kernel_samsung_a53x/drivers/media
Zheng Yejian 043930d150 media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
[ Upstream commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c ]

Infinite log printing occurs during fuzz test:

  rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
  ...
  dvb-usb: schedule remote query interval to 100 msecs.
  dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
  dvb-usb: bulk message failed: -22 (1/0)
  dvb-usb: bulk message failed: -22 (1/0)
  dvb-usb: bulk message failed: -22 (1/0)
  ...
  dvb-usb: bulk message failed: -22 (1/0)

Looking into the codes, there is a loop in dvb_usb_read_remote_control(),
that is in rc_core_dvb_usb_remote_init() create a work that will call
dvb_usb_read_remote_control(), and this work will reschedule itself at
'rc_interval' intervals to recursively call dvb_usb_read_remote_control(),
see following code snippet:

  rc_core_dvb_usb_remote_init() {
    ...
    INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control);
    schedule_delayed_work(&d->rc_query_work,
                          msecs_to_jiffies(rc_interval));
    ...
  }

  dvb_usb_read_remote_control() {
    ...
    err = d->props.rc.core.rc_query(d);
    if (err)
      err(...)  // Did not return even if query failed
    schedule_delayed_work(&d->rc_query_work,
                          msecs_to_jiffies(rc_interval));
  }

When the infinite log printing occurs, the query callback
'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to
the failure of finding a valid 'generic_bulk_ctrl_endpoint'
in usb_bulk_msg(), see following code snippet:

  cxusb_rc_query() {
    cxusb_ctrl_msg() {
      dvb_usb_generic_rw() {
        ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev,
                           d->props.generic_bulk_ctrl_endpoint),...);
        if (ret)
          err("bulk message failed: %d (%d/%d)",ret,wlen,actlen);
          ...
      }
  ...
  }

By analyzing the corresponding USB descriptor, it shows that the
bNumEndpoints is 0 in its interface descriptor, but
the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure
a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this
'invalid' USB device should be rejected before it calls into
dvb_usb_read_remote_control().

To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'.
And as Sean suggested, the same check and clear halts should be done for
'generic_bulk_ctrl_endpoint_response'. So introduce
dvb_usb_check_bulk_endpoint() to do it for both of them.

Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-23 23:20:08 +01:00
..
cec Revert "media: cec: core: avoid confusing "transmit timed out" message" 2024-11-19 14:03:20 +01:00
common media: v4l2-tpg: fix some memleaks in tpg_alloc 2024-11-19 08:44:51 +01:00
dvb-core media: dvbdev: Initialize sbuf 2024-11-19 14:19:32 +01:00
dvb-frontends media: dvb-frontends: tda10048: Fix integer overflow 2024-11-19 14:19:40 +01:00
firewire Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
i2c media: tc358743: register v4l2 async device only after successful setup 2024-11-19 08:44:51 +01:00
mc media: mc: mark the media devnode as registered from the, start 2024-11-19 12:27:17 +01:00
mmc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pci media: ngene: Add dvb_ca_en50221_init return value check 2024-11-19 12:26:58 +01:00
platform media: mediatek: vcodec: avoid -Wcast-function-type-strict warning 2024-11-19 08:44:55 +01:00
radio media: radio-shark2: Avoid led_names truncations 2024-11-19 12:26:58 +01:00
rc media: rc: bpf attach/detach requires write permission 2024-11-18 12:13:31 +01:00
spi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test-drivers media: vivid: avoid integer overflow 2024-11-18 11:43:15 +01:00
tuners media: xc4000: Fix atomicity violation in xc4000_get_frequency 2024-11-19 09:22:15 +01:00
usb media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control() 2024-11-23 23:20:08 +01:00
v4l2-core media: v4l2-core: hold videodev_lock until dev reg, finishes 2024-11-19 12:27:17 +01:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00