Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bd1f976c authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab
Browse files

[media] dib0700: be sure that dib0700_ctrl_rd() users can do DMA 



dib0700_ctrl_rd() takes a RX and a TX pointer. Be sure that
both will point to a memory allocated via kmalloc().

Reviewed-by: default avatarPatrick Boettcher <patrick.boettcher@posteo.de>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 17ce039b

drivers/media/usb/dvb-usb/dib0700_core.c

+3 −1
Original line number Diff line number Diff line
@@ -292,13 +292,15 @@ static int dib0700_i2c_xfer_legacy(struct i2c_adapter *adap, 


			/* special thing in the current firmware: when length is zero the read-failed */

			len = dib0700_ctrl_rd(d, st->buf, msg[i].len + 2,

					msg[i+1].buf, msg[i+1].len);

					      st->buf, msg[i + 1].len);

			if (len <= 0) {

				deb_info("I2C read failed on address 0x%02x\n",

						msg[i].addr);

				break;

			}



			memcpy(msg[i + 1].buf, st->buf, msg[i + 1].len);



			msg[i+1].len = len;



			i++;

drivers/media/usb/dvb-usb/dib0700_devices.c

+13 −12
Original line number Diff line number Diff line
@@ -508,8 +508,6 @@ static int stk7700ph_tuner_attach(struct dvb_usb_adapter *adap) 


#define DEFAULT_RC_INTERVAL 50



static u8 rc_request[] = { REQUEST_POLL_RC, 0 };



/*

 * This function is used only when firmware is < 1.20 version. Newer

 * firmwares use bulk mode, with functions implemented at dib0700_core,
@@ -517,7 +515,6 @@ static u8 rc_request[] = { REQUEST_POLL_RC, 0 }; 
 */

static int dib0700_rc_query_old_firmware(struct dvb_usb_device *d)

{

	u8 key[4];

	enum rc_type protocol;

	u32 scancode;

	u8 toggle;
@@ -532,39 +529,43 @@ static int dib0700_rc_query_old_firmware(struct dvb_usb_device *d) 
		return 0;

	}



	i = dib0700_ctrl_rd(d, rc_request, 2, key, 4);

	st->buf[0] = REQUEST_POLL_RC;

	st->buf[1] = 0;



	i = dib0700_ctrl_rd(d, st->buf, 2, st->buf, 4);

	if (i <= 0) {

		err("RC Query Failed");

		return -1;

		return -EIO;

	}



	/* losing half of KEY_0 events from Philipps rc5 remotes.. */

	if (key[0] == 0 && key[1] == 0 && key[2] == 0 && key[3] == 0)

	if (st->buf[0] == 0 && st->buf[1] == 0

	    && st->buf[2] == 0 && st->buf[3] == 0)

		return 0;



	/* info("%d: %2X %2X %2X %2X",dvb_usb_dib0700_ir_proto,(int)key[3-2],(int)key[3-3],(int)key[3-1],(int)key[3]);  */

	/* info("%d: %2X %2X %2X %2X",dvb_usb_dib0700_ir_proto,(int)st->buf[3 - 2],(int)st->buf[3 - 3],(int)st->buf[3 - 1],(int)st->buf[3]);  */



	dib0700_rc_setup(d, NULL); /* reset ir sensor data to prevent false events */



	switch (d->props.rc.core.protocol) {

	case RC_BIT_NEC:

		/* NEC protocol sends repeat code as 0 0 0 FF */

		if ((key[3-2] == 0x00) && (key[3-3] == 0x00) &&

		    (key[3] == 0xff)) {

		if ((st->buf[3 - 2] == 0x00) && (st->buf[3 - 3] == 0x00) &&

		    (st->buf[3] == 0xff)) {

			rc_repeat(d->rc_dev);

			return 0;

		}



		protocol = RC_TYPE_NEC;

		scancode = RC_SCANCODE_NEC(key[3-2], key[3-3]);

		scancode = RC_SCANCODE_NEC(st->buf[3 - 2], st->buf[3 - 3]);

		toggle = 0;

		break;



	default:

		/* RC-5 protocol changes toggle bit on new keypress */

		protocol = RC_TYPE_RC5;

		scancode = RC_SCANCODE_RC5(key[3-2], key[3-3]);

		toggle = key[3-1];

		scancode = RC_SCANCODE_RC5(st->buf[3 - 2], st->buf[3 - 3]);

		toggle = st->buf[3 - 1];

		break;

	}