Fix for some DMA on stack with DVB devices (rhbz 1417829)

Enable CONFIG_SENSORS_JC42 (rhbz 1417454)

4 files changed, 158 insertions, 1 deletions

diff --git a/1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch b/1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch
new file mode 100644
index 000000000..a3dec80d2
--- /dev/null
+++ b/1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch
@@ -0,0 +1,63 @@
+From patchwork Sun Feb  5 14:57:59 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: [1/2,media] cxusb: Use a dma capable buffer also for reading
+From: =?utf-8?q?Stefan_Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
+X-Patchwork-Id: 39207
+Message-Id: <b638428812af41e080ccfc7cf7ad6963@rwthex-w2-b.rwth-ad.de>
+To: <linux-media@vger.kernel.org>
+Cc: <linux-kernel@vger.kernel.org>, Mauro Carvalho Chehab <mchehab@kernel.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ =?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
+Date: Sun, 5 Feb 2017 15:57:59 +0100
+
+Commit 17ce039b4e54 ("[media] cxusb: don't do DMA on stack")
+added a kmalloc'ed bounce buffer for writes, but missed to do the same
+for reads. As the read only happens after the write is finished, we can
+reuse the same buffer.
+
+As dvb_usb_generic_rw handles a read length of 0 by itself, avoid calling
+it using the dvb_usb_generic_read wrapper function.
+
+Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+---
+ drivers/media/usb/dvb-usb/cxusb.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
+index 9b8c82d94b3f..8f28a63597bd 100644
+--- a/drivers/media/usb/dvb-usb/cxusb.c
++++ b/drivers/media/usb/dvb-usb/cxusb.c
+@@ -59,23 +59,24 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
+ 			  u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
+ {
+ 	struct cxusb_state *st = d->priv;
+-	int ret, wo;
++	int ret;
+ 
+ 	if (1 + wlen > MAX_XFER_SIZE) {
+ 		warn("i2c wr: len=%d is too big!\n", wlen);
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+-	wo = (rbuf == NULL || rlen == 0); /* write-only */
++	if (rlen > MAX_XFER_SIZE) {
++		warn("i2c rd: len=%d is too big!\n", rlen);
++		return -EOPNOTSUPP;
++	}
+ 
+ 	mutex_lock(&d->data_mutex);
+ 	st->data[0] = cmd;
+ 	memcpy(&st->data[1], wbuf, wlen);
+-	if (wo)
+-		ret = dvb_usb_generic_write(d, st->data, 1 + wlen);
+-	else
+-		ret = dvb_usb_generic_rw(d, st->data, 1 + wlen,
+-					 rbuf, rlen, 0);
++	ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, st->data, rlen, 0);
++	if (!ret && rbuf && rlen)
++		memcpy(rbuf, st->data, rlen);
+ 
+ 	mutex_unlock(&d->data_mutex);
+ 	return ret;
diff --git a/2-2-media-dvb-usb-firmware-don-t-do-DMA-on-stack.patch b/2-2-media-dvb-usb-firmware-don-t-do-DMA-on-stack.patch
new file mode 100644
index 000000000..7f3c1e10a
--- /dev/null
+++ b/2-2-media-dvb-usb-firmware-don-t-do-DMA-on-stack.patch
@@ -0,0 +1,86 @@
+From patchwork Sun Feb  5 14:58:00 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: [2/2,media] dvb-usb-firmware: don't do DMA on stack
+From: =?utf-8?q?Stefan_Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
+X-Patchwork-Id: 39206
+Message-Id: <cfae2a63a36641bcab2ec298b21b5b06@rwthex-w2-b.rwth-ad.de>
+To: <linux-media@vger.kernel.org>
+Cc: <linux-kernel@vger.kernel.org>, Mauro Carvalho Chehab <mchehab@kernel.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ =?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
+Date: Sun, 5 Feb 2017 15:58:00 +0100
+
+The USB control messages require DMA to work. We cannot pass
+a stack-allocated buffer, as it is not warranted that the
+stack would be into a DMA enabled area.
+
+Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+---
+ drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 30 ++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+index dd048a7c461c..189b6725edd0 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
++++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+@@ -35,41 +35,45 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
+ 
+ int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
+ {
+-	struct hexline hx;
+-	u8 reset;
+-	int ret,pos=0;
++	u8 *buf = kmalloc(sizeof(struct hexline), GFP_KERNEL);
++	struct hexline *hx = (struct hexline *)buf;
++	int ret, pos = 0;
++	u16 cpu_cs_register = cypress[type].cpu_cs_register;
+ 
+ 	/* stop the CPU */
+-	reset = 1;
+-	if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
++	buf[0] = 1;
++	if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
+ 		err("could not stop the USB controller CPU.");
+ 
+-	while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) {
+-		deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk);
+-		ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len);
++	while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
++		deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",
++		       hx->addr, hx->len, hx->chk);
++		ret = usb_cypress_writemem(udev, hx->addr, hx->data, hx->len);
+ 
+-		if (ret != hx.len) {
++		if (ret != hx->len) {
+ 			err("error while transferring firmware "
+ 				"(transferred size: %d, block size: %d)",
+-				ret,hx.len);
++				ret, hx->len);
+ 			ret = -EINVAL;
+ 			break;
+ 		}
+ 	}
+ 	if (ret < 0) {
+-		err("firmware download failed at %d with %d",pos,ret);
++		err("firmware download failed at %d with %d", pos, ret);
++		kfree(buf);
+ 		return ret;
+ 	}
+ 
+ 	if (ret == 0) {
+ 		/* restart the CPU */
+-		reset = 0;
+-		if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
++		buf[0] = 0;
++		if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
+ 			err("could not restart the USB controller CPU.");
+ 			ret = -EINVAL;
+ 		}
+ 	} else
+ 		ret = -EIO;
++	kfree(buf);
+ 
+ 	return ret;
+ }
diff --git a/config-generic b/config-generic
index 23bfffa1f..c2859f4ef 100644
--- a/config-generic
+++ b/config-generic
@@ -2901,7 +2901,7 @@ CONFIG_SENSORS_ASC7621=m
 CONFIG_SENSORS_EMC1403=m
 CONFIG_SENSORS_TMP102=m
 CONFIG_SENSORS_LTC4261=m
-# CONFIG_SENSORS_JC42 is not set
+CONFIG_SENSORS_JC42=m
 # CONFIG_SENSORS_SMM665 is not set
 # CONFIG_SENSORS_EMC2103 is not set
 # CONFIG_SENSORS_GPIO_FAN is not set
diff --git a/kernel.spec b/kernel.spec
index 892054574..96fab1f10 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -643,6 +643,10 @@ Patch856: PCI-ASPM-Handle-PCI-to-PCIe-bridges-as-roots-of-PCIe-hierarchies.patch
 #CVE-2017-5897 rhbz 1419848 1419851
 Patch857: ip6_gre-fix-ip6gre_err-invalid-reads.patch
 
+#rhbz 1417829
+Patch858: 1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch
+Patch859: 2-2-media-dvb-usb-firmware-don-t-do-DMA-on-stack.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2172,6 +2176,10 @@ fi
 #
 # 
 %changelog
+* Tue Feb  7 2017 Laura Abbott <labbott@fedoraproject.org>
+- Fix for some DMA on stack with DVB devices (rhbz 1417829)
+- Enable CONFIG_SENSORS_JC42 (rhbz 1417454)
+
 * Tue Feb  7 2017 Justin M. Forbes <jforbes@fedoraproject.org>
 - CVE-2017-5897 ip6_gre: Invalid reads in ip6gre_err (rhbz 1419848 1419851)