Skip to content

Commit 354dd39

Browse files
committed
[PATCH] saa7164: Bug - Double fetch PCIe access condition
Avoid a double fetch by reusing the values from the prior transfer. Originally reported via https://bugzilla.kernel.org/show_bug.cgi?id=195559 Thanks to Pengfei Wang <wpengfeinudt@gmail.com> for reporting. Signed-off-by: Steven Toth <stoth@kernellabs.com>
1 parent 37404f9 commit 354dd39

File tree

1 file changed

+1
-12
lines changed

1 file changed

+1
-12
lines changed

Diff for: drivers/media/pci/saa7164/saa7164-bus.c

+1-12
Original file line numberDiff line numberDiff line change
@@ -389,11 +389,11 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
389389
msg_tmp.size = le16_to_cpu((__force __le16)msg_tmp.size);
390390
msg_tmp.command = le32_to_cpu((__force __le32)msg_tmp.command);
391391
msg_tmp.controlselector = le16_to_cpu((__force __le16)msg_tmp.controlselector);
392+
memcpy(msg, &msg_tmp, sizeof(*msg));
392393

393394
/* No need to update the read positions, because this was a peek */
394395
/* If the caller specifically want to peek, return */
395396
if (peekonly) {
396-
memcpy(msg, &msg_tmp, sizeof(*msg));
397397
goto peekout;
398398
}
399399

@@ -438,21 +438,15 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
438438
space_rem = bus->m_dwSizeGetRing - curr_grp;
439439

440440
if (space_rem < sizeof(*msg)) {
441-
/* msg wraps around the ring */
442-
memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, space_rem);
443-
memcpy_fromio((u8 *)msg + space_rem, bus->m_pdwGetRing,
444-
sizeof(*msg) - space_rem);
445441
if (buf)
446442
memcpy_fromio(buf, bus->m_pdwGetRing + sizeof(*msg) -
447443
space_rem, buf_size);
448444

449445
} else if (space_rem == sizeof(*msg)) {
450-
memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
451446
if (buf)
452447
memcpy_fromio(buf, bus->m_pdwGetRing, buf_size);
453448
} else {
454449
/* Additional data wraps around the ring */
455-
memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
456450
if (buf) {
457451
memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp +
458452
sizeof(*msg), space_rem - sizeof(*msg));
@@ -465,15 +459,10 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
465459

466460
} else {
467461
/* No wrapping */
468-
memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
469462
if (buf)
470463
memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp + sizeof(*msg),
471464
buf_size);
472465
}
473-
/* Convert from little endian to CPU */
474-
msg->size = le16_to_cpu((__force __le16)msg->size);
475-
msg->command = le32_to_cpu((__force __le32)msg->command);
476-
msg->controlselector = le16_to_cpu((__force __le16)msg->controlselector);
477466

478467
/* Update the read positions, adjusting the ring */
479468
saa7164_writel(bus->m_dwGetReadPos, new_grp);

0 commit comments

Comments
 (0)