Re: Fix for crash in dvb-usb-af9015

[Antti Palosaari <crope@iki.fi>]

Moi Nils,

Nils Kassube wrote:
> I found out that the crash happens when the device should boot after 
> downloading the firmware because there seems to be no sufficiently big 
> buffer for the boot message (or whatever it is) returned from the 
> device. As this message is ignored by the calling function anyway, this 
> patch fixes the problem:
> 
> --- orig/linux-2.6.31/drivers/media/dvb/dvb-usb/af9015.c	2009-06-30 
> 11:34:45.000000000 +0200
> +++ linux-2.6.31/drivers/media/dvb/dvb-usb/af9015.c	2009-07-06 
> 21:42:50.000000000 +0200
> @@ -158,7 +158,7 @@
>  	}
>  
>  	/* read request, copy returned data to return buf */
> -	if (!write)
> +	if (!write && req->cmd != BOOT)
>  		memcpy(req->data, &buf[2], req->data_len);
>  
>  error_unlock:
> 
> However, it would certainly be better to provide an appropriate buffer 
> when calling this function from af9015_download_firmware because I think 
> it is called very often here and the extra check for the BOOT command is 
> needed only once (after firmware download). As I'm not familiar with the 
> hardware, I can't say what buffer size would be appropriate but I can 
> say that for my device the parameter "req->data_len" was 32 in the 
> memcpy command above when I tried to find the fix.

I see the problem but your fix is not ideally correct for my eyes. I 
don't have currently access to sniffs to ensure that but I think BOOT 
should be write command. Now it is defined as read. I think moving BOOT 
from read to write fixes problem.

regards
Antti
-- 
http://palosaari.fi/