linux/drivers/media/usb/dvb-usb-v2/dvbsky.c

819 lines
21 KiB
C
Raw Normal View History

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 Based on 3 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version [author] [kishon] [vijay] [abraham] [i] [kishon]@[ti] [com] this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version [author] [graeme] [gregory] [gg]@[slimlogic] [co] [uk] [author] [kishon] [vijay] [abraham] [i] [kishon]@[ti] [com] [based] [on] [twl6030]_[usb] [c] [author] [hema] [hk] [hemahk]@[ti] [com] this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 1105 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Reviewed-by: Richard Fontana <rfontana@redhat.com> Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070033.202006027@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-27 06:55:06 +00:00
// SPDX-License-Identifier: GPL-2.0-or-later
/*
* Driver for DVBSky USB2.0 receiver
*
* Copyright (C) 2013 Max nibble <nibble.max@gmail.com>
*/
#include "dvb_usb.h"
#include "m88ds3103.h"
#include "ts2020.h"
#include "sp2.h"
#include "si2168.h"
#include "si2157.h"
#define DVBSKY_MSG_DELAY 0/*2000*/
#define DVBSKY_BUF_LEN 64
static int dvb_usb_dvbsky_disable_rc;
module_param_named(disable_rc, dvb_usb_dvbsky_disable_rc, int, 0644);
MODULE_PARM_DESC(disable_rc, "Disable inbuilt IR receiver.");
DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
struct dvbsky_state {
u8 ibuf[DVBSKY_BUF_LEN];
u8 obuf[DVBSKY_BUF_LEN];
u8 last_lock;
struct i2c_client *i2c_client_demod;
struct i2c_client *i2c_client_tuner;
struct i2c_client *i2c_client_ci;
/* fe hook functions*/
int (*fe_set_voltage)(struct dvb_frontend *fe,
enum fe_sec_voltage voltage);
int (*fe_read_status)(struct dvb_frontend *fe,
enum fe_status *status);
};
static int dvbsky_usb_generic_rw(struct dvb_usb_device *d,
u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
{
int ret;
struct dvbsky_state *state = d_to_priv(d);
mutex_lock(&d->usb_mutex);
if (wlen != 0)
memcpy(state->obuf, wbuf, wlen);
ret = dvb_usbv2_generic_rw_locked(d, state->obuf, wlen,
state->ibuf, rlen);
if (!ret && (rlen != 0))
memcpy(rbuf, state->ibuf, rlen);
mutex_unlock(&d->usb_mutex);
return ret;
}
static int dvbsky_stream_ctrl(struct dvb_usb_device *d, u8 onoff)
{
struct dvbsky_state *state = d_to_priv(d);
static const u8 obuf_pre[3] = { 0x37, 0, 0 };
static const u8 obuf_post[3] = { 0x36, 3, 0 };
int ret;
mutex_lock(&d->usb_mutex);
memcpy(state->obuf, obuf_pre, 3);
ret = dvb_usbv2_generic_write_locked(d, state->obuf, 3);
if (!ret && onoff) {
msleep(20);
memcpy(state->obuf, obuf_post, 3);
ret = dvb_usbv2_generic_write_locked(d, state->obuf, 3);
}
mutex_unlock(&d->usb_mutex);
return ret;
}
static int dvbsky_streaming_ctrl(struct dvb_frontend *fe, int onoff)
{
struct dvb_usb_device *d = fe_to_d(fe);
return dvbsky_stream_ctrl(d, (onoff == 0) ? 0 : 1);
}
/* GPIO */
static int dvbsky_gpio_ctrl(struct dvb_usb_device *d, u8 gport, u8 value)
{
int ret;
u8 obuf[3], ibuf[2];
obuf[0] = 0x0e;
obuf[1] = gport;
obuf[2] = value;
ret = dvbsky_usb_generic_rw(d, obuf, 3, ibuf, 1);
return ret;
}
/* I2C */
static int dvbsky_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
int num)
{
struct dvb_usb_device *d = i2c_get_adapdata(adap);
int ret = 0;
u8 ibuf[64], obuf[64];
if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
return -EAGAIN;
if (num > 2) {
dev_err(&d->udev->dev,
"too many i2c messages[%d], max 2.", num);
ret = -EOPNOTSUPP;
goto i2c_error;
}
if (num == 1) {
if (msg[0].len > 60) {
dev_err(&d->udev->dev,
"too many i2c bytes[%d], max 60.",
msg[0].len);
ret = -EOPNOTSUPP;
goto i2c_error;
}
if (msg[0].flags & I2C_M_RD) {
/* single read */
obuf[0] = 0x09;
obuf[1] = 0;
obuf[2] = msg[0].len;
obuf[3] = msg[0].addr;
ret = dvbsky_usb_generic_rw(d, obuf, 4,
ibuf, msg[0].len + 1);
if (!ret)
memcpy(msg[0].buf, &ibuf[1], msg[0].len);
} else {
/* write */
obuf[0] = 0x08;
obuf[1] = msg[0].addr;
obuf[2] = msg[0].len;
memcpy(&obuf[3], msg[0].buf, msg[0].len);
ret = dvbsky_usb_generic_rw(d, obuf,
msg[0].len + 3, ibuf, 1);
}
} else {
if ((msg[0].len > 60) || (msg[1].len > 60)) {
dev_err(&d->udev->dev,
"too many i2c bytes[w-%d][r-%d], max 60.",
msg[0].len, msg[1].len);
ret = -EOPNOTSUPP;
goto i2c_error;
}
/* write then read */
obuf[0] = 0x09;
obuf[1] = msg[0].len;
obuf[2] = msg[1].len;
obuf[3] = msg[0].addr;
memcpy(&obuf[4], msg[0].buf, msg[0].len);
ret = dvbsky_usb_generic_rw(d, obuf,
msg[0].len + 4, ibuf, msg[1].len + 1);
if (!ret)
memcpy(msg[1].buf, &ibuf[1], msg[1].len);
}
i2c_error:
mutex_unlock(&d->i2c_mutex);
return (ret) ? ret : num;
}
static u32 dvbsky_i2c_func(struct i2c_adapter *adapter)
{
return I2C_FUNC_I2C;
}
static struct i2c_algorithm dvbsky_i2c_algo = {
.master_xfer = dvbsky_i2c_xfer,
.functionality = dvbsky_i2c_func,
};
#if IS_ENABLED(CONFIG_RC_CORE)
static int dvbsky_rc_query(struct dvb_usb_device *d)
{
u32 code = 0xffff, scancode;
u8 rc5_command, rc5_system;
u8 obuf[2], ibuf[2], toggle;
int ret;
obuf[0] = 0x10;
ret = dvbsky_usb_generic_rw(d, obuf, 1, ibuf, 2);
if (ret == 0)
code = (ibuf[0] << 8) | ibuf[1];
if (code != 0xffff) {
dev_dbg(&d->udev->dev, "rc code: %x\n", code);
rc5_command = code & 0x3F;
rc5_system = (code & 0x7C0) >> 6;
toggle = (code & 0x800) ? 1 : 0;
scancode = rc5_system << 8 | rc5_command;
rc_keydown(d->rc_dev, RC_PROTO_RC5, scancode, toggle);
}
return 0;
}
static int dvbsky_get_rc_config(struct dvb_usb_device *d, struct dvb_usb_rc *rc)
{
if (dvb_usb_dvbsky_disable_rc) {
rc->map_name = NULL;
return 0;
}
rc->allowed_protos = RC_PROTO_BIT_RC5;
rc->query = dvbsky_rc_query;
rc->interval = 300;
return 0;
}
#else
#define dvbsky_get_rc_config NULL
#endif
static int dvbsky_usb_set_voltage(struct dvb_frontend *fe,
enum fe_sec_voltage voltage)
{
struct dvb_usb_device *d = fe_to_d(fe);
struct dvbsky_state *state = d_to_priv(d);
u8 value;
if (voltage == SEC_VOLTAGE_OFF)
value = 0;
else
value = 1;
dvbsky_gpio_ctrl(d, 0x80, value);
return state->fe_set_voltage(fe, voltage);
}
static int dvbsky_read_mac_addr(struct dvb_usb_adapter *adap, u8 mac[6])
{
struct dvb_usb_device *d = adap_to_d(adap);
u8 obuf[] = { 0x1e, 0x00 };
u8 ibuf[6] = { 0 };
struct i2c_msg msg[] = {
{
.addr = 0x51,
.flags = 0,
.buf = obuf,
.len = 2,
}, {
.addr = 0x51,
.flags = I2C_M_RD,
.buf = ibuf,
.len = 6,
}
};
if (i2c_transfer(&d->i2c_adap, msg, 2) == 2)
memcpy(mac, ibuf, 6);
return 0;
}
static int dvbsky_usb_read_status(struct dvb_frontend *fe,
enum fe_status *status)
{
struct dvb_usb_device *d = fe_to_d(fe);
struct dvbsky_state *state = d_to_priv(d);
int ret;
ret = state->fe_read_status(fe, status);
/* it need resync slave fifo when signal change from unlock to lock.*/
if ((*status & FE_HAS_LOCK) && (!state->last_lock))
dvbsky_stream_ctrl(d, 1);
state->last_lock = (*status & FE_HAS_LOCK) ? 1 : 0;
return ret;
}
static int dvbsky_s960_attach(struct dvb_usb_adapter *adap)
{
struct dvbsky_state *state = adap_to_priv(adap);
struct dvb_usb_device *d = adap_to_d(adap);
struct i2c_adapter *i2c_adapter;
struct m88ds3103_platform_data m88ds3103_pdata = {};
struct ts2020_config ts2020_config = {};
/* attach demod */
m88ds3103_pdata.clk = 27000000;
m88ds3103_pdata.i2c_wr_max = 33;
m88ds3103_pdata.clk_out = 0;
m88ds3103_pdata.ts_mode = M88DS3103_TS_CI;
m88ds3103_pdata.ts_clk = 16000;
m88ds3103_pdata.ts_clk_pol = 0;
m88ds3103_pdata.agc = 0x99;
m88ds3103_pdata.lnb_hv_pol = 1,
m88ds3103_pdata.lnb_en_pol = 1,
state->i2c_client_demod = dvb_module_probe("m88ds3103", NULL,
&d->i2c_adap,
0x68, &m88ds3103_pdata);
if (!state->i2c_client_demod)
return -ENODEV;
adap->fe[0] = m88ds3103_pdata.get_dvb_frontend(state->i2c_client_demod);
i2c_adapter = m88ds3103_pdata.get_i2c_adapter(state->i2c_client_demod);
/* attach tuner */
ts2020_config.fe = adap->fe[0];
[media] TS2020: Calculate tuner gain correctly The TS2020 and TS2022 tuners take an input from the demodulator indicating the AGC setting on that component that is then used to influence the tuner's own gain. This should be taken into account when calculating the gain and signal strength. Further, the existing TS2020 driver miscalculates the signal strength as the result of its calculations can exceed the storage capacity of the 16-bit word used to return it to userspace. To this end: (1) Add a callback function (->get_agc_pwm()) in the ts2020_config struct that the tuner can call to get the AGC PWM value from the demodulator. (2) Modify the TS2020 driver to calculate the gain according to Montage's specification with the adjustment that we produce a negative value and scale it to 0.001dB units (which is what the DVBv5 API will require): (a) Callback to the demodulator to retrieve the AGC PWM value and then turn that into Vagc for incorporation in the calculations. If the callback is unset, assume a Vagc of 0. (b) Calculate the tuner gain from a combination of Vagc and the tuner's RF gain and baseband gain settings. (3) Turn this into a percentage signal strength as per Montage's specification for return to userspace with the DVBv3 API. (4) Provide a function in the M88DS3103 demodulator driver that can be used to get the AGC PWM value on behalf of the tuner. (5) The ts2020_config.get_agc_pwm function should be set by the code that stitches together the drivers for each card. For the DVBSky cards that use the M88DS3103 with the TS2020 or the TS2022, set the get_agc_pwm function to point to m88ds3103_get_agc_pwm. I have tested this with a DVBSky S952 card which has an M88DS3103 and a TS2022. Thanks to Montage for providing access to information about the workings of these parts. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-05-26 15:04:00 +00:00
ts2020_config.get_agc_pwm = m88ds3103_get_agc_pwm;
state->i2c_client_tuner = dvb_module_probe("ts2020", NULL,
i2c_adapter,
0x60, &ts2020_config);
if (!state->i2c_client_tuner) {
dvb_module_release(state->i2c_client_demod);
return -ENODEV;
}
/* delegate signal strength measurement to tuner */
adap->fe[0]->ops.read_signal_strength =
adap->fe[0]->ops.tuner_ops.get_rf_strength;
/* hook fe: need to resync the slave fifo when signal locks. */
state->fe_read_status = adap->fe[0]->ops.read_status;
adap->fe[0]->ops.read_status = dvbsky_usb_read_status;
/* hook fe: LNB off/on is control by Cypress usb chip. */
state->fe_set_voltage = adap->fe[0]->ops.set_voltage;
adap->fe[0]->ops.set_voltage = dvbsky_usb_set_voltage;
return 0;
}
static int dvbsky_usb_ci_set_voltage(struct dvb_frontend *fe,
enum fe_sec_voltage voltage)
{
struct dvb_usb_device *d = fe_to_d(fe);
struct dvbsky_state *state = d_to_priv(d);
u8 value;
if (voltage == SEC_VOLTAGE_OFF)
value = 0;
else
value = 1;
dvbsky_gpio_ctrl(d, 0x00, value);
return state->fe_set_voltage(fe, voltage);
}
static int dvbsky_ci_ctrl(void *priv, u8 read, int addr,
u8 data, int *mem)
{
struct dvb_usb_device *d = priv;
int ret = 0;
u8 command[4], respond[2], command_size, respond_size;
command[1] = (u8)((addr >> 8) & 0xff); /*high part of address*/
command[2] = (u8)(addr & 0xff); /*low part of address*/
if (read) {
command[0] = 0x71;
command_size = 3;
respond_size = 2;
} else {
command[0] = 0x70;
command[3] = data;
command_size = 4;
respond_size = 1;
}
ret = dvbsky_usb_generic_rw(d, command, command_size,
respond, respond_size);
if (ret)
goto err;
if (read)
*mem = respond[1];
return ret;
err:
dev_err(&d->udev->dev, "ci control failed=%d\n", ret);
return ret;
}
static int dvbsky_s960c_attach(struct dvb_usb_adapter *adap)
{
struct dvbsky_state *state = adap_to_priv(adap);
struct dvb_usb_device *d = adap_to_d(adap);
struct i2c_adapter *i2c_adapter;
struct m88ds3103_platform_data m88ds3103_pdata = {};
struct ts2020_config ts2020_config = {};
struct sp2_config sp2_config = {};
/* attach demod */
m88ds3103_pdata.clk = 27000000,
m88ds3103_pdata.i2c_wr_max = 33,
m88ds3103_pdata.clk_out = 0,
m88ds3103_pdata.ts_mode = M88DS3103_TS_CI,
m88ds3103_pdata.ts_clk = 10000,
m88ds3103_pdata.ts_clk_pol = 1,
m88ds3103_pdata.agc = 0x99,
m88ds3103_pdata.lnb_hv_pol = 0,
m88ds3103_pdata.lnb_en_pol = 1,
state->i2c_client_demod = dvb_module_probe("m88ds3103", NULL,
&d->i2c_adap,
0x68, &m88ds3103_pdata);
if (!state->i2c_client_demod)
return -ENODEV;
adap->fe[0] = m88ds3103_pdata.get_dvb_frontend(state->i2c_client_demod);
i2c_adapter = m88ds3103_pdata.get_i2c_adapter(state->i2c_client_demod);
/* attach tuner */
ts2020_config.fe = adap->fe[0];
[media] TS2020: Calculate tuner gain correctly The TS2020 and TS2022 tuners take an input from the demodulator indicating the AGC setting on that component that is then used to influence the tuner's own gain. This should be taken into account when calculating the gain and signal strength. Further, the existing TS2020 driver miscalculates the signal strength as the result of its calculations can exceed the storage capacity of the 16-bit word used to return it to userspace. To this end: (1) Add a callback function (->get_agc_pwm()) in the ts2020_config struct that the tuner can call to get the AGC PWM value from the demodulator. (2) Modify the TS2020 driver to calculate the gain according to Montage's specification with the adjustment that we produce a negative value and scale it to 0.001dB units (which is what the DVBv5 API will require): (a) Callback to the demodulator to retrieve the AGC PWM value and then turn that into Vagc for incorporation in the calculations. If the callback is unset, assume a Vagc of 0. (b) Calculate the tuner gain from a combination of Vagc and the tuner's RF gain and baseband gain settings. (3) Turn this into a percentage signal strength as per Montage's specification for return to userspace with the DVBv3 API. (4) Provide a function in the M88DS3103 demodulator driver that can be used to get the AGC PWM value on behalf of the tuner. (5) The ts2020_config.get_agc_pwm function should be set by the code that stitches together the drivers for each card. For the DVBSky cards that use the M88DS3103 with the TS2020 or the TS2022, set the get_agc_pwm function to point to m88ds3103_get_agc_pwm. I have tested this with a DVBSky S952 card which has an M88DS3103 and a TS2022. Thanks to Montage for providing access to information about the workings of these parts. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-05-26 15:04:00 +00:00
ts2020_config.get_agc_pwm = m88ds3103_get_agc_pwm;
state->i2c_client_tuner = dvb_module_probe("ts2020", NULL,
i2c_adapter,
0x60, &ts2020_config);
if (!state->i2c_client_tuner) {
dvb_module_release(state->i2c_client_demod);
return -ENODEV;
}
/* attach ci controller */
sp2_config.dvb_adap = &adap->dvb_adap;
sp2_config.priv = d;
sp2_config.ci_control = dvbsky_ci_ctrl;
state->i2c_client_ci = dvb_module_probe("sp2", NULL,
&d->i2c_adap,
0x40, &sp2_config);
if (!state->i2c_client_ci) {
dvb_module_release(state->i2c_client_tuner);
dvb_module_release(state->i2c_client_demod);
return -ENODEV;
}
/* delegate signal strength measurement to tuner */
adap->fe[0]->ops.read_signal_strength =
adap->fe[0]->ops.tuner_ops.get_rf_strength;
/* hook fe: need to resync the slave fifo when signal locks. */
state->fe_read_status = adap->fe[0]->ops.read_status;
adap->fe[0]->ops.read_status = dvbsky_usb_read_status;
/* hook fe: LNB off/on is control by Cypress usb chip. */
state->fe_set_voltage = adap->fe[0]->ops.set_voltage;
adap->fe[0]->ops.set_voltage = dvbsky_usb_ci_set_voltage;
return 0;
}
static int dvbsky_t680c_attach(struct dvb_usb_adapter *adap)
{
struct dvbsky_state *state = adap_to_priv(adap);
struct dvb_usb_device *d = adap_to_d(adap);
struct i2c_adapter *i2c_adapter;
struct si2168_config si2168_config = {};
struct si2157_config si2157_config = {};
struct sp2_config sp2_config = {};
/* attach demod */
si2168_config.i2c_adapter = &i2c_adapter;
si2168_config.fe = &adap->fe[0];
si2168_config.ts_mode = SI2168_TS_PARALLEL;
state->i2c_client_demod = dvb_module_probe("si2168", NULL,
&d->i2c_adap,
0x64, &si2168_config);
if (!state->i2c_client_demod)
return -ENODEV;
/* attach tuner */
si2157_config.fe = adap->fe[0];
si2157_config.if_port = 1;
state->i2c_client_tuner = dvb_module_probe("si2157", NULL,
i2c_adapter,
0x60, &si2157_config);
if (!state->i2c_client_tuner) {
dvb_module_release(state->i2c_client_demod);
return -ENODEV;
}
/* attach ci controller */
sp2_config.dvb_adap = &adap->dvb_adap;
sp2_config.priv = d;
sp2_config.ci_control = dvbsky_ci_ctrl;
state->i2c_client_ci = dvb_module_probe("sp2", NULL,
&d->i2c_adap,
0x40, &sp2_config);
if (!state->i2c_client_ci) {
dvb_module_release(state->i2c_client_tuner);
dvb_module_release(state->i2c_client_demod);
return -ENODEV;
}
return 0;
}
static int dvbsky_t330_attach(struct dvb_usb_adapter *adap)
{
struct dvbsky_state *state = adap_to_priv(adap);
struct dvb_usb_device *d = adap_to_d(adap);
struct i2c_adapter *i2c_adapter;
struct si2168_config si2168_config = {};
struct si2157_config si2157_config = {};
/* attach demod */
si2168_config.i2c_adapter = &i2c_adapter;
si2168_config.fe = &adap->fe[0];
si2168_config.ts_mode = SI2168_TS_PARALLEL;
si2168_config.ts_clock_gapped = true;
state->i2c_client_demod = dvb_module_probe("si2168", NULL,
&d->i2c_adap,
0x64, &si2168_config);
if (!state->i2c_client_demod)
return -ENODEV;
/* attach tuner */
si2157_config.fe = adap->fe[0];
si2157_config.if_port = 1;
state->i2c_client_tuner = dvb_module_probe("si2157", NULL,
i2c_adapter,
0x60, &si2157_config);
if (!state->i2c_client_tuner) {
dvb_module_release(state->i2c_client_demod);
return -ENODEV;
}
return 0;
}
static int dvbsky_mygica_t230c_attach(struct dvb_usb_adapter *adap)
{
struct dvbsky_state *state = adap_to_priv(adap);
struct dvb_usb_device *d = adap_to_d(adap);
struct i2c_adapter *i2c_adapter;
struct si2168_config si2168_config = {};
struct si2157_config si2157_config = {};
/* attach demod */
si2168_config.i2c_adapter = &i2c_adapter;
si2168_config.fe = &adap->fe[0];
si2168_config.ts_mode = SI2168_TS_PARALLEL;
if (le16_to_cpu(d->udev->descriptor.idProduct) == USB_PID_MYGICA_T230C2)
si2168_config.ts_mode |= SI2168_TS_CLK_MANUAL;
si2168_config.ts_clock_inv = 1;
state->i2c_client_demod = dvb_module_probe("si2168", NULL,
&d->i2c_adap,
0x64, &si2168_config);
if (!state->i2c_client_demod)
return -ENODEV;
/* attach tuner */
si2157_config.fe = adap->fe[0];
if (le16_to_cpu(d->udev->descriptor.idProduct) == USB_PID_MYGICA_T230) {
si2157_config.if_port = 1;
state->i2c_client_tuner = dvb_module_probe("si2157", NULL,
i2c_adapter,
0x60,
&si2157_config);
} else {
si2157_config.if_port = 0;
state->i2c_client_tuner = dvb_module_probe("si2157", "si2141",
i2c_adapter,
0x60,
&si2157_config);
}
if (!state->i2c_client_tuner) {
dvb_module_release(state->i2c_client_demod);
return -ENODEV;
}
return 0;
}
static int dvbsky_identify_state(struct dvb_usb_device *d, const char **name)
{
dvbsky_gpio_ctrl(d, 0x04, 1);
msleep(20);
dvbsky_gpio_ctrl(d, 0x83, 0);
dvbsky_gpio_ctrl(d, 0xc0, 1);
msleep(100);
dvbsky_gpio_ctrl(d, 0x83, 1);
dvbsky_gpio_ctrl(d, 0xc0, 0);
msleep(50);
return WARM;
}
static int dvbsky_init(struct dvb_usb_device *d)
{
struct dvbsky_state *state = d_to_priv(d);
/* use default interface */
/*
ret = usb_set_interface(d->udev, 0, 0);
if (ret)
return ret;
*/
state->last_lock = 0;
return 0;
}
media: dvbsky: Avoid leaking dvb frontend Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-01-20 01:30:04 +00:00
static int dvbsky_frontend_detach(struct dvb_usb_adapter *adap)
{
media: dvbsky: Avoid leaking dvb frontend Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-01-20 01:30:04 +00:00
struct dvb_usb_device *d = adap_to_d(adap);
struct dvbsky_state *state = d_to_priv(d);
media: dvbsky: Avoid leaking dvb frontend Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-01-20 01:30:04 +00:00
dev_dbg(&d->udev->dev, "%s: adap=%d\n", __func__, adap->id);
dvb_module_release(state->i2c_client_tuner);
dvb_module_release(state->i2c_client_demod);
dvb_module_release(state->i2c_client_ci);
media: dvbsky: fix driver unregister logic There's a user-after-free there, if the frontend is attached via the new I2C way: [ 112.539806] usbcore: deregistering interface driver dvb_usb_dvbsky [ 112.568489] ================================================================== [ 112.568600] BUG: KASAN: use-after-free in dvb_unregister_frontend+0x18/0xb0 [dvb_core] [ 112.568610] Read of size 8 at addr ffff8803a6f61530 by task rmmod/2246 [ 112.568622] CPU: 0 PID: 2246 Comm: rmmod Not tainted 4.16.0-rc4+ #103 [ 112.568624] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017 [ 112.568625] Call Trace: [ 112.568631] dump_stack+0x5c/0x7c [ 112.568636] print_address_description+0x6a/0x270 [ 112.568640] kasan_report+0x258/0x380 [ 112.568657] ? dvb_unregister_frontend+0x18/0xb0 [dvb_core] [ 112.568673] dvb_unregister_frontend+0x18/0xb0 [dvb_core] [ 112.568681] dvb_usbv2_exit+0x156/0x4a0 [dvb_usb_v2] [ 112.568689] dvb_usbv2_disconnect+0xa0/0x140 [dvb_usb_v2] [ 112.568694] usb_unbind_interface+0xd8/0x3f0 [ 112.568700] device_release_driver_internal+0x1ce/0x2f0 [ 112.568705] driver_detach+0x66/0xc0 [ 112.568709] bus_remove_driver+0x86/0x150 [ 112.568713] usb_deregister+0x90/0x180 [ 112.568718] SyS_delete_module+0x293/0x330 [ 112.568721] ? free_module+0x330/0x330 [ 112.568725] ? _cond_resched+0x16/0x50 [ 112.568729] ? task_work_run+0x7d/0xd0 [ 112.568732] ? mem_cgroup_handle_over_high+0x1c/0xc0 [ 112.568736] ? free_module+0x330/0x330 [ 112.568740] do_syscall_64+0xe7/0x250 [ 112.568744] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 112.568747] RIP: 0033:0x7facafa272a7 [ 112.568749] RSP: 002b:00007fffdea14cc8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 112.568753] RAX: ffffffffffffffda RBX: 00007fffdea14d28 RCX: 00007facafa272a7 [ 112.568755] RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005599557337c8 [ 112.568756] RBP: 0000559955733760 R08: 000000000000000a R09: 0000000000000000 [ 112.568758] R10: 00007facafaa0280 R11: 0000000000000206 R12: 00007fffdea14ef0 [ 112.568761] R13: 00007fffdea16eac R14: 0000559955733260 R15: 0000559955733760 [ 112.568808] Allocated by task 638: [ 112.568816] kasan_kmalloc+0xa0/0xd0 [ 112.568820] kmem_cache_alloc_trace+0x114/0x230 [ 112.568826] m88ds3103_probe+0x9a/0x643 [m88ds3103] [ 112.568830] i2c_device_probe+0x2e9/0x3c0 [ 112.568833] driver_probe_device+0x46e/0x6a0 [ 112.568836] bus_for_each_drv+0xd6/0x130 [ 112.568838] __device_attach+0x166/0x1f0 [ 112.568841] bus_probe_device+0xea/0x110 [ 112.568844] device_add+0x6a3/0x9f0 [ 112.568847] i2c_new_device+0x28f/0x5c0 [ 112.568861] dvb_module_probe+0x91/0x110 [dvb_core] [ 112.568867] dvbsky_s960c_attach+0x1c4/0x460 [dvb_usb_dvbsky] [ 112.568873] dvb_usbv2_probe+0x1191/0x1950 [dvb_usb_v2] [ 112.568877] usb_probe_interface+0x1b3/0x430 [ 112.568880] driver_probe_device+0x46e/0x6a0 [ 112.568882] __driver_attach+0xeb/0x110 [ 112.568885] bus_for_each_dev+0xe4/0x140 [ 112.568888] bus_add_driver+0x249/0x380 [ 112.568891] driver_register+0xc6/0x170 [ 112.568893] usb_register_driver+0xec/0x200 [ 112.568896] do_one_initcall+0x8f/0x1ee [ 112.568900] do_init_module+0xde/0x320 [ 112.568902] load_module+0x3ed0/0x4850 [ 112.568905] SYSC_finit_module+0x192/0x1c0 [ 112.568908] do_syscall_64+0xe7/0x250 [ 112.568911] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 112.568916] Freed by task 2246: [ 112.568923] __kasan_slab_free+0x136/0x180 [ 112.568925] kfree+0xa5/0x1e0 [ 112.568931] m88ds3103_remove+0x42/0x60 [m88ds3103] [ 112.568934] i2c_device_remove+0x72/0xd0 [ 112.568937] device_release_driver_internal+0x1ce/0x2f0 [ 112.568940] bus_remove_device+0x197/0x270 [ 112.568942] device_del+0x239/0x550 [ 112.568945] device_unregister+0x16/0x70 [ 112.568949] dvbsky_exit+0x4c/0x70 [dvb_usb_dvbsky] [ 112.568955] dvb_usbv2_disconnect+0x98/0x140 [dvb_usb_v2] [ 112.568958] usb_unbind_interface+0xd8/0x3f0 [ 112.568961] device_release_driver_internal+0x1ce/0x2f0 [ 112.568964] driver_detach+0x66/0xc0 [ 112.568967] bus_remove_driver+0x86/0x150 [ 112.568970] usb_deregister+0x90/0x180 [ 112.568973] SyS_delete_module+0x293/0x330 [ 112.568976] do_syscall_64+0xe7/0x250 [ 112.568979] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 112.568985] The buggy address belongs to the object at ffff8803a6f61100 which belongs to the cache kmalloc-2048 of size 2048 [ 112.568998] The buggy address is located 1072 bytes inside of 2048-byte region [ffff8803a6f61100, ffff8803a6f61900) [ 112.569008] The buggy address belongs to the page: [ 112.569015] page:ffffea000e9bd800 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0 [ 112.569025] flags: 0x17ffe000008100(slab|head) [ 112.569034] raw: 0017ffe000008100 0000000000000000 0000000000000000 00000001000f000f [ 112.569044] raw: ffffea000ee2d000 0000000500000005 ffff880407002a80 0000000000000000 [ 112.569053] page dumped because: kasan: bad access detected [ 112.569062] Memory state around the buggy address: [ 112.569070] ffff8803a6f61400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 112.569079] ffff8803a6f61480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 112.569088] >ffff8803a6f61500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 112.569095] ^ [ 112.569103] ffff8803a6f61580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 112.569112] ffff8803a6f61600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 112.569119] ================================================================== [ 112.569127] Disabling lock debugging due to kernel taint [ 112.571161] dvb_usb_v2: 'DVBSky S960CI:2-2' successfully deinitialized and disconnected Fix it by letting the dvb-usb-v2 core to know that the frontend was already removed. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-03-08 18:47:39 +00:00
media: dvbsky: Avoid leaking dvb frontend Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-01-20 01:30:04 +00:00
return 0;
}
/* DVB USB Driver stuff */
static struct dvb_usb_device_properties dvbsky_s960_props = {
.driver_name = KBUILD_MODNAME,
.owner = THIS_MODULE,
.adapter_nr = adapter_nr,
.size_of_priv = sizeof(struct dvbsky_state),
.generic_bulk_ctrl_endpoint = 0x01,
.generic_bulk_ctrl_endpoint_response = 0x81,
.generic_bulk_ctrl_delay = DVBSKY_MSG_DELAY,
.i2c_algo = &dvbsky_i2c_algo,
.frontend_attach = dvbsky_s960_attach,
media: dvbsky: Avoid leaking dvb frontend Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-01-20 01:30:04 +00:00
.frontend_detach = dvbsky_frontend_detach,
.init = dvbsky_init,
.get_rc_config = dvbsky_get_rc_config,
.streaming_ctrl = dvbsky_streaming_ctrl,
.identify_state = dvbsky_identify_state,
.read_mac_address = dvbsky_read_mac_addr,
.num_adapters = 1,
.adapter = {
{
.stream = DVB_USB_STREAM_BULK(0x82, 8, 4096),
}
}
};
static struct dvb_usb_device_properties dvbsky_s960c_props = {
.driver_name = KBUILD_MODNAME,
.owner = THIS_MODULE,
.adapter_nr = adapter_nr,
.size_of_priv = sizeof(struct dvbsky_state),
.generic_bulk_ctrl_endpoint = 0x01,
.generic_bulk_ctrl_endpoint_response = 0x81,
.generic_bulk_ctrl_delay = DVBSKY_MSG_DELAY,
.i2c_algo = &dvbsky_i2c_algo,
.frontend_attach = dvbsky_s960c_attach,
media: dvbsky: Avoid leaking dvb frontend Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-01-20 01:30:04 +00:00
.frontend_detach = dvbsky_frontend_detach,
.init = dvbsky_init,
.get_rc_config = dvbsky_get_rc_config,
.streaming_ctrl = dvbsky_streaming_ctrl,
.identify_state = dvbsky_identify_state,
.read_mac_address = dvbsky_read_mac_addr,
.num_adapters = 1,
.adapter = {
{
.stream = DVB_USB_STREAM_BULK(0x82, 8, 4096),
}
}
};
static struct dvb_usb_device_properties dvbsky_t680c_props = {
.driver_name = KBUILD_MODNAME,
.owner = THIS_MODULE,
.adapter_nr = adapter_nr,
.size_of_priv = sizeof(struct dvbsky_state),
.generic_bulk_ctrl_endpoint = 0x01,
.generic_bulk_ctrl_endpoint_response = 0x81,
.generic_bulk_ctrl_delay = DVBSKY_MSG_DELAY,
.i2c_algo = &dvbsky_i2c_algo,
.frontend_attach = dvbsky_t680c_attach,
media: dvbsky: Avoid leaking dvb frontend Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-01-20 01:30:04 +00:00
.frontend_detach = dvbsky_frontend_detach,
.init = dvbsky_init,
.get_rc_config = dvbsky_get_rc_config,
.streaming_ctrl = dvbsky_streaming_ctrl,
.identify_state = dvbsky_identify_state,
.read_mac_address = dvbsky_read_mac_addr,
.num_adapters = 1,
.adapter = {
{
.stream = DVB_USB_STREAM_BULK(0x82, 8, 4096),
}
}
};
static struct dvb_usb_device_properties dvbsky_t330_props = {
.driver_name = KBUILD_MODNAME,
.owner = THIS_MODULE,
.adapter_nr = adapter_nr,
.size_of_priv = sizeof(struct dvbsky_state),
.generic_bulk_ctrl_endpoint = 0x01,
.generic_bulk_ctrl_endpoint_response = 0x81,
.generic_bulk_ctrl_delay = DVBSKY_MSG_DELAY,
.i2c_algo = &dvbsky_i2c_algo,
.frontend_attach = dvbsky_t330_attach,
media: dvbsky: Avoid leaking dvb frontend Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-01-20 01:30:04 +00:00
.frontend_detach = dvbsky_frontend_detach,
.init = dvbsky_init,
.get_rc_config = dvbsky_get_rc_config,
.streaming_ctrl = dvbsky_streaming_ctrl,
.identify_state = dvbsky_identify_state,
.read_mac_address = dvbsky_read_mac_addr,
.num_adapters = 1,
.adapter = {
{
.stream = DVB_USB_STREAM_BULK(0x82, 8, 4096),
}
}
};
static struct dvb_usb_device_properties mygica_t230c_props = {
.driver_name = KBUILD_MODNAME,
.owner = THIS_MODULE,
.adapter_nr = adapter_nr,
.size_of_priv = sizeof(struct dvbsky_state),
.generic_bulk_ctrl_endpoint = 0x01,
.generic_bulk_ctrl_endpoint_response = 0x81,
.generic_bulk_ctrl_delay = DVBSKY_MSG_DELAY,
.i2c_algo = &dvbsky_i2c_algo,
.frontend_attach = dvbsky_mygica_t230c_attach,
media: dvbsky: Avoid leaking dvb frontend Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-01-20 01:30:04 +00:00
.frontend_detach = dvbsky_frontend_detach,
.init = dvbsky_init,
.get_rc_config = dvbsky_get_rc_config,
.streaming_ctrl = dvbsky_streaming_ctrl,
.identify_state = dvbsky_identify_state,
.num_adapters = 1,
.adapter = {
{
.stream = DVB_USB_STREAM_BULK(0x82, 8, 4096),
}
}
};
static const struct usb_device_id dvbsky_id_table[] = {
{ DVB_USB_DEVICE(0x0572, 0x6831,
&dvbsky_s960_props, "DVBSky S960/S860", RC_MAP_DVBSKY) },
{ DVB_USB_DEVICE(0x0572, 0x960c,
&dvbsky_s960c_props, "DVBSky S960CI", RC_MAP_DVBSKY) },
{ DVB_USB_DEVICE(0x0572, 0x680c,
&dvbsky_t680c_props, "DVBSky T680CI", RC_MAP_DVBSKY) },
{ DVB_USB_DEVICE(0x0572, 0x0320,
&dvbsky_t330_props, "DVBSky T330", RC_MAP_DVBSKY) },
{ DVB_USB_DEVICE(USB_VID_TECHNOTREND,
USB_PID_TECHNOTREND_TVSTICK_CT2_4400,
&dvbsky_t330_props, "TechnoTrend TVStick CT2-4400",
RC_MAP_TT_1500) },
{ DVB_USB_DEVICE(USB_VID_TECHNOTREND,
USB_PID_TECHNOTREND_CONNECT_CT2_4650_CI,
&dvbsky_t680c_props, "TechnoTrend TT-connect CT2-4650 CI",
RC_MAP_TT_1500) },
{ DVB_USB_DEVICE(USB_VID_TECHNOTREND,
USB_PID_TECHNOTREND_CONNECT_CT2_4650_CI_2,
&dvbsky_t680c_props, "TechnoTrend TT-connect CT2-4650 CI v1.1",
RC_MAP_TT_1500) },
{ DVB_USB_DEVICE(USB_VID_TECHNOTREND,
USB_PID_TECHNOTREND_CONNECT_S2_4650_CI,
&dvbsky_s960c_props, "TechnoTrend TT-connect S2-4650 CI",
RC_MAP_TT_1500) },
{ DVB_USB_DEVICE(USB_VID_TERRATEC,
USB_PID_TERRATEC_H7_3,
&dvbsky_t680c_props, "Terratec H7 Rev.4",
RC_MAP_TT_1500) },
{ DVB_USB_DEVICE(USB_VID_TERRATEC, USB_PID_TERRATEC_CINERGY_S2_R4,
&dvbsky_s960_props, "Terratec Cinergy S2 Rev.4",
RC_MAP_DVBSKY) },
{ DVB_USB_DEVICE(USB_VID_CONEXANT, USB_PID_MYGICA_T230,
&mygica_t230c_props, "MyGica Mini DVB-T2 USB Stick T230",
RC_MAP_TOTAL_MEDIA_IN_HAND_02) },
{ DVB_USB_DEVICE(USB_VID_CONEXANT, USB_PID_MYGICA_T230C,
&mygica_t230c_props, "MyGica Mini DVB-T2 USB Stick T230C",
RC_MAP_TOTAL_MEDIA_IN_HAND_02) },
{ DVB_USB_DEVICE(USB_VID_CONEXANT, USB_PID_MYGICA_T230C2,
&mygica_t230c_props, "MyGica Mini DVB-T2 USB Stick T230C v2",
RC_MAP_TOTAL_MEDIA_IN_HAND_02) },
{ }
};
MODULE_DEVICE_TABLE(usb, dvbsky_id_table);
static struct usb_driver dvbsky_usb_driver = {
.name = KBUILD_MODNAME,
.id_table = dvbsky_id_table,
.probe = dvb_usbv2_probe,
.disconnect = dvb_usbv2_disconnect,
.suspend = dvb_usbv2_suspend,
.resume = dvb_usbv2_resume,
.reset_resume = dvb_usbv2_reset_resume,
.no_dynamic_id = 1,
.soft_unbind = 1,
};
module_usb_driver(dvbsky_usb_driver);
MODULE_AUTHOR("Max nibble <nibble.max@gmail.com>");
MODULE_DESCRIPTION("Driver for DVBSky USB");
MODULE_LICENSE("GPL");