]> www.pilppa.org Git - linux-2.6-omap-h63xx.git/blobdiff - drivers/media/video/tvaudio.c
V4L/DVB (9624): CVE-2008-5033: fix OOPS on tvaudio when controlling bass/treble
[linux-2.6-omap-h63xx.git] / drivers / media / video / tvaudio.c
index 6c920bf74973ad2b9ebb7dd37507084c27ff1e32..3720f0e03a16906efd339b0eefb89b5454499abf 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * experimental driver for simple i2c audio chips.
+ * Driver for simple i2c audio chips.
  *
  * Copyright (c) 2000 Gerd Knorr
  * based on code by:
@@ -7,6 +7,10 @@
  *   Steve VanDeBogart (vandebo@uclink.berkeley.edu)
  *   Greg Alexander (galexand@acm.org)
  *
+ * Copyright(c) 2005-2008 Mauro Carvalho Chehab
+ *     - Some cleanups, code fixes, etc
+ *     - Convert it to V4L2 API
+ *
  * This code is placed under the terms of the GNU General Public License
  *
  * OPTIONS:
@@ -30,6 +34,7 @@
 
 #include <media/tvaudio.h>
 #include <media/v4l2-common.h>
+#include <media/v4l2-ioctl.h>
 #include <media/v4l2-chip-ident.h>
 #include <media/v4l2-i2c-drv-legacy.h>
 
@@ -102,14 +107,14 @@ struct CHIPDESC {
        int  inputmute;
        int  inputmask;
 };
-static struct CHIPDESC chiplist[];
 
 /* current state of the chip */
 struct CHIPSTATE {
        struct i2c_client *c;
 
-       /* index into CHIPDESC array */
-       int type;
+       /* chip-specific description - should point to
+          an entry at CHIPDESC table */
+       struct CHIPDESC *desc;
 
        /* shadow register set */
        audiocmd   shadow;
@@ -149,7 +154,7 @@ static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
 {
        unsigned char buffer[2];
 
-       if (-1 == subaddr) {
+       if (subaddr < 0) {
                v4l_dbg(1, debug, chip->c, "%s: chip_write: 0x%x\n",
                        chip->c->name, val);
                chip->shadow.bytes[1] = val;
@@ -160,6 +165,13 @@ static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
                        return -1;
                }
        } else {
+               if (subaddr + 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
+                       v4l_info(chip->c,
+                               "Tried to access a non-existent register: %d\n",
+                               subaddr);
+                       return -EINVAL;
+               }
+
                v4l_dbg(1, debug, chip->c, "%s: chip_write: reg%d=0x%x\n",
                        chip->c->name, subaddr, val);
                chip->shadow.bytes[subaddr+1] = val;
@@ -174,12 +186,20 @@ static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
        return 0;
 }
 
-static int chip_write_masked(struct CHIPSTATE *chip, int subaddr, int val, int mask)
+static int chip_write_masked(struct CHIPSTATE *chip,
+                            int subaddr, int val, int mask)
 {
        if (mask != 0) {
-               if (-1 == subaddr) {
+               if (subaddr < 0) {
                        val = (chip->shadow.bytes[1] & ~mask) | (val & mask);
                } else {
+                       if (subaddr + 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
+                               v4l_info(chip->c,
+                                       "Tried to access a non-existent register: %d\n",
+                                       subaddr);
+                               return -EINVAL;
+                       }
+
                        val = (chip->shadow.bytes[subaddr+1] & ~mask) | (val & mask);
                }
        }
@@ -225,6 +245,15 @@ static int chip_cmd(struct CHIPSTATE *chip, char *name, audiocmd *cmd)
        if (0 == cmd->count)
                return 0;
 
+       if (cmd->count + cmd->bytes[0] - 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
+               v4l_info(chip->c,
+                        "Tried to access a non-existent register range: %d to %d\n",
+                        cmd->bytes[0] + 1, cmd->bytes[0] + cmd->count - 1);
+               return -EINVAL;
+       }
+
+       /* FIXME: it seems that the shadow bytes are wrong bellow !*/
+
        /* update our shadow register set; print bytes if (debug > 0) */
        v4l_dbg(1, debug, chip->c, "%s: chip_cmd(%s): reg=%d, data:",
                chip->c->name, name,cmd->bytes[0]);
@@ -260,7 +289,7 @@ static void chip_thread_wake(unsigned long data)
 static int chip_thread(void *data)
 {
        struct CHIPSTATE *chip = data;
-       struct CHIPDESC  *desc = chiplist + chip->type;
+       struct CHIPDESC  *desc = chip->desc;
        int mode;
 
        v4l_dbg(1, debug, chip->c, "%s: thread started\n", chip->c->name);
@@ -1083,7 +1112,7 @@ static int tda8425_shift12(int val) { return (val >> 12) | 0xf0; }
 
 static int tda8425_initialize(struct CHIPSTATE *chip)
 {
-       struct CHIPDESC *desc = chiplist + chip->type;
+       struct CHIPDESC *desc = chip->desc;
        int inputmap[4] = { /* tuner    */ TDA8425_S1_CH2, /* radio  */ TDA8425_S1_CH1,
                            /* extern   */ TDA8425_S1_CH1, /* intern */ TDA8425_S1_OFF};
 
@@ -1499,7 +1528,7 @@ static int chip_probe(struct i2c_client *client, const struct i2c_device_id *id)
        /* fill required data structures */
        if (!id)
                strlcpy(client->name, desc->name, I2C_NAME_SIZE);
-       chip->type = desc-chiplist;
+       chip->desc = desc;
        chip->shadow.count = desc->registers+1;
        chip->prevmode = -1;
        chip->audmode = V4L2_TUNER_MODE_LANG1;
@@ -1586,7 +1615,7 @@ static int chip_remove(struct i2c_client *client)
 static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
                            struct v4l2_control *ctrl)
 {
-       struct CHIPDESC *desc = chiplist + chip->type;
+       struct CHIPDESC *desc = chip->desc;
 
        switch (ctrl->id) {
        case V4L2_CID_AUDIO_MUTE:
@@ -1610,13 +1639,13 @@ static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
                return 0;
        }
        case V4L2_CID_AUDIO_BASS:
-               if (desc->flags & CHIP_HAS_BASSTREBLE)
+               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                        break;
                ctrl->value = chip->bass;
                return 0;
        case V4L2_CID_AUDIO_TREBLE:
-               if (desc->flags & CHIP_HAS_BASSTREBLE)
-                       return -EINVAL;
+               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+                       break;
                ctrl->value = chip->treble;
                return 0;
        }
@@ -1626,7 +1655,7 @@ static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
 static int tvaudio_set_ctrl(struct CHIPSTATE *chip,
                            struct v4l2_control *ctrl)
 {
-       struct CHIPDESC *desc = chiplist + chip->type;
+       struct CHIPDESC *desc = chip->desc;
 
        switch (ctrl->id) {
        case V4L2_CID_AUDIO_MUTE:
@@ -1676,16 +1705,15 @@ static int tvaudio_set_ctrl(struct CHIPSTATE *chip,
                return 0;
        }
        case V4L2_CID_AUDIO_BASS:
-               if (desc->flags & CHIP_HAS_BASSTREBLE)
+               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                        break;
                chip->bass = ctrl->value;
                chip_write(chip,desc->bassreg,desc->bassfunc(chip->bass));
 
                return 0;
        case V4L2_CID_AUDIO_TREBLE:
-               if (desc->flags & CHIP_HAS_BASSTREBLE)
-                       return -EINVAL;
-
+               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+                       break;
                chip->treble = ctrl->value;
                chip_write(chip,desc->treblereg,desc->treblefunc(chip->treble));
 
@@ -1702,9 +1730,12 @@ static int chip_command(struct i2c_client *client,
                        unsigned int cmd, void *arg)
 {
        struct CHIPSTATE *chip = i2c_get_clientdata(client);
-       struct CHIPDESC  *desc = chiplist + chip->type;
+       struct CHIPDESC  *desc = chip->desc;
 
-       v4l_dbg(1, debug, chip->c, "%s: chip_command 0x%x\n", chip->c->name, cmd);
+       if (debug > 0) {
+               v4l_i2c_print_ioctl(chip->c, cmd);
+               printk("\n");
+       }
 
        switch (cmd) {
        case AUDC_SET_RADIO:
@@ -1729,7 +1760,7 @@ static int chip_command(struct i2c_client *client,
                                break;
                        case V4L2_CID_AUDIO_BASS:
                        case V4L2_CID_AUDIO_TREBLE:
-                               if (desc->flags & CHIP_HAS_BASSTREBLE)
+                               if (!(desc->flags & CHIP_HAS_BASSTREBLE))
                                        return -EINVAL;
                                break;
                        default:
@@ -1827,11 +1858,13 @@ static int chip_command(struct i2c_client *client,
        case VIDIOC_S_FREQUENCY:
                chip->mode = 0; /* automatic */
 
-               /* For chips that provide getmode, setmode and checkmode,
-                  a kthread is created to automatically to set the audio
-                  standard. In this case, start with MONO and wait 2 seconds
-                  for the decoding to stablize. Then, run kthread to change
-                  to stereo, if carrier detected.
+               /* For chips that provide getmode and setmode, and doesn't
+                  automatically follows the stereo carrier, a kthread is
+                  created to set the audio standard. In this case, when then
+                  the video channel is changed, tvaudio starts on MONO mode.
+                  After waiting for 2 seconds, the kernel thread is called,
+                  to follow whatever audio standard is pointed by the
+                  audio carrier.
                 */
                if (chip->thread) {
                        desc->setmode(chip,V4L2_TUNER_MODE_MONO);
@@ -1876,9 +1909,3 @@ static struct v4l2_i2c_driver_data v4l2_i2c_data = {
        .legacy_probe = chip_legacy_probe,
        .id_table = chip_id,
 };
-
-/*
- * Local variables:
- * c-basic-offset: 8
- * End:
- */