* [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
@ 2009-11-17 10:00 Ang Way Chuang
0 siblings, 0 replies; 10+ messages in thread
From: Ang Way Chuang @ 2009-11-17 10:00 UTC (permalink / raw)
To: linux-media; +Cc: Mauro Carvalho Chehab, Hilmar Linder, Wolfram Stering
ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
code has a bug that incorrectly treats ULE SNDU packed into the remaining
2 or 3 bytes of a MPEG2-TS frame as having invalid pointer field on the
subsequent MPEG2-TS frame.
This patch was generated against v2.6.32-rc7, however it wasn't tested
using that kernel. Similar patch was applied and tested using 2.6.27 which
is similar to the latest dvb_net.c, except for network device statistical data
structure. I suspect that this bug was introduced in kernel version 2.6.15,
but had not verified it.
Care has been taken not to introduce more bug by fixing this bug, but
please scrutinize the code for I always produces buggy code.
Signed-off-by: Ang Way Chuang <wcang@nav6.org>
---
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c
b/drivers/media/dvb/dvb-core/dvb_net.c
index 0241a7c..a521395 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -533,6 +533,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
from_where += 2;
}
+ priv->ule_sndu_remain = priv->ule_sndu_len + 2;
/*
* State of current TS:
* ts_remain (remaining bytes in the current TS cell)
@@ -542,6 +543,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
*/
switch (ts_remain) {
case 1:
+ priv->ule_sndu_remain--;
priv->ule_sndu_type = from_where[0] << 8;
priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
ts_remain -= 1; from_where += 1;
@@ -555,6 +557,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
default: /* complete ULE header is present in current TS. */
/* Extract ULE type field. */
if (priv->ule_sndu_type_1) {
+ priv->ule_sndu_type_1 = 0;
priv->ule_sndu_type |= from_where[0];
from_where += 1; /* points to payload start. */
ts_remain -= 1;
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
@ 2010-05-27 5:02 Ang Way Chuang
2010-05-27 12:30 ` Jarod Wilson
0 siblings, 1 reply; 10+ messages in thread
From: Ang Way Chuang @ 2010-05-27 5:02 UTC (permalink / raw)
To: linux-media; +Cc: Jarod Wilson
ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
code has a bug that incorrectly treats ULE SNDU packed into the
remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer
field on the subsequent MPEG2-TS frame.
This patch was generated and tested against the latest Linus's pre
2.6.35-rc1 tree.
Signed-off-by: Ang Way Chuang <wcang@nav6.org>
---
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
index f6dac2b..6c3a8a0 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -351,6 +351,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
const u8 *ts, *ts_end, *from_where = NULL;
u8 ts_remain = 0, how_much = 0, new_ts = 1;
struct ethhdr *ethh = NULL;
+ bool error = false;
#ifdef ULE_DEBUG
/* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */
@@ -460,10 +461,16 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
/* Drop partly decoded SNDU, reset state, resync on PUSI. */
if (priv->ule_skb) {
- dev_kfree_skb( priv->ule_skb );
+ error = true;
+ dev_kfree_skb(priv->ule_skb);
+ }
+
+ if (error || priv->ule_sndu_remain) {
dev->stats.rx_errors++;
dev->stats.rx_frame_errors++;
+ error = false;
}
+
reset_ule(priv);
priv->need_pusi = 1;
continue;
@@ -535,6 +542,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
from_where += 2;
}
+ priv->ule_sndu_remain = priv->ule_sndu_len + 2;
/*
* State of current TS:
* ts_remain (remaining bytes in the current TS cell)
@@ -544,6 +552,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
*/
switch (ts_remain) {
case 1:
+ priv->ule_sndu_remain--;
priv->ule_sndu_type = from_where[0] << 8;
priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
ts_remain -= 1; from_where += 1;
@@ -557,6 +566,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
default: /* complete ULE header is present in current TS. */
/* Extract ULE type field. */
if (priv->ule_sndu_type_1) {
+ priv->ule_sndu_type_1 = 0;
priv->ule_sndu_type |= from_where[0];
from_where += 1; /* points to payload start. */
ts_remain -= 1;
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
2010-05-27 5:02 Ang Way Chuang
@ 2010-05-27 12:30 ` Jarod Wilson
0 siblings, 0 replies; 10+ messages in thread
From: Jarod Wilson @ 2010-05-27 12:30 UTC (permalink / raw)
To: Ang Way Chuang; +Cc: linux-media
On Thu, May 27, 2010 at 01:02:09PM +0800, Ang Way Chuang wrote:
> ULE (Unidirectional Lightweight Encapsulation RFC 4326)
> decapsulation code has a bug that incorrectly treats ULE SNDU packed
> into the remaining 2 or 3 bytes of a MPEG2-TS frame as having
> invalid pointer field on the subsequent MPEG2-TS frame.
>
> This patch was generated and tested against the latest Linus's pre
> 2.6.35-rc1 tree.
>
> Signed-off-by: Ang Way Chuang <wcang@nav6.org>
Looks good to me, thanks for the updated version. Good catch noting that
error needed to be reset to false after it was handled, I'd missed that.
Acked-by: Jarod Wilson <jarod@redhat.com>
> ---
> diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
> index f6dac2b..6c3a8a0 100644
> --- a/drivers/media/dvb/dvb-core/dvb_net.c
> +++ b/drivers/media/dvb/dvb-core/dvb_net.c
> @@ -351,6 +351,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
> const u8 *ts, *ts_end, *from_where = NULL;
> u8 ts_remain = 0, how_much = 0, new_ts = 1;
> struct ethhdr *ethh = NULL;
> + bool error = false;
>
> #ifdef ULE_DEBUG
> /* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */
> @@ -460,10 +461,16 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
>
> /* Drop partly decoded SNDU, reset state, resync on PUSI. */
> if (priv->ule_skb) {
> - dev_kfree_skb( priv->ule_skb );
> + error = true;
> + dev_kfree_skb(priv->ule_skb);
> + }
> +
> + if (error || priv->ule_sndu_remain) {
> dev->stats.rx_errors++;
> dev->stats.rx_frame_errors++;
> + error = false;
> }
> +
> reset_ule(priv);
> priv->need_pusi = 1;
> continue;
> @@ -535,6 +542,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
> from_where += 2;
> }
>
> + priv->ule_sndu_remain = priv->ule_sndu_len + 2;
> /*
> * State of current TS:
> * ts_remain (remaining bytes in the current TS cell)
> @@ -544,6 +552,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
> */
> switch (ts_remain) {
> case 1:
> + priv->ule_sndu_remain--;
> priv->ule_sndu_type = from_where[0] << 8;
> priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
> ts_remain -= 1; from_where += 1;
> @@ -557,6 +566,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
> default: /* complete ULE header is present in current TS. */
> /* Extract ULE type field. */
> if (priv->ule_sndu_type_1) {
> + priv->ule_sndu_type_1 = 0;
> priv->ule_sndu_type |= from_where[0];
> from_where += 1; /* points to payload start. */
> ts_remain -= 1;
--
Jarod Wilson
jarod@redhat.com
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
@ 2010-05-06 14:52 Ang Way Chuang
0 siblings, 0 replies; 10+ messages in thread
From: Ang Way Chuang @ 2010-05-06 14:52 UTC (permalink / raw)
To: linux-media
ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
code has a bug that incorrectly treats ULE SNDU packed into the
remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer
field on the subsequent MPEG2-TS frame.
This patch was generated and tested against v2.6.34-rc6. I suspect
that this bug was introduced in kernel version 2.6.15, but had not
verified it.
Care has been taken not to introduce more bug by fixing this bug, but
please scrutinize the code because I always produces buggy code.
Signed-off-by: Ang Way Chuang <wcang@nav6.org>
---
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
index 441c064..35a4afb 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -458,8 +458,9 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
"field: %u.\n", priv->ts_count, *from_where);
/* Drop partly decoded SNDU, reset state, resync on PUSI. */
- if (priv->ule_skb) {
- dev_kfree_skb( priv->ule_skb );
+ if (priv->ule_skb || priv->ule_sndu_remain) {
+ if (priv->ule_skb)
+ dev_kfree_skb( priv->ule_skb );
dev->stats.rx_errors++;
dev->stats.rx_frame_errors++;
}
@@ -534,6 +535,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
from_where += 2;
}
+ priv->ule_sndu_remain = priv->ule_sndu_len + 2;
/*
* State of current TS:
* ts_remain (remaining bytes in the current TS cell)
@@ -543,6 +545,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
*/
switch (ts_remain) {
case 1:
+ priv->ule_sndu_remain--;
priv->ule_sndu_type = from_where[0] << 8;
priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
ts_remain -= 1; from_where += 1;
@@ -556,6 +559,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
default: /* complete ULE header is present in current TS. */
/* Extract ULE type field. */
if (priv->ule_sndu_type_1) {
+ priv->ule_sndu_type_1 = 0;
priv->ule_sndu_type |= from_where[0];
from_where += 1; /* points to payload start. */
ts_remain -= 1;
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
@ 2009-11-23 9:37 Ang Way Chuang
2009-11-24 1:34 ` Ang Way Chuang
2009-11-24 8:00 ` Dan Carpenter
0 siblings, 2 replies; 10+ messages in thread
From: Ang Way Chuang @ 2009-11-23 9:37 UTC (permalink / raw)
To: Mauro Carvalho Chehab, linux-media, linux-kernel
ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
code has a bug that incorrectly treats ULE SNDU packed into the
remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer
field on the subsequent MPEG2-TS frame.
This patch was generated and tested against v2.6.32-rc8. Similar patch
was applied and tested using 2.6.27 which is similar to the latest
dvb_net.c, except for network device statistical data structure. I
suspect that this bug was introduced in kernel version 2.6.15, but had
not verified it.
Care has been taken not to introduce more bug by fixing this bug, but
please scrutinize the code for I always produces buggy code.
Signed-off-by: Ang Way Chuang <wcang@nav6.org>
---
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c
b/drivers/media/dvb/dvb-core/dvb_net.c
index 0241a7c..7e0db86 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -458,8 +458,9 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
"field: %u.\n", priv->ts_count, *from_where);
/* Drop partly decoded SNDU, reset state, resync on PUSI. */
- if (priv->ule_skb) {
- dev_kfree_skb( priv->ule_skb );
+ if (priv->ule_skb || priv->ule_sndu_remain) {
+ if (priv->ule_skb)
+ dev_kfree_skb( priv->ule_skb );
dev->stats.rx_errors++;
dev->stats.rx_frame_errors++;
}
@@ -533,6 +534,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
from_where += 2;
}
+ priv->ule_sndu_remain = priv->ule_sndu_len + 2;
/*
* State of current TS:
* ts_remain (remaining bytes in the current TS cell)
@@ -542,6 +544,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
*/
switch (ts_remain) {
case 1:
+ priv->ule_sndu_remain--;
priv->ule_sndu_type = from_where[0] << 8;
priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
ts_remain -= 1; from_where += 1;
@@ -555,6 +558,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
default: /* complete ULE header is present in current TS. */
/* Extract ULE type field. */
if (priv->ule_sndu_type_1) {
+ priv->ule_sndu_type_1 = 0;
priv->ule_sndu_type |= from_where[0];
from_where += 1; /* points to payload start. */
ts_remain -= 1;
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
2009-11-23 9:37 Ang Way Chuang
@ 2009-11-24 1:34 ` Ang Way Chuang
2009-11-24 8:00 ` Dan Carpenter
1 sibling, 0 replies; 10+ messages in thread
From: Ang Way Chuang @ 2009-11-24 1:34 UTC (permalink / raw)
To: linux-media, linux-kernel
ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
code has a bug that incorrectly treats ULE SNDU packed into the
remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer
field on the subsequent MPEG2-TS frame.
This patch was generated and tested against v2.6.32-rc8. Similar patch
was applied and tested using 2.6.27 which is similar to the latest
dvb_net.c, except for network device statistical data structure. I
suspect that this bug was introduced in kernel version 2.6.15, but had
not verified it.
Care has been taken not to introduce more bug by fixing this bug, but
please scrutinize the code for I always produces buggy code.
Signed-off-by: Ang Way Chuang <wcang@nav6.org>
---
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c
b/drivers/media/dvb/dvb-core/dvb_net.c
index 0241a7c..7e0db86 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -458,8 +458,9 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
"field: %u.\n",
priv->ts_count, *from_where);
/* Drop partly decoded
SNDU, reset state, resync on PUSI. */
- if (priv->ule_skb) {
- dev_kfree_skb(
priv->ule_skb );
+ if (priv->ule_skb ||
priv->ule_sndu_remain) {
+ if (priv->ule_skb)
+
dev_kfree_skb( priv->ule_skb );
dev->stats.rx_errors++;
dev->stats.rx_frame_errors++;
}
@@ -533,6 +534,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
from_where += 2;
}
+ priv->ule_sndu_remain = priv->ule_sndu_len + 2;
/*
* State of current TS:
* ts_remain (remaining bytes in the current TS cell)
@@ -542,6 +544,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
*/
switch (ts_remain) {
case 1:
+ priv->ule_sndu_remain--;
priv->ule_sndu_type = from_where[0] << 8;
priv->ule_sndu_type_1 = 1; /*
first byte of ule_type is set. */
ts_remain -= 1; from_where += 1;
@@ -555,6 +558,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
default: /* complete ULE header is
present in current TS. */
/* Extract ULE type field. */
if (priv->ule_sndu_type_1) {
+ priv->ule_sndu_type_1 = 0;
priv->ule_sndu_type |=
from_where[0];
from_where += 1; /*
points to payload start. */
ts_remain -= 1;
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
2009-11-23 9:37 Ang Way Chuang
2009-11-24 1:34 ` Ang Way Chuang
@ 2009-11-24 8:00 ` Dan Carpenter
2009-11-24 8:04 ` Ang Way Chuang
1 sibling, 1 reply; 10+ messages in thread
From: Dan Carpenter @ 2009-11-24 8:00 UTC (permalink / raw)
To: Ang Way Chuang; +Cc: Mauro Carvalho Chehab, linux-media, linux-kernel
On Mon, Nov 23, 2009 at 05:37:57PM +0800, Ang Way Chuang wrote:
> --- a/drivers/media/dvb/dvb-core/dvb_net.c
> +++ b/drivers/media/dvb/dvb-core/dvb_net.c
> @@ -458,8 +458,9 @@ static void dvb_net_ule( struct net_device *dev,
> const u8 *buf, size_t buf_len )
Your email client line broke the line starting with @@ into 2 lines so
the patch doesn't apply.
Could you resend the patch without line wrapping?
regards,
dan carpenter
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
2009-11-24 8:00 ` Dan Carpenter
@ 2009-11-24 8:04 ` Ang Way Chuang
2009-11-24 8:07 ` Ang Way Chuang
0 siblings, 1 reply; 10+ messages in thread
From: Ang Way Chuang @ 2009-11-24 8:04 UTC (permalink / raw)
To: Dan Carpenter, Ang Way Chuang, Mauro Carvalho Chehab, linux-media,
linux-kernel
Okay, resending. Hope it won't do line wrapping.
ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
code has a bug that incorrectly treats ULE SNDU packed into the
remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer
field on the subsequent MPEG2-TS frame.
This patch was generated and tested against v2.6.32-rc8. Similar patch
was applied and tested using 2.6.27 which is similar to the latest
dvb_net.c, except for network device statistical data structure. I
suspect that this bug was introduced in kernel version 2.6.15, but had
not verified it.
Care has been taken not to introduce more bug by fixing this bug, but
please scrutinize the code for I always produces buggy code.
Signed-off-by: Ang Way Chuang <wcang@nav6.org>
---
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c
b/drivers/media/dvb/dvb-core/dvb_net.c
index 0241a7c..7e0db86 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -458,8 +458,9 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
"field: %u.\n", priv->ts_count, *from_where);
/* Drop partly decoded SNDU, reset state, resync on PUSI. */
- if (priv->ule_skb) {
- dev_kfree_skb( priv->ule_skb );
+ if (priv->ule_skb || priv->ule_sndu_remain) {
+ if (priv->ule_skb)
+ dev_kfree_skb( priv->ule_skb );
dev->stats.rx_errors++;
dev->stats.rx_frame_errors++;
}
@@ -533,6 +534,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
from_where += 2;
}
+ priv->ule_sndu_remain = priv->ule_sndu_len + 2;
/*
* State of current TS:
* ts_remain (remaining bytes in the current TS cell)
@@ -542,6 +544,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
*/
switch (ts_remain) {
case 1:
+ priv->ule_sndu_remain--;
priv->ule_sndu_type = from_where[0] << 8;
priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
ts_remain -= 1; from_where += 1;
@@ -555,6 +558,7 @@ static void dvb_net_ule( struct net_device *dev,
const u8 *buf, size_t buf_len )
default: /* complete ULE header is present in current TS. */
/* Extract ULE type field. */
if (priv->ule_sndu_type_1) {
+ priv->ule_sndu_type_1 = 0;
priv->ule_sndu_type |= from_where[0];
from_where += 1; /* points to payload start. */
ts_remain -= 1;
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
2009-11-24 8:04 ` Ang Way Chuang
@ 2009-11-24 8:07 ` Ang Way Chuang
0 siblings, 0 replies; 10+ messages in thread
From: Ang Way Chuang @ 2009-11-24 8:07 UTC (permalink / raw)
To: Dan Carpenter, Ang Way Chuang, Mauro Carvalho Chehab, linux-media,
linux-kernel
Sorry, line wrap again. I shall test and fix the problem first before
resending the patch.
On Tue, Nov 24, 2009 at 4:04 PM, Ang Way Chuang <wcang79@gmail.com> wrote:
> Okay, resending. Hope it won't do line wrapping.
>
> ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
> code has a bug that incorrectly treats ULE SNDU packed into the
> remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer
> field on the subsequent MPEG2-TS frame.
>
> This patch was generated and tested against v2.6.32-rc8. Similar patch
> was applied and tested using 2.6.27 which is similar to the latest
> dvb_net.c, except for network device statistical data structure. I
> suspect that this bug was introduced in kernel version 2.6.15, but had
> not verified it.
>
> Care has been taken not to introduce more bug by fixing this bug, but
> please scrutinize the code for I always produces buggy code.
>
> Signed-off-by: Ang Way Chuang <wcang@nav6.org>
> ---
> diff --git a/drivers/media/dvb/dvb-core/dvb_net.c
> b/drivers/media/dvb/dvb-core/dvb_net.c
> index 0241a7c..7e0db86 100644
> --- a/drivers/media/dvb/dvb-core/dvb_net.c
> +++ b/drivers/media/dvb/dvb-core/dvb_net.c
> @@ -458,8 +458,9 @@ static void dvb_net_ule( struct net_device *dev,
> const u8 *buf, size_t buf_len )
> "field: %u.\n", priv->ts_count, *from_where);
>
> /* Drop partly decoded SNDU, reset state, resync on PUSI. */
> - if (priv->ule_skb) {
> - dev_kfree_skb( priv->ule_skb );
> + if (priv->ule_skb || priv->ule_sndu_remain) {
> + if (priv->ule_skb)
> + dev_kfree_skb( priv->ule_skb );
> dev->stats.rx_errors++;
> dev->stats.rx_frame_errors++;
> }
> @@ -533,6 +534,7 @@ static void dvb_net_ule( struct net_device *dev,
> const u8 *buf, size_t buf_len )
> from_where += 2;
> }
>
> + priv->ule_sndu_remain = priv->ule_sndu_len + 2;
> /*
> * State of current TS:
> * ts_remain (remaining bytes in the current TS cell)
> @@ -542,6 +544,7 @@ static void dvb_net_ule( struct net_device *dev,
> const u8 *buf, size_t buf_len )
> */
> switch (ts_remain) {
> case 1:
> + priv->ule_sndu_remain--;
> priv->ule_sndu_type = from_where[0] << 8;
> priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
> ts_remain -= 1; from_where += 1;
> @@ -555,6 +558,7 @@ static void dvb_net_ule( struct net_device *dev,
> const u8 *buf, size_t buf_len )
> default: /* complete ULE header is present in current TS. */
> /* Extract ULE type field. */
> if (priv->ule_sndu_type_1) {
> + priv->ule_sndu_type_1 = 0;
> priv->ule_sndu_type |= from_where[0];
> from_where += 1; /* points to payload start. */
> ts_remain -= 1;
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame
@ 2009-11-17 9:56 Ang Way Chuang
0 siblings, 0 replies; 10+ messages in thread
From: Ang Way Chuang @ 2009-11-17 9:56 UTC (permalink / raw)
To: linux-media; +Cc: Mauro Carvalho Chehab, Hilmar Linder, Wolfram Stering
ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
code has a bug that incorrectly treats ULE SNDU packed into the remaining
2 or 3 bytes of a MPEG2-TS frame as having invalid pointer field on the
subsequent MPEG2-TS frame.
This patch was generated against v2.6.32-rc7, however it wasn't tested
using that kernel. Similar patch was applied and tested using 2.6.27 which
is similar to the latest dvb_net.c, except for network device statistical data
structure. I suspect that this bug was introduced in kernel version 2.6.15,
but had not verified it.
Care has been taken not to introduce more bug by fixing this bug, but
please scrutinize the code for I always produces buggy code.
Signed-off-by: Ang Way Chuang <wcang@nav6.org>
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2010-05-27 12:31 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-11-17 10:00 [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame Ang Way Chuang
-- strict thread matches above, loose matches on Subject: below --
2010-05-27 5:02 Ang Way Chuang
2010-05-27 12:30 ` Jarod Wilson
2010-05-06 14:52 Ang Way Chuang
2009-11-23 9:37 Ang Way Chuang
2009-11-24 1:34 ` Ang Way Chuang
2009-11-24 8:00 ` Dan Carpenter
2009-11-24 8:04 ` Ang Way Chuang
2009-11-24 8:07 ` Ang Way Chuang
2009-11-17 9:56 Ang Way Chuang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).