Skip to content

Commit 76f22c9

Browse files
jhovoldmchehab
authored andcommitted
media: rtl28xxu: fix zero-length control request
The direction of the pipe argument must match the request-type direction bit or control requests may fail depending on the host-controller-driver implementation. Control transfers without a data stage are treated as OUT requests by the USB stack and should be using usb_sndctrlpipe(). Failing to do so will now trigger a warning. The driver uses a zero-length i2c-read request for type detection so update the control-request code to use usb_sndctrlpipe() in this case. Note that actually trying to read the i2c register in question does not work as the register might not exist (e.g. depending on the demodulator) as reported by Eero Lehtinen <[email protected]>. Reported-by: [email protected] Reported-by: Eero Lehtinen <[email protected]> Tested-by: Eero Lehtinen <[email protected]> Fixes: d0f232e ("[media] rtl28xxu: add heuristic to detect chip type") Cc: [email protected] # 4.0 Cc: Antti Palosaari <[email protected]> Signed-off-by: Johan Hovold <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
1 parent fe91179 commit 76f22c9

File tree

1 file changed

+10
-1
lines changed

1 file changed

+10
-1
lines changed

drivers/media/usb/dvb-usb-v2/rtl28xxu.c

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,16 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req)
3737
} else {
3838
/* read */
3939
requesttype = (USB_TYPE_VENDOR | USB_DIR_IN);
40-
pipe = usb_rcvctrlpipe(d->udev, 0);
40+
41+
/*
42+
* Zero-length transfers must use usb_sndctrlpipe() and
43+
* rtl28xxu_identify_state() uses a zero-length i2c read
44+
* command to determine the chip type.
45+
*/
46+
if (req->size)
47+
pipe = usb_rcvctrlpipe(d->udev, 0);
48+
else
49+
pipe = usb_sndctrlpipe(d->udev, 0);
4150
}
4251

4352
ret = usb_control_msg(d->udev, pipe, 0, requesttype, req->value,

0 commit comments

Comments
 (0)