- 21 Nov, 2016 10 commits
-
-
Sean Young authored
If you unplug an lirc device while reading from it, you will get an use after free as the cdev is freed while still in use. Signed-off-by:
Sean Young <sean@mess.org> Signed-off-by:
Mauro Carvalho Chehab <mchehab@s-opensource.com>
-
Sean Young authored
[ 101.457944] ------------[ cut here ]------------ [ 101.457954] WARNING: CPU: 3 PID: 1819 at kernel/sched/core.c:7708 __might_sleep+0x7e/0x80 [ 101.457960] do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffffc0364bc2>] lirc_dev_fop_read+0x292/0x4e0 [lirc_dev] Signed-off-by:
-
Sean Young authored
In learning mode, you can get much longer messages which can run out of lengths. The usb message will slightly larger. Signed-off-by:
-
Sean Young authored
The wideband receiver is a little awkward on the redrat3. Data arrives on a different endpoint, and the learning command must be reissued every time data is learned. Signed-off-by:
-
Sean Young authored
If redrat3_delete() is called, ensure ep_in and udev members are set up so we don't dereference null in the error path. Also ensure that rc dev device exists before we enable the receiver and that the led urb exists before we create the led device. Signed-off-by:
-
Sean Young authored
Cleanup the error logic, removing checks for things that should be always initialized when the routines are called, and remove some bogus messages. [mchehab@s-opensource.com: fix some merge conflicts] Signed-off-by:
-
Sean Young authored
No need to duplicate these in the rc name. Signed-off-by:
-
Sean Young authored
Rename the pnp driver in sysfs from /sys/bus/pnp/drivers/Winbond CIR to /sys/bus/pnp/drivers/winbond-cir Signed-off-by:
-
Wei Yongjun authored
Fix to return error code -ENODEV from the error handling case instead of 0, as done elsewhere in this function. Signed-off-by:
Wei Yongjun <weiyongjun1@huawei.com> Acked-by:
Patrice Chotard <patrice.chotard@st.com> Signed-off-by:
-
Wei Yongjun authored
'buf' is malloced in dibusb_rc_query() and should be freed before leaving from the error handling cases, otherwise it will cause memory leak. Fixes: ff1c1235 ("[media] dibusb: handle error code on RC query") Signed-off-by:
-
- 19 Nov, 2016 1 commit
-
-
Arnd Bergmann authored
A previous patch tried to fix a build error, but introduced another warning: drivers/media/platform/mtk-mdp/mtk_mdp_core.c:71:13: error: ‘mtk_mdp_clock_off’ defined but not used [-Werror=unused-function] drivers/media/platform/mtk-mdp/mtk_mdp_core.c:62:13: error: ‘mtk_mdp_clock_on’ defined but not used [-Werror=unused-function] This marks all the PM functions as __maybe_unused and removes the #ifdef around them, as that will always do the right thing. Fixes: 1b06fcf5 ("[media] media: mtk-mdp: fix build error") Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
- 18 Nov, 2016 29 commits
-
-
Mauro Carvalho Chehab authored
While this patch sounded a good idea, unfortunately, it causes bad dependencies, as drivers that would otherwise work without the DVB core will now break: ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5767.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5761.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda827x.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda18218.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/qt1010.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2266.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt20xx.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2060.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mc44s803.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0013.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0012.ko] undefined! ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0011.ko] undefined! So, we have to revert it. Note: as the argument for the release ops changed from "int" to "void", we needed to change it at the revert patch, to avoid compilation issues like: drivers/media/tuners/tea5767.c:437:23: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] .release = tea5767_release, ^~~~~~~~~~~~~~~ This reverts commit 22a613e8. Signed-off-by:
-
Mauro Carvalho Chehab authored
On some weird randconfigs, it is possible to select DVB drivers, without having the DVB_CORE: CONFIG_DVB_AU8522=m CONFIG_DVB_AU8522_V4L=m CONFIG_DVB_TUNER_DIB0090=m This was never supposed to work, but changeset 22a613e8 ("[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations") caused it to be exposed: drivers/built-in.o: In function `fc0011_attach': (.text+0x1598fb): undefined reference to `dvb_tuner_simple_release' drivers/built-in.o:(.rodata+0x55e58): undefined reference to `dvb_tuner_simple_release' drivers/built-in.o:(.rodata+0x57398): undefined reference to `dvb_tuner_simple_release' Fixes: 22a613e8 ("[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations") Reported-by:
kbuild test robot <fengguang.wu@intel.com> Signed-off-by:
-
Heiner Kallweit authored
Kernel takes care that interrupts from one source are serialized. So there's no need to use spinlock_irq_save. Signed-off-by:
Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by:
-
Heiner Kallweit authored
Spinlock nvt_lock is a member of struct nvt_dev and there's no need to prefix it with nvt_. So remove this prefix. [mchehab@s-opensource.org: change the prefix also at the open function, as the patch removing it were not applied (yet?)] Signed-off-by:
-
Heiner Kallweit authored
Using a separate spinlock to protect access to substruct tx of struct nvt_dev doesn't provide any actual benefit. We can use spinlock nvt_lock to protect all access to struct nvt_dev and get rid of nvt->tx.lock. Signed-off-by:
-
Heiner Kallweit authored
Member pdev of struct nvt_dev is needed only to access &pdev->dev. We can get rid of this it by using rdev->dev.parent instead (both point to the same struct device). Setting rdev->dev.parent can be removed from the probe function as this is done by devm_rc_allocate_device now. Signed-off-by:
-
Max Kellermann authored
While removing all interfaces in media_device_unregister(), all media_interface pointers are freed. This is illegal and results in double kfree() if any media_interface is still linked at this point; maybe because a userspace process still has a file handle. Once the process closes the file handle, dvb_media_device_free() gets called, which frees the dvb_device.intf_devnode again. This patch removes the unnecessary kfree() call, and documents who's responsible for really freeing it. Signed-off-by:
Max Kellermann <max.kellermann@gmail.com> Signed-off-by:
-
Max Kellermann authored
media_gobj_destroy() may be called twice on one instance - once by media_device_unregister() and again by dvb_media_device_free(). The function media_remove_intf_links() establishes and documents the convention that mdev==NULL means that the object is not registered, but nobody ever NULLs this variable. So this patch really implements this behavior, and adds another mdev==NULL check to media_gobj_destroy() to protect against double removal. Signed-off-by:
-
Max Kellermann authored
This commit amends my old commit fe35637b ("[media] dvb_frontend: eliminate blocking wait in dvb_unregister_frontend()"), which added kref to struct dvb_frontend_private. It turned out that there are several use-after-free bugs left, which affect the struct dvb_frontend. Protecting it with kref also protects struct dvb_frontend_private, so we can simply move it. This is how the use-after-free looks like in KASAN: BUG: KASAN: use-after-free in string+0x60/0xb1 at addr ffff880033bd9fc0 Read of size 1 by task kworker/0:2/617 CPU: 0 PID: 617 Comm: kworker/0:2 Not tainted 4.8.0-rc1-hosting+ #60 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event 0000000000000000 ffff880033757218 ffffffff81394e50 ffff880033bd9fd0 ffff880035c03b00 ffff880033757240 ffffffff811f271d ffff880033bd9fc0 1ffff1000677b3f8 ffffed000677b3f8 ffff8800337572b8 ffffffff811f2afe Call Trace: [...] [<ffffffff813a2d2f>] vsnprintf+0x39d/0x7e9 [<ffffffff813993f9>] add_uevent_var+0x10f/0x1dc [<ffffffff814fe5ca>] rc_dev_uevent+0x55/0x6f [<ffffffff814438f8>] dev_uevent+0x2e1/0x316 [<ffffffff81399744>] kobject_uevent_env+0x27e/0x701 [<ffffffff81399bd2>] kobject_uevent+0xb/0xd [<ffffffff81443445>] device_del+0x322/0x383 [<ffffffff81500c0c>] rc_unregister_device+0x98/0xc3 [<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90 [<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5 [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80 [...] Object at ffff880033bd9fc0, in cache kmalloc-16 size: 16 Allocated: [...] Freed: PID = 617 [...] [<ffffffff811f034c>] kfree+0xd9/0x166 [<ffffffff814fe513>] ir_free_table+0x2f/0x51 [<ffffffff81500bc1>] rc_unregister_device+0x4d/0xc3 [<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90 [<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5 [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80 Another one: BUG: KASAN: use-after-free in do_sys_poll+0x336/0x6b8 at addr ffff88003563fcc0 Read of size 8 by task tuner on fronte/1042 CPU: 1 PID: 1042 Comm: tuner on fronte Tainted: G B 4.8.0-rc1-hosting+ #60 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 0000000000000000 ffff88003353f910 ffffffff81394e50 ffff88003563fd80 ffff880035c03200 ffff88003353f938 ffffffff811f271d ffff88003563fc80 1ffff10006ac7f98 ffffed0006ac7f98 ffff88003353f9b0 ffffffff811f2afe Call Trace: [...] [<ffffffff812289b3>] do_sys_poll+0x336/0x6b8 [...] [<ffffffff81228ed9>] SyS_poll+0xa9/0x194 [...] Object at ffff88003563fc80, in cache kmalloc-256 size: 256 Allocated: [...] Freed: PID = 617 [...] [<ffffffff811f034c>] kfree+0xd9/0x166 [<ffffffff814eb60d>] dvb_unregister_device+0xd6/0xe5 [<ffffffff814fa4ed>] dvb_unregister_frontend+0x4b/0x66 [<ffffffff8150810b>] dvb_usb_adapter_frontend_exit+0x69/0xac [<ffffffff8150617d>] dvb_usb_exit+0x43/0xe5 [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80 Signed-off-by:
-
Max Kellermann authored
Ensure that STB0899_POSTPROC_GPIO_POWER is set synchronously. Signed-off-by:
-
Max Kellermann authored
Prepare for making "release" asynchronous (via kref). Some operations may need to be run synchronously in dvb_frontend_detach(), and that's why we need a "detach" callback. Signed-off-by:
-
Max Kellermann authored
This code duplication is confusing and error prone. Let's merge them by moving the release/dvb_detach call into one function with one Signed-off-by:
-
Max Kellermann authored
It is not clear what this return value means. All implemenations return 0, and the one caller ignores the value. Let's remove this useless return value completely. Signed-off-by:
-
Max Kellermann authored
Most release callback functions are identical: free the "tuner_priv" and clear it. Let's eliminate some bloat by providing this simple implementation in the dvb_frontend library. Signed-off-by:
-
Max Kellermann authored
Commit da677fe1 ("[media] dvb-core/en50221: use kref to manage struct dvb_ca_private") moved the dvb_unregister_device() call to the kref callback, but that left lots of stale device state visible to userspace (e.g. in sysfs). By using dvb_remove_device() and dvb_free_device() instead of dvb_unregister_device(), we can avoid that. Signed-off-by:
-
Max Kellermann authored
dvb_unregister_device() has a major problem: it combines unregistering with memory disposal. Sometimes, it is necessary to unregister a device, but no memory can be freed yet, because a process still has a (stale) file handle. Therefore, we need to split dvb_unregister_device(). This will allow sanitizing a few callers. With my new design, dvb_unregister_device() appears misnamed, but to reduce patch noise, I'm not renaming it just yet. Signed-off-by:
-
Max Kellermann authored
These are immutable. Making them "const" allows the compiler to move them to the "rodata" section. Note that cxd2841er_t_c_ops cannot be made "const", because cxd2841er_attach() modifies it. Ouch! [mchehab@s-opensource.com: fix merge conflicts] Signed-off-by:
-
Max Kellermann authored
rc_unregister_device() will first call ir_free_table(), and later device_del(); however, the latter causes a call to rc_dev_uevent(), which prints rc_map.name, which at this point has already bee freed. This fixes a use-after-free bug found with KASAN. As reported by Shuah: "I am seeing the following when I do rmmod on au0828 BUG: KASAN: use-after-free in string+0x170/0x1f0 at addr ffff8801bd513000 Read of size 1 by task rmmod/1831 CPU: 1 PID: 1831 Comm: rmmod Tainted: G W 4.9.0-rc5 #5 Hardware name: Hewlett-Packard HP ProBook 6475b/180F, BIOS 68TTU Ver. F.04 08/03/2012 ffff8801aea2f680 ffffffff81b37ad3 ffff8801fa403b80 ffff8801bd513000 ffff8801aea2f6a8 ffffffff8156c301 ffff8801aea2f738 ffff8801bd513000 ffff8801fa403b80 ffff8801aea2f728 ffffffff8156c59a ffff8801aea2f770 Call Trace: dump_stack+0x67/0x94 [<ffffffff8156c301>] kasan_object_err+0x21/0x70 [<ffffffff8156c59a>] kasan_report_error+0x1fa/0x4d0 [<ffffffffa116f05f>] ? au0828_exit+0x10/0x21 [au0828] [<ffffffff8156c8b3>] __asan_report_load1_noabort+0x43/0x50 [<ffffffff81b58b20>] ? string+0x170/0x1f0 [<ffffffff81b58b20>] string+0x170/0x1f0 [<ffffffff81b621c4>] vsnprintf+0x374/0x1c50 [<ffffffff81b61e50>] ? pointer+0xa80/0xa80 [<ffffffff8156b676>] ? save_stack+0x46/0xd0 [<ffffffff81566faa>] ? __kmalloc+0x14a/0x2a0 [<ffffffff81b3d70a>] ? kobject_get_path+0x9a/0x200 [<ffffffff81b408c2>] ? kobject_uevent_env+0x282/0xca0 [<ffffffff81b412eb>] ? kobject_uevent+0xb/0x10 [<ffffffff81f10104>] ? device_del+0x434/0x6d0 [<ffffffffa0fea717>] ? rc_unregister_device+0x177/0x240 [rc_core] [<ffffffffa116eeb0>] ? au0828_rc_unregister+0x60/0xb0 [au0828] The problem is fixed with this patch on Linux 4.9-rc4" Signed-off-by:
Shuah Khan <shuahkh@osg.samsung.com> Signed-off-by:
-
Peter Chen authored
It should call of_node_put on non-null poiner. Cc: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by:
Peter Chen <peter.chen@nxp.com> Acked-by:
Benoit Parrot <bparrot@ti.com> Signed-off-by:
-
Dan Carpenter authored
devm_pinctrl_get() can fail so we should check for that. Fixes: 0a6824bc ('[media] v4l2: blackfin: select proper pinctrl state in ppi_set_params if CONFIG_PINCTRL is enabled') Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Andi Shyti authored
There is no need to check for CONFIG_COMPAT and consequently assign the compat_ioctl. Signed-off-by:
Andi Shyti <andi.shyti@samsung.com> Signed-off-by:
-
Maciej S. Szmigiero authored
When saa7134 module driving a Medion 7134 card is reloaded reads of this card EEPROM (required for automatic detection of tuner model) will be corrupted due to I2C gate in DVB-T demod being left closed. This sometimes also happens on first saa7134 module load after a warm reboot. Fix this by opening this I2C gate before doing EEPROM read during i2c initialization. Signed-off-by:
Maciej S. Szmigiero <mail@maciej.szmigiero.name> Signed-off-by:
-
CrazyCat authored
This patch fix streaming issue for Geniatech T230/PT360. Signed-off-by:
CrazyCat <crazycat69@narod.ru> Signed-off-by:
-
Peter Griffin authored
Now that CLK_PROC_STFE is defined as a critical clock in DT, we can remove the commented clk_disable_unprepare from the c8sectpfe driver. This means we now have balanced clk*enable/disable calls in the driver, but on STiH407 family the clock in reality will never actually be disabled. This is due to a HW bug where once the IP has been configured and the SLIM core is running, disabling the clock causes a unrecoverable bus lockup. Signed-off-by:
Peter Griffin <peter.griffin@linaro.org> Acked-by:
-
Jean-Baptiste Abbadie authored
Removes the superfluous statement about writing to the FSF in the GPL notice Signed-off-by:
Jean-Baptiste Abbadie <jb@abbadie.fr> Acked-by:
-
Jean-Baptiste Abbadie authored
Align multiple lines statement with parentheses Signed-off-by:
-
Jean-Baptiste Abbadie authored
This replaces the S_* style permissions by numbers for the __ATTR macros Signed-off-by:
-
Sakari Ailus authored
Document the interface between the CSI-2 transmitter and receiver drivers. Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Markus Elfring authored
A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. Signed-off-by:
Markus Elfring <elfring@users.sourceforge.net> Signed-off-by:
David Härdeman <david@hardeman.nu> Signed-off-by:
-
