1. 19 Jul, 2016 6 commits
  2. 16 Jul, 2016 7 commits
  3. 15 Jul, 2016 14 commits
  4. 13 Jul, 2016 13 commits
    • Heiner Kallweit's avatar
      [media] rc: nuvoton: fix hang if chip is configured for alternative EFM IO address · 5cac1f67
      Heiner Kallweit authored
      If a system configures the Nuvoton chip to use the alternative
      EFM IO address (CR_EFIR2) then after probing the primary EFM IO
      address (CR_EFIR) this region is not released.
      
      If a driver for another function of the Nuvoton Super I/O
      chip uses the same probing mechanism then it will hang if
      loaded after the nuvoton-cir driver.
      This was reported for the nct6775 hwmon driver.
      
      Fix this by properly releasing the region after probing CR_EFIR.
      This regression was introduced with kernel 4.6 so cc it to stable.
      Reported-by: default avatarAntti Seppälä <a.seppala@gmail.com>
      Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
      Tested-by: default avatarAntti Seppälä <a.seppala@gmail.com>
      Cc: <stable@vger.kernel.org> # 4.6.x-
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      5cac1f67
    • Max Kellermann's avatar
      [media] dvb-core/en50221: use kref to manage struct dvb_ca_private · da677fe1
      Max Kellermann authored
      Don't free the object until the file handle has been closed.  Fixes
      use-after-free bug which occurs when I disconnect my DVB-S received
      while VDR is running.
      
      This is a crash dump of such a use-after-free:
      
          general protection fault: 0000 [#1] SMP
          CPU: 0 PID: 2541 Comm: CI adapter on d Not tainted 4.7.0-rc1-hosting+ #49
          Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
          task: ffff880027d7ce00 ti: ffff88003d8f8000 task.ti: ffff88003d8f8000
          RIP: 0010:[<ffffffff812f3d1f>]  [<ffffffff812f3d1f>] dvb_ca_en50221_io_read_condition.isra.7+0x6f/0x150
          RSP: 0018:ffff88003d8fba98  EFLAGS: 00010206
          RAX: 0000000059534255 RBX: 000000753d470f90 RCX: ffff88003c74d181
          RDX: 00000001bea04ba9 RSI: ffff88003d8fbaf4 RDI: 3a3030a56d763fc0
          RBP: ffff88003d8fbae0 R08: ffff88003c74d180 R09: 0000000000000000
          R10: 0000000000000001 R11: 0000000000000000 R12: ffff88003c480e00
          R13: 00000000ffffffff R14: 0000000059534255 R15: 0000000000000000
          FS:  00007fb4209b4700(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
          CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
          CR2: 00007f06445f4078 CR3: 000000003c55b000 CR4: 00000000000006b0
          Stack:
           ffff88003d8fbaf4 000000003c2170c0 0000000000004000 0000000000000000
           ffff88003c480e00 ffff88003d8fbc80 ffff88003c74d180 ffff88003d8fbb8c
           0000000000000000 ffff88003d8fbb10 ffffffff812f3e37 ffff88003d8fbb00
          Call Trace:
           [<ffffffff812f3e37>] dvb_ca_en50221_io_poll+0x37/0xa0
           [<ffffffff8113109b>] do_sys_poll+0x2db/0x520
      
      This is a backtrace of the kernel attempting to lock a freed mutex:
      
          #0  0xffffffff81083d40 in rep_nop () at ./arch/x86/include/asm/processor.h:569
          #1  cpu_relax () at ./arch/x86/include/asm/processor.h:574
          #2  virt_spin_lock (lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:57
          #3  native_queued_spin_lock_slowpath (lock=0xffff88003c480e90, val=761492029) at kernel/locking/qspinlock.c:304
          #4  0xffffffff810d1a06 in pv_queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/paravirt.h:669
          #5  queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:28
          #6  queued_spin_lock (lock=<optimized out>) at include/asm-generic/qspinlock.h:107
          #7  __mutex_lock_common (use_ww_ctx=<optimized out>, ww_ctx=<optimized out>, ip=<optimized out>, nest_lock=<optimized out>, subclass=<optimized out>,
              state=<optimized out>, lock=<optimized out>) at kernel/locking/mutex.c:526
          #8  mutex_lock_interruptible_nested (lock=0xffff88003c480e88, subclass=<optimized out>) at kernel/locking/mutex.c:647
          #9  0xffffffff812f49fe in dvb_ca_en50221_io_do_ioctl (file=<optimized out>, cmd=761492029, parg=0x1 <irq_stack_union+1>)
              at drivers/media/dvb-core/dvb_ca_en50221.c:1210
          #10 0xffffffff812ee660 in dvb_usercopy (file=<optimized out>, cmd=761492029, arg=<optimized out>, func=<optimized out>) at drivers/media/dvb-core/dvbdev.c:883
          #11 0xffffffff812f3410 in dvb_ca_en50221_io_ioctl (file=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at drivers/media/dvb-core/dvb_ca_en50221.c:1284
          #12 0xffffffff8112eddd in vfs_ioctl (arg=<optimized out>, cmd=<optimized out>, filp=<optimized out>) at fs/ioctl.c:43
          #13 do_vfs_ioctl (filp=0xffff88003c480e90, fd=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at fs/ioctl.c:674
          #14 0xffffffff8112f30c in SYSC_ioctl (arg=<optimized out>, cmd=<optimized out>, fd=<optimized out>) at fs/ioctl.c:689
          #15 SyS_ioctl (fd=6, cmd=2148298626, arg=140734533693696) at fs/ioctl.c:680
          #16 0xffffffff8103feb2 in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:207
      Signed-off-by: default avatarMax Kellermann <max@duempel.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      da677fe1
    • Max Kellermann's avatar
      [media] dvb_frontend: eliminate blocking wait in dvb_unregister_frontend() · fe35637b
      Max Kellermann authored
      The wait_event() call in dvb_unregister_frontend() waits synchronously
      for other tasks to free a file descriptor, but it does that while
      holding several mutexes.  That alone is a bad idea, but if one user
      process happens to keep a (defunct) file descriptor open indefinitely,
      the kernel will correctly detect a hung task:
      
          INFO: task kworker/0:1:314 blocked for more than 30 seconds.
                Not tainted 4.7.0-rc1-hosting+ #50
          "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
          kworker/0:1     D ffff88003daf7a50     0   314      2 0x00000000
          Workqueue: usb_hub_wq hub_event
           ffff88003daf7a50 0000000000000296 ffff88003daf7a30 ffff88003fc13f98
           ffff88003dadce00 ffff88003daf8000 ffff88003e3fc010 ffff88003d48d4f8
           ffff88003e3b5030 ffff88003e3f8898 ffff88003daf7a68 ffffffff810cf860
          Call Trace:
           [<ffffffff810cf860>] schedule+0x30/0x80
           [<ffffffff812f88d3>] dvb_unregister_frontend+0x93/0xc0
           [<ffffffff8107a000>] ? __wake_up_common+0x80/0x80
           [<ffffffff813019c7>] dvb_usb_adapter_frontend_exit+0x37/0x70
           [<ffffffff81300614>] dvb_usb_exit+0x34/0xb0
           [<ffffffff81300d4a>] dvb_usb_device_exit+0x3a/0x50
           [<ffffffff81302dc2>] pctv452e_usb_disconnect+0x52/0x60
           [<ffffffff81295a07>] usb_unbind_interface+0x67/0x1e0
           [<ffffffff810609f3>] ? __blocking_notifier_call_chain+0x53/0x70
           [<ffffffff8127ba67>] __device_release_driver+0x77/0x110
           [<ffffffff8127c2d3>] device_release_driver+0x23/0x30
           [<ffffffff8127ab5d>] bus_remove_device+0x10d/0x150
           [<ffffffff8127879b>] device_del+0x13b/0x260
           [<ffffffff81299dea>] ? usb_remove_ep_devs+0x1a/0x30
           [<ffffffff8129468e>] usb_disable_device+0x9e/0x1e0
           [<ffffffff8128bb09>] usb_disconnect+0x89/0x260
           [<ffffffff8128db8d>] hub_event+0x30d/0xfc0
           [<ffffffff81059475>] process_one_work+0x1c5/0x4a0
           [<ffffffff8105940c>] ? process_one_work+0x15c/0x4a0
           [<ffffffff81059799>] worker_thread+0x49/0x480
           [<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0
           [<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0
           [<ffffffff8105f65e>] kthread+0xee/0x110
           [<ffffffff810400bf>] ret_from_fork+0x1f/0x40
           [<ffffffff8105f570>] ? __kthread_unpark+0x70/0x70
          5 locks held by kworker/0:1/314:
           #0:  ("usb_hub_wq"){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0
           #1:  ((&hub->events)){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0
           #2:  (&dev->mutex){......}, at: [<ffffffff8128d8cb>] hub_event+0x4b/0xfc0
           #3:  (&dev->mutex){......}, at: [<ffffffff8128bad2>] usb_disconnect+0x52/0x260
           #4:  (&dev->mutex){......}, at: [<ffffffff8127c2cb>] device_release_driver+0x1b/0x30
      
      This patch removes the blocking wait, and postpones the kfree() call
      until all file handles have been closed by using struct kref.
      Signed-off-by: default avatarMax Kellermann <max@duempel.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      fe35637b
    • Aayush Gupta's avatar
    • Andi Shyti's avatar
      [media] lirc_dev: use LIRC_CAN_REC() define to check if the device can receive · 273b902a
      Andi Shyti authored
      The LIRC_CAN_REC() returns a boolean "flag & LIRC_CAN_REC_MASK"
      to check whether the device can receive data.
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      273b902a
    • Andi Shyti's avatar
      [media] lirc_dev: fix potential segfault · 8e5fa4c6
      Andi Shyti authored
      When opening or closing a lirc character device, the framework
      provides to the user the possibility to keep track of opening or
      closing of the device by calling two functions:
      
       - set_use_inc() when opening the device
       - set_use_dec() when closing the device
      
      if those are not set by the lirc user, the system segfaults.
      Check the pointer value before calling the above functions.
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      8e5fa4c6
    • Andi Shyti's avatar
    • Andi Shyti's avatar
      [media] lirc_dev: fix error return value · b4088094
      Andi Shyti authored
      If ioctl is called, it cannot be a case of invalid system call
      number (ENOSYS), that is a ENOTTY case which means that the
      device doesn't support that specific ioctl command.
      
      So, replace ENOSYS with ENOTTY.
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      b4088094
    • Andi Shyti's avatar
      [media] lirc_dev: fix variable constant comparisons · 9675ee5a
      Andi Shyti authored
      When comparing a variable with a constant, the comparison should
      start from the variable and not from the constant. It's also
      written in the human DNA.
      
      Swap the terms of comparisons whenever the constant comes first
      and fix the following checkpatch warning:
      
        WARNING: Comparisons should place the constant on the right side of the test
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      9675ee5a
    • Andi Shyti's avatar
      [media] lirc_dev: merge three if statements in only one · 14db9fc2
      Andi Shyti authored
      The three if statements check the same thing, merge them in only
      one statement.
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      14db9fc2
    • Andi Shyti's avatar
      [media] lirc_dev: remove double if ... else statement · 6ab86d2a
      Andi Shyti authored
      There are two if ... else which check the same thing in different
      part of the code, they can be merged in a single check.
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      6ab86d2a
    • Andi Shyti's avatar
      [media] lirc_dev: simplify if statement in lirc_add_to_buf · 19e56539
      Andi Shyti authored
      The whole function is inside an 'if' statement
      ("if (ir->d.add_to_buf)").
      
      Check the opposite of that statement at the beginning and exit,
      this way we can have one level less of indentation.
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      19e56539
    • Andi Shyti's avatar
      [media] lirc_dev: do not use goto to create loops · 7fe579d2
      Andi Shyti authored
      ... use "do .. while" instead.
      Signed-off-by: default avatarAndi Shyti <andi.shyti@samsung.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      7fe579d2