linux/drivers/media/usb
Michael Kuron f7b77ebe6d media: dib0700: fix undefined behavior in tuner shutdown
This fixes a problem where closing the tuner would leave it in a state
where it would not tune to any channel when reopened. This problem was
discovered as part of https://github.com/hselasky/webcamd/issues/16.

Since adap->id is 0 or 1, this bit-shift overflows, which is undefined
behavior. The driver still worked in practice as the overflow would in
most environments result in 0, which rendered the line a no-op. When
running the driver as part of webcamd however, the overflow could lead
to 0xff due to optimizations by the compiler, which would, in the end,
improperly shut down the tuner.

The bug is a regression introduced in the commit referenced below. The
present patch causes identical behavior to before that commit for
adap->id equal to 0 or 1. The driver does not contain support for
dib0700 devices with more adapters, assuming such even exist.

Tests have been performed with the Xbox One Digital TV Tuner on amd64.
Not all dib0700 devices are expected to be affected by the regression;
this code path is only taken by those with incorrect endpoint numbers.

Link: https://lore.kernel.org/linux-media/1d2fc36d94ced6f67c7cc21dcc469d5e5bdd8201.1632689033.git.mchehab+huawei@kernel.org

Cc: stable@vger.kernel.org
Fixes: 7757ddda6f ("[media] DiB0700: add function to change I2C-speed")
Signed-off-by: Michael Kuron <michael.kuron@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-11-19 16:22:42 +00:00
..
airspy media: usb: airspy: clean the freed pointer and counter 2021-09-30 10:07:54 +02:00
as102 treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 118 2019-05-24 17:39:02 +02:00
au0828 media: au0828: fix a NULL vs IS_ERR() check 2021-06-02 13:30:28 +02:00
b2c2 media: flexcop-usb: fix control-message timeouts 2021-11-19 06:04:53 +00:00
cpia2 media: cpia2: fix control-message timeouts 2021-11-19 06:05:12 +00:00
cx231xx media: cx231xx/cx231xx.h: Remove repeated struct declaration 2021-04-06 16:10:19 +02:00
dvb-usb media: dib0700: fix undefined behavior in tuner shutdown 2021-11-19 16:22:42 +00:00
dvb-usb-v2 media: mxl111sf: change mutex_init() location 2021-09-30 10:08:01 +02:00
em28xx media: em28xx: fix control-message timeouts 2021-11-19 06:05:33 +00:00
go7007 media: go7007: remove redundant initialization 2021-07-22 14:01:54 +02:00
gspca media: gspca: Make use of the helper macro kthread_run() 2021-11-15 08:12:01 +00:00
hackrf media: rtl2832_sdr/vivid/airspy/hackrf/msi2500: drop memset of fmt.sdr.reserved 2021-05-19 09:51:39 +02:00
hdpvr media: usb: hdpvr: convert to use i2c_new_client_device() 2020-04-14 11:31:48 +02:00
msi2500 media: rtl2832_sdr/vivid/airspy/hackrf/msi2500: drop memset of fmt.sdr.reserved 2021-05-19 09:51:39 +02:00
pvrusb2 media: pvrusb2: fix control-message timeouts 2021-11-19 06:06:12 +00:00
pwc treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
s2255 media: s2255: fix control-message timeouts 2021-11-19 06:08:32 +00:00
siano media: Use fallthrough pseudo-keyword 2020-08-29 08:35:27 +02:00
stk1160 media: stk1160: fix control-message timeouts 2021-11-19 06:08:52 +00:00
stkwebcam media: usb: stkwebcam: Update the reference count of the usb device structure 2021-09-30 10:07:58 +02:00
tm6000 media: tm6000: Avoid card name truncation 2021-09-30 10:08:00 +02:00
ttusb-budget media: dvb-ttusb-budget: cleanup printk logic 2020-09-03 11:15:47 +02:00
ttusb-dec media: ttusb-dec: avoid release of non-acquired mutex 2021-09-30 10:07:40 +02:00
usbtv media updates for v5.13-rc1 2021-04-28 09:24:36 -07:00
uvc media: uvcvideo: Don't spam the log in uvc_ctrl_restore_values() 2021-09-30 10:07:48 +02:00
zr364xx media: zr364xx: fix memory leak in zr364xx_start_readpipe 2021-06-02 13:35:15 +02:00
Kconfig media: move ttpci-eeprom to common 2021-06-02 11:16:15 +02:00
Makefile media: move CEC USB drivers to a separate directory 2020-04-15 12:06:40 +02:00