kernel/linux.git/drivers/media/dvb-core, branch v5.15.7

media: dvb-core: frontend: make GET/SET safer

2021-06-17T07:29:11+00:00

The implementation for FE_SET_PROPERTY/FE_GET_PROPERTY has a debug code that might be explored via spectre. Improve the logic in order to mitigate such risk. It should be noticed that, before this patch, the logic which implements FE_GET_PROPERTY doesn't check the length passed by the user, which might lead to expose some information. This is probably not exploitable, though, as the frontend drivers won't rely on the buffer length value set by userspace, but it helps to return a valid value back to userspace. The code was changed to only try to access an array based on userspace values only when DVB debug is turned on, helping to reduce the attack surface, as a speculation attack would work only if DVB dev_dbg() macros are enabled, which is usually enabled only on test Kernels or by the root user. As a side effect, a const array size can now be reduced by ~570 bytes, as it now needs to contain just the name of each DTV command. Signed-off-by: Mauro Carvalho Chehab

media: dvbdev: fix error logic at dvb_register_device()

2021-06-17T07:25:31+00:00

As reported by smatch: drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:510 dvb_register_device() warn: '&dvbdev->list_head' not removed from list drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:530 dvb_register_device() warn: '&dvbdev->list_head' not removed from list drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:545 dvb_register_device() warn: '&dvbdev->list_head' not removed from list The error logic inside dvb_register_device() doesn't remove devices from the dvb_adapter_list in case of errors. Signed-off-by: Mauro Carvalho Chehab

media: dvb_net: avoid speculation from net slot

2021-06-17T07:25:01+00:00

The risk of especulation is actually almost-non-existing here, as there are very few users of TCP/IP using the DVB stack, as, this is mainly used with DVB-S/S2 cards, and only by people that receives TCP/IP from satellite connections, which limits a lot the number of users of such feature(*). (*) In thesis, DVB-C cards could also benefit from it, but I'm yet to see a hardware that supports it. Yet, fixing it is trivial. Signed-off-by: Mauro Carvalho Chehab

media: dvb_ca_en50221: avoid speculation from CA slot

2021-06-17T07:24:10+00:00

As warned by smatch: drivers/media/dvb-core/dvb_ca_en50221.c:1392 dvb_ca_en50221_io_do_ioctl() warn: potential spectre issue 'ca->slot_info' [r] (local cap) There's a potential of using a CAM ioctl for speculation. The risk here is minimum, as only a small subset of DVB boards have CI, with a CAM module installed. Also, exploiting it would require a user capable of starting a DVB application. There are probably a lot of easier ways to try to exploit. Yet, it doesn't harm addressing it. Signed-off-by: Mauro Carvalho Chehab

media: dmxdev: change the check for problems allocing secfeed

2021-06-09T12:45:20+00:00

While the logic there is right, it tricks static check analyzers, like smatch: drivers/media/dvb-core/dmxdev.c:729 dvb_dmxdev_filter_start() error: we previously assumed '*secfeed' could be null (see line 719) Because the implementation of the filter itself is made via a callback, with its real implementation at the dvbdmx_allocate_section_feed() inside dvb_demux.c. So, change the check logic to make it clear that the function will not try to use *secfeed == NULL. Signed-off-by: Mauro Carvalho Chehab

media: dvbdev: Fix memory leak in dvb_media_device_free()

2021-03-22T22:36:39+00:00

dvb_media_device_free() is leaking memory. Free `dvbdev->adapter->conn` before setting it to NULL, as documented in include/media/media-device.h: "The media_entity instance itself must be freed explicitly by the driver if required." Link: https://syzkaller.appspot.com/bug?id=9bbe4b842c98f0ed05c5eed77a226e9de33bf298 Link: https://lore.kernel.org/linux-media/20201211083039.521617-1-yepeilin.cs@gmail.com Cc: stable@vger.kernel.org Fixes: 0230d60e4661 ("[media] dvbdev: Add RF connector if needed") Reported-by: syzbot+7f09440acc069a0d38ac@syzkaller.appspotmail.com Signed-off-by: Peilin Ye Signed-off-by: Mauro Carvalho Chehab

media: dvb_frontend: warn if frontend driver has API issues

2021-03-22T15:38:51+00:00

the kAPI for a frontend can use 3 different tuning methods: 1. The hardware tracks internally frequency shifts via its own internal zigzag logic; 2. The hardware has a custom zigzag method, implemented via fe search() ops; 3. The hardware doesn't have any internal zigzag logic. So, the Kernel needs to implement it. Drivers that use the in-kernel software zigzag are required to provide some parameters for the zigzag code to work. Failing to do that will just make the Kernel to tune several times to the very same frequency, delaying the tuning time for no good reason. This is actually a kAPI violation (and an uAPI one, as the frequency shift is exported to the uAPI). Emit a warning on such case, as the driver needs to be fixed. Link: https://lore.kernel.org/linux-media/6d5941e3ba77439bbc401207cd87d9b8748d5cb8.1616427172.git.mchehab+huawei@kernel.org Signed-off-by: Mauro Carvalho Chehab

media: dvb_frontend: don't call dvb_frontend_get_stepsize() twice

2021-03-22T14:53:46+00:00

Avoid calling the function twice, as it was just called at the previous line. Signed-off-by: Mauro Carvalho Chehab

media: dvb_frontend: move algo-specific settings to a function

2021-03-22T14:47:53+00:00

As we're planning to call this code from somewhere else, let's first move it to its own function. Link: https://lore.kernel.org/linux-media/daa69edd80e7fcf979062273f3067cb7b5573d52.1592419750.git.mchehab+huawei@kernel.org Reviewed-by: Marc Gonzalez Signed-off-by: Mauro Carvalho Chehab

media: fix incorrect kernel doc usages

2021-03-11T10:59:44+00:00

This patch fixes the following trivial warnings w.r.t. kernel-doc usage: drivers/media/common/videobuf2/frame_vector.c:38: warning: Excess function parameter 'gup_flags' description in 'get_vaddr_frames' drivers/media/dvb-core/dvb_ca_en50221.c:193: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1014: warning: expecting prototype for Wake up the DVB CA thread(). Prototype was for dvb_ca_en50221_thread_wakeup() instead drivers/media/dvb-core/dvb_ca_en50221.c:1023: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1081: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1112: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1327: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1411: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1426: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1582: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1693: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1743: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1772: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1830: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1922: warning: wrong kernel-doc identifier on line: drivers/media/rc/img-ir/img-ir-hw.c:628: warning: expecting prototype for img_ir_decoder_compatable(). Prototype was for img_ir_decoder_compatible() instead drivers/media/v4l2-core/v4l2-jpeg.c:461: warning: expecting prototype for jpeg_parse_header(). Prototype was for v4l2_jpeg_parse_header() instead drivers/media/platform/vsp1/vsp1_dl.c:166: warning: expecting prototype for struct vsp1_cmd_pool. Prototype was for struct vsp1_dl_cmd_pool instead drivers/media/platform/mtk-vpu/mtk_vpu.c:28: warning: expecting prototype for is a tiny processor controlling video hardware(). Prototype was for INIT_TIMEOUT_MS() instead drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:73: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct vp9_ref_buf instead drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:85: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct vp9_sf_ref_fb instead drivers/media/tuners/mt2063.c:1404: warning: expecting prototype for fLO_FractionalTerm(). Prototype was for MT2063_fLO_FractionalTerm() instead drivers/media/tuners/mt2063.c:1465: warning: expecting prototype for CalcLO2Mult(). Prototype was for MT2063_CalcLO2Mult() instead drivers/media/usb/pwc/pwc-dec23.c:640: warning: wrong kernel-doc identifier on line: drivers/media/platform/exynos4-is/media-dev.c:820: warning: expecting prototype for __fimc_md_create_fimc_links(). Prototype was for __fimc_md_create_fimc_sink_links() instead drivers/media/i2c/s5k6aa.c:426: warning: expecting prototype for s5k6aa_configure_pixel_clock(). Prototype was for s5k6aa_configure_pixel_clocks() instead drivers/media/i2c/imx274.c:700: warning: wrong kernel-doc identifier on line: drivers/media/i2c/imx274.c:735: warning: wrong kernel-doc identifier on line: drivers/media/i2c/imx274.c:983: warning: wrong kernel-doc identifier on line: Most are missing or mistyped function names. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab