lwn.git/drivers/media/usb/dvb-usb/dw2102.c, branch docs-fixes

media: dvb-usb: Constify struct i2c_algorithm

2025-02-21T09:33:12+00:00

'struct i2c_algorithm' are not modified in these drivers. Constifying this structure moves some data to a read-only section, so increase overall security, especially when the structure holds some function pointers. More over, dvb_usb_device_properties->i2c_algo seems to only be copied in i2c_adapter->algo, which is already a "const struct i2c_algorithm". This is done in dvb_usb_i2c_init() On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 30571 5916 36 36523 8eab drivers/media/usb/dvb-usb/af9005.o After: ===== text data bss dec hex filename 30667 5852 36 36555 8ecb drivers/media/usb/dvb-usb/af9005.o Signed-off-by: Christophe JAILLET Signed-off-by: Hans Verkuil

media: dvb-usb: Constify struct usb_device_id

2025-02-21T09:33:08+00:00

'struct usb_device_id' is not modified in these drivers. Constifying this structure moves some data to a read-only section, so increase overall security. In order to do that, struct dvb_usb_device_description (in dvb-usb.h) also needs to be updated. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 1983 4240 4 6227 1853 drivers/media/usb/dvb-usb/a800.o After: ===== text data bss dec hex filename 2079 4144 4 6227 1853 drivers/media/usb/dvb-usb/a800.o Signed-off-by: Christophe JAILLET Signed-off-by: Hans Verkuil

media: dw2102: fix a potential buffer overflow

2024-04-29T18:04:03+00:00

As pointed by smatch: drivers/media/usb/dvb-usb/dw2102.c:802 su3000_i2c_transfer() error: __builtin_memcpy() '&state->data[4]' too small (64 vs 67) That seemss to be due to a wrong copy-and-paste. Fixes: 0e148a522b84 ("media: dw2102: Don't translate i2c read into write") Reported-by: Hans Verkuil Reviewed-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: dw2102: fix coding style issues

2024-04-29T09:00:17+00:00

Use checkpatch --strict --in-place to cleanup most style issues. Then, do some manual work to fix most of the remaining issues. Signed-off-by: Mauro Carvalho Chehab

media: dw2102: Fix minor issues

2024-04-29T08:48:08+00:00

Found by checkpatch. Link: https://lore.kernel.org/linux-media/20220116112238.74171-4-micha@freedict.org Signed-off-by: Michael Bunk Signed-off-by: Mauro Carvalho Chehab

media: dw2102: Dont't list TT Cinergy S2 R4 twice

2024-04-29T08:48:08+00:00

"modinfo dvb-usb-dw2102|grep 0105" returns two lines, because the module reports this usb alias twice. Remove one of them. Signed-off-by: Michael Bunk Signed-off-by: Mauro Carvalho Chehab

media: dw2102: Don't translate i2c read into write

2024-04-29T08:21:50+00:00

The code ignored the I2C_M_RD flag on I2C messages. Instead it assumed an i2c transaction with a single message must be a write operation and a transaction with two messages would be a read operation. Though this works for the driver code, it leads to problems once the i2c device is exposed to code not knowing this convention. For example, I did "insmod i2c-dev" and issued read requests from userspace, which were translated into write requests and destroyed the EEPROM of my device. So, just check and respect the I2C_M_READ flag, which indicates a read when set on a message. If it is absent, it is a write message. Incidentally, changing from the case statement to a while loop allows the code to lift the limitation to two i2c messages per transaction. There are 4 more *_i2c_transfer functions affected by the same behaviour and limitation that should be fixed in the same way. Link: https://lore.kernel.org/linux-media/20220116112238.74171-2-micha@freedict.org Signed-off-by: Michael Bunk Signed-off-by: Mauro Carvalho Chehab

media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()

2023-07-19T10:57:50+00:00

In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach dw2102_i2c_transfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 950e252cb469 ("[media] dw2102: limit messages to buffer size") Signed-off-by: Zhang Shurong Signed-off-by: Hans Verkuil

media: dw2102: return -EIO instead of -1 for mac address read errors

2023-05-14T15:05:28+00:00

The dvb-usb core function only checks if the returned value is zero, so it doesn't actually matter the error code. Still, returning -1 as an error condition is something that we don't do upstream. So, change the logic to return -EIO in case of I2C transfer failures. Signed-off-by: Mauro Carvalho Chehab

media: dvb-usb: remove unnecessary (void*) conversions

2023-05-14T15:05:28+00:00

Pointer variables of void * type do not require type cast. Link: https://lore.kernel.org/linux-media/20230320064039.5670-1-yuzhe@nfschina.com Signed-off-by: Yu Zhe Signed-off-by: Mauro Carvalho Chehab