From patchwork Wed Oct 3 09:25:40 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans-Frieder Vogt X-Patchwork-Id: 14861 Received: from mail.tu-berlin.de ([130.149.7.33]) by www.linuxtv.org with esmtp (Exim 4.72) (envelope-from ) id 1TJLDD-0002Bv-Ps for patchwork@linuxtv.org; Wed, 03 Oct 2012 11:25:51 +0200 X-tubIT-Incoming-IP: 209.132.180.67 Received: from vger.kernel.org ([209.132.180.67]) by mail.tu-berlin.de (exim-4.75/mailfrontend-2) with esmtp for id 1TJLDD-0007Ve-Gt; Wed, 03 Oct 2012 11:25:51 +0200 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753371Ab2JCJZt (ORCPT ); Wed, 3 Oct 2012 05:25:49 -0400 Received: from mailout-de.gmx.net ([213.165.64.22]:50253 "HELO mailout-de.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1752287Ab2JCJZs (ORCPT ); Wed, 3 Oct 2012 05:25:48 -0400 Received: (qmail invoked by alias); 03 Oct 2012 09:25:46 -0000 Received: from p4FC09FC6.dip0.t-ipconnect.de (EHLO maximilian.localnet) [79.192.159.198] by mail.gmx.net (mp038) with SMTP; 03 Oct 2012 11:25:46 +0200 X-Authenticated: #24390674 X-Provags-ID: V01U2FsdGVkX1/2iREIwYD2FcaBCm2EPaEPK95UNp2ax1LHQ0rVmx VlO/Sa2VaFnbPv From: "Hans-Frieder Vogt" To: Dan Carpenter , Antti Palosaari Subject: [PATCH] af9033: prevent unintended underflow Date: Wed, 3 Oct 2012 11:25:40 +0200 User-Agent: KMail/1.13.7 (Linux/3.6.0-a64; KDE/4.8.4; x86_64; ; ) Cc: linux-media@vger.kernel.org MIME-Version: 1.0 Message-Id: <201210031125.40850.hfvogt@gmx.net> X-Y-GMX-Trusted: 0 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-PMX-Version: 5.6.1.2065439, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2012.10.3.91515 X-PMX-Spam: Gauge=IIIIIIII, Probability=8%, Report=' HTML_00_01 0.05, HTML_00_10 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1900_1999 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, URI_ENDS_IN_HTML 0, __ANY_URI 0, __CP_URI_IN_BODY 0, __CT 0, __CTE 0, __CT_TEXT_PLAIN 0, __FRAUD_BODY_WEBMAIL 0, __FRAUD_WEBMAIL 0, __FRAUD_WEBMAIL_FROM 0, __HAS_FROM 0, __HAS_MSGID 0, __HAS_X_MAILING_LIST 0, __MIME_TEXT_ONLY 0, __MIME_VERSION 0, __PHISH_SPEAR_STRUCTURE_1 0, __SANE_MSGID 0, __SUBJ_ALPHA_END 0, __TO_MALFORMED_2 0, __URI_NO_WWW 0, __URI_NS , __USER_AGENT 0' As spotted by Dan Carpenter (thanks!), we have improperly used an unsigned variable in a calculation that may result in a negative number. This may cause an unintended underflow if the interface frequency of the tuner is > approx. 40MHz. This patch should resolve the issue, following an approach similar to what is used in af9013.c. Signed-off-by: Hans-Frieder Vogt drivers/media/dvb-frontends/af9033.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) Hans-Frieder Vogt e-mail: hfvogt gmx .dot. net Acked-by: Antti Palosaari --- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/drivers/media/dvb-frontends/af9033.c 2012-09-28 05:45:17.000000000 +0200 +++ b/drivers/media/dvb-frontends/af9033.c 2012-10-03 11:08:18.160894181 +0200 @@ -408,7 +408,7 @@ static int af9033_set_frontend(struct dv { struct af9033_state *state = fe->demodulator_priv; struct dtv_frontend_properties *c = &fe->dtv_property_cache; - int ret, i, spec_inv; + int ret, i, spec_inv, sampling_freq; u8 tmp, buf[3], bandwidth_reg_val; u32 if_frequency, freq_cw, adc_freq; @@ -465,18 +465,20 @@ static int af9033_set_frontend(struct dv else if_frequency = 0; - while (if_frequency > (adc_freq / 2)) - if_frequency -= adc_freq; + sampling_freq = if_frequency; - if (if_frequency >= 0) + while (sampling_freq > (adc_freq / 2)) + sampling_freq -= adc_freq; + + if (sampling_freq >= 0) spec_inv *= -1; else - if_frequency *= -1; + sampling_freq *= -1; - freq_cw = af9033_div(state, if_frequency, adc_freq, 23ul); + freq_cw = af9033_div(state, sampling_freq, adc_freq, 23ul); if (spec_inv == -1) - freq_cw *= -1; + freq_cw = 0x800000 - freq_cw; /* get adc multiplies */ ret = af9033_rd_reg(state, 0x800045, &tmp);