->descriptor; + if (p->idVendor == cpu_to_le16(USB_VID_PINNACLE) && + p->idProduct == cpu_to_le16(USB_PID_PINNACLE_PCTV72E)) + dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0); else - dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1); + dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1); msleep(10); dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1); dib0700_set_gpio(adap->dev, GPIO4, GPIO_OUT, 1); -- cgit v1.2.3 From 74875813195241193456c82f7bf123f50186d7f1 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:31:31 +0000 Subject: ttusb endianness annotations and fixes From: Al Viro Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- .../media/dvb/ttusb-budget/dvb-ttusb-budget.c | 2 +- linux/drivers/media/dvb/ttusb-dec/ttusb_dec.c | 25 +++++++++++----------- linux/drivers/media/dvb/ttusb-dec/ttusbdecfe.c | 10 ++++----- 3 files changed, 19 insertions(+), 18 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c b/linux/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c index 6716ab2b1..df7add8a9 100644 --- a/linux/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c +++ b/linux/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c @@ -560,7 +560,7 @@ static void ttusb_process_muxpack(struct ttusb *ttusb, const u8 * muxpack, u16 csum = 0, cc; int i; for (i = 0; i < len; i += 2) - csum ^= le16_to_cpup((u16 *) (muxpack + i)); + csum ^= le16_to_cpup((__le16 *) (muxpack + i)); if (csum) { printk("%s: muxpack with incorrect checksum, ignoring\n", __func__); diff --git a/linux/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/linux/drivers/media/dvb/ttusb-dec/ttusb_dec.c index cb930e37e..052979dc9 100644 --- a/linux/drivers/media/dvb/ttusb-dec/ttusb_dec.c +++ b/linux/drivers/media/dvb/ttusb-dec/ttusb_dec.c @@ -358,7 +358,7 @@ static int ttusb_dec_get_stb_state (struct ttusb_dec *dec, unsigned int *mode, u8 c[COMMAND_PACKET_SIZE]; int c_length; int result; - unsigned int tmp; + __be32 tmp; dprintk("%s\n", __func__); @@ -413,9 +413,9 @@ static void ttusb_dec_set_pids(struct ttusb_dec *dec) 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; - u16 pcr = htons(dec->pid[DMX_PES_PCR]); - u16 audio = htons(dec->pid[DMX_PES_AUDIO]); - u16 video = htons(dec->pid[DMX_PES_VIDEO]); + __be16 pcr = htons(dec->pid[DMX_PES_PCR]); + __be16 audio = htons(dec->pid[DMX_PES_AUDIO]); + __be16 video = htons(dec->pid[DMX_PES_VIDEO]); dprintk("%s\n", __func__); @@ -450,7 +450,7 @@ static void ttusb_dec_process_pva(struct ttusb_dec *dec, u8 *pva, int length) case 0x01: { /* VideoStream */ int prebytes = pva[5] & 0x03; int postbytes = (pva[5] & 0x0c) >> 2; - u16 v_pes_payload_length; + __be16 v_pes_payload_length; if (output_pva) { dec->video_filter->feed->cb.ts(pva, length, NULL, 0, @@ -1025,7 +1025,7 @@ static int ttusb_dec_start_sec_feed(struct dvb_demux_feed *dvbdmxfeed) 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; - u16 pid; + __be16 pid; u8 c[COMMAND_PACKET_SIZE]; int c_length; int result; @@ -1297,9 +1297,10 @@ static int ttusb_dec_boot_dsp(struct ttusb_dec *dec) u8 *firmware = NULL; size_t firmware_size = 0; u16 firmware_csum = 0; - u16 firmware_csum_ns; - u32 firmware_size_nl; - u32 crc32_csum, crc32_check, tmp; + __be16 firmware_csum_ns; + __be32 firmware_size_nl; + u32 crc32_csum, crc32_check; + __be32 tmp; const struct firmware *fw_entry = NULL; dprintk("%s\n", __func__); @@ -1325,7 +1326,7 @@ static int ttusb_dec_boot_dsp(struct ttusb_dec *dec) valid. */ crc32_csum = crc32(~0L, firmware, 56) ^ ~0L; memcpy(&tmp, &firmware[56], 4); - crc32_check = htonl(tmp); + crc32_check = ntohl(tmp); if (crc32_csum != crc32_check) { printk("%s: crc32 check of DSP code failed (calculated " "0x%08x != 0x%08x in file), file invalid.\n", @@ -1646,7 +1647,7 @@ static int ttusb_dec_probe(struct usb_interface *intf, usb_set_intfdata(intf, (void *)dec); - switch (le16_to_cpu(id->idProduct)) { + switch (id->idProduct) { case 0x1006: ttusb_dec_set_model(dec, TTUSB_DEC3000S); break; @@ -1671,7 +1672,7 @@ static int ttusb_dec_probe(struct usb_interface *intf, ttusb_dec_init_dvb(dec); dec->adapter.priv = dec; - switch (le16_to_cpu(id->idProduct)) { + switch (id->idProduct) { case 0x1006: dec->fe = ttusbdecfe_dvbs_attach(&fe_config); break; diff --git a/linux/drivers/media/dvb/ttusb-dec/ttusbdecfe.c b/linux/drivers/media/dvb/ttusb-dec/ttusbdecfe.c index eb5eaeccd..443af2409 100644 --- a/linux/drivers/media/dvb/ttusb-dec/ttusbdecfe.c +++ b/linux/drivers/media/dvb/ttusb-dec/ttusbdecfe.c @@ -86,7 +86,7 @@ static int ttusbdecfe_dvbt_set_frontend(struct dvb_frontend* fe, struct dvb_fron 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x00, 0xff }; - u32 freq = htonl(p->frequency / 1000); + __be32 freq = htonl(p->frequency / 1000); memcpy(&b[4], &freq, sizeof (u32)); state->config->send_command(fe, 0x71, sizeof(b), b, NULL, NULL); @@ -117,10 +117,10 @@ static int ttusbdecfe_dvbs_set_frontend(struct dvb_frontend* fe, struct dvb_fron 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; - u32 freq; - u32 sym_rate; - u32 band; - u32 lnb_voltage; + __be32 freq; + __be32 sym_rate; + __be32 band; + __be32 lnb_voltage; freq = htonl(p->frequency + (state->hi_band ? LOF_HI : LOF_LO)); -- cgit v1.2.3 From 8a60d4bcdc0249852620b847552a86d0b49b0dc6 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:32:41 +0000 Subject: m920x: unaligned access From: Al Viro Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/dvb-usb/m920x.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/dvb-usb/m920x.c b/linux/drivers/media/dvb/dvb-usb/m920x.c index 7597c4b78..5a7766fab 100644 --- a/linux/drivers/media/dvb/dvb-usb/m920x.c +++ b/linux/drivers/media/dvb/dvb-usb/m920x.c @@ -16,6 +16,7 @@ #include "qt1010.h" #include "tda1004x.h" #include "tda827x.h" +#include /* debug */ static int dvb_usb_m920x_debug; @@ -347,13 +348,13 @@ static int m920x_firmware_download(struct usb_device *udev, const struct firmwar for (pass = 0; pass < 2; pass++) { for (i = 0; i + (sizeof(u16) * 3) < fw->size;) { - value = le16_to_cpu(*(u16 *)(fw->data + i)); + value = get_unaligned_le16(fw->data + i); i += sizeof(u16); - index = le16_to_cpu(*(u16 *)(fw->data + i)); + index = get_unaligned_le16(fw->data + i); i += sizeof(u16); - size = le16_to_cpu(*(u16 *)(fw->data + i)); + size = get_unaligned_le16(fw->data + i); i += sizeof(u16); if (pass == 1) { -- cgit v1.2.3 From 45c2f7f961e7e6bb92b03635989ceade61e15d98 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:33:01 +0000 Subject: usb: unaligned From: Al Viro Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c b/linux/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c index e1112e39f..733a7ff7b 100644 --- a/linux/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c +++ b/linux/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c @@ -127,7 +127,7 @@ int dvb_usb_get_hexline(const struct firmware *fw, struct hexline *hx, if ((*pos + hx->len + 4) >= fw->size) return -EINVAL; - hx->addr = le16_to_cpu( *((u16 *) &b[1]) ); + hx->addr = b[1] | (b[2] << 8); hx->type = b[3]; if (hx->type == 0x04) { -- cgit v1.2.3 From 854913598c72226119901b52d665e1c435391f79 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:33:11 +0000 Subject: or51132.c: unaligned From: Al Viro Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/frontends/or51132.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/frontends/or51132.c b/linux/drivers/media/dvb/frontends/or51132.c index c7b5785f8..5ed32544d 100644 --- a/linux/drivers/media/dvb/frontends/or51132.c +++ b/linux/drivers/media/dvb/frontends/or51132.c @@ -126,7 +126,7 @@ static int or51132_readreg(struct or51132_state *state, u8 reg) reg, err); return -EREMOTEIO; } - return le16_to_cpup((u16*)buf); + return buf[0] | (buf[1] << 8); } static int or51132_load_firmware (struct dvb_frontend* fe, const struct firmware *fw) @@ -140,9 +140,9 @@ static int or51132_load_firmware (struct dvb_frontend* fe, const struct firmware dprintk("Firmware is %Zd bytes\n",fw->size); /* Get size of firmware A and B */ - firmwareAsize = le32_to_cpu(*((u32*)fw->data)); + firmwareAsize = le32_to_cpu(*((__le32*)fw->data)); dprintk("FirmwareA is %i bytes\n",firmwareAsize); - firmwareBsize = le32_to_cpu(*((u32*)(fw->data+4))); + firmwareBsize = le32_to_cpu(*((__le32*)(fw->data+4))); dprintk("FirmwareB is %i bytes\n",firmwareBsize); /* Upload firmware */ -- cgit v1.2.3 From b47d82cb176427c78627d8791cc1361be9c0e971 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 21 May 2008 00:30:31 +0000 Subject: cinergyT2: endianness annotations, endianness and race fixes From: Al Viro Endianness annotations and fixes + fixing the handling of ->uncorrected_block_count Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/cinergyT2/cinergyT2.c | 46 ++++++++++++++------------- 1 file changed, 24 insertions(+), 22 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/cinergyT2/cinergyT2.c b/linux/drivers/media/dvb/cinergyT2/cinergyT2.c index 728197340..651df056e 100644 --- a/linux/drivers/media/dvb/cinergyT2/cinergyT2.c +++ b/linux/drivers/media/dvb/cinergyT2/cinergyT2.c @@ -95,22 +95,22 @@ enum cinergyt2_ep1_cmd { struct dvbt_set_parameters_msg { uint8_t cmd; - uint32_t freq; + __le32 freq; uint8_t bandwidth; - uint16_t tps; + __le16 tps; uint8_t flags; } __attribute__((packed)); struct dvbt_get_status_msg { - uint32_t freq; + __le32 freq; uint8_t bandwidth; - uint16_t tps; + __le16 tps; uint8_t flags; - uint16_t gain; + __le16 gain; uint8_t snr; - uint32_t viterbi_error_rate; - uint32_t rs_error_rate; - uint32_t uncorrected_block_count; + __le32 viterbi_error_rate; + __le32 rs_error_rate; + __le32 uncorrected_block_count; uint8_t lock_bits; uint8_t prev_lock_bits; } __attribute__((packed)); @@ -158,6 +158,7 @@ struct cinergyt2 { wait_queue_head_t poll_wq; int pending_fe_events; int disconnect_pending; + unsigned int uncorrected_block_count; atomic_t inuse; void *streambuf; @@ -173,7 +174,7 @@ struct cinergyt2 { struct delayed_work rc_query_work; #endif int rc_input_event; - u32 rc_last_code; + __le32 rc_last_code; unsigned long last_event_jiffies; #endif }; @@ -186,7 +187,7 @@ enum { struct cinergyt2_rc_event { char type; - uint32_t value; + __le32 value; } __attribute__((packed)); static const uint32_t rc_keys[] = { @@ -653,8 +654,11 @@ static int cinergyt2_ioctl (struct inode *inode, struct file *file, { uint32_t unc_count; - unc_count = stat->uncorrected_block_count; - stat->uncorrected_block_count = 0; + if (mutex_lock_interruptible(&cinergyt2->sem)) + return -ERESTARTSYS; + unc_count = cinergyt2->uncorrected_block_count; + cinergyt2->uncorrected_block_count = 0; + mutex_unlock(&cinergyt2->sem); /* UNC are already converted to host byte order... */ return put_user(unc_count,(__u32 __user *) arg); @@ -811,7 +815,7 @@ static void cinergyt2_query_rc (struct work_struct *work) input_sync(cinergyt2->rc_input_dev); cinergyt2->rc_input_event = KEY_MAX; } - cinergyt2->rc_last_code = ~0; + cinergyt2->rc_last_code = cpu_to_le32(~0); } goto out; } @@ -822,7 +826,7 @@ static void cinergyt2_query_rc (struct work_struct *work) n, le32_to_cpu(rc_events[n].value), rc_events[n].type); if (rc_events[n].type == CINERGYT2_RC_EVENT_TYPE_NEC && - rc_events[n].value == ~0) { + rc_events[n].value == cpu_to_le32(~0)) { /* keyrepeat bit -> just repeat last rc_input_event */ } else { cinergyt2->rc_input_event = KEY_MAX; @@ -837,7 +841,7 @@ static void cinergyt2_query_rc (struct work_struct *work) if (cinergyt2->rc_input_event != KEY_MAX) { if (rc_events[n].value == cinergyt2->rc_last_code && - cinergyt2->rc_last_code != ~0) { + cinergyt2->rc_last_code != cpu_to_le32(~0)) { /* emit a key-up so the double event is recognized */ dprintk(1, "rc_input_event=%d UP\n", cinergyt2->rc_input_event); input_report_key(cinergyt2->rc_input_dev, @@ -871,7 +875,7 @@ static int cinergyt2_register_rc(struct cinergyt2 *cinergyt2) usb_make_path(cinergyt2->udev, cinergyt2->phys, sizeof(cinergyt2->phys)); strlcat(cinergyt2->phys, "/input0", sizeof(cinergyt2->phys)); cinergyt2->rc_input_event = KEY_MAX; - cinergyt2->rc_last_code = ~0; + cinergyt2->rc_last_code = cpu_to_le32(~0); #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20) INIT_WORK(&cinergyt2->rc_query_work, cinergyt2_query_rc, cinergyt2); #else @@ -886,8 +890,8 @@ static int cinergyt2_register_rc(struct cinergyt2 *cinergyt2) input_dev->keycodesize = 0; input_dev->keycodemax = 0; input_dev->id.bustype = BUS_USB; - input_dev->id.vendor = cinergyt2->udev->descriptor.idVendor; - input_dev->id.product = cinergyt2->udev->descriptor.idProduct; + input_dev->id.vendor = le16_to_cpu(cinergyt2->udev->descriptor.idVendor); + input_dev->id.product = le16_to_cpu(cinergyt2->udev->descriptor.idProduct); input_dev->id.version = 1; #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22) input_dev->dev.parent = &cinergyt2->udev->dev; @@ -951,18 +955,16 @@ static void cinergyt2_query (struct work_struct *work) char cmd [] = { CINERGYT2_EP1_GET_TUNER_STATUS }; struct dvbt_get_status_msg *s = &cinergyt2->status; uint8_t lock_bits; - uint32_t unc; if (cinergyt2->disconnect_pending || mutex_lock_interruptible(&cinergyt2->sem)) return; - unc = s->uncorrected_block_count; lock_bits = s->lock_bits; cinergyt2_command(cinergyt2, cmd, sizeof(cmd), (char *) s, sizeof(*s)); - unc += le32_to_cpu(s->uncorrected_block_count); - s->uncorrected_block_count = unc; + cinergyt2->uncorrected_block_count += + le32_to_cpu(s->uncorrected_block_count); if (lock_bits != s->lock_bits) { wake_up_interruptible(&cinergyt2->poll_wq); -- cgit v1.2.3 From e92f78bc63e71d1572225b93b4ea0c31e6e6efc0 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Tue, 3 Jun 2008 14:50:32 -0300 Subject: backout changeset e30f9c367fabf6227e17c5191c62f886d55eb2d7 From: Mauro Carvalho Chehab Unfortunately, this patch were mixed with an experimental patch I'm working with. Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/cinergyT2/cinergyT2.c | 46 +++++++++++++-------------- 1 file changed, 22 insertions(+), 24 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/cinergyT2/cinergyT2.c b/linux/drivers/media/dvb/cinergyT2/cinergyT2.c index 651df056e..728197340 100644 --- a/linux/drivers/media/dvb/cinergyT2/cinergyT2.c +++ b/linux/drivers/media/dvb/cinergyT2/cinergyT2.c @@ -95,22 +95,22 @@ enum cinergyt2_ep1_cmd { struct dvbt_set_parameters_msg { uint8_t cmd; - __le32 freq; + uint32_t freq; uint8_t bandwidth; - __le16 tps; + uint16_t tps; uint8_t flags; } __attribute__((packed)); struct dvbt_get_status_msg { - __le32 freq; + uint32_t freq; uint8_t bandwidth; - __le16 tps; + uint16_t tps; uint8_t flags; - __le16 gain; + uint16_t gain; uint8_t snr; - __le32 viterbi_error_rate; - __le32 rs_error_rate; - __le32 uncorrected_block_count; + uint32_t viterbi_error_rate; + uint32_t rs_error_rate; + uint32_t uncorrected_block_count; uint8_t lock_bits; uint8_t prev_lock_bits; } __attribute__((packed)); @@ -158,7 +158,6 @@ struct cinergyt2 { wait_queue_head_t poll_wq; int pending_fe_events; int disconnect_pending; - unsigned int uncorrected_block_count; atomic_t inuse; void *streambuf; @@ -174,7 +173,7 @@ struct cinergyt2 { struct delayed_work rc_query_work; #endif int rc_input_event; - __le32 rc_last_code; + u32 rc_last_code; unsigned long last_event_jiffies; #endif }; @@ -187,7 +186,7 @@ enum { struct cinergyt2_rc_event { char type; - __le32 value; + uint32_t value; } __attribute__((packed)); static const uint32_t rc_keys[] = { @@ -654,11 +653,8 @@ static int cinergyt2_ioctl (struct inode *inode, struct file *file, { uint32_t unc_count; - if (mutex_lock_interruptible(&cinergyt2->sem)) - return -ERESTARTSYS; - unc_count = cinergyt2->uncorrected_block_count; - cinergyt2->uncorrected_block_count = 0; - mutex_unlock(&cinergyt2->sem); + unc_count = stat->uncorrected_block_count; + stat->uncorrected_block_count = 0; /* UNC are already converted to host byte order... */ return put_user(unc_count,(__u32 __user *) arg); @@ -815,7 +811,7 @@ static void cinergyt2_query_rc (struct work_struct *work) input_sync(cinergyt2->rc_input_dev); cinergyt2->rc_input_event = KEY_MAX; } - cinergyt2->rc_last_code = cpu_to_le32(~0); + cinergyt2->rc_last_code = ~0; } goto out; } @@ -826,7 +822,7 @@ static void cinergyt2_query_rc (struct work_struct *work) n, le32_to_cpu(rc_events[n].value), rc_events[n].type); if (rc_events[n].type == CINERGYT2_RC_EVENT_TYPE_NEC && - rc_events[n].value == cpu_to_le32(~0)) { + rc_events[n].value == ~0) { /* keyrepeat bit -> just repeat last rc_input_event */ } else { cinergyt2->rc_input_event = KEY_MAX; @@ -841,7 +837,7 @@ static void cinergyt2_query_rc (struct work_struct *work) if (cinergyt2->rc_input_event != KEY_MAX) { if (rc_events[n].value == cinergyt2->rc_last_code && - cinergyt2->rc_last_code != cpu_to_le32(~0)) { + cinergyt2->rc_last_code != ~0) { /* emit a key-up so the double event is recognized */ dprintk(1, "rc_input_event=%d UP\n", cinergyt2->rc_input_event); input_report_key(cinergyt2->rc_input_dev, @@ -875,7 +871,7 @@ static int cinergyt2_register_rc(struct cinergyt2 *cinergyt2) usb_make_path(cinergyt2->udev, cinergyt2->phys, sizeof(cinergyt2->phys)); strlcat(cinergyt2->phys, "/input0", sizeof(cinergyt2->phys)); cinergyt2->rc_input_event = KEY_MAX; - cinergyt2->rc_last_code = cpu_to_le32(~0); + cinergyt2->rc_last_code = ~0; #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20) INIT_WORK(&cinergyt2->rc_query_work, cinergyt2_query_rc, cinergyt2); #else @@ -890,8 +886,8 @@ static int cinergyt2_register_rc(struct cinergyt2 *cinergyt2) input_dev->keycodesize = 0; input_dev->keycodemax = 0; input_dev->id.bustype = BUS_USB; - input_dev->id.vendor = le16_to_cpu(cinergyt2->udev->descriptor.idVendor); - input_dev->id.product = le16_to_cpu(cinergyt2->udev->descriptor.idProduct); + input_dev->id.vendor = cinergyt2->udev->descriptor.idVendor; + input_dev->id.product = cinergyt2->udev->descriptor.idProduct; input_dev->id.version = 1; #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22) input_dev->dev.parent = &cinergyt2->udev->dev; @@ -955,16 +951,18 @@ static void cinergyt2_query (struct work_struct *work) char cmd [] = { CINERGYT2_EP1_GET_TUNER_STATUS }; struct dvbt_get_status_msg *s = &cinergyt2->status; uint8_t lock_bits; + uint32_t unc; if (cinergyt2->disconnect_pending || mutex_lock_interruptible(&cinergyt2->sem)) return; + unc = s->uncorrected_block_count; lock_bits = s->lock_bits; cinergyt2_command(cinergyt2, cmd, sizeof(cmd), (char *) s, sizeof(*s)); - cinergyt2->uncorrected_block_count += - le32_to_cpu(s->uncorrected_block_count); + unc += le32_to_cpu(s->uncorrected_block_count); + s->uncorrected_block_count = unc; if (lock_bits != s->lock_bits) { wake_up_interruptible(&cinergyt2->poll_wq); -- cgit v1.2.3 From 480df628e9153e3669da57b2a41eacc00666066c Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Tue, 3 Jun 2008 17:37:03 -0300 Subject: cinergyT2: endianness annotations, endianness and race fixes From: Al Viro Endianness annotations and fixes + fixing the handling of ->uncorrected_block_count Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab PS.: I've reapplied this patch since changeset e30f9c367fab got mangled. --- linux/drivers/media/dvb/cinergyT2/cinergyT2.c | 46 ++++++++++++++------------- 1 file changed, 24 insertions(+), 22 deletions(-) (limited to 'linux/drivers/media/dvb') diff --git a/linux/drivers/media/dvb/cinergyT2/cinergyT2.c b/linux/drivers/media/dvb/cinergyT2/cinergyT2.c index 728197340..651df056e 100644 --- a/linux/drivers/media/dvb/cinergyT2/cinergyT2.c +++ b/linux/drivers/media/dvb/cinergyT2/cinergyT2.c @@ -95,22 +95,22 @@ enum cinergyt2_ep1_cmd { struct dvbt_set_parameters_msg { uint8_t cmd; - uint32_t freq; + __le32 freq; uint8_t bandwidth; - uint16_t tps; + __le16 tps; uint8_t flags; } __attribute__((packed)); struct dvbt_get_status_msg { - uint32_t freq; + __le32 freq; uint8_t bandwidth; - uint16_t tps; + __le16 tps; uint8_t flags; - uint16_t gain; + __le16 gain; uint8_t snr; - uint32_t viterbi_error_rate; - uint32_t rs_error_rate; - uint32_t uncorrected_block_count; + __le32 viterbi_error_rate; + __le32 rs_error_rate; + __le32 uncorrected_block_count; uint8_t lock_bits; uint8_t prev_lock_bits; } __attribute__((packed)); @@ -158,6 +158,7 @@ struct cinergyt2 { wait_queue_head_t poll_wq; int pending_fe_events; int disconnect_pending; + unsigned int uncorrected_block_count; atomic_t inuse; void *streambuf; @@ -173,7 +174,7 @@ struct cinergyt2 { struct delayed_work rc_query_work; #endif int rc_input_event; - u32 rc_last_code; + __le32 rc_last_code; unsigned long last_event_jiffies; #endif }; @@ -186,7 +187,7 @@ enum { struct cinergyt2_rc_event { char type; - uint32_t value; + __le32 value; } __attribute__((packed)); static const uint32_t rc_keys[] = { @@ -653,8 +654,11 @@ static int cinergyt2_ioctl (struct inode *inode, struct file *file, { uint32_t unc_count; - unc_count = stat->uncorrected_block_count; - stat->uncorrected_block_count = 0; + if (mutex_lock_interruptible(&cinergyt2->sem)) + return -ERESTARTSYS; + unc_count = cinergyt2->uncorrected_block_count; + cinergyt2->uncorrected_block_count = 0; + mutex_unlock(&cinergyt2->sem); /* UNC are already converted to host byte order... */ return put_user(unc_count,(__u32 __user *) arg); @@ -811,7 +815,7 @@ static void cinergyt2_query_rc (struct work_struct *work) input_sync(cinergyt2->rc_input_dev); cinergyt2->rc_input_event = KEY_MAX; } - cinergyt2->rc_last_code = ~0; + cinergyt2->rc_last_code = cpu_to_le32(~0); } goto out; } @@ -822,7 +826,7 @@ static void cinergyt2_query_rc (struct work_struct *work) n, le32_to_cpu(rc_events[n].value), rc_events[n].type); if (rc_events[n].type == CINERGYT2_RC_EVENT_TYPE_NEC && - rc_events[n].value == ~0) { + rc_events[n].value == cpu_to_le32(~0)) { /* keyrepeat bit -> just repeat last rc_input_event */ } else { cinergyt2->rc_input_event = KEY_MAX; @@ -837,7 +841,7 @@ static void cinergyt2_query_rc (struct work_struct *work) if (cinergyt2->rc_input_event != KEY_MAX) { if (rc_events[n].value == cinergyt2->rc_last_code && - cinergyt2->rc_last_code != ~0) { + cinergyt2->rc_last_code != cpu_to_le32(~0)) { /* emit a key-up so the double event is recognized */ dprintk(1, "rc_input_event=%d UP\n", cinergyt2->rc_input_event); input_report_key(cinergyt2->rc_input_dev, @@ -871,7 +875,7 @@ static int cinergyt2_register_rc(struct cinergyt2 *cinergyt2) usb_make_path(cinergyt2->udev, cinergyt2->phys, sizeof(cinergyt2->phys)); strlcat(cinergyt2->phys, "/input0", sizeof(cinergyt2->phys)); cinergyt2->rc_input_event = KEY_MAX; - cinergyt2->rc_last_code = ~0; + cinergyt2->rc_last_code = cpu_to_le32(~0); #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20) INIT_WORK(&cinergyt2->rc_query_work, cinergyt2_query_rc, cinergyt2); #else @@ -886,8 +890,8 @@ static int cinergyt2_register_rc(struct cinergyt2 *cinergyt2) input_dev->keycodesize = 0; input_dev->keycodemax = 0; input_dev->id.bustype = BUS_USB; - input_dev->id.vendor = cinergyt2->udev->descriptor.idVendor; - input_dev->id.product = cinergyt2->udev->descriptor.idProduct; + input_dev->id.vendor = le16_to_cpu(cinergyt2->udev->descriptor.idVendor); + input_dev->id.product = le16_to_cpu(cinergyt2->udev->descriptor.idProduct); input_dev->id.version = 1; #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22) input_dev->dev.parent = &cinergyt2->udev->dev; @@ -951,18 +955,16 @@ static void cinergyt2_query (struct work_struct *work) char cmd [] = { CINERGYT2_EP1_GET_TUNER_STATUS }; struct dvbt_get_status_msg *s = &cinergyt2->status; uint8_t lock_bits; - uint32_t unc; if (cinergyt2->disconnect_pending || mutex_lock_interruptible(&cinergyt2->sem)) return; - unc = s->uncorrected_block_count; lock_bits = s->lock_bits; cinergyt2_command(cinergyt2, cmd, sizeof(cmd), (char *) s, sizeof(*s)); - unc += le32_to_cpu(s->uncorrected_block_count); - s->uncorrected_block_count = unc; + cinergyt2->uncorrected_block_count += + le32_to_cpu(s->uncorrected_block_count); if (lock_bits != s->lock_bits) { wake_up_interruptible(&cinergyt2->poll_wq); -- cgit v1.2.3