linux/drivers/media
YongSu Yoo 747a121914 media: dvb_ca_en50221: fix a size write bug
[ Upstream commit a4315e5be7 ]

The function of "dvb_ca_en50221_write_data" at source/drivers/media
/dvb-core/dvb_ca_en50221.c is used for two cases.
The first case is for writing APDU data in the function of
"dvb_ca_en50221_io_write" at source/drivers/media/dvb-core/
dvb_ca_en50221.c.
The second case is for writing the host link buf size on the
Command Register in the function of "dvb_ca_en50221_link_init"
at source/drivers/media/dvb-core/dvb_ca_en50221.c.
In the second case, there exists a bug like following.
In the function of the "dvb_ca_en50221_link_init",
after a TV host calculates the host link buf_size,
the TV host writes the calculated host link buf_size on the
Size Register.
Accroding to the en50221 Spec (the page 60 of
https://dvb.org/wp-content/uploads/2020/02/En50221.V1.pdf),
before this writing operation, the "SW(CMDREG_SW)" flag in the
Command Register should be set. We can see this setting operation
in the function of the "dvb_ca_en50221_link_init" like below.
...
	if ((ret = ca->pub->write_cam_control(ca->pub, slot,
CTRLIF_COMMAND, IRQEN | CMDREG_SW)) != 0)
		return ret;
...
But, after that, the real writing operation is implemented using
the function of the "dvb_ca_en50221_write_data" in the function of
"dvb_ca_en50221_link_init", and the "dvb_ca_en50221_write_data"
includes the function of "ca->pub->write_cam_control",
and the function of the "ca->pub->write_cam_control" in the
function of the "dvb_ca_en50221_wrte_data" does not include
"CMDREG_SW" flag like below.
...
	if ((status = ca->pub->write_cam_control(ca->pub, slot,
CTRLIF_COMMAND, IRQEN | CMDREG_HC)) != 0)
...
In the above source code, we can see only the "IRQEN | CMDREG_HC",
but we cannot see the "CMDREG_SW".
The "CMDREG_SW" flag which was set in the function of the
"dvb_ca_en50221_link_init" was rollbacked by the follwoing function
of the "dvb_ca_en50221_write_data".
This is a bug. and this bug causes that the calculated host link buf_size
is not properly written in the CI module.
Through this patch, we fix this bug.

Link: https://lore.kernel.org/linux-media/20220818125027.1131-1-yongsuyoo0215@gmail.com
Signed-off-by: YongSu Yoo <yongsuyoo0215@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-09 10:32:23 +02:00
..
cec media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE 2022-11-10 18:15:33 +01:00
common media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() 2022-12-14 11:37:19 +01:00
dvb-core media: dvb_ca_en50221: fix a size write bug 2023-06-09 10:32:23 +02:00
dvb-frontends media: stv0288: use explicitly signed char 2023-01-12 11:58:49 +01:00
firewire media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() 2021-11-06 14:13:30 +01:00
i2c media: max9286: Free control handler 2023-05-11 23:00:22 +09:00
mc media: mc-device.c: use DEVICE_ATTR_RO() helper macro 2021-08-04 14:43:50 +02:00
mmc
pci media: netup_unidvb: fix irq init by register it at the end of probe 2023-06-09 10:32:23 +02:00
platform media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE 2023-06-09 10:32:20 +02:00
radio media: radio-shark: Add endpoint checks 2023-05-30 13:55:31 +01:00
rc media: rc: gpio-ir-recv: Fix support for wake-up 2023-05-11 23:00:24 +09:00
spi media: cxd2880-spi: Fix a null pointer dereference on error handling path 2021-11-18 19:16:27 +01:00
test-drivers media: vimc: Fix wrong function called when vimc_init() fails 2022-12-31 13:14:12 +01:00
tuners media: msi001: fix possible null-ptr-deref in msi001_probe() 2022-01-27 11:03:36 +01:00
usb media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address 2023-06-09 10:32:23 +02:00
v4l2-core media: v4l2-jpeg: ignore the unknown APP14 marker 2023-03-10 09:39:45 +01:00
Kconfig media: correct MEDIA_TEST_SUPPORT help text 2022-01-27 11:05:20 +01:00
Makefile