1. 12 10月, 2017 1 次提交
  2. 05 9月, 2017 1 次提交
  3. 28 8月, 2017 2 次提交
  4. 02 3月, 2017 1 次提交
  5. 03 2月, 2017 1 次提交
    • S
      [media] media: Protect enable_source and disable_source handler code paths · 90cd366b
      Shuah Khan 提交于
      Drivers might try to access and run enable_source and disable_source
      handlers when the driver that implements these handlers is clearing
      the handlers during its unregister.
      
      Fix the following race condition:
      
      process 1				process 2
      
      request video streaming			unbind au0828
      v4l2 checks if tuner is free
      ...					...
      
      					au0828_unregister_media_device()
      ...					...
      					(doesn't hold graph_mutex)
      					mdev->enable_source = NULL;
      if (mdev && mdev->enable_source)	mdev->disable_source = NULL;
      	mdev->enable_source()
      (enable_source holds graph_mutex)
      
      As shown above enable_source check is done without holding the graph_mutex.
      If unbind happens to be in progress, au0828 could clear enable_source and
      disable_source handlers leading to null pointer de-reference.
      
      Fix it by protecting enable_source and disable_source set and clear and
      protecting enable_source and disable_source handler access and the call
      itself.
      
      process 1				process 2
      
      request video streaming			unbind au0828
      v4l2 checks if tuner is free
      ...					...
      
      					au0828_unregister_media_device()
      ...					...
      					(hold graph_mutex while clearing)
      					mdev->enable_source = NULL;
      if (mdev)				mdev->disable_source = NULL;
      (hold graph_mutex to check and
       call enable_source)
          if (mdev->enable_source)
      	mdev->enable_source()
      
      If graph_mutex is held to just heck for handler being null and needs to be
      released before calling the handler, there will be another window for the
      handlers to be cleared. Hence, enable_source and disable_source handlers
      no longer hold the graph_mutex and expect callers to hold it to avoid
      forcing them release the graph_mutex before calling the handlers.
      Signed-off-by: NShuah Khan <shuahkh@osg.samsung.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      90cd366b
  6. 27 1月, 2017 1 次提交
    • S
      [media] media: Drop FSF's postal address from the source code files · bcb63314
      Sakari Ailus 提交于
      Drop the FSF's postal address from the source code files that typically
      contain mostly the license text. Of the 628 removed instances, 578 are
      outdated.
      
      The patch has been created with the following command without manual edits:
      
      git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \
      	drivers/media/ include/media|while read i; do i=$i perl -e '
      open(F,"< $ENV{i}");
      $a=join("", <F>);
      $a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m
      	&& $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m;
      close(F);
      open(F, "> $ENV{i}");
      print F $a;
      close(F);'; done
      Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
      bcb63314
  7. 19 11月, 2016 6 次提交
    • M
      Revert "[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations" · f2709c20
      Mauro Carvalho Chehab 提交于
      While this patch sounded a good idea, unfortunately, it causes
      bad dependencies, as drivers that would otherwise work without
      the DVB core will now break:
      
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5767.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5761.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda827x.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda18218.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/qt1010.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2266.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt20xx.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2060.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mc44s803.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0013.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0012.ko] undefined!
      ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0011.ko] undefined!
      
      So, we have to revert it.
      
      Note: as the argument for the release ops changed from "int"
      to "void", we needed to change it at the revert patch, to
      avoid compilation issues like:
      	drivers/media/tuners/tea5767.c:437:23: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
      	  .release           = tea5767_release,
      	                       ^~~~~~~~~~~~~~~
      
      This reverts commit 22a613e8.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      f2709c20
    • M
      [media] dvb_frontend: move kref to struct dvb_frontend · 1f862a68
      Max Kellermann 提交于
      This commit amends my old commit fe35637b ("[media] dvb_frontend:
      eliminate blocking wait in dvb_unregister_frontend()"), which added
      kref to struct dvb_frontend_private.  It turned out that there are
      several use-after-free bugs left, which affect the struct
      dvb_frontend.  Protecting it with kref also protects struct
      dvb_frontend_private, so we can simply move it.
      
      This is how the use-after-free looks like in KASAN:
      
          BUG: KASAN: use-after-free in string+0x60/0xb1 at addr ffff880033bd9fc0
          Read of size 1 by task kworker/0:2/617
          CPU: 0 PID: 617 Comm: kworker/0:2 Not tainted 4.8.0-rc1-hosting+ #60
          Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
          Workqueue: usb_hub_wq hub_event
           0000000000000000 ffff880033757218 ffffffff81394e50 ffff880033bd9fd0
           ffff880035c03b00 ffff880033757240 ffffffff811f271d ffff880033bd9fc0
           1ffff1000677b3f8 ffffed000677b3f8 ffff8800337572b8 ffffffff811f2afe
          Call Trace:
           [...]
           [<ffffffff813a2d2f>] vsnprintf+0x39d/0x7e9
           [<ffffffff813993f9>] add_uevent_var+0x10f/0x1dc
           [<ffffffff814fe5ca>] rc_dev_uevent+0x55/0x6f
           [<ffffffff814438f8>] dev_uevent+0x2e1/0x316
           [<ffffffff81399744>] kobject_uevent_env+0x27e/0x701
           [<ffffffff81399bd2>] kobject_uevent+0xb/0xd
           [<ffffffff81443445>] device_del+0x322/0x383
           [<ffffffff81500c0c>] rc_unregister_device+0x98/0xc3
           [<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90
           [<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5
           [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
           [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80
           [...]
          Object at ffff880033bd9fc0, in cache kmalloc-16 size: 16
          Allocated:
           [...]
          Freed:
          PID = 617
           [...]
           [<ffffffff811f034c>] kfree+0xd9/0x166
           [<ffffffff814fe513>] ir_free_table+0x2f/0x51
           [<ffffffff81500bc1>] rc_unregister_device+0x4d/0xc3
           [<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90
           [<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5
           [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
           [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80
      
      Another one:
      
          BUG: KASAN: use-after-free in do_sys_poll+0x336/0x6b8 at addr ffff88003563fcc0
          Read of size 8 by task tuner on fronte/1042
          CPU: 1 PID: 1042 Comm: tuner on fronte Tainted: G    B           4.8.0-rc1-hosting+ #60
          Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
           0000000000000000 ffff88003353f910 ffffffff81394e50 ffff88003563fd80
           ffff880035c03200 ffff88003353f938 ffffffff811f271d ffff88003563fc80
           1ffff10006ac7f98 ffffed0006ac7f98 ffff88003353f9b0 ffffffff811f2afe
          Call Trace:
           [...]
           [<ffffffff812289b3>] do_sys_poll+0x336/0x6b8
           [...]
           [<ffffffff81228ed9>] SyS_poll+0xa9/0x194
           [...]
          Object at ffff88003563fc80, in cache kmalloc-256 size: 256
          Allocated:
           [...]
          Freed:
          PID = 617
           [...]
           [<ffffffff811f034c>] kfree+0xd9/0x166
           [<ffffffff814eb60d>] dvb_unregister_device+0xd6/0xe5
           [<ffffffff814fa4ed>] dvb_unregister_frontend+0x4b/0x66
           [<ffffffff8150810b>] dvb_usb_adapter_frontend_exit+0x69/0xac
           [<ffffffff8150617d>] dvb_usb_exit+0x43/0xe5
           [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
           [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80
      Signed-off-by: NMax Kellermann <max.kellermann@gmail.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      1f862a68
    • M
      [media] dvb_frontend: add "detach" callback · d812b3ca
      Max Kellermann 提交于
      Prepare for making "release" asynchronous (via kref).  Some operations
      may need to be run synchronously in dvb_frontend_detach(), and that's
      why we need a "detach" callback.
      Signed-off-by: NMax Kellermann <max.kellermann@gmail.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      d812b3ca
    • M
      [media] dvb_frontend: merge the two dvb_frontend_detach() versions · 967d8e8f
      Max Kellermann 提交于
      This code duplication is confusing and error prone.  Let's merge them
      by moving the release/dvb_detach call into one function with one
      Signed-off-by: NMax Kellermann <max.kellermann@gmail.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      967d8e8f
    • M
      [media] dvb_frontend: tuner_ops.release returns void · 194ced7a
      Max Kellermann 提交于
      It is not clear what this return value means.  All implemenations
      return 0, and the one caller ignores the value.  Let's remove this
      useless return value completely.
      Signed-off-by: NMax Kellermann <max.kellermann@gmail.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      194ced7a
    • M
      [media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations · 22a613e8
      Max Kellermann 提交于
      Most release callback functions are identical: free the "tuner_priv"
      and clear it.  Let's eliminate some bloat by providing this simple
      implementation in the dvb_frontend library.
      Signed-off-by: NMax Kellermann <max.kellermann@gmail.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      22a613e8
  8. 16 11月, 2016 1 次提交
  9. 21 10月, 2016 1 次提交
  10. 25 8月, 2016 1 次提交
  11. 14 7月, 2016 1 次提交
    • M
      [media] dvb_frontend: eliminate blocking wait in dvb_unregister_frontend() · fe35637b
      Max Kellermann 提交于
      The wait_event() call in dvb_unregister_frontend() waits synchronously
      for other tasks to free a file descriptor, but it does that while
      holding several mutexes.  That alone is a bad idea, but if one user
      process happens to keep a (defunct) file descriptor open indefinitely,
      the kernel will correctly detect a hung task:
      
          INFO: task kworker/0:1:314 blocked for more than 30 seconds.
                Not tainted 4.7.0-rc1-hosting+ #50
          "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
          kworker/0:1     D ffff88003daf7a50     0   314      2 0x00000000
          Workqueue: usb_hub_wq hub_event
           ffff88003daf7a50 0000000000000296 ffff88003daf7a30 ffff88003fc13f98
           ffff88003dadce00 ffff88003daf8000 ffff88003e3fc010 ffff88003d48d4f8
           ffff88003e3b5030 ffff88003e3f8898 ffff88003daf7a68 ffffffff810cf860
          Call Trace:
           [<ffffffff810cf860>] schedule+0x30/0x80
           [<ffffffff812f88d3>] dvb_unregister_frontend+0x93/0xc0
           [<ffffffff8107a000>] ? __wake_up_common+0x80/0x80
           [<ffffffff813019c7>] dvb_usb_adapter_frontend_exit+0x37/0x70
           [<ffffffff81300614>] dvb_usb_exit+0x34/0xb0
           [<ffffffff81300d4a>] dvb_usb_device_exit+0x3a/0x50
           [<ffffffff81302dc2>] pctv452e_usb_disconnect+0x52/0x60
           [<ffffffff81295a07>] usb_unbind_interface+0x67/0x1e0
           [<ffffffff810609f3>] ? __blocking_notifier_call_chain+0x53/0x70
           [<ffffffff8127ba67>] __device_release_driver+0x77/0x110
           [<ffffffff8127c2d3>] device_release_driver+0x23/0x30
           [<ffffffff8127ab5d>] bus_remove_device+0x10d/0x150
           [<ffffffff8127879b>] device_del+0x13b/0x260
           [<ffffffff81299dea>] ? usb_remove_ep_devs+0x1a/0x30
           [<ffffffff8129468e>] usb_disable_device+0x9e/0x1e0
           [<ffffffff8128bb09>] usb_disconnect+0x89/0x260
           [<ffffffff8128db8d>] hub_event+0x30d/0xfc0
           [<ffffffff81059475>] process_one_work+0x1c5/0x4a0
           [<ffffffff8105940c>] ? process_one_work+0x15c/0x4a0
           [<ffffffff81059799>] worker_thread+0x49/0x480
           [<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0
           [<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0
           [<ffffffff8105f65e>] kthread+0xee/0x110
           [<ffffffff810400bf>] ret_from_fork+0x1f/0x40
           [<ffffffff8105f570>] ? __kthread_unpark+0x70/0x70
          5 locks held by kworker/0:1/314:
           #0:  ("usb_hub_wq"){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0
           #1:  ((&hub->events)){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0
           #2:  (&dev->mutex){......}, at: [<ffffffff8128d8cb>] hub_event+0x4b/0xfc0
           #3:  (&dev->mutex){......}, at: [<ffffffff8128bad2>] usb_disconnect+0x52/0x260
           #4:  (&dev->mutex){......}, at: [<ffffffff8127c2cb>] device_release_driver+0x1b/0x30
      
      This patch removes the blocking wait, and postpones the kfree() call
      until all file handles have been closed by using struct kref.
      Signed-off-by: NMax Kellermann <max@duempel.org>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      fe35637b
  12. 27 2月, 2016 1 次提交
  13. 05 2月, 2016 2 次提交
    • M
      [media] dvb_frontend: Don't let drivers to trash data at cache · bb31d238
      Mauro Carvalho Chehab 提交于
      GET_FRONTEND and G_PROPERTY can be called anytime, even when the
      tuner/demod is not fully locked. However, several parameters
      returned by those calls are available only after the demod get
      VITERBI lock.
      
      While several drivers do the right thing by checking the status before
      returning the parameter, some drivers simply blindly update the
      DTV properties cache without checking if the registers at the
      hardware contain valid values.
      
      Due to that, programs that call G_PROPERTY (or GET_FRONTEND)
      before having a tuner lock may interfere at the zigzag logic,
      as the DVB kthread calls the set_frontend() callback several
      times, to fine tune the frequency and to identify if the signal
      is inverted or not.
      
      While the drivers should be fixed to report the right status,
      we should prevent that such bugs would actually interfere at the
      device operation.
      
      So, let's use a separate var for userspace calls to get frontend.
      
      As we copy the content of the cache, this should not cause any
      troubles.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      bb31d238
    • M
      [media] dvb_frontend: pass the props cache to get_frontend() as arg · 7e3e68bc
      Mauro Carvalho Chehab 提交于
      Instead of using the DTV properties cache directly, pass the get
      frontend data as an argument. For now, everything should remain
      the same, but the next patch will prevent get_frontend to
      affect the global cache.
      
      This is needed because several drivers don't care enough to only
      change the properties if locked. Due to that, calling
      G_PROPERTY before locking on those drivers will make them to
      never lock. Ok, those drivers are crap and should never be
      merged like that, but the core should not rely that the drivers
      would be doing the right thing.
      Reviewed-by: NMichael Ira Krufky <mkrufky@linuxtv.org>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      7e3e68bc
  14. 04 2月, 2016 2 次提交
  15. 01 2月, 2016 1 次提交
  16. 11 1月, 2016 2 次提交
    • M
      [media] dvb: modify core to implement interfaces/entities at MC new gen · df2f94e5
      Mauro Carvalho Chehab 提交于
      The Media Controller New Generation redefines the types for both
      interfaces and entities to be used on DVB. Make the needed
      changes at the DVB core for all interfaces, entities and
      data and interface links to appear in the graph.
      Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      df2f94e5
    • M
      [media] media: convert links from array to list · 57208e5e
      Mauro Carvalho Chehab 提交于
      The entire logic that represent graph links were developed on a
      time where there were no needs to dynamic remove links. So,
      although links are created/removed one by one via some
      functions, they're stored as an array inside the entity struct.
      
      As the array may grow, there's a logic inside the code that
      checks if the amount of space is not enough to store
      the needed links. If it isn't the core uses krealloc()
      to change the size of the link, with is bad, as it
      leaves the memory fragmented.
      
      So, convert links into a list.
      
      Also, currently,  both source and sink entities need the link
      at the graph traversal logic inside media_entity. So there's
      a logic duplicating all links. That makes it to spend
      twice the memory needed. This is not a big deal for today's
      usage, where the number of links are not big.
      
      Yet, if during the MC workshop discussions, it was said that
      IIO graphs could have up to 4,000 entities. So, we may
      want to remove the duplication on some future. The problem
      is that it would require a separate linked list to store
      the backlinks inside the entity, or to use a more complex
      algorithm to do graph backlink traversal, with is something
      that the current graph traversal inside the core can't cope
      with. So, let's postpone a such change if/when it is actually
      needed.
      
      It should also be noticed that the media_link structure uses
      44 bytes on 32-bit architectures and 84 bytes on 64-bit
      architecture. It will thus be allocated out of the 64-bytes and
      96-bytes pools respectively. That's a 12.5% memory waste on
      64-bit architectures and 31.25% on 32-bit architecture.
      A linked list is less efficient than an array in this case, but
      this could later be optimized if we can get rid of the reverse
      links (with would reduce memory allocation by 50%).
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      57208e5e
  17. 19 11月, 2015 1 次提交
    • M
      [media] fix dvb_frontend_sleep_until() logic · a733a41a
      Mauro Carvalho Chehab 提交于
      As pointed by Laurent Navet:
      	"Calling ktime_add_us() seems useless as is only useful
      	 for it's return value which is ignored."
      
      That's reported by coverity CID 1309761.
      
      Laurent proposed to just remove ktime_add_us, but the fact is that
      the logic of this function is broken. Instead, we need to use the
      value of the timeout, and ensure that it will work on the loops
      to emulate the legacy DiSEqC ioctl (FE_DISHNETWORK_SEND_LEGACY_CMD).
      
      Please notice that the logic was also broken if, for any reason,
      msleep() would sleep a little less than what it was expected, as
      newdelta would be smaller than delta, and udelay() would not be called.
      
      It should also be noticed that nobody noticed that trouble before
      likely because the FE_DISHNETWORK_SEND_LEGACY_CMD is not used
      anymore by modern DVB applications.
      Reported-by: NLaurent Navet <laurent.navet@gmail.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      a733a41a
  18. 18 11月, 2015 1 次提交
  19. 17 11月, 2015 2 次提交
  20. 23 8月, 2015 1 次提交
  21. 10 6月, 2015 3 次提交
  22. 21 5月, 2015 1 次提交
  23. 26 2月, 2015 1 次提交
  24. 24 2月, 2015 1 次提交
  25. 14 2月, 2015 3 次提交
  26. 04 11月, 2014 1 次提交