1. 07 Nov, 2017 15 commits
    • Andrey Konovalov's avatar
      media: dib0700: fix invalid dvb_detach argument · eb0c1994
      Andrey Konovalov authored
      dvb_detach(arg) calls symbol_put_addr(arg), where arg should be a pointer
      to a function. Right now a pointer to state->dib7000p_ops is passed to
      dvb_detach(), which causes a BUG() in symbol_put_addr() as discovered by
      syzkaller. Pass state->dib7000p_ops.set_wbd_ref instead.
      
      ------------[ cut here ]------------
      kernel BUG at kernel/module.c:1081!
      invalid opcode: 0000 [#1] PREEMPT SMP KASAN
      Modules linked in:
      CPU: 1 PID: 1151 Comm: kworker/1:1 Tainted: G        W
      4.14.0-rc1-42251-gebb2c243 #224
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
      Workqueue: usb_hub_wq hub_event
      task: ffff88006a336300 task.stack: ffff88006a7c8000
      RIP: 0010:symbol_put_addr+0x54/0x60 kernel/module.c:1083
      RSP: 0018:ffff88006a7ce210 EFLAGS: 00010246
      RAX: 0000000000000000 RBX: ffff880062a8d190 RCX: 0000000000000000
      RDX: dffffc0000000020 RSI: ffffffff85876d60 RDI: ffff880062a8d190
      RBP: ffff88006a7ce218 R08: 1ffff1000d4f9c12 R09: 1ffff1000d4f9ae4
      R10: 1ffff1000d4f9bed R11: 0000000000000000 R12: ffff880062a8d180
      R13: 00000000ffffffed R14: ffff880062a8d190 R15: ffff88006947c000
      FS:  0000000000000000(0000) GS:ffff88006c900000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f6416532000 CR3: 00000000632f5000 CR4: 00000000000006e0
      Call Trace:
       stk7070p_frontend_attach+0x515/0x610
      drivers/media/usb/dvb-usb/dib0700_devices.c:1013
       dvb_usb_adapter_frontend_init+0x32b/0x660
      drivers/media/usb/dvb-usb/dvb-usb-dvb.c:286
       dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:86
       dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:162
       dvb_usb_device_init+0xf70/0x17f0 drivers/media/usb/dvb-usb/dvb-usb-init.c:277
       dib0700_probe+0x171/0x5a0 drivers/media/usb/dvb-usb/dib0700_core.c:886
       usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
       really_probe drivers/base/dd.c:413
       driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
       __device_attach_driver+0x230/0x290 drivers/base/dd.c:653
       bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
       __device_attach+0x26e/0x3d0 drivers/base/dd.c:710
       device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
       bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
       device_add+0xd0b/0x1660 drivers/base/core.c:1835
       usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932
       generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
       usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
       really_probe drivers/base/dd.c:413
       driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
       __device_attach_driver+0x230/0x290 drivers/base/dd.c:653
       bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
       __device_attach+0x26e/0x3d0 drivers/base/dd.c:710
       device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
       bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
       device_add+0xd0b/0x1660 drivers/base/core.c:1835
       usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
       hub_port_connect drivers/usb/core/hub.c:4903
       hub_port_connect_change drivers/usb/core/hub.c:5009
       port_event drivers/usb/core/hub.c:5115
       hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195
       process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119
       worker_thread+0x221/0x1850 kernel/workqueue.c:2253
       kthread+0x3a1/0x470 kernel/kthread.c:231
       ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
      Code: ff ff 48 85 c0 74 24 48 89 c7 e8 48 ea ff ff bf 01 00 00 00 e8
      de 20 e3 ff 65 8b 05 b7 2f c2 7e 85 c0 75 c9 e8 f9 0b c1 ff eb c2 <0f>
      0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 b8 00 00
      RIP: symbol_put_addr+0x54/0x60 RSP: ffff88006a7ce210
      ---[ end trace b75b357739e7e116 ]---
      Signed-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      eb0c1994
    • Andy Shevchenko's avatar
      media: v4l2-ctrls: Don't validate BITMASK twice · 38929ea9
      Andy Shevchenko authored
      There is no need to repeat what check_range() does for us, i.e. BITMASK
      validation in v4l2_ctrl_new().
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Acked-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      38929ea9
    • Shuah Khan's avatar
      media: s5p-mfc: fix lockdep warning · 55a839a0
      Shuah Khan authored
      The driver mmap functions shouldn't take lock when calling vb2_mmap().
      Fix it to not take the lock. The following lockdep warning is fixed
      with this change.
      
      [ 2106.181412] ======================================================
      [ 2106.187563] WARNING: possible circular locking dependency detected
      [ 2106.193718] 4.14.0-rc2-00002-gfab205f-dirty #4 Not tainted
      [ 2106.199175] ------------------------------------------------------
      [ 2106.205328] qtdemux0:sink/2614 is trying to acquire lock:
      [ 2106.210701]  (&dev->mfc_mutex){+.+.}, at: [<bf175544>] s5p_mfc_mmap+0x28/0xd4 [s5p_mfc]
      [ 2106.218672]
      [ 2106.218672] but task is already holding lock:
      [ 2106.224477]  (&mm->mmap_sem){++++}, at: [<c01df2e4>] vm_mmap_pgoff+0x44/0xb8
      [ 2106.231497]
      [ 2106.231497] which lock already depends on the new lock.
      [ 2106.231497]
      [ 2106.239642]
      [ 2106.239642] the existing dependency chain (in reverse order) is:
      [ 2106.247095]
      [ 2106.247095] -> #1 (&mm->mmap_sem){++++}:
      [ 2106.252473]        __might_fault+0x80/0xb0
      [ 2106.256567]        video_usercopy+0x1cc/0x510 [videodev]
      [ 2106.261845]        v4l2_ioctl+0xa4/0xdc [videodev]
      [ 2106.266596]        do_vfs_ioctl+0xa0/0xa18
      [ 2106.270667]        SyS_ioctl+0x34/0x5c
      [ 2106.274395]        ret_fast_syscall+0x0/0x28
      [ 2106.278637]
      [ 2106.278637] -> #0 (&dev->mfc_mutex){+.+.}:
      [ 2106.284186]        lock_acquire+0x6c/0x88
      [ 2106.288173]        __mutex_lock+0x68/0xa34
      [ 2106.292244]        mutex_lock_interruptible_nested+0x1c/0x24
      [ 2106.297893]        s5p_mfc_mmap+0x28/0xd4 [s5p_mfc]
      [ 2106.302747]        v4l2_mmap+0x54/0x88 [videodev]
      [ 2106.307409]        mmap_region+0x3a8/0x638
      [ 2106.311480]        do_mmap+0x330/0x3a4
      [ 2106.315207]        vm_mmap_pgoff+0x90/0xb8
      [ 2106.319279]        SyS_mmap_pgoff+0x90/0xc0
      [ 2106.323439]        ret_fast_syscall+0x0/0x28
      [ 2106.327683]
      [ 2106.327683] other info that might help us debug this:
      [ 2106.327683]
      [ 2106.335656]  Possible unsafe locking scenario:
      [ 2106.335656]
      [ 2106.341548]        CPU0                    CPU1
      [ 2106.346053]        ----                    ----
      [ 2106.350559]   lock(&mm->mmap_sem);
      [ 2106.353939]                                lock(&dev->mfc_mutex);
      [ 2106.353939]                                lock(&dev->mfc_mutex);
      [ 2106.365897]   lock(&dev->mfc_mutex);
      [ 2106.369450]
      [ 2106.369450]  *** DEADLOCK ***
      [ 2106.369450]
      [ 2106.375344] 1 lock held by qtdemux0:sink/2614:
      [ 2106.379762]  #0:  (&mm->mmap_sem){++++}, at: [<c01df2e4>] vm_mmap_pgoff+0x44/0xb8
      [ 2106.387214]
      [ 2106.387214] stack backtrace:
      [ 2106.391550] CPU: 7 PID: 2614 Comm: qtdemux0:sink Not tainted 4.14.0-rc2-00002-gfab205f-dirty #4
      [ 2106.400213] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
      [ 2106.406285] [<c01102c8>] (unwind_backtrace) from [<c010cabc>] (show_stack+0x10/0x14)
      [ 2106.413995] [<c010cabc>] (show_stack) from [<c08543a4>] (dump_stack+0x98/0xc4)
      [ 2106.421187] [<c08543a4>] (dump_stack) from [<c016b2fc>] (print_circular_bug+0x254/0x410)
      [ 2106.429245] [<c016b2fc>] (print_circular_bug) from [<c016c580>] (check_prev_add+0x468/0x938)
      [ 2106.437651] [<c016c580>] (check_prev_add) from [<c016f4dc>] (__lock_acquire+0x1314/0x14fc)
      [ 2106.445883] [<c016f4dc>] (__lock_acquire) from [<c016fefc>] (lock_acquire+0x6c/0x88)
      [ 2106.453596] [<c016fefc>] (lock_acquire) from [<c0869fb4>] (__mutex_lock+0x68/0xa34)
      [ 2106.461221] [<c0869fb4>] (__mutex_lock) from [<c086aa08>] (mutex_lock_interruptible_nested+0x1c/0x24)
      [ 2106.470425] [<c086aa08>] (mutex_lock_interruptible_nested) from [<bf175544>] (s5p_mfc_mmap+0x28/0xd4 [s5p_mfc])
      [ 2106.480494] [<bf175544>] (s5p_mfc_mmap [s5p_mfc]) from [<bf037120>] (v4l2_mmap+0x54/0x88 [videodev])
      [ 2106.489575] [<bf037120>] (v4l2_mmap [videodev]) from [<c01f4798>] (mmap_region+0x3a8/0x638)
      [ 2106.497875] [<c01f4798>] (mmap_region) from [<c01f4d58>] (do_mmap+0x330/0x3a4)
      [ 2106.505068] [<c01f4d58>] (do_mmap) from [<c01df330>] (vm_mmap_pgoff+0x90/0xb8)
      [ 2106.512260] [<c01df330>] (vm_mmap_pgoff) from [<c01f28cc>] (SyS_mmap_pgoff+0x90/0xc0)
      [ 2106.520059] [<c01f28cc>] (SyS_mmap_pgoff) from [<c0108820>] (ret_fast_syscall+0x0/0x28)
      Signed-off-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
      Suggested-by: default avatarHans Verkuil <hansverk@cisco.com>
      Acked-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
      Acked-by: default avatarHans Verkuil <hansverk@cisco.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      55a839a0
    • Daniel Scheller's avatar
      media: dvb-core: always call invoke_release() in fe_free() · 62229de1
      Daniel Scheller authored
      Follow-up to: ead66600 ("media: dvb_frontend: only use kref after initialized")
      
      The aforementioned commit fixed refcount OOPSes when demod driver attaching
      succeeded but tuner driver didn't. However, the use count of the attached
      demod drivers don't go back to zero and thus couldn't be cleanly unloaded.
      Improve on this by calling dvb_frontend_invoke_release() in
      __dvb_frontend_free() regardless of fepriv being NULL, instead of returning
      when fepriv is NULL. This is safe to do since _invoke_release() will check
      for passed pointers being valid before calling the .release() function.
      
      [mchehab@s-opensource.com: changed the logic a little bit to reduce
       conflicts with another bug fix patch under review]
      Fixes: ead66600 ("media: dvb_frontend: only use kref after initialized")
      Signed-off-by: default avatarDaniel Scheller <d.scheller@gmx.net>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      62229de1
    • Gustavo A. R. Silva's avatar
      media: usb: dvb-usb-v2: dvb_usb_core: remove redundant code in dvb_usb_fe_sleep · b4b138a9
      Gustavo A. R. Silva authored
      Check on return value and goto instruction is redundant as the code
      that follows is the goto label err.
      
      Addresses-Coverity-ID: 1268783
      Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      b4b138a9
    • Colin Ian King's avatar
      media: au0828: make const array addr_list static · 213bc75a
      Colin Ian King authored
      Don't populate array addr_list on the stack but instead make it
      static. Makes the object code smaller by over 360 bytes:
      
      Before:
         text    data     bss     dec     hex filename
         8036    1488     192    9716    25f4 au0828-input.o
      
      After:
         text    data     bss     dec     hex filename
         7696    1488     192    9376    24a0 au0828-input.o
      
      (gcc version 7.2.0 x86_64)
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      213bc75a
    • Colin Ian King's avatar
      media: cx88: make const arrays default_addr_list and pvr2000_addr_list static · 4b8a14c8
      Colin Ian King authored
      Don't populate arrays default_addr_list and pvr2000_addr_list on the
      stack but instead make them static. Makes the object code smaller by
      over 340 bytes:
      
      Before:
         text	   data	    bss	    dec	    hex	filename
        12520	   2800	     64	  15384	   3c18	drivers/media/pci/cx88/cx88-input.o
      
      After:
         text	   data	    bss	    dec	    hex	filename
        12142	   2832	     64	  15038	   3abe	drivers/media/pci/cx88/cx88-input.o
      
      (gcc version 7.2.0 x86_64)
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      4b8a14c8
    • Colin Ian King's avatar
      media: drxd: make const array fastIncrDecLUT static · eaa8c79e
      Colin Ian King authored
      Don't populate array fastIncrDecLUT on the stack but instead make it
      static. Makes the object code smaller by over 360 bytes:
      
         text	   data	    bss	    dec	    hex	filename
        32680	    944	     64	  33688	   8398	drxd_hard.o
      
         text	   data	    bss	    dec	    hex	filename
        32223	   1040	     64	  33327	   822f	drxd_hard.o
      
      (gcc version 7.2.0 x86_64)
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      eaa8c79e
    • Colin Ian King's avatar
      media: usb: fix spelling mistake: "synchronuously" -> "synchronously" · b436e26e
      Colin Ian King authored
      Trivial fix to spelling mistake in error message text
      
      [mchehab@s-opensource.org: folded all similar patches into one]
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      b436e26e
    • Randy Dunlap's avatar
      media: ddbridge: fix build warnings · f3eff209
      Randy Dunlap authored
      Fix 2 build warnings.
      These functions are void, so drop the "return"s.
      
      ./drivers/media/pci/ddbridge/ddbridge-io.h: warning: 'return' with a value, in function returning void [enabled by default]:  => 50:2, 55:2
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Reported-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Cc: Daniel Scheller <d.scheller.oss@gmail.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      f3eff209
    • Arnd Bergmann's avatar
      media: av7110: avoid 2038 overflow in debug print · fe365285
      Arnd Bergmann authored
      Using the deprecated do_gettimeofday() in print_time() will overflow
      in 2038 on 32-bit architectures. It'sbetter to use a structure that
      is safe everywhere. While we're at it, fix the missing leading zeroes
      on the sub-second portion.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      fe365285
    • Michele Baldessari's avatar
      media: Don't do DMA on stack for firmware upload in the AS102 driver · b3120d2c
      Michele Baldessari authored
      Firmware load on AS102 is using the stack which is not allowed any
      longer. We currently fail with:
      
      kernel: transfer buffer not dma capable
      kernel: ------------[ cut here ]------------
      kernel: WARNING: CPU: 0 PID: 598 at drivers/usb/core/hcd.c:1595 usb_hcd_map_urb_for_dma+0x41d/0x620
      kernel: Modules linked in: amd64_edac_mod(-) edac_mce_amd as102_fe dvb_as102(+) kvm_amd kvm snd_hda_codec_realtek dvb_core snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_intel snd_hda_codec irqbypass crct10dif_pclmul crc32_pclmul snd_hda_core snd_hwdep snd_seq ghash_clmulni_intel sp5100_tco fam15h_power wmi k10temp i2c_piix4 snd_seq_device snd_pcm snd_timer parport_pc parport tpm_infineon snd tpm_tis soundcore tpm_tis_core tpm shpchp acpi_cpufreq xfs libcrc32c amdgpu amdkfd amd_iommu_v2 radeon hid_logitech_hidpp i2c_algo_bit drm_kms_helper crc32c_intel ttm drm r8169 mii hid_logitech_dj
      kernel: CPU: 0 PID: 598 Comm: systemd-udevd Not tainted 4.13.10-200.fc26.x86_64 #1
      kernel: Hardware name: ASUS All Series/AM1I-A, BIOS 0505 03/13/2014
      kernel: task: ffff979933b24c80 task.stack: ffffaf83413a4000
      kernel: RIP: 0010:usb_hcd_map_urb_for_dma+0x41d/0x620
      systemd-fsck[659]: /dev/sda2: clean, 49/128016 files, 268609/512000 blocks
      kernel: RSP: 0018:ffffaf83413a7728 EFLAGS: 00010282
      systemd-udevd[604]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
      kernel: RAX: 000000000000001f RBX: ffff979930bce780 RCX: 0000000000000000
      kernel: RDX: 0000000000000000 RSI: ffff97993ec0e118 RDI: ffff97993ec0e118
      kernel: RBP: ffffaf83413a7768 R08: 000000000000039a R09: 0000000000000000
      kernel: R10: 0000000000000001 R11: 00000000ffffffff R12: 00000000fffffff5
      kernel: R13: 0000000001400000 R14: 0000000000000001 R15: ffff979930806800
      kernel: FS:  00007effaca5c8c0(0000) GS:ffff97993ec00000(0000) knlGS:0000000000000000
      kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      kernel: CR2: 00007effa9fca962 CR3: 0000000233089000 CR4: 00000000000406f0
      kernel: Call Trace:
      kernel:  usb_hcd_submit_urb+0x493/0xb40
      kernel:  ? page_cache_tree_insert+0x100/0x100
      kernel:  ? xfs_iunlock+0xd5/0x100 [xfs]
      kernel:  ? xfs_file_buffered_aio_read+0x57/0xc0 [xfs]
      kernel:  usb_submit_urb+0x22d/0x560
      kernel:  usb_start_wait_urb+0x6e/0x180
      kernel:  usb_bulk_msg+0xb8/0x160
      kernel:  as102_send_ep1+0x49/0xe0 [dvb_as102]
      kernel:  ? devres_add+0x3f/0x50
      kernel:  as102_firmware_upload.isra.0+0x1dc/0x210 [dvb_as102]
      kernel:  as102_fw_upload+0xb6/0x1f0 [dvb_as102]
      kernel:  as102_dvb_register+0x2af/0x2d0 [dvb_as102]
      kernel:  as102_usb_probe+0x1f3/0x260 [dvb_as102]
      kernel:  usb_probe_interface+0x124/0x300
      kernel:  driver_probe_device+0x2ff/0x450
      kernel:  __driver_attach+0xa4/0xe0
      kernel:  ? driver_probe_device+0x450/0x450
      kernel:  bus_for_each_dev+0x6e/0xb0
      kernel:  driver_attach+0x1e/0x20
      kernel:  bus_add_driver+0x1c7/0x270
      kernel:  driver_register+0x60/0xe0
      kernel:  usb_register_driver+0x81/0x150
      kernel:  ? 0xffffffffc0807000
      kernel:  as102_usb_driver_init+0x1e/0x1000 [dvb_as102]
      kernel:  do_one_initcall+0x50/0x190
      kernel:  ? __vunmap+0x81/0xb0
      kernel:  ? kfree+0x154/0x170
      kernel:  ? kmem_cache_alloc_trace+0x15f/0x1c0
      kernel:  ? do_init_module+0x27/0x1e9
      kernel:  do_init_module+0x5f/0x1e9
      kernel:  load_module+0x2602/0x2c30
      kernel:  SYSC_init_module+0x170/0x1a0
      kernel:  ? SYSC_init_module+0x170/0x1a0
      kernel:  SyS_init_module+0xe/0x10
      kernel:  do_syscall_64+0x67/0x140
      kernel:  entry_SYSCALL64_slow_path+0x25/0x25
      kernel: RIP: 0033:0x7effab6cf3ea
      kernel: RSP: 002b:00007fff5cfcbbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000af
      kernel: RAX: ffffffffffffffda RBX: 00005569e0b83760 RCX: 00007effab6cf3ea
      kernel: RDX: 00007effac2099c5 RSI: 0000000000009a13 RDI: 00005569e0b98c50
      kernel: RBP: 00007effac2099c5 R08: 00005569e0b83ed0 R09: 0000000000001d80
      kernel: R10: 00007effab98db00 R11: 0000000000000246 R12: 00005569e0b98c50
      kernel: R13: 00005569e0b81c60 R14: 0000000000020000 R15: 00005569dfadfdf7
      kernel: Code: 48 39 c8 73 30 80 3d 59 60 9d 00 00 41 bc f5 ff ff ff 0f 85 26 ff ff ff 48 c7 c7 b8 6b d0 92 c6 05 3f 60 9d 00 01 e8 24 3d ad ff <0f> ff 8b 53 64 e9 09 ff ff ff 65 48 8b 0c 25 00 d3 00 00 48 8b
      kernel: ---[ end trace c4cae366180e70ec ]---
      kernel: as10x_usb: error during firmware upload part1
      
      Let's allocate the the structure dynamically so we can get the firmware
      loaded correctly:
      [   14.243057] as10x_usb: firmware: as102_data1_st.hex loaded with success
      [   14.500777] as10x_usb: firmware: as102_data2_st.hex loaded with success
      Signed-off-by: default avatarMichele Baldessari <michele@acksyn.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      b3120d2c
    • Niklas Söderlund's avatar
      media: v4l: async: fix unregister for implicitly registered sub-device notifiers · 1453ad81
      Niklas Söderlund authored
      The commit aef69d54 ("media: v4l: fwnode: Add a convenience
      function for registering sensors") adds the function
      v4l2_async_notifier_parse_fwnode_sensor_common() to parse and register a
      subdevice and a subdev-notifier by parsing firmware information. This
      new subdev-notifier is stored in the new field 'subdev_notifier' in
      struct v4l2_subdev.
      
      In v4l2_async_unregister_subdev() this field is used to unregister and
      cleanup the subdev-notifier. A check for if the subdev-notifier is
      initialized or not was forgotten leading to a NULL pointer dereference
      in v4l2_async_notifier_cleanup() if a subdevice do not use the optional
      convince function to initialize the field.
      
      Fix this by checking in v4l2_async_notifier_cleanup() that it is
      provided whit a notifier making it safe to call with a NULL parameter.
      
      Fixes: aef69d54 ("media: v4l: fwnode: Add a convenience function for registering sensors")
      Signed-off-by: default avatarNiklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
      Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      1453ad81
    • Colin Ian King's avatar
      media: v4l: async: fix return of unitialized variable ret · 580db6ca
      Colin Ian King authored
      A shadow declaration of variable ret is being assigned a return error
      status and this value is being lost when the error exit goto's jump
      out of the local scope. This leads to an uninitalized error return value
      in the outer scope being returned. Fix this by removing the inner scoped
      declaration of variable ret.
      
      Detected by CoverityScan, CID#1460380 ("Uninitialized scalar variable")
      
      Fixes: fb45f436 ("media: v4l: async: Fix notifier complete callback error handling")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Reviewed-by: default avatarNiklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
      Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      580db6ca
    • Colin Ian King's avatar
      media: imx274: fix missing return assignment from call to imx274_mode_regs · 2b00e30f
      Colin Ian King authored
      The variable ret is being checked for failure however it is not being set
      from the return status from the call to imx274_mode_regs. Currently ret is
      alwayus zero and the check is redundant. Fix this by assigning it.
      
      Detected by CoverityScan, CID#1460278 ("Logically dead code")
      
      Fixes: 0985dd30 ("media: imx274: V4l2 driver for Sony imx274 CMOS sensor")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      2b00e30f
  2. 01 Nov, 2017 10 commits
  3. 31 Oct, 2017 15 commits