mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-13 14:14:37 +00:00
media: mxl111sf: change mutex_init() location
commit44870a9e7a
upstream. Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized mutex. The problem was in wrong mutex_init() location. Previous mutex_init(&state->msg_lock) call was in ->init() function, but dvb_usbv2_init() has this order of calls: dvb_usbv2_init() dvb_usbv2_adapter_init() dvb_usbv2_adapter_frontend_init() props->frontend_attach() props->init() Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach() internally we need to initialize state->msg_lock before frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_* devices, which will simply initiaize mutex. Reported-and-tested-by: syzbot+5ca0bf339f13c4243001@syzkaller.appspotmail.com Fixes:8572211842
("[media] mxl111sf: convert to new DVB USB") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
095ad3969b
commit
96f182c9f4
1 changed files with 14 additions and 2 deletions
|
@ -931,8 +931,6 @@ static int mxl111sf_init(struct dvb_usb_device *d)
|
|||
.len = sizeof(eeprom), .buf = eeprom },
|
||||
};
|
||||
|
||||
mutex_init(&state->msg_lock);
|
||||
|
||||
ret = get_chip_info(state);
|
||||
if (mxl_fail(ret))
|
||||
pr_err("failed to get chip info during probe");
|
||||
|
@ -1074,6 +1072,14 @@ static int mxl111sf_get_stream_config_dvbt(struct dvb_frontend *fe,
|
|||
return 0;
|
||||
}
|
||||
|
||||
static int mxl111sf_probe(struct dvb_usb_device *dev)
|
||||
{
|
||||
struct mxl111sf_state *state = d_to_priv(dev);
|
||||
|
||||
mutex_init(&state->msg_lock);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static struct dvb_usb_device_properties mxl111sf_props_dvbt = {
|
||||
.driver_name = KBUILD_MODNAME,
|
||||
.owner = THIS_MODULE,
|
||||
|
@ -1083,6 +1089,7 @@ static struct dvb_usb_device_properties mxl111sf_props_dvbt = {
|
|||
.generic_bulk_ctrl_endpoint = 0x02,
|
||||
.generic_bulk_ctrl_endpoint_response = 0x81,
|
||||
|
||||
.probe = mxl111sf_probe,
|
||||
.i2c_algo = &mxl111sf_i2c_algo,
|
||||
.frontend_attach = mxl111sf_frontend_attach_dvbt,
|
||||
.tuner_attach = mxl111sf_attach_tuner,
|
||||
|
@ -1124,6 +1131,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc = {
|
|||
.generic_bulk_ctrl_endpoint = 0x02,
|
||||
.generic_bulk_ctrl_endpoint_response = 0x81,
|
||||
|
||||
.probe = mxl111sf_probe,
|
||||
.i2c_algo = &mxl111sf_i2c_algo,
|
||||
.frontend_attach = mxl111sf_frontend_attach_atsc,
|
||||
.tuner_attach = mxl111sf_attach_tuner,
|
||||
|
@ -1165,6 +1173,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mh = {
|
|||
.generic_bulk_ctrl_endpoint = 0x02,
|
||||
.generic_bulk_ctrl_endpoint_response = 0x81,
|
||||
|
||||
.probe = mxl111sf_probe,
|
||||
.i2c_algo = &mxl111sf_i2c_algo,
|
||||
.frontend_attach = mxl111sf_frontend_attach_mh,
|
||||
.tuner_attach = mxl111sf_attach_tuner,
|
||||
|
@ -1233,6 +1242,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc_mh = {
|
|||
.generic_bulk_ctrl_endpoint = 0x02,
|
||||
.generic_bulk_ctrl_endpoint_response = 0x81,
|
||||
|
||||
.probe = mxl111sf_probe,
|
||||
.i2c_algo = &mxl111sf_i2c_algo,
|
||||
.frontend_attach = mxl111sf_frontend_attach_atsc_mh,
|
||||
.tuner_attach = mxl111sf_attach_tuner,
|
||||
|
@ -1311,6 +1321,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury = {
|
|||
.generic_bulk_ctrl_endpoint = 0x02,
|
||||
.generic_bulk_ctrl_endpoint_response = 0x81,
|
||||
|
||||
.probe = mxl111sf_probe,
|
||||
.i2c_algo = &mxl111sf_i2c_algo,
|
||||
.frontend_attach = mxl111sf_frontend_attach_mercury,
|
||||
.tuner_attach = mxl111sf_attach_tuner,
|
||||
|
@ -1381,6 +1392,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury_mh = {
|
|||
.generic_bulk_ctrl_endpoint = 0x02,
|
||||
.generic_bulk_ctrl_endpoint_response = 0x81,
|
||||
|
||||
.probe = mxl111sf_probe,
|
||||
.i2c_algo = &mxl111sf_i2c_algo,
|
||||
.frontend_attach = mxl111sf_frontend_attach_mercury_mh,
|
||||
.tuner_attach = mxl111sf_attach_tuner,
|
||||
|
|
Loading…
Reference in a new issue