Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

TBS 6281/6285 broken #103

Closed
bas-t opened this issue Jun 8, 2015 · 4 comments
Closed

TBS 6281/6285 broken #103

bas-t opened this issue Jun 8, 2015 · 4 comments

Comments

@bas-t
Copy link
Contributor

bas-t commented Jun 8, 2015

Hi Luis, you don't have it in your repo yet, but with your next pull you'll get:
http://git.linuxtv.org/cgit.cgi/media_tree.git/patch/drivers/media/dvb-frontends/si2168.c?id=d2b72f6482b9a3c57f036c11786a2489dcc81176

This commit prevents TBS 6281/6285 to lock and tune.
My other adapters (DVBSky T982, cx23885,si2168,si2157) continue to work correct.
So I assume something has to be done in saa716x regarding the i2c logic.
Unfortunately, I know nothing about i2c logic. Can you fix this?
@ljalves
Copy link
Owner

ljalves commented Jun 9, 2015

Hi,

I took a quick look at the patch, but I see no reason why it should break the i2c handling code.
What behavior do you get when applying the patch?

@bas-t
Copy link
Contributor Author

bas-t commented Jun 9, 2015

Well, as I stated: no lock, no tune.
Nothing in dmesg or other logs that sheds any light on this.

@bas-t
Copy link
Contributor Author

bas-t commented Jun 15, 2015

Not sure what caused the malfunction yet, but you are right, i2c handling code is ok.
Closing.

@bas-t bas-t closed this as completed Jun 15, 2015
@bas-t
Copy link
Contributor Author

bas-t commented Jun 26, 2015

I don't know how I managed to screw up, that'll probably remain a mystery.
The good news: still going strong with TBS 6281/6285 in linux 4.1

crazycat69 pushed a commit to crazycat69/linux_media that referenced this issue Jul 17, 2022
@ebirger @borkmann
bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit…
b02d196 
… lwt hook

xmit_check_hhlen() observes the dst for getting the device hard header
length to make sure a modified packet can fit. When a helper which changes
the dst - such as bpf_skb_set_tunnel_key() - is called as part of the
xmit program the accessed dst is no longer valid.

This leads to the following splat:

 BUG: kernel NULL pointer dereference, address: 00000000000000de
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [ljalves#1] PREEMPT SMP PTI
 CPU: 0 PID: 798 Comm: ping Not tainted 5.18.0-rc2+ ljalves#103
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
 RIP: 0010:bpf_xmit+0xfb/0x17f
 Code: c6 c0 4d cd 8e 48 c7 c7 7d 33 f0 8e e8 42 09 fb ff 48 8b 45 58 48 8b 95 c8 00 00 00 48 2b 95 c0 00 00 00 48 83 e0 fe 48 8b 00 <0f> b7 80 de 00 00 00 39 c2 73 22 29 d0 b9 20 0a 00 00 31 d2 48 89
 RSP: 0018:ffffb148c0bc7b98 EFLAGS: 00010282
 RAX: 0000000000000000 RBX: 0000000000240008 RCX: 0000000000000000
 RDX: 0000000000000010 RSI: 00000000ffffffea RDI: 00000000ffffffff
 RBP: ffff922a828a4e00 R08: ffffffff8f1350e8 R09: 00000000ffffdfff
 R10: ffffffff8f055100 R11: ffffffff8f105100 R12: 0000000000000000
 R13: ffff922a828a4e00 R14: 0000000000000040 R15: 0000000000000000
 FS:  00007f414e8f0080(0000) GS:ffff922afdc00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00000000000000de CR3: 0000000002d80006 CR4: 0000000000370ef0
 Call Trace:
  <TASK>
  lwtunnel_xmit.cold+0x71/0xc8
  ip_finish_output2+0x279/0x520
  ? __ip_finish_output.part.0+0x21/0x130

Fix by fetching the device hard header length before running the BPF code.

Fixes: 3a0af8f ("bpf: BPF for lightweight tunnel infrastructure")
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20220420165219.1755407-1-eyal.birger@gmail.com
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@bas-t @ljalves