From c6cfe05532cf6e9858d60ee699c51b906842489d Mon Sep 17 00:00:00 2001 From: Julia Lawall Date: Sat, 22 May 2010 05:21:02 -0300 Subject: V4L/DVB: drivers/media: Use memdup_user Use memdup_user when user data is immediately copied into the allocated region. The semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // @@ expression from,to,size,flag; position p; identifier l1,l2; @@ - to = \(kmalloc@p\|kzalloc@p\)(size,flag); + to = memdup_user(from,size); if ( - to==NULL + IS_ERR(to) || ...) { <+... when != goto l1; - -ENOMEM + PTR_ERR(to) ...+> } - if (copy_from_user(to, from, size) != 0) { - <+... when != goto l2; - -EFAULT - ...+> - } // Signed-off-by: Julia Lawall Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/dvb-core/dvb_demux.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) (limited to 'drivers/media/dvb/dvb-core') diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c index 977ddba3e23..4a88a3e4db2 100644 --- a/drivers/media/dvb/dvb-core/dvb_demux.c +++ b/drivers/media/dvb/dvb-core/dvb_demux.c @@ -1130,13 +1130,9 @@ static int dvbdmx_write(struct dmx_demux *demux, const char __user *buf, size_t if ((!demux->frontend) || (demux->frontend->source != DMX_MEMORY_FE)) return -EINVAL; - p = kmalloc(count, GFP_USER); - if (!p) - return -ENOMEM; - if (copy_from_user(p, buf, count)) { - kfree(p); - return -EFAULT; - } + p = memdup_user(buf, count); + if (IS_ERR(p)) + return PTR_ERR(p); if (mutex_lock_interruptible(&dvbdemux->mutex)) { kfree(p); return -ERESTARTSYS; -- cgit v1.2.3-70-g09d2 From e252984c5279dde24fbd6d3efe7fe13dc642e714 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 4 Jun 2010 12:39:03 -0300 Subject: V4L/DVB: dvb_ca_en50221: return -EFAULT on copy_to_user errors copy_to_user() returns the number of bytes remaining to be copied which isn't the right thing to return here. The comments say that these functions in dvb_ca_en50221.c should return the number of bytes copied or an error return. I've changed it to return -EFAULT. Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/dvb-core/dvb_ca_en50221.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'drivers/media/dvb/dvb-core') diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c index ef259a0718a..cb97e6b8543 100644 --- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c @@ -1318,8 +1318,11 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file, fragbuf[0] = connection_id; fragbuf[1] = ((fragpos + fraglen) < count) ? 0x80 : 0x00; - if ((status = copy_from_user(fragbuf + 2, buf + fragpos, fraglen)) != 0) + status = copy_from_user(fragbuf + 2, buf + fragpos, fraglen); + if (status) { + status = -EFAULT; goto exit; + } timeout = jiffies + HZ / 2; written = 0; @@ -1494,8 +1497,11 @@ static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user * buf, hdr[0] = slot; hdr[1] = connection_id; - if ((status = copy_to_user(buf, hdr, 2)) != 0) + status = copy_to_user(buf, hdr, 2); + if (status) { + status = -EFAULT; goto exit; + } status = pktlen; exit: -- cgit v1.2.3-70-g09d2 From 2030c0325aa3d430b7bb9ec99da0295f49d183ef Mon Sep 17 00:00:00 2001 From: Guillaume Audirac Date: Thu, 6 May 2010 09:30:25 -0300 Subject: V4L/DVB: dvb_frontend: fix typos in comments and one function Signed-off-by: Guillaume Audirac Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/dvb-core/dvb_frontend.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'drivers/media/dvb/dvb-core') diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c index 44ae89ecef9..4d45b7d6b3f 100644 --- a/drivers/media/dvb/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb/dvb-core/dvb_frontend.c @@ -465,7 +465,7 @@ static void dvb_frontend_swzigzag(struct dvb_frontend *fe) if ((fepriv->state & FESTATE_SEARCHING_FAST) || (fepriv->state & FESTATE_RETUNE)) { fepriv->delay = fepriv->min_delay; - /* peform a tune */ + /* perform a tune */ retval = dvb_frontend_swzigzag_autotune(fe, fepriv->check_wrapped); if (retval < 0) { @@ -791,7 +791,7 @@ static int dvb_frontend_start(struct dvb_frontend *fe) return 0; } -static void dvb_frontend_get_frequeny_limits(struct dvb_frontend *fe, +static void dvb_frontend_get_frequency_limits(struct dvb_frontend *fe, u32 *freq_min, u32 *freq_max) { *freq_min = max(fe->ops.info.frequency_min, fe->ops.tuner_ops.info.frequency_min); @@ -815,7 +815,7 @@ static int dvb_frontend_check_parameters(struct dvb_frontend *fe, u32 freq_max; /* range check: frequency */ - dvb_frontend_get_frequeny_limits(fe, &freq_min, &freq_max); + dvb_frontend_get_frequency_limits(fe, &freq_min, &freq_max); if ((freq_min && parms->frequency < freq_min) || (freq_max && parms->frequency > freq_max)) { printk(KERN_WARNING "DVB: adapter %i frontend %i frequency %u out of range (%u..%u)\n", @@ -1627,7 +1627,7 @@ static int dvb_frontend_ioctl_legacy(struct file *file, case FE_GET_INFO: { struct dvb_frontend_info* info = parg; memcpy(info, &fe->ops.info, sizeof(struct dvb_frontend_info)); - dvb_frontend_get_frequeny_limits(fe, &info->frequency_min, &info->frequency_max); + dvb_frontend_get_frequency_limits(fe, &info->frequency_min, &info->frequency_max); /* Force the CAN_INVERSION_AUTO bit on. If the frontend doesn't * do it, it is done for it. */ @@ -1726,7 +1726,7 @@ static int dvb_frontend_ioctl_legacy(struct file *file, * (stv0299 for instance) take longer than 8msec to * respond to a set_voltage command. Those switches * need custom routines to switch properly. For all - * other frontends, the following shoule work ok. + * other frontends, the following should work ok. * Dish network legacy switches (as used by Dish500) * are controlled by sending 9-bit command words * spaced 8msec apart. -- cgit v1.2.3-70-g09d2 From 1c488ea9d52032d07dd320d31e0720239c93dd64 Mon Sep 17 00:00:00 2001 From: Jiri Slaby Date: Sun, 18 Jul 2010 15:34:18 -0300 Subject: V4L/DVB: DVB: fix dvr node refcounting In dvb_dvr_release, there is a test dvbdev->users==-1, but users are never negative. This error results in hung tasks: task PC stack pid father bash D ffffffffa000c948 0 3264 3170 0x00000000 ffff88003aec5ce8 0000000000000086 0000000000011f80 0000000000011f80 ffff88003aec5fd8 ffff88003aec5fd8 ffff88003b848670 0000000000011f80 ffff88003aec5fd8 0000000000011f80 ffff88003e02a030 ffff88003b848670 Call Trace: [] dvb_dmxdev_release+0xc5/0x130 [] ? autoremove_wake_function+0x0/0x40 [] dvb_usb_adapter_dvb_exit+0x42/0x70 [dvb_usb] [] dvb_usb_exit+0x55/0xd0 [dvb_usb] [] dvb_usb_device_exit+0x4e/0x70 [dvb_usb] [] af9015_usb_device_exit+0x55/0x60 [dvb_usb_af9015] [] usb_unbind_interface+0x55/0x1a0 [] __device_release_driver+0x70/0xe0 ... So check against 1 there instead. BTW why's the TODO there? Adding TODOs to the code without descriptions is like adding nothing. Signed-off-by: Jiri Slaby Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/dvb-core/dmxdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/media/dvb/dvb-core') diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c index 425862ffb28..0042306ea11 100644 --- a/drivers/media/dvb/dvb-core/dmxdev.c +++ b/drivers/media/dvb/dvb-core/dmxdev.c @@ -207,7 +207,7 @@ static int dvb_dvr_release(struct inode *inode, struct file *file) } /* TODO */ dvbdev->users--; - if(dvbdev->users==-1 && dmxdev->exit==1) { + if (dvbdev->users == 1 && dmxdev->exit == 1) { fops_put(file->f_op); file->f_op = NULL; mutex_unlock(&dmxdev->mutex); -- cgit v1.2.3-70-g09d2