1. 30 12月, 2008 9 次提交
  2. 23 12月, 2008 1 次提交
  3. 22 12月, 2008 2 次提交
  4. 17 12月, 2008 3 次提交
  5. 02 12月, 2008 3 次提交
  6. 24 11月, 2008 4 次提交
  7. 21 11月, 2008 4 次提交
  8. 17 11月, 2008 3 次提交
  9. 15 11月, 2008 11 次提交
    • M
      V4L/DVB (9624): CVE-2008-5033: fix OOPS on tvaudio when controlling bass/treble · 01a1a3cc
      Mauro Carvalho Chehab 提交于
      This bug were supposed to be fixed by 5ba2f67a,
      where a call to NULL happens.
      
      Not all tvaudio chips allow controlling bass/treble. So, the driver
      has a table with a flag to indicate if the chip does support it.
      
      Unfortunately, the handling of this logic were broken for a very long
      time (probably since the first module version). Due to that, an OOPS
      were generated for devices that don't support bass/treble.
      
      This were the resulting OOPS message before the patch, with debug messages
      enabled:
      
      tvaudio' 1-005b: VIDIOC_S_CTRL
      BUG: unable to handle kernel NULL pointer dereference at 00000000
      IP: [<00000000>]
      *pde = 22fda067 *pte = 00000000
      Oops: 0000 [#1] SMP
      Modules linked in: snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
      snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_hwdep snd soundcore tuner_simple tuner_types tea5767 tuner
      tvaudio bttv bridgebnep rfcomm l2cap bluetooth it87 hwmon_vid hwmon fuse sunrpc ipt_REJECT
      nf_conntrack_ipv4 iptable_filter ip_tables ip6t_REJECT xt_tcpudp nf_conntrack_ipv6 xt_state nf_conntrack
      ip6table_filter ip6_tables x_tables ipv6 dm_mirrordm_multipath dm_mod configfs videodev v4l1_compat
      ir_common 8139cp compat_ioctl32 v4l2_common 8139too videobuf_dma_sg videobuf_core mii btcx_risc tveeprom
      i915 button snd_page_alloc serio_raw drm pcspkr i2c_algo_bit i2c_i801 i2c_core iTCO_wdt
      iTCO_vendor_support sr_mod cdrom sg ata_generic pata_acpi ata_piix libata sd_mod scsi_mod ext3 jbdmbcache
      uhci_hcd ohci_hcd ehci_hcd [last unloaded: soundcore]
      
      Pid: 15413, comm: qv4l2 Not tainted (2.6.25.14-108.fc9.i686 #1)
      EIP: 0060:[<00000000>] EFLAGS: 00210246 CPU: 0
      EIP is at 0x0
      EAX: 00008000 EBX: ebd21600 ECX: e2fd9ec4 EDX: 00200046
      ESI: f8c0f0c4 EDI: f8c0f0c4 EBP: e2fd9d50 ESP: e2fd9d2c
       DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
      Process qv4l2 (pid: 15413, ti=e2fd9000 task=ebe44000 task.ti=e2fd9000)
      Stack: f8c0c6ae e2ff2a00 00000d00 e2fd9ec4 ebc4e000 e2fd9d5c f8c0c448 00000000
             f899c12a e2fd9d5c f899c154 e2fd9d68 e2fd9d80 c0560185 e2fd9d88 f8f3e1d8
             f8f3e1dc ebc4e034 f8f3e18c e2fd9ec4 00000000 e2fd9d90 f899c286 c008561c
      Call Trace:
       [<f8c0c6ae>] ? chip_command+0x266/0x4b6 [tvaudio]
       [<f8c0c448>] ? chip_command+0x0/0x4b6 [tvaudio]
       [<f899c12a>] ? i2c_cmd+0x0/0x2f [i2c_core]
       [<f899c154>] ? i2c_cmd+0x2a/0x2f [i2c_core]
       [<c0560185>] ? device_for_each_child+0x21/0x49
       [<f899c286>] ? i2c_clients_command+0x1c/0x1e [i2c_core]
       [<f8f283d8>] ? bttv_call_i2c_clients+0x14/0x16 [bttv]
       [<f8f23601>] ? bttv_s_ctrl+0x1bc/0x313 [bttv]
       [<f8f23445>] ? bttv_s_ctrl+0x0/0x313 [bttv]
       [<f8b6096d>] ? __video_do_ioctl+0x1f84/0x3726 [videodev]
       [<c05abb4e>] ? sock_aio_write+0x100/0x10d
       [<c041b23e>] ? kmap_atomic_prot+0x1dd/0x1df
       [<c043a0c9>] ? enqueue_hrtimer+0xc2/0xcd
       [<c04f4fa4>] ? copy_from_user+0x39/0x121
       [<f8b622b9>] ? __video_ioctl2+0x1aa/0x24a [videodev]
       [<c04054fd>] ? do_notify_resume+0x768/0x795
       [<c043c0f7>] ? getnstimeofday+0x34/0xd1
       [<c0437b77>] ? autoremove_wake_function+0x0/0x33
       [<f8b62368>] ? video_ioctl2+0xf/0x13 [videodev]
       [<c048c6f0>] ? vfs_ioctl+0x50/0x69
       [<c048c942>] ? do_vfs_ioctl+0x239/0x24c
       [<c048c995>] ? sys_ioctl+0x40/0x5b
       [<c0405bf2>] ? syscall_call+0x7/0xb
       [<c0620000>] ? cpuid4_cache_sysfs_exit+0x3d/0x69
       =======================
      Code:  Bad EIP value.
      EIP: [<00000000>] 0x0 SS:ESP 0068:e2fd9d2c
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      01a1a3cc
    • M
      V4L/DVB (9623): tvaudio: Improve debug msg by printing something more human · c6241b6c
      Mauro Carvalho Chehab 提交于
      Before the patch, the used ioctl were printed as an hexadecimal code,
      hard to be understand without consulting the way _IO macros work.
      Instead, use the V4L default handler for printing such errors into a way
      that would be easier to understand.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      c6241b6c
    • M
      V4L/DVB (9622): tvaudio: Improve comments and remove a unneeded prototype · 41f5230f
      Mauro Carvalho Chehab 提交于
      Some comments are not clear enough. Improve it to allow a better
      understanding of the driver behavior.
      
      While there, remove an unneeded struct prototype.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      41f5230f
    • M
      V4L/DVB (9621): Avoid writing outside shadow.bytes[] array · 49426437
      Mauro Carvalho Chehab 提交于
      There were no check about the limits of shadow.bytes array. This offers
      a risk of writing values outside the limits, overriding other data
      areas.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      49426437
    • M
      V4L/DVB (9620): tvaudio: use a direct reference for chip description · 81cb5c4f
      Mauro Carvalho Chehab 提交于
      Instead of storing the pointer for the proper entry at chip description
      table, the driver were storing an indirect reference, by using an index.
      Better to reference directly the data.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      81cb5c4f
    • M
      V4L/DVB (9619): tvaudio: update initial comments · b4ab114c
      Mauro Carvalho Chehab 提交于
      A driver used on several bttv boards since 2000 is not experimental
      anymore ;) Remove it from the comments.
      
      While there, update copyrights addind a quick note about the "recent"
      updates since 2005.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      b4ab114c
    • M
      V4L/DVB (9618): tvaudio: add additional logic to avoid OOPS · 099b7fcc
      Mauro Carvalho Chehab 提交于
      This patch checks for volume, bass, treble, set mode and get mode
      callbacks before actually enabling the code that would use them.
      
      Instead of aborting the driver for load, this patch will allow it to
      load with a reduced number of functionatities.
      
      This prevents OOPS if some board entry is missing a needed callback.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      099b7fcc
    • M
      V4L/DVB (9617): tvtime: remove generic_checkmode callback · dd03e970
      Mauro Carvalho Chehab 提交于
      generic_checkmode() were called, via a callback, for some tvaudio chips.
      There's just one callback code used on all those boards. So, it makes no
      sense on keeping this as a callback.
      
      Since there were some OOPS reported on tvaudio on kerneloops.org, this
      patch removes this callback, adding the code at the only place were it
      is called: inside chip_tread. A flag were added to indicate the need for
      a kernel thread to set stereo mode on cards that needs it.
      
      Using this more direct approach simplifies the code, making it more
      robust against human errors.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      dd03e970
    • M
    • M
      V4L/DVB (9615): tvaudio: instead of using a magic number, use ARRAY_SIZE · 04e6f990
      Mauro Carvalho Chehab 提交于
      Also, the default standard is the first one. So, fix the comment at the
      array.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      04e6f990
    • M
      5c653351