mirror of
				https://github.com/torvalds/linux.git
				synced 2025-11-04 02:30:34 +02:00 
			
		
		
		
	Fix oops introduced by commit ae93a55bf9
(emi26: use request_firmware()):
usb 1-1: new full speed USB device using uhci_hcd and address 2
usb 1-1: configuration #1 chosen from 1 choice
emi26 - firmware loader 1-1:1.0: emi26_probe start
usb 1-1: firmware: requesting emi26/loader.fw
usb 1-1: firmware: requesting emi26/bitstream.fw
usb 1-1: firmware: requesting emi26/firmware.fw
usb 1-1: emi26_set_reset - 1
usb 1-1: emi26_set_reset - 0
BUG: unable to handle kernel NULL pointer dereference at 00000000
IP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26]
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1d.0/usb1/1-1/firmware/1-1/loading
Modules linked in: emi26(+) ipv6 cpufreq_ondemand coretemp arc4 ecb iwl3945 irtty_sir sir_dev nsc_ircc ehci_hcd uhci_hcd mac80211 irda usbcore snd_hda_intel thinkpad_acpi rfkill hwmon led_class e1000e snd_pcm cfg80211 snd_timer crc_ccitt snd snd_page_alloc aes_generic
Pid: 5082, comm: modprobe Not tainted (2.6.28 #2) 17023QG
EIP: 0060:[<f80dc487>] EFLAGS: 00010206 CPU: 0
EIP is at emi26_probe+0x2f7/0x620 [emi26]
EAX: 0000015c EBX: 00000000 ECX: c1ffd9c0 EDX: 00000000
ESI: 0000015c EDI: f6bb215c EBP: f6bb0400 ESP: f00ebcfc
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process modprobe (pid: 5082, ti=f00ea000 task=f5c7c700 task.ti=f00ea000)
Stack:
 0000015c 000000a5 f6a67cb8 f80dc7e0 c01c6262 fbef2986 f6bb2000 00008fe0
 0000015c f715f748 f715f740 f715f738 f715f748 f6a67c00 f80dd040 f80dcfc0
 f6bb0400 fbacb290 f6a67c94 fbae0160 c01c70bf 00000000 f6a67c1c 00000000
Call Trace:
 [<c01c6262>] sysfs_add_one+0x12/0x50
 [<fbacb290>] usb_probe_interface+0xa0/0x140 [usbcore]
 [<c01c70bf>] sysfs_create_link+0xf/0x20
 [<c02dead2>] driver_probe_device+0x82/0x180
 [<fbac9eeb>] usb_match_id+0x3b/0x50 [usbcore]
 [<c02dec4e>] __driver_attach+0x7e/0x80
 [<c02de27a>] bus_for_each_dev+0x3a/0x60
 [<c02de956>] driver_attach+0x16/0x20
 [<c02debd0>] __driver_attach+0x0/0x80
 [<c02de7b1>] bus_add_driver+0x1a1/0x220
 [<c02dee4d>] driver_register+0x4d/0x120
 [<c024e622>] idr_get_empty_slot+0xf2/0x290
 [<fbacab71>] usb_register_driver+0x81/0x100 [usbcore]
 [<f806c000>] emi26_init+0x0/0x14 [emi26]
 [<c0101126>] do_one_initcall+0x36/0x1b0
 [<c01c5e70>] sysfs_ilookup_test+0x0/0x10
 [<c0197a61>] ifind+0x31/0x90
 [<c01c6229>] __sysfs_add_one+0x59/0x80
 [<c01c64e4>] sysfs_addrm_finish+0x14/0x1c0
 [<c0175ca3>] __vunmap+0xa3/0xd0
 [<c014b854>] load_module+0x1544/0x1640
 [<c014b9d7>] sys_init_module+0x87/0x1b0
 [<c0187f41>] sys_read+0x41/0x70
 [<c01032a5>] sysenter_do_call+0x12/0x21
 [<c03d0000>] wait_for_common+0x40/0x110
Code: 66 c1 e8 08 66 09 d0 75 a5 31 d2 89 e8 e8 72 fc ff ff 85 c0 0f 88 9a 02 00 00 b8 fa 00 00 00 e8 30 46 05 c8 8b 74 24 28 8b 5e 04 <8b> 03 89 44 24 1c 0f c8 89 44 24 1c 0f b7 4b 04 c7 44 24 20 00
EIP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26] SS:ESP 0068:f00ebcfc
---[ end trace 2eefa13825431230 ]---
After the last "package" of firmware data is sent to the device, we dereference
NULL pointer (on access to rec->addr). Fix it.
Reported--by: David Flatz <david@upcs.at>
Tested-by: David Flatz <david@upcs.at>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: stable <stable@kernel.org> [2.6.27, 2.6.28]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
		
	
			
		
			
				
	
	
		
			300 lines
		
	
	
	
		
			8.7 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			300 lines
		
	
	
	
		
			8.7 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
/* 
 | 
						|
 * Emagic EMI 2|6 usb audio interface firmware loader.
 | 
						|
 * Copyright (C) 2002
 | 
						|
 * 	Tapio Laxström (tapio.laxstrom@iptime.fi)
 | 
						|
 *
 | 
						|
 * This program is free software; you can redistribute it and/or modify
 | 
						|
 * it under the terms of the GNU General Public License, as published by
 | 
						|
 * the Free Software Foundation, version 2.
 | 
						|
 * 
 | 
						|
 * emi26.c,v 1.13 2002/03/08 13:10:26 tapio Exp
 | 
						|
 */
 | 
						|
#include <linux/kernel.h>
 | 
						|
#include <linux/errno.h>
 | 
						|
#include <linux/slab.h>
 | 
						|
#include <linux/module.h>
 | 
						|
#include <linux/init.h>
 | 
						|
#include <linux/usb.h>
 | 
						|
#include <linux/delay.h>
 | 
						|
#include <linux/firmware.h>
 | 
						|
#include <linux/ihex.h>
 | 
						|
 | 
						|
#define EMI26_VENDOR_ID 		0x086a  /* Emagic Soft-und Hardware GmBH */
 | 
						|
#define EMI26_PRODUCT_ID		0x0100	/* EMI 2|6 without firmware */
 | 
						|
#define EMI26B_PRODUCT_ID		0x0102	/* EMI 2|6 without firmware */
 | 
						|
 | 
						|
#define ANCHOR_LOAD_INTERNAL	0xA0	/* Vendor specific request code for Anchor Upload/Download (This one is implemented in the core) */
 | 
						|
#define ANCHOR_LOAD_EXTERNAL	0xA3	/* This command is not implemented in the core. Requires firmware */
 | 
						|
#define ANCHOR_LOAD_FPGA	0xA5	/* This command is not implemented in the core. Requires firmware. Emagic extension */
 | 
						|
#define MAX_INTERNAL_ADDRESS	0x1B3F	/* This is the highest internal RAM address for the AN2131Q */
 | 
						|
#define CPUCS_REG		0x7F92  /* EZ-USB Control and Status Register.  Bit 0 controls 8051 reset */ 
 | 
						|
#define INTERNAL_RAM(address)   (address <= MAX_INTERNAL_ADDRESS)
 | 
						|
 | 
						|
static int emi26_writememory( struct usb_device *dev, int address,
 | 
						|
			      const unsigned char *data, int length,
 | 
						|
			      __u8 bRequest);
 | 
						|
static int emi26_set_reset(struct usb_device *dev, unsigned char reset_bit);
 | 
						|
static int emi26_load_firmware (struct usb_device *dev);
 | 
						|
static int emi26_probe(struct usb_interface *intf, const struct usb_device_id *id);
 | 
						|
static void emi26_disconnect(struct usb_interface *intf);
 | 
						|
static int __init emi26_init (void);
 | 
						|
static void __exit emi26_exit (void);
 | 
						|
 | 
						|
 | 
						|
/* thanks to drivers/usb/serial/keyspan_pda.c code */
 | 
						|
static int emi26_writememory (struct usb_device *dev, int address,
 | 
						|
			      const unsigned char *data, int length,
 | 
						|
			      __u8 request)
 | 
						|
{
 | 
						|
	int result;
 | 
						|
	unsigned char *buffer =  kmemdup(data, length, GFP_KERNEL);
 | 
						|
 | 
						|
	if (!buffer) {
 | 
						|
		dev_err(&dev->dev, "kmalloc(%d) failed.\n", length);
 | 
						|
		return -ENOMEM;
 | 
						|
	}
 | 
						|
	/* Note: usb_control_msg returns negative value on error or length of the
 | 
						|
	 * 		 data that was written! */
 | 
						|
	result = usb_control_msg (dev, usb_sndctrlpipe(dev, 0), request, 0x40, address, 0, buffer, length, 300);
 | 
						|
	kfree (buffer);
 | 
						|
	return result;
 | 
						|
}
 | 
						|
 | 
						|
/* thanks to drivers/usb/serial/keyspan_pda.c code */
 | 
						|
static int emi26_set_reset (struct usb_device *dev, unsigned char reset_bit)
 | 
						|
{
 | 
						|
	int response;
 | 
						|
	dev_info(&dev->dev, "%s - %d\n", __func__, reset_bit);
 | 
						|
	/* printk(KERN_DEBUG "%s - %d", __func__, reset_bit); */
 | 
						|
	response = emi26_writememory (dev, CPUCS_REG, &reset_bit, 1, 0xa0);
 | 
						|
	if (response < 0) {
 | 
						|
		dev_err(&dev->dev, "set_reset (%d) failed\n", reset_bit);
 | 
						|
	}
 | 
						|
	return response;
 | 
						|
}
 | 
						|
 | 
						|
#define FW_LOAD_SIZE		1023
 | 
						|
 | 
						|
static int emi26_load_firmware (struct usb_device *dev)
 | 
						|
{
 | 
						|
	const struct firmware *loader_fw = NULL;
 | 
						|
	const struct firmware *bitstream_fw = NULL;
 | 
						|
	const struct firmware *firmware_fw = NULL;
 | 
						|
	const struct ihex_binrec *rec;
 | 
						|
	int err;
 | 
						|
	int i;
 | 
						|
	__u32 addr;	/* Address to write */
 | 
						|
	__u8 *buf;
 | 
						|
 | 
						|
	buf = kmalloc(FW_LOAD_SIZE, GFP_KERNEL);
 | 
						|
	if (!buf) {
 | 
						|
		dev_err(&dev->dev, "%s - error loading firmware: error = %d\n",
 | 
						|
			__func__, -ENOMEM);
 | 
						|
		err = -ENOMEM;
 | 
						|
		goto wraperr;
 | 
						|
	}
 | 
						|
 | 
						|
	err = request_ihex_firmware(&loader_fw, "emi26/loader.fw", &dev->dev);
 | 
						|
	if (err)
 | 
						|
		goto nofw;
 | 
						|
 | 
						|
	err = request_ihex_firmware(&bitstream_fw, "emi26/bitstream.fw",
 | 
						|
				    &dev->dev);
 | 
						|
	if (err)
 | 
						|
		goto nofw;
 | 
						|
 | 
						|
	err = request_ihex_firmware(&firmware_fw, "emi26/firmware.fw",
 | 
						|
				    &dev->dev);
 | 
						|
	if (err) {
 | 
						|
	nofw:
 | 
						|
		dev_err(&dev->dev, "%s - request_firmware() failed\n",
 | 
						|
			__func__);
 | 
						|
		goto wraperr;
 | 
						|
	}
 | 
						|
 | 
						|
	/* Assert reset (stop the CPU in the EMI) */
 | 
						|
	err = emi26_set_reset(dev,1);
 | 
						|
	if (err < 0) {
 | 
						|
		dev_err(&dev->dev,"%s - error loading firmware: error = %d\n",
 | 
						|
			__func__, err);
 | 
						|
		goto wraperr;
 | 
						|
	}
 | 
						|
 | 
						|
	rec = (const struct ihex_binrec *)loader_fw->data;
 | 
						|
	/* 1. We need to put the loader for the FPGA into the EZ-USB */
 | 
						|
	while (rec) {
 | 
						|
		err = emi26_writememory(dev, be32_to_cpu(rec->addr),
 | 
						|
					rec->data, be16_to_cpu(rec->len),
 | 
						|
					ANCHOR_LOAD_INTERNAL);
 | 
						|
		if (err < 0) {
 | 
						|
			err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
			goto wraperr;
 | 
						|
		}
 | 
						|
		rec = ihex_next_binrec(rec);
 | 
						|
	}
 | 
						|
 | 
						|
	/* De-assert reset (let the CPU run) */
 | 
						|
	err = emi26_set_reset(dev,0);
 | 
						|
	if (err < 0) {
 | 
						|
		err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
		goto wraperr;
 | 
						|
	}
 | 
						|
	msleep(250);	/* let device settle */
 | 
						|
 | 
						|
	/* 2. We upload the FPGA firmware into the EMI
 | 
						|
	 * Note: collect up to 1023 (yes!) bytes and send them with
 | 
						|
	 * a single request. This is _much_ faster! */
 | 
						|
	rec = (const struct ihex_binrec *)bitstream_fw->data;
 | 
						|
	do {
 | 
						|
		i = 0;
 | 
						|
		addr = be32_to_cpu(rec->addr);
 | 
						|
 | 
						|
		/* intel hex records are terminated with type 0 element */
 | 
						|
		while (rec && (i + be16_to_cpu(rec->len) < FW_LOAD_SIZE)) {
 | 
						|
			memcpy(buf + i, rec->data, be16_to_cpu(rec->len));
 | 
						|
			i += be16_to_cpu(rec->len);
 | 
						|
			rec = ihex_next_binrec(rec);
 | 
						|
		}
 | 
						|
		err = emi26_writememory(dev, addr, buf, i, ANCHOR_LOAD_FPGA);
 | 
						|
		if (err < 0) {
 | 
						|
			err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
			goto wraperr;
 | 
						|
		}
 | 
						|
	} while (rec);
 | 
						|
 | 
						|
	/* Assert reset (stop the CPU in the EMI) */
 | 
						|
	err = emi26_set_reset(dev,1);
 | 
						|
	if (err < 0) {
 | 
						|
		err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
		goto wraperr;
 | 
						|
	}
 | 
						|
 | 
						|
	/* 3. We need to put the loader for the firmware into the EZ-USB (again...) */
 | 
						|
	for (rec = (const struct ihex_binrec *)loader_fw->data;
 | 
						|
	     rec; rec = ihex_next_binrec(rec)) {
 | 
						|
		err = emi26_writememory(dev, be32_to_cpu(rec->addr),
 | 
						|
					rec->data, be16_to_cpu(rec->len),
 | 
						|
					ANCHOR_LOAD_INTERNAL);
 | 
						|
		if (err < 0) {
 | 
						|
			err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
			goto wraperr;
 | 
						|
		}
 | 
						|
	}
 | 
						|
	msleep(250);	/* let device settle */
 | 
						|
 | 
						|
	/* De-assert reset (let the CPU run) */
 | 
						|
	err = emi26_set_reset(dev,0);
 | 
						|
	if (err < 0) {
 | 
						|
		err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
		goto wraperr;
 | 
						|
	}
 | 
						|
 | 
						|
	/* 4. We put the part of the firmware that lies in the external RAM into the EZ-USB */
 | 
						|
 | 
						|
	for (rec = (const struct ihex_binrec *)firmware_fw->data;
 | 
						|
	     rec; rec = ihex_next_binrec(rec)) {
 | 
						|
		if (!INTERNAL_RAM(be32_to_cpu(rec->addr))) {
 | 
						|
			err = emi26_writememory(dev, be32_to_cpu(rec->addr),
 | 
						|
						rec->data, be16_to_cpu(rec->len),
 | 
						|
						ANCHOR_LOAD_EXTERNAL);
 | 
						|
			if (err < 0) {
 | 
						|
				err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
				goto wraperr;
 | 
						|
			}
 | 
						|
		}
 | 
						|
	}
 | 
						|
	
 | 
						|
	/* Assert reset (stop the CPU in the EMI) */
 | 
						|
	err = emi26_set_reset(dev,1);
 | 
						|
	if (err < 0) {
 | 
						|
		err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
		goto wraperr;
 | 
						|
	}
 | 
						|
 | 
						|
	for (rec = (const struct ihex_binrec *)firmware_fw->data;
 | 
						|
	     rec; rec = ihex_next_binrec(rec)) {
 | 
						|
		if (INTERNAL_RAM(be32_to_cpu(rec->addr))) {
 | 
						|
			err = emi26_writememory(dev, be32_to_cpu(rec->addr),
 | 
						|
						rec->data, be16_to_cpu(rec->len),
 | 
						|
						ANCHOR_LOAD_INTERNAL);
 | 
						|
			if (err < 0) {
 | 
						|
				err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
				goto wraperr;
 | 
						|
			}
 | 
						|
		}
 | 
						|
	}
 | 
						|
 | 
						|
	/* De-assert reset (let the CPU run) */
 | 
						|
	err = emi26_set_reset(dev,0);
 | 
						|
	if (err < 0) {
 | 
						|
		err("%s - error loading firmware: error = %d", __func__, err);
 | 
						|
		goto wraperr;
 | 
						|
	}
 | 
						|
	msleep(250);	/* let device settle */
 | 
						|
 | 
						|
	/* return 1 to fail the driver inialization
 | 
						|
	 * and give real driver change to load */
 | 
						|
	err = 1;
 | 
						|
 | 
						|
wraperr:
 | 
						|
	release_firmware(loader_fw);
 | 
						|
	release_firmware(bitstream_fw);
 | 
						|
	release_firmware(firmware_fw);
 | 
						|
 | 
						|
	kfree(buf);
 | 
						|
	return err;
 | 
						|
}
 | 
						|
 | 
						|
static struct usb_device_id id_table [] = {
 | 
						|
	{ USB_DEVICE(EMI26_VENDOR_ID, EMI26_PRODUCT_ID) },
 | 
						|
	{ USB_DEVICE(EMI26_VENDOR_ID, EMI26B_PRODUCT_ID) },
 | 
						|
	{ }                                             /* Terminating entry */
 | 
						|
};
 | 
						|
 | 
						|
MODULE_DEVICE_TABLE (usb, id_table);
 | 
						|
 | 
						|
static int emi26_probe(struct usb_interface *intf, const struct usb_device_id *id)
 | 
						|
{
 | 
						|
	struct usb_device *dev = interface_to_usbdev(intf);
 | 
						|
 | 
						|
	dev_info(&intf->dev, "%s start\n", __func__);
 | 
						|
 | 
						|
	emi26_load_firmware(dev);
 | 
						|
 | 
						|
	/* do not return the driver context, let real audio driver do that */
 | 
						|
	return -EIO;
 | 
						|
}
 | 
						|
 | 
						|
static void emi26_disconnect(struct usb_interface *intf)
 | 
						|
{
 | 
						|
}
 | 
						|
 | 
						|
static struct usb_driver emi26_driver = {
 | 
						|
	.name		= "emi26 - firmware loader",
 | 
						|
	.probe		= emi26_probe,
 | 
						|
	.disconnect	= emi26_disconnect,
 | 
						|
	.id_table	= id_table,
 | 
						|
};
 | 
						|
 | 
						|
static int __init emi26_init (void)
 | 
						|
{
 | 
						|
	return usb_register(&emi26_driver);
 | 
						|
}
 | 
						|
 | 
						|
static void __exit emi26_exit (void)
 | 
						|
{
 | 
						|
	usb_deregister (&emi26_driver);
 | 
						|
}
 | 
						|
 | 
						|
module_init(emi26_init);
 | 
						|
module_exit(emi26_exit);
 | 
						|
 | 
						|
MODULE_AUTHOR("Tapio Laxström");
 | 
						|
MODULE_DESCRIPTION("Emagic EMI 2|6 firmware loader.");
 | 
						|
MODULE_LICENSE("GPL");
 | 
						|
 | 
						|
MODULE_FIRMWARE("emi26/loader.fw");
 | 
						|
MODULE_FIRMWARE("emi26/bitstream.fw");
 | 
						|
MODULE_FIRMWARE("emi26/firmware.fw");
 | 
						|
/* vi:ai:syntax=c:sw=8:ts=8:tw=80
 | 
						|
 */
 |