Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96f182c9 authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Greg Kroah-Hartman
Browse files

media: mxl111sf: change mutex_init() location 



commit 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f upstream.

Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized
mutex. The problem was in wrong mutex_init() location.

Previous mutex_init(&state->msg_lock) call was in ->init() function, but
dvb_usbv2_init() has this order of calls:

	dvb_usbv2_init()
	  dvb_usbv2_adapter_init()
	    dvb_usbv2_adapter_frontend_init()
	      props->frontend_attach()

	  props->init()

Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach()
internally we need to initialize state->msg_lock before
frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_*
devices, which will simply initiaize mutex.

Reported-and-tested-by: default avatar <syzbot+5ca0bf339f13c4243001@syzkaller.appspotmail.com>

Fixes: 85722118 ("[media] mxl111sf: convert to new DVB USB")
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 095ad396

drivers/media/usb/dvb-usb-v2/mxl111sf.c

+14 −2
Original line number Diff line number Diff line
@@ -931,8 +931,6 @@ static int mxl111sf_init(struct dvb_usb_device *d) 
		  .len = sizeof(eeprom), .buf = eeprom },

	};



	mutex_init(&state->msg_lock);



	ret = get_chip_info(state);

	if (mxl_fail(ret))

		pr_err("failed to get chip info during probe");
@@ -1074,6 +1072,14 @@ static int mxl111sf_get_stream_config_dvbt(struct dvb_frontend *fe, 
	return 0;

}



static int mxl111sf_probe(struct dvb_usb_device *dev)

{

	struct mxl111sf_state *state = d_to_priv(dev);



	mutex_init(&state->msg_lock);

	return 0;

}



static struct dvb_usb_device_properties mxl111sf_props_dvbt = {

	.driver_name = KBUILD_MODNAME,

	.owner = THIS_MODULE,
@@ -1083,6 +1089,7 @@ static struct dvb_usb_device_properties mxl111sf_props_dvbt = { 
	.generic_bulk_ctrl_endpoint = 0x02,

	.generic_bulk_ctrl_endpoint_response = 0x81,



	.probe             = mxl111sf_probe,

	.i2c_algo          = &mxl111sf_i2c_algo,

	.frontend_attach   = mxl111sf_frontend_attach_dvbt,

	.tuner_attach      = mxl111sf_attach_tuner,
@@ -1124,6 +1131,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc = { 
	.generic_bulk_ctrl_endpoint = 0x02,

	.generic_bulk_ctrl_endpoint_response = 0x81,



	.probe             = mxl111sf_probe,

	.i2c_algo          = &mxl111sf_i2c_algo,

	.frontend_attach   = mxl111sf_frontend_attach_atsc,

	.tuner_attach      = mxl111sf_attach_tuner,
@@ -1165,6 +1173,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mh = { 
	.generic_bulk_ctrl_endpoint = 0x02,

	.generic_bulk_ctrl_endpoint_response = 0x81,



	.probe             = mxl111sf_probe,

	.i2c_algo          = &mxl111sf_i2c_algo,

	.frontend_attach   = mxl111sf_frontend_attach_mh,

	.tuner_attach      = mxl111sf_attach_tuner,
@@ -1233,6 +1242,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc_mh = { 
	.generic_bulk_ctrl_endpoint = 0x02,

	.generic_bulk_ctrl_endpoint_response = 0x81,



	.probe             = mxl111sf_probe,

	.i2c_algo          = &mxl111sf_i2c_algo,

	.frontend_attach   = mxl111sf_frontend_attach_atsc_mh,

	.tuner_attach      = mxl111sf_attach_tuner,
@@ -1311,6 +1321,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury = { 
	.generic_bulk_ctrl_endpoint = 0x02,

	.generic_bulk_ctrl_endpoint_response = 0x81,



	.probe             = mxl111sf_probe,

	.i2c_algo          = &mxl111sf_i2c_algo,

	.frontend_attach   = mxl111sf_frontend_attach_mercury,

	.tuner_attach      = mxl111sf_attach_tuner,
@@ -1381,6 +1392,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury_mh = { 
	.generic_bulk_ctrl_endpoint = 0x02,

	.generic_bulk_ctrl_endpoint_response = 0x81,



	.probe             = mxl111sf_probe,

	.i2c_algo          = &mxl111sf_i2c_algo,

	.frontend_attach   = mxl111sf_frontend_attach_mercury_mh,

	.tuner_attach      = mxl111sf_attach_tuner,