1. 06 3月, 2018 3 次提交
  2. 29 12月, 2017 1 次提交
  3. 12 12月, 2017 2 次提交
  4. 27 8月, 2017 1 次提交
    • M
      media: cx23885: Fix use-after-free when unregistering the i2c_client for the dvb demod · 412b16d6
      Matthias Schwarzott 提交于
      Unregistering the i2c_client of the demod driver destroys the frontend
      object.
      Calling vb2_dvb_unregister_bus later accesses the frontend (and with the
      refcount_t) conversion the refcount_t code complains:
      
      kernel: ------------[ cut here ]------------
      kernel: WARNING: CPU: 0 PID: 7883 at lib/refcount.c:128 refcount_sub_and_test+0x70/0x80
      kernel: refcount_t: underflow; use-after-free.
      kernel: Modules linked in: bluetooth si2165(O) a8293(O) tda10071(O) tea5767(O) tuner(O) cx23885(O-) tda18271(O) videobuf2_dvb(O) videobuf2_dma_sg(O) m88ds3103(O) tveeprom(O) cx2341x(O) v4l2_common(O) dvb_core(O) rc_core(O) videobuf2_memops(O) videobuf2_v4l2(O) ums_realtek videobuf2_core(O) uas videodev(O) media(O) rtl8192cu i2c_mux usb_storage rtl_usb rtl8192c_common rtlwifi snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core x86_pkg_temp_thermal kvm_intel kvm irqbypass
      kernel: CPU: 0 PID: 7883 Comm: rmmod Tainted: G        W  O    4.11.3-gentoo #3
      kernel: Hardware name: MEDION E2050 2391/H81H3-EM2, BIOS H81EM2W08.308 08/25/2014
      kernel: Call Trace:
      kernel:  dump_stack+0x4d/0x66
      kernel:  __warn+0xc6/0xe0
      kernel:  warn_slowpath_fmt+0x46/0x50
      kernel:  ? kobject_put+0x2f/0x60
      kernel:  refcount_sub_and_test+0x70/0x80
      kernel:  refcount_dec_and_test+0x11/0x20
      kernel:  dvb_unregister_frontend+0x42/0x60 [dvb_core]
      kernel:  vb2_dvb_dealloc_frontends+0x9e/0x100 [videobuf2_dvb]
      kernel:  vb2_dvb_unregister_bus+0xd/0x20 [videobuf2_dvb]
      kernel:  cx23885_dvb_unregister+0xc3/0x110 [cx23885]
      kernel:  cx23885_dev_unregister+0xea/0x150 [cx23885]
      kernel:  cx23885_finidev+0x4f/0x70 [cx23885]
      kernel:  pci_device_remove+0x34/0xb0
      kernel:  device_release_driver_internal+0x150/0x200
      kernel:  driver_detach+0x33/0x70
      kernel:  bus_remove_driver+0x47/0xa0
      kernel:  driver_unregister+0x27/0x50
      kernel:  pci_unregister_driver+0x34/0x90
      kernel:  cx23885_fini+0x10/0x12 [cx23885]
      kernel:  SyS_delete_module+0x166/0x220
      kernel:  ? exit_to_usermode_loop+0x7b/0x80
      kernel:  entry_SYSCALL_64_fastpath+0x17/0x98
      kernel: RIP: 0033:0x7f5901680b07
      kernel: RSP: 002b:00007ffdf6cdb028 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
      kernel: RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5901680b07
      kernel: RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000000001500258
      kernel: RBP: 00000000015001f0 R08: 0000000000000000 R09: 1999999999999999
      kernel: R10: 0000000000000884 R11: 0000000000000206 R12: 00007ffdf6cda010
      kernel: R13: 0000000000000000 R14: 00000000015001f0 R15: 00000000014ff010
      kernel: ---[ end trace c3a4659b89086061 ]---
      Signed-off-by: NMatthias Schwarzott <zzam@gentoo.org>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      412b16d6
  5. 03 2月, 2017 1 次提交
  6. 18 11月, 2016 1 次提交
  7. 21 10月, 2016 1 次提交
    • M
      [media] cx23885: don't break long lines · 07ab29e1
      Mauro Carvalho Chehab 提交于
      Due to the 80-cols restrictions, and latter due to checkpatch
      warnings, several strings were broken into multiple lines. This
      is not considered a good practice anymore, as it makes harder
      to grep for strings at the source code.
      
      As we're right now fixing other drivers due to KERN_CONT, we need
      to be able to identify what printk strings don't end with a "\n".
      It is a way easier to detect those if we don't break long lines.
      
      So, join those continuation lines.
      
      The patch was generated via the script below, and manually
      adjusted if needed.
      
      </script>
      use Text::Tabs;
      while (<>) {
      	if ($next ne "") {
      		$c=$_;
      		if ($c =~ /^\s+\"(.*)/) {
      			$c2=$1;
      			$next =~ s/\"\n$//;
      			$n = expand($next);
      			$funpos = index($n, '(');
      			$pos = index($c2, '",');
      			if ($funpos && $pos > 0) {
      				$s1 = substr $c2, 0, $pos + 2;
      				$s2 = ' ' x ($funpos + 1) . substr $c2, $pos + 2;
      				$s2 =~ s/^\s+//;
      
      				$s2 = ' ' x ($funpos + 1) . $s2 if ($s2 ne "");
      
      				print unexpand("$next$s1\n");
      				print unexpand("$s2\n") if ($s2 ne "");
      			} else {
      				print "$next$c2\n";
      			}
      			$next="";
      			next;
      		} else {
      			print $next;
      		}
      		$next="";
      	} else {
      		if (m/\"$/) {
      			if (!m/\\n\"$/) {
      				$next=$_;
      				next;
      			}
      		}
      	}
      	print $_;
      }
      </script>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      07ab29e1
  8. 23 9月, 2016 1 次提交
    • M
      [media] cx23885: Fix some smatch warnings · e837d85c
      Mauro Carvalho Chehab 提交于
      Make sure that it won't go past the config buffers
      
      	drivers/media/pci/cx23885/cx23885-dvb.c:1733 dvb_register() warn: buffer overflow 'netup_xc5000_config' 2 <= s32max
      	drivers/media/pci/cx23885/cx23885-dvb.c:1745 dvb_register() warn: buffer overflow 'netup_stv0367_config' 2 <= s32max
      	drivers/media/pci/cx23885/cx23885-dvb.c:1752 dvb_register() warn: buffer overflow 'netup_xc5000_config' 2 <= s32max
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      e837d85c
  9. 22 9月, 2016 1 次提交
  10. 20 9月, 2016 1 次提交
  11. 25 8月, 2016 1 次提交
  12. 13 7月, 2016 1 次提交
  13. 09 7月, 2016 2 次提交
  14. 03 3月, 2016 2 次提交
  15. 10 2月, 2016 1 次提交
  16. 19 12月, 2015 2 次提交
  17. 18 12月, 2015 1 次提交
    • H
      [media] vb2: drop v4l2_format argument from queue_setup · df9ecb0c
      Hans Verkuil 提交于
      The queue_setup callback has a void pointer that is just for V4L2
      and is the pointer to the v4l2_format struct that was passed to
      VIDIOC_CREATE_BUFS. The idea was that drivers would use the information
      from that struct to buffers suitable for the requested format.
      
      After the vb2 split series this pointer is now a void pointer,
      which is ugly, and the reality is that all existing drivers will
      effectively just look at the sizeimage field of v4l2_format.
      
      To make this more generic the queue_setup callback is changed:
      the void pointer is dropped, instead if the *num_planes argument
      is 0, then use the current format size, if it is non-zero, then
      it contains the number of requested planes and the sizes array
      contains the requested sizes. If either is unsupported, then return
      -EINVAL, otherwise use the requested size(s).
      Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      df9ecb0c
  18. 21 10月, 2015 1 次提交
  19. 01 10月, 2015 1 次提交
  20. 10 6月, 2015 2 次提交
    • D
      [media] TS2020: Calculate tuner gain correctly · 0f91c9d6
      David Howells 提交于
      The TS2020 and TS2022 tuners take an input from the demodulator indicating the
      AGC setting on that component that is then used to influence the tuner's own
      gain.  This should be taken into account when calculating the gain and signal
      strength.
      
      Further, the existing TS2020 driver miscalculates the signal strength as the
      result of its calculations can exceed the storage capacity of the 16-bit word
      used to return it to userspace.
      
      To this end:
      
       (1) Add a callback function (->get_agc_pwm()) in the ts2020_config struct that
           the tuner can call to get the AGC PWM value from the demodulator.
      
       (2) Modify the TS2020 driver to calculate the gain according to Montage's
           specification with the adjustment that we produce a negative value and
           scale it to 0.001dB units (which is what the DVBv5 API will require):
      
           (a) Callback to the demodulator to retrieve the AGC PWM value and then
           	 turn that into Vagc for incorporation in the calculations.  If the
           	 callback is unset, assume a Vagc of 0.
      
           (b) Calculate the tuner gain from a combination of Vagc and the tuner's RF
           	 gain and baseband gain settings.
      
       (3) Turn this into a percentage signal strength as per Montage's
           specification for return to userspace with the DVBv3 API.
      
       (4) Provide a function in the M88DS3103 demodulator driver that can be used to
           get the AGC PWM value on behalf of the tuner.
      
       (5) The ts2020_config.get_agc_pwm function should be set by the code that
           stitches together the drivers for each card.
      
           For the DVBSky cards that use the M88DS3103 with the TS2020 or the TS2022,
           set the get_agc_pwm function to point to m88ds3103_get_agc_pwm.
      
      I have tested this with a DVBSky S952 card which has an M88DS3103 and a TS2022.
      
      Thanks to Montage for providing access to information about the workings of
      these parts.
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Signed-off-by: NAntti Palosaari <crope@iki.fi>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      0f91c9d6
    • M
      [media] dvb: Get rid of typedev usage for enums · 0df289a2
      Mauro Carvalho Chehab 提交于
      The DVB API was originally defined using typedefs. This is against
      Kernel CodingStyle, and there's no good usage here. While we can't
      remove its usage on userspace, we can avoid its usage in Kernelspace.
      
      So, let's do it.
      
      This patch was generated by this shell script:
      
      	for j in $(grep typedef include/uapi/linux/dvb/frontend.h |cut -d' ' -f 3); do for i in $(find drivers/media -name '*.[ch]' -type f) $(find drivers/staging/media -name '*.[ch]' -type f); do sed "s,${j}_t,enum $j," <$i >a && mv a $i; done; done
      
      While here, make CodingStyle fixes on the affected lines.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de> # for drivers/media/firewire/*
      0df289a2
  21. 06 6月, 2015 4 次提交
  22. 13 5月, 2015 1 次提交
  23. 03 4月, 2015 1 次提交
  24. 02 2月, 2015 1 次提交
  25. 22 1月, 2015 1 次提交
  26. 30 12月, 2014 3 次提交
  27. 25 11月, 2014 2 次提交