summaryrefslogtreecommitdiffstats
path: root/drivers/media
Commit message (Collapse)AuthorAgeFilesLines
* Merge tag 'media/v4.14-1' of ↵Linus Torvalds2017-09-07550-5133/+36234
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: "Brazil's Independence Day pull request :-) This is one of the biggest media pull requests, with 625 patches affecting almost all parts of media (RC, DVB, V4L2, CEC, docs). This contains: - A lot of new drivers: * DVB frontends: mxl5xx, stv0910, stv6111; * camera flash: as3645a led driver; * HDMI receiver: adv748X; * camera sensor: Omnivision 6650 5M driver (ov6650); * HDMI CEC: ao-cec meson driver; * V4L2: Qualcom camss driver; * Remote controller: gpio-ir-tx, pwm-ir-tx and zx-irdec drivers. - The DDbridge DVB driver got a massive update, with makes it in sync with modern hardware from that vendor; - There's an important milestone on this series: the DVB documentation was written in 2003, but only started to be updated in 2007. It also used to contain several gaps from the time it was kept out of tree, mentioning error codes and device nodes that never existed upstream. On this series, it received a massive update: all non-deprecated digital TV APIs are now in sync with the current implementation; - Some DVB APIs that aren't used by any upstream driver got removed; - Other parts of the media documentation algo got updated, fixing some bugs on its PDF output and making it compatible with Sphinx version 1.6. As the number of hacks required to build PDF output reduced, I hope we'll have less troubles as newer versions of our documentation toolchain are released (famous last words); - As usual, lots of driver cleanups and improvements" * tag 'media/v4.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (624 commits) media: leds: as3645a: add V4L2_FLASH_LED_CLASS dependency media: get rid of removed DMX_GET_CAPS and DMX_SET_SOURCE leftovers media: Revert "[media] v4l: async: make v4l2 coexist with devicetree nodes in a dt overlay" media: staging: atomisp: sh_css_calloc shall return a pointer to the allocated space media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls" media: add qcom_camss.rst to v4l-drivers rst file media: dvb headers: make checkpatch happier media: dvb uapi: move frontend legacy API to another part of the book media: pixfmt-srggb12p.rst: better format the table for PDF output media: docs-rst: media: Don't use \small for V4L2_PIX_FMT_SRGGB10 documentation media: index.rst: don't write "Contents:" on PDF output media: pixfmt*.rst: replace a two dots by a comma media: vidioc-g-fmt.rst: adjust table format media: vivid.rst: add a blank line to correct ReST format media: v4l2 uapi book: get rid of driver programming's chapter media: format.rst: use the right markup for important notes media: docs-rst: cardlists: change their format to flat-tables media: em28xx-cardlist.rst: update to reflect last changes media: v4l2-event.rst: adjust table to fit on PDF output media: docs: don't show ToC for each part on PDF output ...
| * media: get rid of removed DMX_GET_CAPS and DMX_SET_SOURCE leftoversMauro Carvalho Chehab2017-09-051-20/+0Star
| | | | | | | | | | | | | | | | | | | | | | Those two ioctls were never used within the Kernel. Still, there used to have compat32 code there (and an if #0 block at the core). Get rid of them. Fixes: 286fe1ca3fa1 ("media: dmx.h: get rid of DMX_GET_CAPS") Fixes: 13adefbe9e56 ("media: dmx.h: get rid of DMX_SET_SOURCE") Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: Revert "[media] v4l: async: make v4l2 coexist with devicetree nodes ↵Rob Herring2017-09-051-6/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in a dt overlay" This reverts commit d2180e0cf77dc7a7049671d5d57dfa0a228f83c1. The commit was flawed in that if the device_node pointers are different, then in fact a different device is present and the device node could be different in ways other than full_name. As Frank Rowand explained: "When an overlay (1) is removed, all uses and references to the nodes and properties in that overlay are no longer valid. Any driver that uses any information from the overlay _must_ stop using any data from the overlay. Any driver that is bound to a new node in the overlay _must_ unbind. Any driver that became bound to a pre-existing node that was modified by the overlay (became bound after the overlay was applied) _must_ adjust itself to account for any changes to that node when the overlay is removed. One way to do this is to unbind when notified that the overlay is about to be removed, then to re-bind after the overlay is completely removed. If an overlay (2) is subsequently applied, a node with the same full_name as from overlay (1) may exist. There is no guarantee that overlay (1) and overlay (2) are the same overlay, even if that node has the same full_name in both cases." Also, there's not sufficient overlay support in mainline to actually remove and re-apply an overlay to hit this condition as overlays can only be applied from in kernel APIs. Fixes: d2180e0cf77d ("[media] v4l: async: make v4l2 coexist with devicetree nodes in a dt overlay") Cc: Javier Martinez Canillas <javier@osg.samsung.com> Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: Frank Rowand <frowand.list@gmail.com> Signed-off-by: Rob Herring <robh@kernel.org> Acked-by: Javi Merino <javi.merino@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls"Sean Young2017-09-051-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 5be2b76a9ca4ea5fd3e221114d62eeb0d78267ca. Only when the lirc device is freed, should we drop our reference to rc_dev, else we the rc_dev is freed to early. If userspace has a file descriptor open during unplug, it goes bang. ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10 Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609 -snip- mutex_lock_nested+0x1b/0x20 ? mutex_lock_nested+0x1b/0x20 rc_close.part.6+0x20/0x60 [rc_core] rc_close+0x13/0x20 [rc_core] lirc_dev_fop_close+0x62/0xd0 [lirc_dev] __fput+0x236/0x410 ? fput+0xb0/0xb0 ? do_raw_spin_trylock+0x110/0x110 ? set_rq_offline.part.70+0xa0/0xa0 ____fput+0xe/0x10 task_work_run+0x116/0x180 ? task_work_cancel+0x170/0x170 ? _raw_spin_unlock+0x27/0x40 ? switch_task_namespaces+0x5f/0x90 do_exit+0x68b/0xe80 Cc: stable@vger.kernel.org # For Kernel 4.13 Fixes: 5be2b76a9ca4 ("[media] lirc_dev: remove superfluous get/put_device() calls") Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dst_ca: remove CA_SET_DESCR boilerplateMauro Carvalho Chehab2017-09-051-17/+0Star
| | | | | | | | | | | | | | | | This ioctl is not implemented at dst_ca driver. There's just a boilerplate code there. Remove it, as it is unlikely that anyone would implement it those days. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dst_ca: return a proper error code from CA errorsMauro Carvalho Chehab2017-09-051-19/+22
| | | | | | | | | | | | | | | | | | Right now, on several places, the driver is returning a "-1" error to userspace, instead of a proper error code. Fix it. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: ca.h: get rid of CA_SET_PIDMauro Carvalho Chehab2017-09-051-16/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This ioctl seems to be some attempt to support a feature at the bt8xx dst_ca driver. Yet, as said there, it "needs more work". Right now, the code there is just a boilerplate. At the end of the day, no driver uses this ioctl, nor it is documented anywhere (except for "needs more work"). So, get rid of it. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dvb/frontend.h: move out a private internal structureMauro Carvalho Chehab2017-09-051-0/+11
| | | | | | | | | | | | | | | | | | | | struct dtv_cmds_h is just an ancillary struct used by the dvb_frontend.c to internally store frontend commands. It doesn't belong to the userspace header, nor it is used anywhere, except inside the DVB core. So, remove it from the header. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dmx.h: split typedefs from structsMauro Carvalho Chehab2017-09-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Using typedefs inside the Kernel is against CodingStyle, and there's no good usage here. Just like we did at frontend.h, at commit 0df289a209e0 ("[media] dvb: Get rid of typedev usage for enums"), let's keep those typedefs only to provide userspace backward compatibility. No functional changes. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: ca.h: split typedefs from structsMauro Carvalho Chehab2017-09-052-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | Using typedefs inside the Kernel is against CodingStyle, and there's no good usage here. Just like we did at frontend.h, at commit 0df289a209e0 ("[media] dvb: Get rid of typedev usage for enums"), let's keep those typedefs only to provide userspace backward compatibility. No functional changes. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: serial_ir: fix tx timing calculation on 32-bitSean Young2017-08-311-20/+14Star
| | | | | | | | | | | | | | | | Move the calculation to where it is needed, so the result doesn't need to be stored in the device struct. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: rc: gpio-ir-tx: use ktime accessor functionsSean Young2017-08-311-5/+7
| | | | | | | | | | | | | | | | Prefer using accessor functions so we are not dependent on the ktime_t type. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: rc: use ktime accessor functionsJasmin Jessich2017-08-311-5/+6
| | | | | | | | | | | | | | | | | | Prefer using accessor functions so we are not dependent on the ktime_t type. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: max2175: Propagate the real error on devm_clk_get() failureFabio Estevam2017-08-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | When devm_clk_get() fails we should return the real error code instead of always returning -ENODEV. This allows defer probe to happen in the case the clock provider has not been enabled by the time max2175 driver gets probed. Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: cx23885: Explicitly list Hauppauge model numbers of HVR-4400 and HVR-5500Matthias Schwarzott2017-08-281-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add two new model numbers to suppress this message in kernel log: cx23885: cx23885[0]: warning: unknown hauppauge model #121029 Add these model numbers: * Model 121019 - WinTV-HVR4400 * Model 121029 - WinTV-HVR5500 For WinTV-HVR4400 the documentation and my hardware differ: Documentation says it supports DVB-S/S2 and DVB-T, but my hardware also supports DVB-C. Signed-off-by: Matthias Schwarzott <zzam@gentoo.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: i2c: adv748x: Export I2C device table entries as module aliasesJavier Martinez Canillas2017-08-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The I2C core always reports a MODALIAS of the form i2c:<foo> even if the device was registered via OF, and the driver is only exporting the OF ID table entries as module aliases. So if the driver is built as module, autoload won't work since udev/kmod won't be able to match the registered OF device with its driver module. Before this patch: $ modinfo drivers/media/i2c/adv748x/adv748x.ko | grep alias alias: of:N*T*Cadi,adv7482C* alias: of:N*T*Cadi,adv7482 alias: of:N*T*Cadi,adv7481C* alias: of:N*T*Cadi,adv7481 After this patch: modinfo drivers/media/i2c/adv748x/adv748x.ko | grep alias alias: of:N*T*Cadi,adv7482C* alias: of:N*T*Cadi,adv7482 alias: of:N*T*Cadi,adv7481C* alias: of:N*T*Cadi,adv7481 alias: i2c:adv7482 alias: i2c:adv7481 Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dw2102: make dvb_usb_device_description structures constBhumika Goyal2017-08-281-7/+7
| | | | | | | | | | | | | | | | dvb_usb_device_description structures are only used during a copy operation. Therefore, declare them as const. Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: mn88473: reset stream ID reg if no PLP givenOlli Salonen2017-08-281-1/+3
| | | | | | | | | | | | | | If the PLP given is NO_STREAM_ID_FILTER (~0u) don't try to set that into the PLP register. Set PLP to 0 instead. Signed-off-by: Olli Salonen <olli.salonen@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: mn88472: reset stream ID reg if no PLP givenOlli Salonen2017-08-281-1/+3
| | | | | | | | | | | | | | If the PLP given is NO_STREAM_ID_FILTER (~0u) don't try to set that into the PLP register. Set PLP to 0 instead. Signed-off-by: Olli Salonen <olli.salonen@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dvb_frontend: initialize variable s with FE_NONE instead of 0Colin Ian King2017-08-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | GIT_AUTHOR_NAME=Colin King GIT_AUTHOR_EMAIL=colin.king@canonical.com In a previous commit, we added FE_NONE as an unknown fe_status. Initialize variable s to FE_NONE instead of the more opaque value 0. Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dvb_frontend: ensure that inital front end status initializedColin Ian King2017-08-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fe_status variable s is not initialized meaning it can have any random garbage status. This could be problematic if fe->ops.tune is false as s is not updated by the call to fe->ops.tune() and a subsequent check on the change status will using a garbage value. Fix this by adding FE_NONE to the enum fe_status and initializing s to this. Detected by CoverityScan, CID#112887 ("Uninitialized scalar variable") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: usbvision: Improve a size determination in usbvision_alloc()Markus Elfring2017-08-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | Replace the specification of a data structure by a pointer dereference as the parameter for the operator "sizeof" to make the corresponding size determination a bit safer according to the Linux coding style convention. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: usbvision: Adjust eight checks for null pointersMarkus Elfring2017-08-271-8/+8
| | | | | | | | | | | | | | | | | | | | | | The script “checkpatch.pl” pointed information out like the following. Comparison to NULL could be written !… Thus fix the affected source code places. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: usbvision: Delete an error message for a failed memory allocation in ↵Markus Elfring2017-08-271-1/+0Star
| | | | | | | | | | | | | | | | | | | | | | usbvision_probe() Omit an extra message for a memory allocation failure in this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: radio: make video_device constBhumika Goyal2017-08-274-4/+4
| | | | | | | | | | | | | | Make these const as they are only used in a copy operation. Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dib8000: remove some bogus dead codeDan Carpenter2017-08-272-19/+0Star
| | | | | | | | | | | | | | | | This function is broken. It sets the wrong front_end to NULL. But it's not used, so let's just delete it. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dib9000: delete some unused broken codeDan Carpenter2017-08-272-25/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The dib9000_remove_slave_frontend() function isn't used. I was reviewing it because my static checker claims it writes one element beyond the end of the array. That's a false positive. What it actually does is, if there are two or more front ends, then it prints a debug message to say that it removed the first one, stored in state->fe[1], and then it "removes" (scare quotes on purpose) the second one, stored in state->fe[2]. Deleting a front end from the middle is not really supported and breaks code like dib9000_release() which assumes the first NULL front end marks the end of the list. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: usbtv: make v4l2_file_operations constBhumika Goyal2017-08-271-1/+1
| | | | | | | | | | | | | | | | Make this const as it is only stored in a const field of a video_device structure. Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: cx18: make v4l2_file_operations constBhumika Goyal2017-08-271-1/+1
| | | | | | | | | | | | | | | | Make this const as it is only stored in a const field of a video_device structure. Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: usb: make video_device constBhumika Goyal2017-08-2711-11/+11
| | | | | | | | | | | | | | | | Make these const as they are only used during a copy operation. Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Acked-by: Mike Isely <isely@pobox.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: pci: make video_device constBhumika Goyal2017-08-277-7/+7
| | | | | | | | | | | | | | | | Make these const as they are either used during a copy operation or passed to a const argument of the function cx88_vdev_init. Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: platform: make video_device constBhumika Goyal2017-08-279-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make these const as they are only used during a copy operation. Done using Coccinelle: @match disable optional_qualifier@ identifier s; @@ static struct video_device s = {...}; @ref@ position p; identifier match.s; @@ s@p @good1@ identifier match.s; expression list[3] es; position ref.p; @@ cx88_vdev_init(es,&s@p,...) @good2@ position ref.p; identifier match.s,f,c; expression e; @@ ( e = s@p | e = s@p.f | c(...,s@p.f,...) | c(...,s@p,...) ) @bad depends on !good1 && !good2@ position ref.p; identifier match.s; @@ s@p @depends on forall !bad disable optional_qualifier@ identifier match.s; @@ static + const struct video_device s; Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: au0828: fix RC_CORE dependencyArnd Bergmann2017-08-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When RC_CORE is a loadable module, and au0828 is built-in including the RC support, we get a link error: drivers/media/usb/au0828/au0828-input.o: In function `au0828_get_key_au8522': au0828-input.c:(.text+0x474): undefined reference to `ir_raw_event_store' drivers/media/usb/au0828/au0828-input.o: In function `au0828_rc_register': au0828-input.c:(.text+0x7c8): undefined reference to `rc_allocate_device' au0828-input.c:(.text+0x8f8): undefined reference to `rc_register_device' This adds an additional dependency, similar to the one for em28xx, to ensure the broken configuration is never used. Fixes: 2fcfd317f66c ("[media] au0828: add support for IR on HVR-950Q") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dib0090: fix duplicated code for different branchesGustavo A. R. Silva2017-08-271-8/+1Star
| | | | | | | | | | | | | | | | | | | | | | Refactor code in order to avoid identical code for different branches. This issue was detected with the help of Coccinelle. Addresses-Coverity-ID: 1226795 Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: mx2_emmaprp: Check for platform_get_irq() errorFabio Estevam2017-08-271-0/+2
| | | | | | | | | | | | | | | | platform_get_irq() may fail, so we should better check its return value and propagate it in the case of error. Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dvb-frontends/stv0367: remove QAM_AUTO from ddb_fe_opsDaniel Scheller2017-08-271-1/+1
| | | | | | | | | | | | | | | | | | Since the cab_* codepath doesn't recognize QAM_AUTO, don't announce that it is supported when it really isn't. Fixes ie. w_scan from unconditionally using QAM_AUTO on DVB-C scans. Signed-off-by: Daniel Scheller <d.scheller@gmx.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: mxl111sf: Fix potential null pointer dereferenceEugeniu Rosca2017-08-271-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reviewing the delta between cppcheck output of v4.9.39 and v4.9.40 stable updates, I stumbled on the new warning: mxl111sf.c:80: (warning) Possible null pointer dereference: rbuf Since copying state->rcvbuf into rbuf is not needed in the 'write-only' scenario (i.e. calling mxl111sf_ctrl_msg() from mxl111sf_i2c_send_data() or from mxl111sf_write_reg()), bypass memcpy() in this case. Fixes: d90b336f3f65 ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages") Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com> Reviewed-by: Michael Ira Krufky <mkrufky@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: au0828: fix unbalanced lock/unlock in au0828_usb_probeGustavo A. R. Silva2017-08-271-0/+2
| | | | | | | | | | | | | | | | Call mutex_unlock and free dev on failure. Reported-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dvb-usb: Add memory free on error path in dw2102_probe()Anton Vasilyev2017-08-271-17/+22
| | | | | | | | | | | | | | | | | | | | | | | | If dw2102_probe() fails on dvb_usb_device_init(), then memleak occurs. The patch adds deallocation to the error path. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru> Reviewed-by: Enrico Mioso <mrkiko.rs@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dvb-frontends/stv0910: change minsymrate to 100Ksyms/sDaniel Scheller2017-08-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The demodulator supports symbol rates as low as 100Ksyms/s - the demod setup in start() already handles such low symbol rates and reviewers of stv0910 equipped cards even found and tested transponders with SRs in that range. So, announce this in the fe_ops. Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Richard Scobie <r.scobie@clear.net.nz> Signed-off-by: Daniel Scheller <d.scheller@gmx.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: ddbridge: fix sparse warningsDaniel Scheller2017-08-272-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix several drivers/media/pci/ddbridge/ddbridge-core.c: warning: symbol ... was not declared. Should it be static? drivers/media/pci/ddbridge/ddbridge-core.c: warning: Using plain integer as NULL pointer drivers/media/pci/ddbridge/ddbridge-io.h: warning: cast removes address space of expression drivers/media/pci/ddbridge/ddbridge-io.h: warning: incorrect type in argument 1 (different address spaces) at multiple places. Cc: Ralph Metzler <rjkm@metzlerbros.de> Signed-off-by: Daniel Scheller <d.scheller@gmx.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: ddbridge: fix teardown/deregistration order in ddb_input_detach()Daniel Scheller2017-08-271-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Brought to attention by Matthias Schwarzott <zzam@gentoo.org> by fixing possible use-after-free faults in some demod drivers: In ddb_input_detach(), the i2c_client is unregistered and removed before dvb frontends are unregistered and detached. While no use-after-free issue was observed so far, there is another issue with this: dvb->attached keeps track of the state of the input/output registration, and the i2c_client unregistration takes place only if everything was successful (dvb->attached == 0x31). If for some reason an error occurred during the frontend setup, that value stays at 0x20. In the following error handling and cleanup, ddb_input_detach() will skip down to that state, leaving the i2c_client registered, causing refcount issues. Fix this by moving the i2c_client deregistration down to case 0x20. Cc: Matthias Schwarzott <zzam@gentoo.org> Signed-off-by: Daniel Scheller <d.scheller@gmx.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: dvb-frontends/stv0910: release lock on gate_ctrl() failureDaniel Scheller2017-08-271-5/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whenever write_reg() fails to open/close the demod's I2C gate, release the lock to avoid deadlocking situations. If I2c gate open failed, there's no need to hold a lock, and if close fails, the mutex_unlock() at the end of the function is never reached, leaving the mutex_lock in locked state, which in turn will cause potential for deadlocks. Thus, release the lock on failure. While we're touching gate_ctrl(), add some explanation about the need for locking and the shared I2C bus/gate. Cc: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Daniel Scheller <d.scheller@gmx.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: cx231xx: fix use-after-free when unregistering the i2c_client for the ↵Matthias Schwarzott2017-08-271-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dvb demod Calling i2c_unregister_device for a demod driver destroys the frontend object. Later it is accessed by calling dvb_unregister_frontend and dvb_frontend_detach. In some cases this leads to a general protection fault with this callstack: dvb_unregister_frontend+0x25/0x50 [dvb_core] dvb_fini+0xdb/0x160 [cx231xx_dvb] cx231xx_unregister_extension+0x3d/0xb0 [cx231xx] cx231xx_dvb_unregister+0x10/0x809 [cx231xx_dvb] SyS_delete_module+0x18a/0x240 ? exit_to_usermode_loop+0x7b/0x80 entry_SYSCALL_64_fastpath+0x17/0x98 Signed-off-by: Matthias Schwarzott <zzam@gentoo.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: cx23885: Fix use-after-free when unregistering the i2c_client for the ↵Matthias Schwarzott2017-08-271-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dvb demod Unregistering the i2c_client of the demod driver destroys the frontend object. Calling vb2_dvb_unregister_bus later accesses the frontend (and with the refcount_t) conversion the refcount_t code complains: kernel: ------------[ cut here ]------------ kernel: WARNING: CPU: 0 PID: 7883 at lib/refcount.c:128 refcount_sub_and_test+0x70/0x80 kernel: refcount_t: underflow; use-after-free. kernel: Modules linked in: bluetooth si2165(O) a8293(O) tda10071(O) tea5767(O) tuner(O) cx23885(O-) tda18271(O) videobuf2_dvb(O) videobuf2_dma_sg(O) m88ds3103(O) tveeprom(O) cx2341x(O) v4l2_common(O) dvb_core(O) rc_core(O) videobuf2_memops(O) videobuf2_v4l2(O) ums_realtek videobuf2_core(O) uas videodev(O) media(O) rtl8192cu i2c_mux usb_storage rtl_usb rtl8192c_common rtlwifi snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core x86_pkg_temp_thermal kvm_intel kvm irqbypass kernel: CPU: 0 PID: 7883 Comm: rmmod Tainted: G W O 4.11.3-gentoo #3 kernel: Hardware name: MEDION E2050 2391/H81H3-EM2, BIOS H81EM2W08.308 08/25/2014 kernel: Call Trace: kernel: dump_stack+0x4d/0x66 kernel: __warn+0xc6/0xe0 kernel: warn_slowpath_fmt+0x46/0x50 kernel: ? kobject_put+0x2f/0x60 kernel: refcount_sub_and_test+0x70/0x80 kernel: refcount_dec_and_test+0x11/0x20 kernel: dvb_unregister_frontend+0x42/0x60 [dvb_core] kernel: vb2_dvb_dealloc_frontends+0x9e/0x100 [videobuf2_dvb] kernel: vb2_dvb_unregister_bus+0xd/0x20 [videobuf2_dvb] kernel: cx23885_dvb_unregister+0xc3/0x110 [cx23885] kernel: cx23885_dev_unregister+0xea/0x150 [cx23885] kernel: cx23885_finidev+0x4f/0x70 [cx23885] kernel: pci_device_remove+0x34/0xb0 kernel: device_release_driver_internal+0x150/0x200 kernel: driver_detach+0x33/0x70 kernel: bus_remove_driver+0x47/0xa0 kernel: driver_unregister+0x27/0x50 kernel: pci_unregister_driver+0x34/0x90 kernel: cx23885_fini+0x10/0x12 [cx23885] kernel: SyS_delete_module+0x166/0x220 kernel: ? exit_to_usermode_loop+0x7b/0x80 kernel: entry_SYSCALL_64_fastpath+0x17/0x98 kernel: RIP: 0033:0x7f5901680b07 kernel: RSP: 002b:00007ffdf6cdb028 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 kernel: RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5901680b07 kernel: RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000000001500258 kernel: RBP: 00000000015001f0 R08: 0000000000000000 R09: 1999999999999999 kernel: R10: 0000000000000884 R11: 0000000000000206 R12: 00007ffdf6cda010 kernel: R13: 0000000000000000 R14: 00000000015001f0 R15: 00000000014ff010 kernel: ---[ end trace c3a4659b89086061 ]--- Signed-off-by: Matthias Schwarzott <zzam@gentoo.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: v4l2-flash-led-class: Create separate sub-devices for indicatorsSakari Ailus2017-08-271-46/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The V4L2 flash interface allows controlling multiple LEDs through a single sub-devices if, and only if, these LEDs are of different types. This approach scales badly for flash controllers that drive multiple flash LEDs or for LED specific associations. Essentially, the original assumption of a LED driver chip that drives a single flash LED and an indicator LED is no longer valid. Address the matter by registering one sub-device per LED. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com> Acked-by: Pavel Machek <pavel@ucw.cz> Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> (for greybus/light) Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: smiapp: check memory allocation failureChristophe JAILLET2017-08-271-0/+2
| | | | | | | | | | | | | | | | Check memory allocation failure and return -ENOMEM in such a case. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: omap3isp: fix uninitialized variable useArnd Bergmann2017-08-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A debug printk statement was copied incorrectly into the new csi1 parser code and causes a warning there: drivers/media/platform/omap3isp/isp.c: In function 'isp_probe': include/linux/dynamic_debug.h:134:3: error: 'i' may be used uninitialized in this function [-Werror=maybe-uninitialized] Since there is only one lane, the index is never set. This changes the debug print to always print a zero instead, keeping the original format of the message. Fixes: 9211434bad30 ("media: omap3isp: Parse CSI1 configuration from the device tree") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: qcom: don't go past the arrayMauro Carvalho Chehab2017-08-261-1/+1
| | | | | | | | | | | | | | | | As reported by smatch: drivers/media/platform/qcom/camss-8x16/camss-vfe.c:1136 vfe_release_wm() error: buffer overflow 'vfe->wm_output_map' 7 <= 7 Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| * media: qcom: mark long long consts as suchMauro Carvalho Chehab2017-08-261-2/+2
| | | | | | | | | | | | | | | | | | Fix those warnings when building on i386: drivers/media/platform/qcom/camss-8x16/camss-csiphy.c:333:22: warning: constant 1000000000000 is so big it is long long drivers/media/platform/qcom/camss-8x16/camss-csiphy.c:339:32: warning: constant 1000000000000 is so big it is long long Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-11-02 20:00:31 +0100