github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-06 21:45:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: mxl111sf: change mutex_init() location

Browse Source 
commit 44870a9e7a upstream.

Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized
mutex. The problem was in wrong mutex_init() location.

Previous mutex_init(&state->msg_lock) call was in ->init() function, but
dvb_usbv2_init() has this order of calls:

	dvb_usbv2_init()
	  dvb_usbv2_adapter_init()
	    dvb_usbv2_adapter_frontend_init()
	      props->frontend_attach()

	  props->init()

Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach()
internally we need to initialize state->msg_lock before
frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_*
devices, which will simply initiaize mutex.

Reported-and-tested-by: syzbot+5ca0bf339f13c4243001@syzkaller.appspotmail.com

Fixes: 8572211842 ("[media] mxl111sf: convert to new DVB USB")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Pavel Skripkin 2021-08-19 12:42:21 +02:00 committed by Greg Kroah-Hartman
parent 0413f7a1a5
commit b99bdf127a
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/media/usb/dvb-usb-v2/mxl111sf.c
View File

@ -931,8 +931,6 @@ static int mxl111sf_init(struct dvb_usb_device *d)
.len = sizeof(eeprom), .buf = eeprom }, .len = sizeof(eeprom), .buf = eeprom },
}; };
mutex_init(&state->msg_lock);
ret = get_chip_info(state); ret = get_chip_info(state);
if (mxl_fail(ret)) if (mxl_fail(ret))
pr_err("failed to get chip info during probe"); pr_err("failed to get chip info during probe");
@ -1074,6 +1072,14 @@ static int mxl111sf_get_stream_config_dvbt(struct dvb_frontend *fe,
return 0; return 0;
} }
static int mxl111sf_probe(struct dvb_usb_device *dev)
{
struct mxl111sf_state *state = d_to_priv(dev);
mutex_init(&state->msg_lock);
return 0;
}
static struct dvb_usb_device_properties mxl111sf_props_dvbt = { static struct dvb_usb_device_properties mxl111sf_props_dvbt = {
.driver_name = KBUILD_MODNAME, .driver_name = KBUILD_MODNAME,
.owner = THIS_MODULE, .owner = THIS_MODULE,
@ -1083,6 +1089,7 @@ static struct dvb_usb_device_properties mxl111sf_props_dvbt = {
.generic_bulk_ctrl_endpoint = 0x02, .generic_bulk_ctrl_endpoint = 0x02,
.generic_bulk_ctrl_endpoint_response = 0x81, .generic_bulk_ctrl_endpoint_response = 0x81,
.probe = mxl111sf_probe,
.i2c_algo = &mxl111sf_i2c_algo, .i2c_algo = &mxl111sf_i2c_algo,
.frontend_attach = mxl111sf_frontend_attach_dvbt, .frontend_attach = mxl111sf_frontend_attach_dvbt,
.tuner_attach = mxl111sf_attach_tuner, .tuner_attach = mxl111sf_attach_tuner,
@ -1124,6 +1131,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc = {
.generic_bulk_ctrl_endpoint = 0x02, .generic_bulk_ctrl_endpoint = 0x02,
.generic_bulk_ctrl_endpoint_response = 0x81, .generic_bulk_ctrl_endpoint_response = 0x81,
.probe = mxl111sf_probe,
.i2c_algo = &mxl111sf_i2c_algo, .i2c_algo = &mxl111sf_i2c_algo,
.frontend_attach = mxl111sf_frontend_attach_atsc, .frontend_attach = mxl111sf_frontend_attach_atsc,
.tuner_attach = mxl111sf_attach_tuner, .tuner_attach = mxl111sf_attach_tuner,
@ -1165,6 +1173,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mh = {
.generic_bulk_ctrl_endpoint = 0x02, .generic_bulk_ctrl_endpoint = 0x02,
.generic_bulk_ctrl_endpoint_response = 0x81, .generic_bulk_ctrl_endpoint_response = 0x81,
.probe = mxl111sf_probe,
.i2c_algo = &mxl111sf_i2c_algo, .i2c_algo = &mxl111sf_i2c_algo,
.frontend_attach = mxl111sf_frontend_attach_mh, .frontend_attach = mxl111sf_frontend_attach_mh,
.tuner_attach = mxl111sf_attach_tuner, .tuner_attach = mxl111sf_attach_tuner,
@ -1233,6 +1242,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc_mh = {
.generic_bulk_ctrl_endpoint = 0x02, .generic_bulk_ctrl_endpoint = 0x02,
.generic_bulk_ctrl_endpoint_response = 0x81, .generic_bulk_ctrl_endpoint_response = 0x81,
.probe = mxl111sf_probe,
.i2c_algo = &mxl111sf_i2c_algo, .i2c_algo = &mxl111sf_i2c_algo,
.frontend_attach = mxl111sf_frontend_attach_atsc_mh, .frontend_attach = mxl111sf_frontend_attach_atsc_mh,
.tuner_attach = mxl111sf_attach_tuner, .tuner_attach = mxl111sf_attach_tuner,
@ -1311,6 +1321,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury = {
.generic_bulk_ctrl_endpoint = 0x02, .generic_bulk_ctrl_endpoint = 0x02,
.generic_bulk_ctrl_endpoint_response = 0x81, .generic_bulk_ctrl_endpoint_response = 0x81,
.probe = mxl111sf_probe,
.i2c_algo = &mxl111sf_i2c_algo, .i2c_algo = &mxl111sf_i2c_algo,
.frontend_attach = mxl111sf_frontend_attach_mercury, .frontend_attach = mxl111sf_frontend_attach_mercury,
.tuner_attach = mxl111sf_attach_tuner, .tuner_attach = mxl111sf_attach_tuner,
@ -1381,6 +1392,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury_mh = {
.generic_bulk_ctrl_endpoint = 0x02, .generic_bulk_ctrl_endpoint = 0x02,
.generic_bulk_ctrl_endpoint_response = 0x81, .generic_bulk_ctrl_endpoint_response = 0x81,
.probe = mxl111sf_probe,
.i2c_algo = &mxl111sf_i2c_algo, .i2c_algo = &mxl111sf_i2c_algo,
.frontend_attach = mxl111sf_frontend_attach_mercury_mh, .frontend_attach = mxl111sf_frontend_attach_mercury_mh,
.tuner_attach = mxl111sf_attach_tuner, .tuner_attach = mxl111sf_attach_tuner,