Commits · 757d7ace565c06e1302ba7c9244d839455e13881 · Kirill Smelkov / linux

19 Jun, 2013 6 commits

[media] r820t: avoid potential memcpy buffer overflow in shadow_store() · 757d7ace

Gianluca Gennari authored Jun 02, 2013

The memcpy in shadow_store() could exceed buffer limits when r > 0.
Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

757d7ace

[media] r820t: remove redundant initializations in r820t_attach() · e2e324d7

Gianluca Gennari authored Jun 02, 2013

fe->tuner_priv and fe->ops.tuner_ops are initialized twice in r820t_attach().
Remove the redundant initializations and also move fe->ops.tuner_ops
initialization outside of the mutex lock (as in the xc4000 tuner code for example).
Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

e2e324d7

[media] V4L: Remove all links of the media entity when unregistering subdev · c2efd3e6

Sylwester Nawrocki authored May 09, 2013

Remove all links of the subdev's media entity after internal_ops
'unregistered' call and right before unregistering the entity from
a media device.
It is assumed here that an unregistered (orphan) media entity cannot
have links to other entities registered to a media device.
It is also assumed the media links should be created/removed with
the media graph's mutex held.
The above implies that the caller of v4l2_device_unregister_subdev()
must not hold the graph's mutex.
Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

c2efd3e6

[media] media: Add a function removing all links of a media entity · 7349cec1

Sylwester Nawrocki authored May 09, 2013

This function allows to remove all media entity's links to other
entities, leaving no references to a media entity's links array
at its remote entities.
Currently, when a driver of some entity is removed it will free its
media entities links[] array, leaving dangling pointers at other
entities that are part of same media graph. This is troublesome when
drivers of a media device entities are in separate kernel modules,
removing only some modules will leave others in an incorrect state.
This function is intended to be used when an entity is being
unregistered from a media device.
With an assumption that normally the media links should be created
between media entities registered to a media device, with the graph
mutex held.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7349cec1

[media] smiapp: Clean up media entity after unregistering subdev · 2a3e7256

Sakari Ailus authored Jun 11, 2013

media_entity_cleanup() frees the links array which will be accessed by
media_entity_remove_links() called by v4l2_device_unregister_subdev().
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

2a3e7256

[media] davinci_vpfe: Clean up media entity after unregistering subdev · 7bb151b2

Sakari Ailus authored Jun 11, 2013

media_entity_cleanup() frees the links array which will be accessed by
media_entity_remove_links() called by v4l2_device_unregister_subdev().
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

7bb151b2

17 Jun, 2013 34 commits

[media] staging/media: lirc_imon: fix leaks in imon_probe() · e049ca5e

Alexey Khoroshilov authored Jun 02, 2013

Error handling of usb_submit_urb() is not as all others in imon_probe().
It just unlocks mutexes and returns nonzero leaving all already
allocated resources unfreed.
The patch makes sure all the resources are deallocated.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

e049ca5e

[media] pvrusb2: Cocci spatch "memdup.spatch" · 07342664

Thomas Meyer authored Jun 01, 2013

Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>