1. 06 2月, 2013 1 次提交
  2. 05 1月, 2013 1 次提交
  3. 02 10月, 2012 1 次提交
  4. 14 8月, 2012 1 次提交
  5. 20 12月, 2011 1 次提交
  6. 04 11月, 2011 1 次提交
  7. 01 11月, 2011 1 次提交
  8. 22 9月, 2011 2 次提交
    • D
      [media] v4l: Make sure we hold a reference to the v4l2_device before using it · 236c5441
      Dave Young 提交于
      v4l2_device_disconnect() calls dev_get_drvdata() and dev_set_drvdata()
      on the device it received in v4l2_device_register(). Get a reference to
      the device in v4l2_device_register() to make sure it won't disappear as
      long as we need it.
      Reported-by: NSitsofe Wheeler <sitsofe@yahoo.com>
      Signed-off-by: NDave Young <hidave.darkstar@gmail.com>
      Tested-by: NSitsofe Wheeler <sitsofe@yahoo.com>
      Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      236c5441
    • Y
      [media] v4l2: uvcvideo use after free bug fix · 69803ecf
      Yang Ruirui 提交于
      Unplugging uvc video camera trigger following oops:
      
      eeepc kernel: [ 1393.500719] usb 3-2: USB disconnect, device number 4
      eeepc kernel: [ 1393.504351] uvcvideo: Failed to resubmit video URB (-19).
      eeepc kernel: [ 1495.428853] BUG: unable to handle kernel paging request at 6b6b6bcb
      eeepc kernel: [ 1495.429017] IP: [<b0358d37>] dev_get_drvdata+0x17/0x20
      eeepc kernel: [ 1495.429017] *pde = 00000000
      eeepc kernel: [ 1495.429017] Oops: 0000 [#1] DEBUG_PAGEALLOC
      eeepc kernel: [ 1495.429017]
      eeepc kernel: [ 1495.429017] Pid: 3476, comm: cheese Not tainted 3.1.0-rc3-00270-g7a54f5e1-dirty #485 ASUSTeK Computer INC. 900/900
      eeepc kernel: [ 1495.429017] EIP: 0060:[<b0358d37>] EFLAGS: 00010202 CPU: 0
      eeepc kernel: [ 1495.429017] EIP is at dev_get_drvdata+0x17/0x20
      eeepc kernel: [ 1495.429017] EAX: 6b6b6b6b EBX: eb08d870 ECX: 00000000 EDX: eb08d930
      eeepc kernel: [ 1495.429017] ESI: eb08d870 EDI: eb08d870 EBP: d3249cac ESP: d3249cac
      eeepc kernel: [ 1495.429017]  DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068
      eeepc kernel: [ 1495.429017] Process cheese (pid: 3476, ti=d3248000 task=df46d870 task.ti=d3248000)
      eeepc kernel: [ 1495.429017] Stack:
      eeepc kernel: [ 1495.429017]  d3249cb8 b03e77a1 d307b840 d3249ccc b03e77d1 d307b840 eb08d870 eb08d830
      eeepc kernel: [ 1495.429017]  d3249ce4 b03ed3b7 00000246 d307b840 eb08d870 d3021b80 d3249cec b03ed565
      eeepc kernel: [ 1495.429017]  d3249cfc b03e044d e8323d10 b06e013c d3249d18 b0355fb9 fffffffe d3249d1c
      eeepc kernel: [ 1495.429017] Call Trace:
      eeepc kernel: [ 1495.429017]  [<b03e77a1>] v4l2_device_disconnect+0x11/0x30
      eeepc kernel: [ 1495.429017]  [<b03e77d1>] v4l2_device_unregister+0x11/0x50
      eeepc kernel: [ 1495.429017]  [<b03ed3b7>] uvc_delete+0x37/0x110
      eeepc kernel: [ 1495.429017]  [<b03ed565>] uvc_release+0x25/0x30
      eeepc kernel: [ 1495.429017]  [<b03e044d>] v4l2_device_release+0x9d/0xc0
      eeepc kernel: [ 1495.429017]  [<b0355fb9>] device_release+0x19/0x90
      eeepc kernel: [ 1495.429017]  [<b03adfdc>] ? usb_hcd_unlink_urb+0x7c/0x90
      eeepc kernel: [ 1495.429017]  [<b026b99c>] kobject_release+0x3c/0x90
      eeepc kernel: [ 1495.429017]  [<b026b960>] ? kobject_del+0x30/0x30
      eeepc kernel: [ 1495.429017]  [<b026ca4c>] kref_put+0x2c/0x60
      eeepc kernel: [ 1495.429017]  [<b026b88d>] kobject_put+0x1d/0x50
      eeepc kernel: [ 1495.429017]  [<b03b2385>] ? usb_autopm_put_interface+0x25/0x30
      eeepc kernel: [ 1495.429017]  [<b03f0e5d>] ? uvc_v4l2_release+0x5d/0xd0
      eeepc kernel: [ 1495.429017]  [<b0355d2f>] put_device+0xf/0x20
      eeepc kernel: [ 1495.429017]  [<b03dfa96>] v4l2_release+0x56/0x60
      eeepc kernel: [ 1495.429017]  [<b019c8dc>] fput+0xcc/0x220
      eeepc kernel: [ 1495.429017]  [<b01990f4>] filp_close+0x44/0x70
      eeepc kernel: [ 1495.429017]  [<b012b238>] put_files_struct+0x158/0x180
      eeepc kernel: [ 1495.429017]  [<b012b100>] ? put_files_struct+0x20/0x180
      eeepc kernel: [ 1495.429017]  [<b012b2a0>] exit_files+0x40/0x50
      eeepc kernel: [ 1495.429017]  [<b012b9e7>] do_exit+0x5a7/0x660
      eeepc kernel: [ 1495.429017]  [<b0135f72>] ? __dequeue_signal+0x12/0x120
      eeepc kernel: [ 1495.429017]  [<b055edf2>] ? _raw_spin_unlock_irq+0x22/0x30
      eeepc kernel: [ 1495.429017]  [<b012badc>] do_group_exit+0x3c/0xb0
      eeepc kernel: [ 1495.429017]  [<b015792b>] ? trace_hardirqs_on+0xb/0x10
      eeepc kernel: [ 1495.429017]  [<b013755f>] get_signal_to_deliver+0x18f/0x570
      eeepc kernel: [ 1495.429017]  [<b01020f7>] do_signal+0x47/0x9e0
      eeepc kernel: [ 1495.429017]  [<b055edf2>] ? _raw_spin_unlock_irq+0x22/0x30
      eeepc kernel: [ 1495.429017]  [<b015792b>] ? trace_hardirqs_on+0xb/0x10
      eeepc kernel: [ 1495.429017]  [<b0123300>] ? T.1034+0x30/0xc0
      eeepc kernel: [ 1495.429017]  [<b055c45f>] ? schedule+0x29f/0x640
      eeepc kernel: [ 1495.429017]  [<b0102ac8>] do_notify_resume+0x38/0x40
      eeepc kernel: [ 1495.429017]  [<b055f154>] work_notifysig+0x9/0x11
      eeepc kernel: [ 1495.429017] Code: e5 5d 83 f8 01 19 c0 f7 d0 83 e0 f0 c3 8d b4 26 00 00 00 00 55 85 c0 89 e5 75 09 31 c0 5d c3 90 8d 74 26 00 8b 40 04 85 c0 74 f0 <8b> 40 60 5d c3 8d 74 26 00 55 89 e5 53 89 c3 83 ec 04 8b 40 04
      eeepc kernel: [ 1495.429017] EIP: [<b0358d37>] dev_get_drvdata+0x17/0x20 SS:ESP 0068:d3249cac
      eeepc kernel: [ 1495.429017] CR2: 000000006b6b6bcb
      eeepc kernel: [ 1495.466975] uvcvideo: Failed to resubmit video URB (-27).
      eeepc kernel: [ 1495.467860] uvcvideo: Failed to resubmit video URB (-27).
      eeepc kernel: last message repeated 3 times
      eeepc kernel: [ 1495.512610] ---[ end trace 73ec16848794e5a5 ]---
      
      For uvc device, dev->vdev.dev is the &intf->dev,
      uvc_delete code is as below:
      	usb_put_intf(dev->intf);
      	usb_put_dev(dev->udev);
      
      	uvc_status_cleanup(dev);
      	uvc_ctrl_cleanup_device(dev);
      
      	if (dev->vdev.dev)
      		v4l2_device_unregister(&dev->vdev);
      
      Fix it by get_device in v4l2_device_register and put_device in v4l2_device_disconnect
      Reported-by: NSitsofe Wheeler <sitsofe@yahoo.com>
      Signed-off-by: NDave Young <hidave.darkstar@gmail.com>
      Tested-by: NSitsofe Wheeler <sitsofe@yahoo.com>
      Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      69803ecf
  9. 28 7月, 2011 1 次提交
  10. 05 5月, 2011 1 次提交
  11. 23 3月, 2011 2 次提交
  12. 22 3月, 2011 3 次提交
  13. 19 1月, 2011 2 次提交
    • H
      [media] v4l2-device: fix 'use-after-freed' oops · 672dcd54
      Hans Verkuil 提交于
      Fix a bug in v4l2_device_unregister where the sd pointer can be dereferenced
      after it was freed.
      
      Normally the i2c adapter is removed before this function is called. Removing
      the adapter will also unregister all subdevs on that adapter, so generally
      v4l2_device_unregister has nothing to do. However, in the case of a platform
      i2c bus that bus is generally not freed.
      
      In that case, after freeing the i2c subdevice the code will fall into the
      second block when it tests if the subdev is a SPI device. But by that time
      the subdev is already freed and the kernel oopses.
      
      The fix is trivial: continue with the loop after freeing the i2c or spi
      subdevice.
      Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
      Reported-by: NDaniel Drake <dsd@laptop.org>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      672dcd54
    • H
      [media] v4l2-subdev: add (un)register internal ops · 45f6f84a
      Hans Verkuil 提交于
      Some subdevs need to call into the board code after they are registered
      and have a valid struct v4l2_device pointer. The s_config op was abused
      for this, but now that it is removed we need a cleaner way of solving this.
      
      So this patch adds a struct with internal ops that the v4l2 core can call.
      
      Currently only two ops exist: register and unregister. Subdevs can implement
      these to call the board code and pass it the v4l2_device pointer, which the
      board code can then use to get access to the struct that embeds the
      v4l2_device.
      
      It is expected that in the future open and close ops will also be added.
      Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
      Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
      45f6f84a
  14. 02 12月, 2010 1 次提交
  15. 09 8月, 2010 1 次提交
  16. 18 5月, 2010 1 次提交
  17. 17 6月, 2009 4 次提交
  18. 30 3月, 2009 3 次提交
  19. 25 3月, 2009 1 次提交
  20. 08 1月, 2009 1 次提交
  21. 30 12月, 2008 1 次提交