1. 28 Jun, 2016 7 commits
  2. 24 Jun, 2016 19 commits
    • Mauro Carvalho Chehab's avatar
      bdisp: move the V/H filter spec to bdisp-hw.c · 068adc45
      Mauro Carvalho Chehab authored
      Those structs are used only at bdisp-hw, so they shouldn't be
      there in a header file that it is used elsewhere.
      
      This fixes the following Gcc 6.1 warnings:
      
      In file included from drivers/media/platform/sti/bdisp/bdisp-debug.c:11:0:
      drivers/media/platform/sti/bdisp/bdisp-filter.h:207:65: warning: ‘bdisp_v_spec’ defined but not used [-Wunused-const-variable=]
       static const struct __maybe_unused bdisp_filter_v_spec bdisp_v_spec[] = {
                                                                       ^~~~~~~~~
      In file included from drivers/media/platform/sti/bdisp/bdisp-debug.c:11:0:
      drivers/media/platform/sti/bdisp/bdisp-filter.h:23:65: warning: ‘bdisp_h_spec’ defined but not used [-Wunused-const-variable=]
       static const struct __maybe_unused bdisp_filter_h_spec bdisp_h_spec[] = {
                                                                       ^~~~~~~~~
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      068adc45
    • Mauro Carvalho Chehab's avatar
      adv7842: comment out a table useful for debug · 60eb9579
      Mauro Carvalho Chehab authored
      Gcc 6.1 warns about an unused table:
      
      drivers/media/i2c/adv7842.c:2400:27: warning: 'prim_mode_txt' defined but not used [-Wunused-const-variable=]
       static const char * const prim_mode_txt[] = {
                                 ^~~~~~~~~~~~~
      
      That seems to be useful for debug, and likely were used before.
      While we could simply remove, let's comment it out, for now.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      60eb9579
    • Mauro Carvalho Chehab's avatar
      em28xx-dvb: remove some left over · 5776fbec
      Mauro Carvalho Chehab authored
      Gcc 6.1 warns about an unused table:
      
      drivers/media/usb/em28xx/em28xx-dvb.c:907:38: warning: 'pctv_461e_m88ds3103_config' defined but not used [-Wunused-const-variable=]
       static const struct m88ds3103_config pctv_461e_m88ds3103_config = {
                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~
      
      That's a left over of patch 76b91be3 ('em28xx: PCTV 461e use I2C
      client for demod and SEC').
      
      Remove the dead code.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      5776fbec
    • Mauro Carvalho Chehab's avatar
      vivid: remove some unused vars · ba4cd399
      Mauro Carvalho Chehab authored
      Gcc 6.1 warns about some unused vars. Remove them:
      drivers/media/platform/vivid/vivid-vid-cap.c:40:2: warning: 'tpf_default' defined but not used [-Wunused-const-variable=]
        tpf_default = {.numerator = 1,  .denominator = 30};
        ^~~~~~~~~~~
      drivers/media/platform/vivid/vivid-sdr-cap.c:54:27: warning: 'NUM_FORMATS' defined but not used [-Wunused-const-variable=]
       static const unsigned int NUM_FORMATS = ARRAY_SIZE(formats);
                                 ^~~~~~~~~~~
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      ba4cd399
    • Mauro Carvalho Chehab's avatar
      zr36016: remove some unused tables · 40bcfdac
      Mauro Carvalho Chehab authored
      Gcc 6.1 warns about some unused tables:
      
      drivers/media/pci/zoran/zr36016.c:251:18: warning: 'zr016_yoff' defined but not used [-Wunused-const-variable=]
       static const int zr016_yoff[] = { 8, 9, 7 };
                        ^~~~~~~~~~
      drivers/media/pci/zoran/zr36016.c:250:18: warning: 'zr016_xoff' defined but not used [-Wunused-const-variable=]
       static const int zr016_xoff[] = { 20, 20, 20 };
                        ^~~~~~~~~~
      
      Those tables aren't used anywere. So, remove them.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      40bcfdac
    • Mauro Carvalho Chehab's avatar
      r820t: comment out two ancillary tables · 29025f69
      Mauro Carvalho Chehab authored
      As Gcc6.1 warned, those tables are currently unused:
      	drivers/media/tuners/r820t.c:349:18: warning: 'r820t_mixer_gain_steps' defined but not used [-Wunused-const-variable=]
      	 static const int r820t_mixer_gain_steps[]  = {
      	                  ^~~~~~~~~~~~~~~~~~~~~~
      	drivers/media/tuners/r820t.c:345:18: warning: 'r820t_lna_gain_steps' defined but not used [-Wunused-const-variable=]
      	 static const int r820t_lna_gain_steps[]  = {
      	                  ^~~~~~~~~~~~~~~~~~~~
      
      They're actually used only by a routine that it is currently
      commented out. So, move those tables to be together with such
      code and comment them out.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      29025f69
    • Mauro Carvalho Chehab's avatar
      dib0090: comment out the unused tables · cf47faca
      Mauro Carvalho Chehab authored
      Those tables are currently unused, so comment them out:
      
      drivers/media/dvb-frontends/dib0090.c:852:18: warning: 'rf_ramp_pwm_sband' defined but not used [-Wunused-const-variable=]
       static const u16 rf_ramp_pwm_sband[] = {
                        ^~~~~~~~~~~~~~~~~
      drivers/media/dvb-frontends/dib0090.c:800:18: warning: 'bb_ramp_pwm_boost' defined but not used [-Wunused-const-variable=]
       static const u16 bb_ramp_pwm_boost[] = {
                        ^~~~~~~~~~~~~~~~~
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      cf47faca
    • Mauro Carvalho Chehab's avatar
      drxj: comment out the unused nicam_presc_table_val table · 01d7d436
      Mauro Carvalho Chehab authored
      Avoid this warning:
      
      drivers/media/dvb-frontends/drx39xyj/drxj.c:1243:18: warning: 'nicam_presc_table_val' defined but not used [-Wunused-const-variable=]
       static const u16 nicam_presc_table_val[43] = {
                        ^~~~~~~~~~~~~~~~~~~~~
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      01d7d436
    • Mauro Carvalho Chehab's avatar
      cx25821-alsa: shutup a Gcc 6.1 warning · 114e877a
      Mauro Carvalho Chehab authored
      The PCI device ID table is only used if compiled with modules
      support. When compiled with modules disabled, this is now
      producing this bogus warning:
      
      drivers/media/pci/cx25821/cx25821-alsa.c:696:35: warning: 'cx25821_audio_pci_tbl' defined but not used [-Wunused-const-variable=]
       static const struct pci_device_id cx25821_audio_pci_tbl[] = {
                                         ^~~~~~~~~~~~~~~~~~~~~
      
      Fix it by annotating that the function may not be used.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      114e877a
    • Mauro Carvalho Chehab's avatar
      m5602_ov7660: move skeletons to the .c file · 123818ee
      Mauro Carvalho Chehab authored
      The header file has some private static structures that
      are used only by the C file. Move those structures to the C file,
      in order to shut up gcc 6.1 warnings.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      123818ee
    • Mauro Carvalho Chehab's avatar
      m5602_po1030: move skeletons to the .c file · 804c7812
      Mauro Carvalho Chehab authored
      The header file has some private static structures that
      are used only by the C file. Move those structures to the C file,
      in order to shut up gcc 6.1 warnings.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      804c7812
    • Mauro Carvalho Chehab's avatar
      m5602_s5k83a: move skeletons to the .c file · 1ab9e600
      Mauro Carvalho Chehab authored
      The header file has some private static structures that
      are used only by the C file. Move those structures to the C file,
      in order to shut up gcc 6.1 warnings.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      1ab9e600
    • Mauro Carvalho Chehab's avatar
      m5602_ov9650: move skeletons to the .c file · 14ccffa3
      Mauro Carvalho Chehab authored
      The header file has some private static structures that
      are used only by the C file. Move those structures to the C file,
      in order to shut up gcc 6.1 warnings.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      14ccffa3
    • Mauro Carvalho Chehab's avatar
      m5602_mt9m111: move skeletons to the .c file · 349e4dc5
      Mauro Carvalho Chehab authored
      The header file has some private static structures that
      are used only by the C file. Move those structures to the C file,
      in order to shut up gcc 6.1 warnings.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      349e4dc5
    • Mauro Carvalho Chehab's avatar
      m5602_s5k4aa: move skeletons to the .c file · 0eed95b2
      Mauro Carvalho Chehab authored
      The mc5602_s5k4aa.h has some private static structures that
      are used only by the C file. Move those structures to the C file,
      in order to shut up gcc 6.1 warnings.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      0eed95b2
    • Mauro Carvalho Chehab's avatar
      m5602_core: move skeletons to the .c file · 511ebc09
      Mauro Carvalho Chehab authored
      The mc5602_brigde.h is included at m5602 submodules. This
      causes Gcc 6.1 to complain:
      
      drivers/media/usb/gspca/m5602/m5602_bridge.h:124:28: warning: 'sensor_urb_skeleton' defined but not used [-Wunused-const-variable=]
       static const unsigned char sensor_urb_skeleton[] = {
                                  ^~~~~~~~~~~~~~~~~~~
      drivers/media/usb/gspca/m5602/m5602_bridge.h:119:28: warning: 'bridge_urb_skeleton' defined but not used [-Wunused-const-variable=]
       static const unsigned char bridge_urb_skeleton[] = {
                                 ^~~~~~~~~~~~~~~~~~~
      
      Let's shut up gcc 6.1 warnings by moving those data structures
      to the core, as they're used only there.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      511ebc09
    • Mauro Carvalho Chehab's avatar
      cx18: use macros instead of static const vars · 318de791
      Mauro Carvalho Chehab authored
      Gcc 6.1 now complains about unused vars:
      
      drivers/media/pci/cx18/cx18-driver.h:497:18: warning: 'vbi_hblank_samples_50Hz' defined but not used [-Wunused-const-variable=]
       static const u32 vbi_hblank_samples_50Hz = 284; /* 4 byte EAV + 280 anc/fill */
                        ^~~~~~~~~~~~~~~~~~~~~~~
      drivers/media/pci/cx18/cx18-driver.h:496:18: warning: 'vbi_hblank_samples_60Hz' defined but not used [-Wunused-const-variable=]
       static const u32 vbi_hblank_samples_60Hz = 272; /* 4 byte EAV + 268 anc/fill */
                        ^~~~~~~~~~~~~~~~~~~~~~~
      In file included from drivers/media/pci/cx18/cx18-cards.c:25:0:
      drivers/media/pci/cx18/cx18-driver.h:497:18: warning: 'vbi_hblank_samples_50Hz' defined but not used [-Wunused-const-variable=]
       static const u32 vbi_hblank_samples_50Hz = 284; /* 4 byte EAV + 280 anc/fill */
                        ^~~~~~~~~~~~~~~~~~~~~~~
      drivers/media/pci/cx18/cx18-driver.h:496:18: warning: 'vbi_hblank_samples_60Hz' defined but not used [-Wunused-const-variable=]
       static const u32 vbi_hblank_samples_60Hz = 272; /* 4 byte EAV + 268 anc/fill */
                        ^~~~~~~~~~~~~~~~~~~~~~~
      drivers/media/pci/cx18/cx18-driver.h:495:18: warning: 'vbi_active_samples' defined but not used [-Wunused-const-variable=]
       static const u32 vbi_active_samples = 1444; /* 4 byte SAV + 720 Y + 720 U/V */
                        ^~~~~~~~~~~~~~~~~~
      
      In this specific case, this is somewhat intentional, as those
      values are actually used in parts of the driver. The code assumes
      that gcc optimizer it and not actually create any var, but convert
      it to immediate access at the routines.
      
      Yet, as we want to shut up gcc warnings, let's use #define, with
      is the standard way to store values that will use assembler's
      immediate access code.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      318de791
    • Mauro Carvalho Chehab's avatar
      exynos4-is: remove some unused vars · 21ed2034
      Mauro Carvalho Chehab authored
      Gcc 6.1 warns about some unused vars and functions. Remove them:
      
      drivers/media/platform/exynos4-is/mipi-csis.c:665:46: warning: 's5pcsis_sd_internal_ops' defined but not used [-Wunused-const-variable=]
       static const struct v4l2_subdev_internal_ops s5pcsis_sd_internal_ops = {
                                                    ^~~~~~~~~~~~~~~~~~~~~~~
      
      drivers/media/platform/exynos4-is/mipi-csis.c:652:12: warning: 's5pcsis_open' defined but not used [-Wunused-function]
       static int s5pcsis_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
                  ^~~~~~~~~~~~
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      21ed2034
    • Mauro Carvalho Chehab's avatar
      usbvision: remove some unused vars · d69bb093
      Mauro Carvalho Chehab authored
      Gcc 6.1 warns about some unused vars. Remove them:
      
      drivers/media/usb/usbvision/usbvision-core.c:94:18: warning: 'min_imgheight' defined but not used [-Wunused-const-variable=]
       static const int min_imgheight = MIN_FRAME_HEIGHT;
                        ^~~~~~~~~~~~~
      drivers/media/usb/usbvision/usbvision-core.c:93:18: warning: 'min_imgwidth' defined but not used [-Wunused-const-variable=]
       static const int min_imgwidth = MIN_FRAME_WIDTH;
                        ^~~~~~~~~~~~
      drivers/media/usb/usbvision/usbvision-core.c:92:18: warning: 'max_imgheight' defined but not used [-Wunused-const-variable=]
       static const int max_imgheight = MAX_FRAME_HEIGHT;
                        ^~~~~~~~~~~~~
      drivers/media/usb/usbvision/usbvision-core.c:91:18: warning: 'max_imgwidth' defined but not used [-Wunused-const-variable=]
       static const int max_imgwidth = MAX_FRAME_WIDTH;
                        ^~~~~~~~~~~~
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      d69bb093
  3. 16 Jun, 2016 5 commits
  4. 15 Jun, 2016 4 commits
    • Shuah Khan's avatar
      [media] media: fix media devnode ioctl/syscall and unregister race · 6f0dd24a
      Shuah Khan authored
      Media devnode open/ioctl could be in progress when media device unregister
      is initiated. System calls and ioctls check media device registered status
      at the beginning, however, there is a window where unregister could be in
      progress without changing the media devnode status to unregistered.
      
      process 1				process 2
      fd = open(/dev/media0)
      media_devnode_is_registered()
      	(returns true here)
      
      					media_device_unregister()
      						(unregister is in progress
      						and devnode isn't
      						unregistered yet)
      					...
      ioctl(fd, ...)
      __media_ioctl()
      media_devnode_is_registered()
      	(returns true here)
      					...
      					media_devnode_unregister()
      					...
      					(driver releases the media device
      					memory)
      
      media_device_ioctl()
      	(By this point
      	devnode->media_dev does not
      	point to allocated memory.
      	use-after free in in mutex_lock_nested)
      
      BUG: KASAN: use-after-free in mutex_lock_nested+0x79c/0x800 at addr
      ffff8801ebe914f0
      
      Fix it by clearing register bit when unregister starts to avoid the race.
      
      process 1                               process 2
      fd = open(/dev/media0)
      media_devnode_is_registered()
              (could return true here)
      
                                              media_device_unregister()
                                                      (clear the register bit,
      						 then start unregister.)
                                              ...
      ioctl(fd, ...)
      __media_ioctl()
      media_devnode_is_registered()
              (return false here, ioctl
      	 returns I/O error, and
      	 will not access media
      	 device memory)
                                              ...
                                              media_devnode_unregister()
                                              ...
                                              (driver releases the media device
      					 memory)
      Signed-off-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
      Suggested-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Reported-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Tested-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      6f0dd24a
    • Shuah Khan's avatar
      [media] media: fix use-after-free in cdev_put() when app exits after driver unbind · 5b28dde5
      Shuah Khan authored
      When driver unbinds while media_ioctl is in progress, cdev_put() fails with
      when app exits after driver unbinds.
      
      Add devnode struct device kobj as the cdev parent kobject. cdev_add() gets
      a reference to it and releases it in cdev_del() ensuring that the devnode
      is not deallocated as long as the application has the device file open.
      
      media_devnode_register() initializes the struct device kobj before calling
      cdev_add(). media_devnode_unregister() does cdev_del() and then deletes the
      device. devnode is released when the last reference to the struct device is
      gone.
      
      This problem is found on uvcvideo, em28xx, and au0828 drivers and fix has
      been tested on all three.
      
      kernel: [  193.599736] BUG: KASAN: use-after-free in cdev_put+0x4e/0x50
      kernel: [  193.599745] Read of size 8 by task media_device_te/1851
      kernel: [  193.599792] INFO: Allocated in __media_device_register+0x54
      kernel: [  193.599951] INFO: Freed in media_devnode_release+0xa4/0xc0
      
      kernel: [  193.601083] Call Trace:
      kernel: [  193.601093]  [<ffffffff81aecac3>] dump_stack+0x67/0x94
      kernel: [  193.601102]  [<ffffffff815359b2>] print_trailer+0x112/0x1a0
      kernel: [  193.601111]  [<ffffffff8153b5e4>] object_err+0x34/0x40
      kernel: [  193.601119]  [<ffffffff8153d9d4>] kasan_report_error+0x224/0x530
      kernel: [  193.601128]  [<ffffffff814a2c3d>] ? kzfree+0x2d/0x40
      kernel: [  193.601137]  [<ffffffff81539d72>] ? kfree+0x1d2/0x1f0
      kernel: [  193.601154]  [<ffffffff8157ca7e>] ? cdev_put+0x4e/0x50
      kernel: [  193.601162]  [<ffffffff8157ca7e>] cdev_put+0x4e/0x50
      kernel: [  193.601170]  [<ffffffff815767eb>] __fput+0x52b/0x6c0
      kernel: [  193.601179]  [<ffffffff8117743a>] ? switch_task_namespaces+0x2a
      kernel: [  193.601188]  [<ffffffff815769ee>] ____fput+0xe/0x10
      kernel: [  193.601196]  [<ffffffff81170023>] task_work_run+0x133/0x1f0
      kernel: [  193.601204]  [<ffffffff8117746e>] ? switch_task_namespaces+0x5e
      kernel: [  193.601213]  [<ffffffff8111b50c>] do_exit+0x72c/0x2c20
      kernel: [  193.601224]  [<ffffffff8111ade0>] ? release_task+0x1250/0x1250
      -
      -
      -
      kernel: [  193.601360]  [<ffffffff81003587>] ? exit_to_usermode_loop+0xe7
      kernel: [  193.601368]  [<ffffffff810035c0>] exit_to_usermode_loop+0x120
      kernel: [  193.601376]  [<ffffffff810061da>] syscall_return_slowpath+0x16a
      kernel: [  193.601386]  [<ffffffff82848b33>] entry_SYSCALL_64_fastpath+0xa6
      Signed-off-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
      Tested-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      5b28dde5
    • Mauro Carvalho Chehab's avatar
      [media] media-device: dynamically allocate struct media_devnode · a087ce70
      Mauro Carvalho Chehab authored
      struct media_devnode is currently embedded at struct media_device.
      
      While this works fine during normal usage, it leads to a race
      condition during devnode unregister. the problem is that drivers
      assume that, after calling media_device_unregister(), the struct
      that contains media_device can be freed. This is not true, as it
      can't be freed until userspace closes all opened /dev/media devnodes.
      
      In other words, if the media devnode is still open, and media_device
      gets freed, any call to an ioctl will make the core to try to access
      struct media_device, with will cause an use-after-free and even GPF.
      
      Fix this by dynamically allocating the struct media_devnode and only
      freeing it when it is safe.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      a087ce70
    • Mauro Carvalho Chehab's avatar
      [media] media-devnode: fix namespace mess · 163f1e93
      Mauro Carvalho Chehab authored
      Along all media controller code, "mdev" is used to represent
      a pointer to struct media_device, and "devnode" for a pointer
      to struct media_devnode.
      
      However, inside media-devnode.[ch], "mdev" is used to represent
      a pointer to struct media_devnode.
      
      This is very confusing and may lead to development errors.
      
      So, let's change all occurrences at media-devnode.[ch] to
      also use "devnode" for such pointers.
      
      This patch doesn't make any functional changes.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      163f1e93
  5. 14 Jun, 2016 1 commit
  6. 10 Jun, 2016 2 commits
  7. 09 Jun, 2016 2 commits