- 10 Oct, 2019 18 commits
-
-
Alan Stern authored
Visual inspection of the usbvision driver shows that it suffers from three races between its open, close, and disconnect handlers. In particular, the driver is careful to update its usbvision->user and usbvision->remove_pending flags while holding the private mutex, but: usbvision_v4l2_close() and usbvision_radio_close() don't hold the mutex while they check the value of usbvision->remove_pending; usbvision_disconnect() doesn't hold the mutex while checking the value of usbvision->user; and also, usbvision_v4l2_open() and usbvision_radio_open() don't check whether the device has been unplugged before allowing the user to open the device files. Each of these can potentially lead to usbvision_release() being called twice and use-after-free errors. This patch fixes the races by reading the flags while the mutex is still held and checking for pending removes before allowing an open to succeed. Signed-off-by:
Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
-
Alan Stern authored
The syzbot fuzzer found two invalid-access bugs in the usbvision driver. These bugs occur when userspace keeps the device file open after the device has been disconnected and usbvision_disconnect() has set usbvision->dev to NULL: When the device file is closed, usbvision_radio_close() tries to issue a usb_set_interface() call, passing the NULL pointer as its first argument. If userspace performs a querycap ioctl call, vidioc_querycap() calls usb_make_path() with the same NULL pointer. This patch fixes the problems by making the appropriate tests beforehand. Note that vidioc_querycap() is protected by usbvision->v4l2_lock, acquired in a higher layer of the V4L2 subsystem. Reported-and-tested-by: syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com Signed-off-by:
-
Colin Ian King authored
Don't populate the array st6422_bridge_init on the stack but instead make it static. Makes the object code smaller by 231 bytes. Before: text data bss dec hex filename 3419 752 64 4235 108b gspca/stv06xx/stv06xx_st6422.o After: text data bss dec hex filename 3124 816 64 4004 fa4 gspca/stv06xx/stv06xx_st6422.o (gcc version 9.2.1, amd64) Signed-off-by:
Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
Colin Ian King authored
Don't populate the array mapping on the stack but instead make it static. Makes the object code smaller by 79 bytes. Before: text data bss dec hex filename 27572 2096 0 29668 73e4 drivers/media/pci/cx18/cx18-ioctl.o After: text data bss dec hex filename 27429 2160 0 29589 7395 drivers/media/pci/cx18/cx18-ioctl.o (gcc version 9.2.1, amd64) Signed-off-by:
-
YueHaibing authored
Remove duplicated include. Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Signed-off-by:
-
Jeeeun Evans authored
This patch fixes a warning by coccicheck: drivers/staging/media/imx/imx7-mipi-csis.c:973:1-12: WARNING: Use devm_platform_ioremap_resource for state -> regs Use devm_platform_ioremap_resource helper which wraps platform_get_resource() and devm_ioremap_resource() together. Signed-off-by:
Jeeeun Evans <jeeeunevans@gmail.com> Reviewed-by:
Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by:
-
Christophe JAILLET authored
A call to 'pci_disable_device()' is missing in the error handling path. In some cases, a call to 'free_irq()' may also be missing. Reorder the error handling path, add some new labels and fix the 2 issues mentionned above. This way, the error handling path in more in line with 'cx8800_finidev()' (i.e. the remove function) Signed-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by:
-
Christophe JAILLET authored
The 2nd parameter of 'find_first_zero_bit()' is a number of bits, not of bytes. So use 'csi2rx->max_lanes' instead of 'sizeof(lanes_used)'. Fixes: 1fc3b37f ("media: v4l: cadence: Add Cadence MIPI-CSI2 RX driver") Signed-off-by:
-
Navid Emamdoost authored
In sd_start return value of create_singlethread_workqueue needs null check. Signed-off-by:
Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by:
-
Navid Emamdoost authored
In sd_start the return value of create_singlethread_workqueue needs null check. Signed-off-by:
-
Daniel Gonzalez Cabanelas authored
Add support for the PCI hybrid card NotOnlyTV LV3H. This card consists of: - A/V Controller: Conexant CX-23883 - Tuner: Xceive XC3028L - DVB-T Decoder: Zarlink ZL10353 This patch adds support for DVB-T, Analog TV, FM radio, composite and S-video inputs. The IR input isn't supported. Since the PCI subsystem ID (14f1:8852) is the same as the Geniatech X8000-MT, but they are different boards, the card is only supported via insmod option: options cx88xx card=91 For the record this is the eeprom dump, useful if someone wanted to implement the card auto detection: 07 ff ff ff f1 14 52 88 04 04 32 55 f8 00 a2 02 a1 00 40 63 06 11 44 30 03 df 40 80 00 20 00 73 3c 10 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff a0 00 Signed-off-by:
Daniel Gonzalez Cabanelas <dgcbueu@gmail.com> Signed-off-by:
-
Amol Grover authored
CHECK: Alignment should match open parenthesis Signed-off-by:
Amol Grover <frextrite@gmail.com> Signed-off-by:
-
Geert Uytterhoeven authored
div_u64() does a 64-by-32 division, while the divisor max2175.xtal_freq is unsigned long, thus 64-bit on 64-bit platforms. Hence the proper function to call is div64_ul(). Note that this change does not have any functional impact, as the crystal frequency must be much lower than the 32-bit limit anyway. On 32-bit platforms, the generated code is the same. But at least on arm64, this saves an AND-instruction to truncate xtal_freq to 32-bit. Signed-off-by:
Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by:
Simon Horman <horms+renesas@verge.net.au> Signed-off-by:
-
Yizhuo authored
media: media/pci/ivtv: Variable vbi.type could be uninitialized if macro v4l2_subdev_call set __result an error code Inside function compress_sliced_buf(), variable vbi.type is uninitialized if macro v4l2_subdev_call set __result an error code. However, vbi.type is used in the if statement without any check, which is potentially unsafe. Signed-off-by:
Yizhuo <yzhai003@ucr.edu> Signed-off-by:
-
Gon Solo authored
This includes a hack for the device as it returns only 0xff after a new firmware is loaded. To quote Mauro: "When the [...] firmware that came with the device is replaced by a new one, any I2C data received from the tuner will be replaced by 0xff. Probably, the vendor firmware has some patch specifically designed for this device. So, we can't replace by the generic firmware. The right solution would be to extract the [...] firmware from the original driver and ask the driver to load the specifically designed firmware, but, while we don't have that, the next best solution is to just keep the original firmware at the device." Signed-off-by:
Gon Solo <gonsolo@gmail.com> Signed-off-by:
-
Gon Solo authored
While at it, convert to kernel-doc format and use bits instead of bools. Signed-off-by:
-
Mauro Carvalho Chehab authored
A very old patch sent to the media ML used to contain the I2C speed formula: https://lore.kernel.org/linux-media/1312539895.2763.33.camel@Jason-Linux/ When the ite9135 code was merged with af9035, the formula was lost. As we might need to slow down the speed for some devices, add the formula again. No functional changes. Signed-off-by:
-
Mauro Carvalho Chehab authored
Using bool on struct is not recommended, as it wastes lots of space. So, instead, let's use bits. While here, convert the comments to kernel-doc format. Signed-off-by:
-
- 08 Oct, 2019 1 commit
-
-
Mauro Carvalho Chehab authored
As reported by jenkins@linuxtv.org, the build with i386 fails with: ld: drivers/media/platform/qcom/venus/helpers.o: in function `venus_helper_load_scale_clocks': (.text+0x1d77): undefined reference to `__udivdi3' ld: (.text+0x1dce): undefined reference to `__udivdi3' make: *** [Makefile:1094: vmlinux] Error 1 That's because it divides an u32 bit integer by a u64 one. Reviewed-by:
Stanimir Varbanov <stanimir.varbanov@linaro.org> Signed-off-by:
-
- 07 Oct, 2019 21 commits
-
-
Hans Verkuil authored
When the new CEC_OP_UI_CMD defines were added I forgot to update this header to use these new defines. This is now fixed. Signed-off-by:
-
Hans Verkuil authored
The CEC_MSG_GIVE_DECK_STATUS and CEC_MSG_GIVE_TUNER_DEVICE_STATUS commands both have a status_req argument: ON, OFF, ONCE. If ON or ONCE, then the follower will reply with a STATUS message. Either once or whenever the status changes (status_req == ON). If status_req == OFF, then it will stop sending continuous status updates, but the follower will *not* send a STATUS message in that case. This means that if status_req == OFF, then msg->reply should be 0 as well since no reply is expected in that case. Signed-off-by:
-
Yang Yingliang authored
If usb_set_interface() failed, iface->cur_altsetting will not be assigned and it will be used in flexcop_usb_transfer_init() It may lead a NULL pointer dereference. Check usb_set_interface() return value in flexcop_usb_init() and return failed to avoid using this NULL pointer. Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com> Signed-off-by:
Sean Young <sean@mess.org> Signed-off-by:
-
Akihiro Tsukada authored
Support Friio devices to read from tuner via demod tc90522, by enabling the config option. Signed-off-by:
Akihiro Tsukada <tskd08@gmail.com> Signed-off-by:
-
Akihiro Tsukada authored
This demod implements an i2c adapter for attached tuner and relays i2c messages from users (dvb adapters / bridge chips). Some of them, such as Friio dvb card using gl861, require each pair of i2c messages for one read to be issued as two separate transactions. This patch adds a configuration option to enable this split. Signed-off-by:
-
Akihiro Tsukada authored
The header contained just internal definitions and they are not used anymore. Signed-off-by:
-
Akihiro Tsukada authored
For Friio dvb cards, a distinct I2C algo was provided to support some "long" I2C messages used in relaying tuner I2C via demod. Since the other (generic) i2c algo in this module has been patched to support those messages in a more generic way, this patch replaces and integrates the device-specific i2c algo with the generic one and simplifies the code. Signed-off-by:
-
Antti Palosaari authored
Device I2C adapter is capable of writing and reading large messages. For I2C writes there is 2 methods: simple for max 2 byte messages and usb_control_msg() with payload data for larger I2C messages. Add I2C adapter logic which selects suitable method according to message size. Add also support for plain I2C read. Cc: Akihiro TSUKADA <tskd08@gmail.com> Signed-off-by:
Antti Palosaari <crope@iki.fi> Signed-off-by:
-
Andrei Koshkosh authored
Re-use usb_mutex from dvb_usb_device for this. Tested-by:
Jan Pieter van Woerkom <jp@jpvw.nl> Signed-off-by:
Andrei Koshkosh <andreykosh000@mail.ru> Signed-off-by:
-
Colin Ian King authored
The variable rc is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: -
Nishad Kamdar authored
This patch corrects the SPDX License Identifier style in header files for TV Master Media USB Adapter drivers. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by:
Joe Perches <joe@perches.com> Signed-off-by:
Nishad Kamdar <nishadkamdar@gmail.com> Signed-off-by:
-
Markus Elfring authored
Simplify this function implementation by using a known wrapper function. This issue was detected by using the Coccinelle software. Signed-off-by:
Markus Elfring <elfring@users.sourceforge.net> Acked-by:
Mans Rullgard <mans@mansr.com> Signed-off-by:
-
Nishad Kamdar authored
This patch corrects the SPDX License Identifier style in header file related to Remote Controller Driver for Linux. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by:
-
Navid Emamdoost authored
In cx23888_ir_probe if kfifo_alloc fails the allocated memory for state should be released. Signed-off-by:
-
Dominik Danelski authored
Add support for Magix Wideowandler 2 - analog USB capture card Signed-off-by:
Dominik Danelski <dominik@danelski.pl> Co-author: Cornelius Porosanu <cornelius591@gmail.com> Signed-off-by:
-
Colin Ian King authored
Don't populate the array tab on the stack but instead make it static const. Makes the object size smaller by 170 bytes in total. Before: text data bss dec hex filename 7045 1736 0 8781 224d media/dvb-frontends/cxd2820r_c.o 8800 2216 0 11016 2b08 media/dvb-frontends/cxd2820r_t.o 8981 2120 0 11101 2b5d media/dvb-frontends/cxd2820r_t2.o After: text data bss dec hex filename 6896 1832 0 8728 2218 media/dvb-frontends/cxd2820r_c.o 8651 2312 0 10963 2ad3 media/dvb-frontends/cxd2820r_t.o 8853 2184 0 11037 2b1d media/dvb-frontends/cxd2820r_t2.o (gcc version 9.2.1, amd64) Signed-off-by:
-
Sean Young authored
Currently the IR receiver is put into idle mode after each interrupt. However longer IR like NEC can be distributed over multiple interrupts, so putting the IR into idle in the middle of such a message will break decoding. Every IR message has a trailing space of 0xbf (one less than IR_IDE_LEN{0,1} which is programmed to 0xc0). So, set the timeout to that value and rc-core will put the IR receiver into idle mode automatically. Thanks to Jan Pieter van Woerkom <jp@jpvw.nl> for providing the hardware. Signed-off-by: -
Sean Young authored
Thanks to Jan Pieter van Woerkom <jp@jpvw.nl> for providing the hardware. Signed-off-by:
-
Flavius Georgescu authored
The device it's an iMON UltraBay (0x98 in config byte) with LCD, IR and dual-knobs front panel. To work properly the device also require its own key table, and repeat suppression for all buttons. Signed-off-by:
Flavius Georgescu <pretoriano.mp@gmail.com> Co-developed-by:
Chris Vandomelen <chris@sightworks.com> Signed-off-by:
-
A Sun authored
Fix multiple cases of out of bounds (OOB) read associated with MCE device receive/input data handling. In reference for the OOB cases below, the incoming/read (byte) data format when the MCE device responds to a command is: { cmd_prefix, subcmd, data0, data1, ... } where cmd_prefix are: MCE_CMD_PORT_SYS MCE_CMD_PORT_IR and subcmd examples are: MCE_RSP_GETPORTSTATUS MCE_RSP_EQIRNUMPORTS ... Response size dynamically depends on cmd_prefix and subcmd. So data0, data1, ... may or may not be present on input. Multiple responses may return in a single receiver buffer. The trigger condition for OOB read is typically random or corrupt input data that fills the mceusb receiver buffer. Case 1: mceusb_handle_command() reads data0 (var hi) and data1 (var lo) regardless of whether the response includes such data. If { cmd_prefix, subcmd } is at the end of the receiver buffer, read past end of buffer occurs. This case was reported by KASAN: slab-out-of-bounds Read in mceusb_dev_recv https://syzkaller.appspot.com/bug?extid=c7fdb6cb36e65f2fe8c9 Fix: In mceusb_handle_command(), change variable hi and lo to pointers, and dereference only when required. Case 2: If response with data is truncated at end of buffer after { cmd_prefix, subcmd }, mceusb_handle_command() reads past end of buffer for data0, data1, ... Fix: In mceusb_process_ir_data(), check response size with remaining buffer size before invoking mceusb_handle_command(). + if (i + ir->rem < buf_len) mceusb_handle_command(ir, &ir->buf_in[i - 1]); Case 3: mceusb_handle_command() handles invalid/bad response such as { 0x??, MCE_RSP_GETPORTSTATUS } of length 2 as a response { MCE_CMD_PORT_SYS, MCE_RSP_GETPORTSTATUS, data0, ... } of length 7. Read OOB occurs for non-existent data0, data1, ... Cause is mceusb_handle_command() does not check cmd_prefix value. Fix: mceusb_handle_command() must test both cmd_prefix and subcmd. Case 4: mceusb_process_ir_data() receiver parser state SUBCMD is possible at start (i=0) of receiver buffer resulting in buffer offset=-1 passed to mceusb_dev_printdata(). Bad offset results in OOB read before start of buffer. [1214218.580308] mceusb 1-1.3:1.0: rx data[0]: 00 80 (length=2) [1214218.580323] mceusb 1-1.3:1.0: Unknown command 0x00 0x80 ... [1214218.580406] mceusb 1-1.3:1.0: rx data[14]: 7f 7f (length=2) [1214218.679311] mceusb 1-1.3:1.0: rx data[-1]: 80 90 (length=2) [1214218.679325] mceusb 1-1.3:1.0: End of raw IR data [1214218.679340] mceusb 1-1.3:1.0: rx data[1]: 7f 7f (length=2) Fix: If parser_state is SUBCMD after processing receiver buffer, reset parser_state to CMD_HEADER. In effect, discard cmd_prefix at end of receiver buffer. In mceusb_dev_printdata(), abort if buffer offset is out of bounds. Case 5: If response with data is truncated at end of buffer after { cmd_prefix, subcmd }, mceusb_dev_printdata() reads past end of buffer for data0, data1, ... while decoding the response to print out. Fix: In mceusb_dev_printdata(), remove unneeded buffer offset adjustments (var start and var skip) associated with MCE gen1 header. Test for truncated MCE cmd response (compare offset+len with buf_len) and skip decoding of incomplete response. Move IR data tracing to execute before the truncation test. Signed-off-by:A Sun <as1033x@comcast.net> Signed-off-by:
-
Sean Young authored
Decoding often fails on e.g. redrat3 devices. The dev_dbg() helps with debugging when decoding does fail. Cc: Patrick Lerda <patrick9876@free.fr> Signed-off-by:
-
