From b2ad41f9ef72d7b3309a2578bf4432a262ff2b47 Mon Sep 17 00:00:00 2001 From: Stefan Richter Date: Fri, 25 Dec 2009 21:47:12 -0300 Subject: V4L/DVB (13953): firedtv: add missing NULL pointer check If there is ever going to be a FireDTV or FloppyDTV firmware which does not provide a minimal ASCII textual descriptor for Model_Id --- or if the descriptor is provided indirectly in a descriptor directory --- the ieee1394 variant of the device probe of firedtv would dereference a NULL pointer. The firewire variant of firedtv's device probe is not affected. The fix makes sure that such an unexpected firmware is safely recognized by fdtv_alloc as an unknown firmware. Signed-off-by: Stefan Richter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/firewire/firedtv-1394.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'drivers/media/dvb/firewire/firedtv-1394.c') diff --git a/drivers/media/dvb/firewire/firedtv-1394.c b/drivers/media/dvb/firewire/firedtv-1394.c index 7c5459c27b7..81a56293540 100644 --- a/drivers/media/dvb/firewire/firedtv-1394.c +++ b/drivers/media/dvb/firewire/firedtv-1394.c @@ -192,9 +192,13 @@ static int node_probe(struct device *dev) int kv_len, err; void *kv_str; - kv_len = (ud->model_name_kv->value.leaf.len - 2) * sizeof(quadlet_t); - kv_str = CSR1212_TEXTUAL_DESCRIPTOR_LEAF_DATA(ud->model_name_kv); - + if (ud->model_name_kv) { + kv_len = (ud->model_name_kv->value.leaf.len - 2) * 4; + kv_str = CSR1212_TEXTUAL_DESCRIPTOR_LEAF_DATA(ud->model_name_kv); + } else { + kv_len = 0; + kv_str = NULL; + } fdtv = fdtv_alloc(dev, &fdtv_1394_backend, kv_str, kv_len); if (!fdtv) return -ENOMEM; -- cgit v1.2.3 From 3fb80ef3bc0f2b1008e14f695dcb32415cbacc90 Mon Sep 17 00:00:00 2001 From: Stefan Richter Date: Wed, 18 Nov 2009 16:02:01 -0300 Subject: V4L/DVB: firedtv: do not DMA-map stack addresses This is a portability fix and reduces stack usage. The DMA mapping API cannot map on-stack addresses, as explained in Documentation/DMA-mapping.txt. Convert the two cases of on-stack packet payload buffers in firedtv (payload of write requests in avc_write and of lock requests in cmp_lock) to slab-allocated memory. We use the 512 bytes sized FCP frame buffer in struct firedtv for this purpose. Previously it held only incoming FCP responses, now it holds pending FCP requests and is then overwriten by an FCP response from the tuner subunit. Ditto for CMP lock requests and responses. Accesses to the payload buffer are serialized by fdtv->avc_mutex. As a welcome side effect, stack usage of the AV/C transaction functions is reduced by 512 bytes. Alas, avc_register_remote_control() is a special case: It previously did not wait for a response. To fit better in with the other FCP transactions, let it wait for an interim response. Signed-off-by: Stefan Richter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/firewire/firedtv-1394.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'drivers/media/dvb/firewire/firedtv-1394.c') diff --git a/drivers/media/dvb/firewire/firedtv-1394.c b/drivers/media/dvb/firewire/firedtv-1394.c index 81a56293540..c3e0ec2dcfc 100644 --- a/drivers/media/dvb/firewire/firedtv-1394.c +++ b/drivers/media/dvb/firewire/firedtv-1394.c @@ -90,13 +90,14 @@ static inline struct node_entry *node_of(struct firedtv *fdtv) return container_of(fdtv->device, struct unit_directory, device)->ne; } -static int node_lock(struct firedtv *fdtv, u64 addr, __be32 data[]) +static int node_lock(struct firedtv *fdtv, u64 addr, void *data) { + quadlet_t *d = data; int ret; - ret = hpsb_node_lock(node_of(fdtv), addr, EXTCODE_COMPARE_SWAP, - (__force quadlet_t *)&data[1], (__force quadlet_t)data[0]); - data[0] = data[1]; + ret = hpsb_node_lock(node_of(fdtv), addr, + EXTCODE_COMPARE_SWAP, &d[1], d[0]); + d[0] = d[1]; return ret; } -- cgit v1.2.3