[patch] [media] saa7164: fix endian conversion in saa7164_bus_set()

[patch] [media] saa7164: fix endian conversion in saa7164_bus_set()

[Dan Carpenter]

The msg->command field is 32 bits, and we should fill it with a call
to cpu_to_le32().  The current code is broken on big endian systems,
and on little endian systems it just truncates the 32 bit value to
16 bits.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This is a static checker bug.  I haven't tested it.

diff --git a/drivers/media/video/saa7164/saa7164-bus.c b/drivers/media/video/saa7164/saa7164-bus.c
index 466e1b0..8f853d1 100644
--- a/drivers/media/video/saa7164/saa7164-bus.c
+++ b/drivers/media/video/saa7164/saa7164-bus.c
@@ -149,7 +149,7 @@ int saa7164_bus_set(struct saa7164_dev *dev, struct tmComResInfo* msg,
 	saa7164_bus_verify(dev);
 
 	msg->size = cpu_to_le16(msg->size);
-	msg->command = cpu_to_le16(msg->command);
+	msg->command = cpu_to_le32(msg->command);
 	msg->controlselector = cpu_to_le16(msg->controlselector);
 
 	if (msg->size > dev->bus.m_wMaxReqSize) {

Re: [patch] [media] saa7164: fix endian conversion in saa7164_bus_set()

[Mauro Carvalho Chehab]

Em 23-11-2011 05:09, Dan Carpenter escreveu:
> The msg->command field is 32 bits, and we should fill it with a call
> to cpu_to_le32().  The current code is broken on big endian systems,
> and on little endian systems it just truncates the 32 bit value to
> 16 bits.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> This is a static checker bug.  I haven't tested it.
> 
> diff --git a/drivers/media/video/saa7164/saa7164-bus.c b/drivers/media/video/saa7164/saa7164-bus.c
> index 466e1b0..8f853d1 100644
> --- a/drivers/media/video/saa7164/saa7164-bus.c
> +++ b/drivers/media/video/saa7164/saa7164-bus.c
> @@ -149,7 +149,7 @@ int saa7164_bus_set(struct saa7164_dev *dev, struct tmComResInfo* msg,
>  	saa7164_bus_verify(dev);
>  
>  	msg->size = cpu_to_le16(msg->size);
> -	msg->command = cpu_to_le16(msg->command);
> +	msg->command = cpu_to_le32(msg->command);
>  	msg->controlselector = cpu_to_le16(msg->controlselector);
>  
>  	if (msg->size > dev->bus.m_wMaxReqSize) {

Hmm... I don't have this hardware, but:

peekout:
        msg->size = le16_to_cpu(msg->size);
        msg->command = le16_to_cpu(msg->command);
        msg->controlselector = le16_to_cpu(msg->controlselector);
        ret = SAA_OK;
out:
        mutex_unlock(&bus->lock);
        saa7164_bus_verify(dev);
        return ret;
}

le16_to_cpu() is used for command. If one place needs fix, so the other one also
requires it.

Regards,
Mauro

Re: [patch] [media] saa7164: fix endian conversion in

[Dan Carpenter]

[-- Attachment #1: Type: text/plain, Size: 328 bytes --]

On Fri, Nov 25, 2011 at 03:50:38PM -0200, Mauro Carvalho Chehab wrote:
> le16_to_cpu() is used for command. If one place needs fix, so the other one also
> requires it.
> 

Ah yeah.  I should have looked for that.  I'll take another look and
see if there was anything else I missed and resend.

regards,
dan carpenter

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

[patch v2] [media] saa7164: fix endian conversion in

[Dan Carpenter]

[-- Attachment #1: Type: text/plain, Size: 1463 bytes --]

The msg->command field is 32 bits, and we should fill it with a call
to cpu_to_le32().  The current code is broke on big endian systems.
On little endian systems it truncates the 32 bit value to 16 bits
which probably still works fine.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: Mauro pointed out that I missed the conversion back to cpu endian.

This is a static checker bug.  The current code is definitely broken on
big endian systems.  I'm pretty sure my fix is correct, but I don't
have the hardware to test it.

diff --git a/drivers/media/video/saa7164/saa7164-bus.c b/drivers/media/video/saa7164/saa7164-bus.c
index 466e1b0..a7f58a9 100644
--- a/drivers/media/video/saa7164/saa7164-bus.c
+++ b/drivers/media/video/saa7164/saa7164-bus.c
@@ -149,7 +149,7 @@ int saa7164_bus_set(struct saa7164_dev *dev, struct tmComResInfo* msg,
 	saa7164_bus_verify(dev);
 
 	msg->size = cpu_to_le16(msg->size);
-	msg->command = cpu_to_le16(msg->command);
+	msg->command = cpu_to_le32(msg->command);
 	msg->controlselector = cpu_to_le16(msg->controlselector);
 
 	if (msg->size > dev->bus.m_wMaxReqSize) {
@@ -464,7 +464,7 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
 
 peekout:
 	msg->size = le16_to_cpu(msg->size);
-	msg->command = le16_to_cpu(msg->command);
+	msg->command = le32_to_cpu(msg->command);
 	msg->controlselector = le16_to_cpu(msg->controlselector);
 	ret = SAA_OK;
 out:

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]