linux-stable/drivers
Arvo Järve 225ee0ca19 V4L/DVB (13989): [TDA8261] Fix TDA8261 I2C read bug
The TDA8261 driver would crash when reading more than a byte as described.

ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff
[ 8.430350] KNC1-2: MAC addr = 00:09:d6:65:2d:91
[ 8.610008] saa7146 (1) saa7146_i2c_writeout [irq]: timed out waiting for end of xfer
[ 8.734457] stb0899_attach: Attaching STB0899
[ 8.768481] tda8261_attach: Attaching TDA8261 8PSK/QPSK tuner
[ 8.768485] DVB: registering adapter 2 frontend 0 (STB0899 Multistandard)...

Once I launch scan-s2:
scan-s2 -vvvv -a 2 -s 1 -l UNIVERSAL /usr/share/dvb/dvb-s/Hotbird-13.0E

I see the following via dmesg:

[ 435.040017] saa7146 (1) saa7146_i2c_writeout [irq]: timed out waiting for end of xfer
[ 435.778648] tda8261_get_bandwidth: Bandwidth=40000000
[ 435.781781] tda8261_get_bandwidth: Bandwidth=40000000
[ 435.783311] tda8261_set_state: Step size=1, Divider=1000, PG=0x793 (1939)
[ 435.783512] tda8261_set_state: Waiting to Phase LOCK
[ 435.810134] tda8261_get_status: Tuner Phase Locked
[ 435.810137] tda8261_set_state: Tuner Phase locked: status=1
[ 435.810139] tda8261_set_frequency: Frequency=1939000
[ 435.810141] tda8261_get_frequency: Frequency=7574
[ 435.830008] tda8261_get_bandwidth: Bandwidth=40000000
[ 436.402814] tda8261_get_bandwidth: Bandwidth=40000000
[ 436.405946] tda8261_get_bandwidth: Bandwidth=40000000
[ 436.407458] general protection fault: 0000 [#1] SMP
[ 436.407527] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
[ 436.407560] CPU 0
[ 436.407601] Modules linked in: tda8261 stb0899 dvb_pll mt352 lnbp21 budget_av saa7146_vv snd_hda_codec_realtek videodev stv0299 v4l1_compat coretemp snd_hda_intel v4l2_compat_ioctl32 i915 videobuf_dma_sg b2c2_flexcop_pci snd_hda_codec budget_ci videobuf_core b2c2_flexcop ir_common w83627ehf drm snd_hwdep cx24123 budget_core hwmon_vid snd_pcm cx24113 dvb_core iptable_filter snd_timer i2c_algo_bit ip_tables saa7146 s5h1420 snd ttpci_eeprom soundcore intel_agp video serio_raw pcspkr lp snd_page_alloc x_tables output parport pata_it8213 e1000e
[ 436.408757] Pid: 1410, comm: kdvb-ad-2-fe-0 Not tainted 2.6.31-14-server #48-Ubuntu C2SBC-Q
[ 436.408818] RIP: 0010:[<ffffffffa00241a1>] [<ffffffffa00241a1>] tda8261_set_state+0x51/0x250 [tda8261]
[ 436.408903] RSP: 0018:ffff88013649bc70 EFLAGS: 00010283
[ 436.408945] RAX: 00000000000f1748 RBX: ffff880138870680 RCX: 0000000000000018
[ 436.408990] RDX: ffff88013649bcd0 RSI: 0000000000000001 RDI: ffff880135273010
[ 436.409035] RBP: ffff88013649bcc0 R08: 0000000000000001 R09: 0000000000000002
[ 436.409081] R10: ffff88013649bc40 R11: 0000000055555556 R12: 00000000001d9638
[ 436.409126] R13: 38ffffffa0261568 R14: 0000000000000000 R15: ffff880135273010
[ 436.409172] FS: 0000000000000000(0000) GS:ffff880028022000(0000) knlGS:0000000000000000
[ 436.409232] CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
[ 436.409274] CR2: 00007fff925e4cd8 CR3: 000000013642a000 CR4: 00000000000406f0
[ 436.409320] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 436.409365] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 436.409411] Process kdvb-ad-2-fe-0 (pid: 1410, threadinfo ffff88013649a000, task ffff88013658ad60)
[ 436.409473] Stack:
[ 436.409508] ffff880136ee2af1 00000000bcd5d166 ffff000200000068 0000000035273000
[ 436.409608] <0> 0000000000000001 ffff880135273000 ffffffffa0265260 00003473bc000000
[ 436.409758] <0> 0000000000000000 ffff88013a4e05e0 ffff88013649bd00 ffffffffa025f133
[ 436.409938] Call Trace:
[ 436.409978] [<ffffffffa025f133>] tda8261_set_frequency+0x23/0x70 [budget_av]
[ 436.410027] [<ffffffffa026ed09>] ? stb0899_i2c_gate_ctrl+0x49/0xf0 [stb0899]
[ 436.410074] [<ffffffffa026e259>] ? stb0899_write_reg+0x19/0x20 [stb0899]
[ 436.410121] [<ffffffffa02716e2>] stb0899_dvbs_algo+0x3a2/0x13c8 [stb0899]
[ 436.410170] [<ffffffff813cdd0d>] ? i2c_transfer+0xbd/0x100
[ 436.410215] [<ffffffffa026e13c>] ? stb0899_write_regs+0xac/0x1b0 [stb0899]
[ 436.410262] [<ffffffffa026f239>] stb0899_search+0x489/0x750 [stb0899]
[ 436.410308] [<ffffffff8107d153>] ? down_interruptible+0x33/0x60
[ 436.410360] [<ffffffffa00c34ec>] dvb_frontend_thread+0x57c/0x720 [dvb_core]
[ 436.410407] [<ffffffff81078620>] ? autoremove_wake_function+0x0/0x40
[ 436.410457] [<ffffffffa00c2f70>] ? dvb_frontend_thread+0x0/0x720 [dvb_core]
[ 436.410504] [<ffffffff81078236>] kthread+0xa6/0xb0
[ 436.410547] [<ffffffff810130aa>] child_rip+0xa/0x20
[ 436.410589] [<ffffffff81078190>] ? kthread+0x0/0xb0
[ 436.410631] [<ffffffff810130a0>] ? child_rip+0x0/0x20
[ 436.410672] Code: 00 03 00 00 4c 8b 6b 10 c7 45 cc 00 00 00 00 0f 84 e8 01 00 00 44 8b 22 41 8d 84 24 10 81 f1 ff 3d 80 4f 12 00 0f 87 af 01 00 00 <41> 8b 75 04 31 d2 48 c7 c7 d8 46 02 a0 89 f0 8b 0c 85 f0 45 02
[ 436.411950] RIP [<ffffffffa00241a1>] tda8261_set_state+0x51/0x250 [tda8261]
[ 436.412015] RSP <ffff88013649bc70>
[ 436.412064] ---[ end trace c1d7ae4d9e05c51b ]---

Signed-off-by: Arvo Järve <arvo@softshark.ee>
Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-02-26 15:10:38 -03:00
..
accessibility
acpi Merge branch 'pcc' into release 2010-02-23 00:39:00 -05:00
amba
ata [libata] Call flush_dcache_page after PIO data transfers in libata-sff.c 2010-02-04 01:04:50 -05:00
atm
auxdisplay
base class: Free the class private data in class_release 2010-02-16 15:43:00 -08:00
block cciss: Make cciss_seq_show handle holes in the h->drv[] array 2010-02-05 13:15:36 +01:00
bluetooth Bluetooth: Fix memory leak in Marvell BT-over-SDIO driver 2010-02-03 19:08:30 -08:00
cdrom
char Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip 2010-02-11 14:01:10 -08:00
clocksource geode-mfgpt: restore previous behavior for selecting IRQ 2010-02-22 19:50:34 -08:00
connector connector: Delete buggy notification code. 2010-02-02 15:58:48 -08:00
cpufreq [CPUFREQ] Fix ondemand to not request targets outside policy limits 2010-01-13 10:55:16 -05:00
cpuidle drivers/cpuidle/governors/menu.c: fix undefined reference to `__udivdi3' 2010-01-11 09:34:07 -08:00
crypto crypto: padlock-sha - Add import/export support 2010-02-02 06:50:25 +11:00
dca
dio
dma drivers/dma: Correct NULL test 2010-02-10 12:07:28 -07:00
edac Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp 2010-02-11 14:07:13 -08:00
eisa
firewire firewire: ohci: retransmit isochronous transmit packets on cycle loss 2010-02-14 15:10:41 +01:00
firmware
gpio gpio: adp5588-gpio: new driver for ADP5588 GPIO expanders 2010-01-11 09:34:07 -08:00
gpu Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 2010-02-23 18:13:34 -08:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2010-01-13 16:10:13 -08:00
hwmon hwmon: (w83781d) Request I/O ports individually for probing 2010-02-05 19:58:36 +01:00
i2c i2c-tiny-usb: Fix on big-endian systems 2010-02-05 17:48:13 +01:00
ide
idle
ieee1394
ieee802154
infiniband Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband 2010-02-11 14:01:25 -08:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2010-02-22 08:48:06 -08:00
isdn Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2010-01-12 20:53:29 -08:00
leds
lguest
macintosh powerpc/macintosh: Make Open Firmware device id constant 2010-01-15 13:26:04 +11:00
mca
md dm: sysfs revert add empty release function to avoid debug warning 2010-02-16 18:43:04 +00:00
media V4L/DVB (13989): [TDA8261] Fix TDA8261 I2C read bug 2010-02-26 15:10:38 -03:00
memstick
message [SCSI] mptfusion : mptscsih_abort return value should be SUCCESS instead of value 0. 2010-02-08 13:40:17 -06:00
mfd mfd: Fix asic3 build 2010-01-29 21:03:09 +01:00
misc
mmc mmc_test: block addressed cards 2010-02-11 13:59:42 -08:00
mtd Merge branch 'for-linus' of git://git.infradead.org/ubi-2.6 2010-01-28 12:57:50 -08:00
net Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2010-02-23 01:27:05 -08:00
nubus
of
oprofile
parisc
parport
pci Merge branches 'bugzilla-14886', 'bugzilla-15000', 'bugzilla-15040', 'bugzilla-15108', 'pdc', 'hotplug-null-ref' and 'thinkpad' into release 2010-02-18 03:51:04 -05:00
pcmcia
platform acer-wmi: Respect current backlight level when loading 2010-02-19 00:19:26 -05:00
pnp
power wm97xx_battery: Handle missing platform data gracefully 2010-01-29 17:00:18 +03:00
pps
ps3
rapidio
regulator regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage() 2010-02-12 11:39:49 +00:00
rtc rtc-fm3130: add missing braces 2010-02-02 18:11:21 -08:00
s390 Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 2010-02-11 14:05:55 -08:00
sbus
scsi Merge master.kernel.org:/home/rmk/linux-2.6-arm 2010-02-20 16:55:05 -08:00
serial serial: 8250: add serial transmitter fully empty test 2010-02-16 15:55:51 -08:00
sfi
sh
sn
spi spi: spi_sh_msiof: Fixed data sampling on the correct edge 2010-02-02 11:29:15 +09:00
ssb ssb: Fix CONFIG_SSB_SDIOHOST typo 2010-02-03 16:55:20 -05:00
staging Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 2010-02-01 10:46:49 -08:00
tc
telephony
thermal
uio
usb USB: gadget: fix EEM gadget CRC usage 2010-02-16 15:11:10 -08:00
uwb
video efifb: fix framebuffer handoff 2010-02-22 19:50:34 -08:00
virtio virtio: fix section mismatch warnings 2010-01-16 12:15:39 -08:00
vlynq
w1
watchdog [WATCHDOG] bfin: fix max timeout calculation 2010-02-21 19:16:30 +00:00
xen xen: fix hang on suspend. 2010-01-13 10:01:35 +00:00
zorro
Kconfig
Makefile