Skip to content

L
Linux Imx

FengXiao2002 / Linux Imx

通知 8
Star 0
Fork 0
L
Linux Imx

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 15 11月, 2008 11 次提交
    • M
      V4L/DVB (9624): CVE-2008-5033: fix OOPS on tvaudio when controlling bass/treble · 01a1a3cc
      由 Mauro Carvalho Chehab 提交于 
      This bug were supposed to be fixed by 5ba2f67a,
where a call to NULL happens.

Not all tvaudio chips allow controlling bass/treble. So, the driver
has a table with a flag to indicate if the chip does support it.

Unfortunately, the handling of this logic were broken for a very long
time (probably since the first module version). Due to that, an OOPS
were generated for devices that don't support bass/treble.

This were the resulting OOPS message before the patch, with debug messages
enabled:

tvaudio' 1-005b: VIDIOC_S_CTRL
BUG: unable to handle kernel NULL pointer dereference at 00000000
IP: [<00000000>]
*pde = 22fda067 *pte = 00000000
Oops: 0000 [#1] SMP
Modules linked in: snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_hwdep snd soundcore tuner_simple tuner_types tea5767 tuner
tvaudio bttv bridgebnep rfcomm l2cap bluetooth it87 hwmon_vid hwmon fuse sunrpc ipt_REJECT
nf_conntrack_ipv4 iptable_filter ip_tables ip6t_REJECT xt_tcpudp nf_conntrack_ipv6 xt_state nf_conntrack
ip6table_filter ip6_tables x_tables ipv6 dm_mirrordm_multipath dm_mod configfs videodev v4l1_compat
ir_common 8139cp compat_ioctl32 v4l2_common 8139too videobuf_dma_sg videobuf_core mii btcx_risc tveeprom
i915 button snd_page_alloc serio_raw drm pcspkr i2c_algo_bit i2c_i801 i2c_core iTCO_wdt
iTCO_vendor_support sr_mod cdrom sg ata_generic pata_acpi ata_piix libata sd_mod scsi_mod ext3 jbdmbcache
uhci_hcd ohci_hcd ehci_hcd [last unloaded: soundcore]

Pid: 15413, comm: qv4l2 Not tainted (2.6.25.14-108.fc9.i686 #1)
EIP: 0060:[<00000000>] EFLAGS: 00210246 CPU: 0
EIP is at 0x0
EAX: 00008000 EBX: ebd21600 ECX: e2fd9ec4 EDX: 00200046
ESI: f8c0f0c4 EDI: f8c0f0c4 EBP: e2fd9d50 ESP: e2fd9d2c
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process qv4l2 (pid: 15413, ti=e2fd9000 task=ebe44000 task.ti=e2fd9000)
Stack: f8c0c6ae e2ff2a00 00000d00 e2fd9ec4 ebc4e000 e2fd9d5c f8c0c448 00000000
       f899c12a e2fd9d5c f899c154 e2fd9d68 e2fd9d80 c0560185 e2fd9d88 f8f3e1d8
       f8f3e1dc ebc4e034 f8f3e18c e2fd9ec4 00000000 e2fd9d90 f899c286 c008561c
Call Trace:
 [<f8c0c6ae>] ? chip_command+0x266/0x4b6 [tvaudio]
 [<f8c0c448>] ? chip_command+0x0/0x4b6 [tvaudio]
 [<f899c12a>] ? i2c_cmd+0x0/0x2f [i2c_core]
 [<f899c154>] ? i2c_cmd+0x2a/0x2f [i2c_core]
 [<c0560185>] ? device_for_each_child+0x21/0x49
 [<f899c286>] ? i2c_clients_command+0x1c/0x1e [i2c_core]
 [<f8f283d8>] ? bttv_call_i2c_clients+0x14/0x16 [bttv]
 [<f8f23601>] ? bttv_s_ctrl+0x1bc/0x313 [bttv]
 [<f8f23445>] ? bttv_s_ctrl+0x0/0x313 [bttv]
 [<f8b6096d>] ? __video_do_ioctl+0x1f84/0x3726 [videodev]
 [<c05abb4e>] ? sock_aio_write+0x100/0x10d
 [<c041b23e>] ? kmap_atomic_prot+0x1dd/0x1df
 [<c043a0c9>] ? enqueue_hrtimer+0xc2/0xcd
 [<c04f4fa4>] ? copy_from_user+0x39/0x121
 [<f8b622b9>] ? __video_ioctl2+0x1aa/0x24a [videodev]
 [<c04054fd>] ? do_notify_resume+0x768/0x795
 [<c043c0f7>] ? getnstimeofday+0x34/0xd1
 [<c0437b77>] ? autoremove_wake_function+0x0/0x33
 [<f8b62368>] ? video_ioctl2+0xf/0x13 [videodev]
 [<c048c6f0>] ? vfs_ioctl+0x50/0x69
 [<c048c942>] ? do_vfs_ioctl+0x239/0x24c
 [<c048c995>] ? sys_ioctl+0x40/0x5b
 [<c0405bf2>] ? syscall_call+0x7/0xb
 [<c0620000>] ? cpuid4_cache_sysfs_exit+0x3d/0x69
 =======================
Code:  Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:e2fd9d2c
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      01a1a3cc
    • M
      V4L/DVB (9623): tvaudio: Improve debug msg by printing something more human · c6241b6c
      由 Mauro Carvalho Chehab 提交于 
      Before the patch, the used ioctl were printed as an hexadecimal code,
hard to be understand without consulting the way _IO macros work.
Instead, use the V4L default handler for printing such errors into a way
that would be easier to understand.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      c6241b6c
    • M
      V4L/DVB (9622): tvaudio: Improve comments and remove a unneeded prototype · 41f5230f
      由 Mauro Carvalho Chehab 提交于 
      Some comments are not clear enough. Improve it to allow a better
understanding of the driver behavior.

While there, remove an unneeded struct prototype.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      41f5230f
    • M
      V4L/DVB (9621): Avoid writing outside shadow.bytes[] array · 49426437
      由 Mauro Carvalho Chehab 提交于 
      There were no check about the limits of shadow.bytes array. This offers
a risk of writing values outside the limits, overriding other data
areas.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      49426437
    • M
      V4L/DVB (9620): tvaudio: use a direct reference for chip description · 81cb5c4f
      由 Mauro Carvalho Chehab 提交于 
      Instead of storing the pointer for the proper entry at chip description
table, the driver were storing an indirect reference, by using an index.
Better to reference directly the data.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      81cb5c4f
    • M
      V4L/DVB (9619): tvaudio: update initial comments · b4ab114c
      由 Mauro Carvalho Chehab 提交于 
      A driver used on several bttv boards since 2000 is not experimental
anymore ;) Remove it from the comments.

While there, update copyrights addind a quick note about the "recent"
updates since 2005.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      b4ab114c
    • M
      V4L/DVB (9618): tvaudio: add additional logic to avoid OOPS · 099b7fcc
      由 Mauro Carvalho Chehab 提交于 
      This patch checks for volume, bass, treble, set mode and get mode
callbacks before actually enabling the code that would use them.

Instead of aborting the driver for load, this patch will allow it to
load with a reduced number of functionatities.

This prevents OOPS if some board entry is missing a needed callback.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      099b7fcc
    • M
      V4L/DVB (9617): tvtime: remove generic_checkmode callback · dd03e970
      由 Mauro Carvalho Chehab 提交于 
      generic_checkmode() were called, via a callback, for some tvaudio chips.
There's just one callback code used on all those boards. So, it makes no
sense on keeping this as a callback.

Since there were some OOPS reported on tvaudio on kerneloops.org, this
patch removes this callback, adding the code at the only place were it
is called: inside chip_tread. A flag were added to indicate the need for
a kernel thread to set stereo mode on cards that needs it.

Using this more direct approach simplifies the code, making it more
robust against human errors.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      dd03e970
    • M
      V4L/DVB (9616): tvaudio: cleanup - group all callbacks together · af1a9951
      由 Mauro Carvalho Chehab 提交于 
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      af1a9951
    • M
      V4L/DVB (9615): tvaudio: instead of using a magic number, use ARRAY_SIZE · 04e6f990
      由 Mauro Carvalho Chehab 提交于 
      Also, the default standard is the first one. So, fix the comment at the
array.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      04e6f990
    • M
      V4L/DVB (9613): tvaudio: fix a memory leak · 5c653351
      由 Mauro Carvalho Chehab 提交于 
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      5c653351
  3. 12 11月, 2008 13 次提交
  5. 11 11月, 2008 16 次提交