- 17 Sep, 2018 1 commit
-
-
Mauro Carvalho Chehab authored
The parameters of v4l2_ctrl_new_std_menu_items() are tricky: instead of the number of possible values, it requires the number of the maximum value. In other words, the ARRAY_SIZE() value should be decremented, otherwise it will go past the array bounds, as warned by KASAN: [ 279.839688] BUG: KASAN: global-out-of-bounds in v4l2_querymenu+0x10d/0x180 [videodev] [ 279.839709] Read of size 8 at addr ffffffffc10a4cb0 by task v4l2-compliance/16676 [ 279.839736] CPU: 1 PID: 16676 Comm: v4l2-compliance Not tainted 4.18.0-rc2+ #120 [ 279.839741] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017 [ 279.839743] Call Trace: [ 279.839758] dump_stack+0x71/0xab [ 279.839807] ? v4l2_querymenu+0x10d/0x180 [videodev] [ 279.839817] print_address_description+0x1c9/0x270 [ 279.839863] ? v4l2_querymenu+0x10d/0x180 [videodev] [ 279.839871] kasan_report+0x237/0x360 [ 279.839918] v4l2_querymenu+0x10d/0x180 [videodev] [ 279.839964] __video_do_ioctl+0x2c8/0x590 [videodev] [ 279.840011] ? copy_overflow+0x20/0x20 [videodev] [ 279.840020] ? avc_ss_reset+0xa0/0xa0 [ 279.840028] ? check_stack_object+0x21/0x60 [ 279.840036] ? __check_object_size+0xe7/0x240 [ 279.840080] video_usercopy+0xed/0x730 [videodev] [ 279.840123] ? copy_overflow+0x20/0x20 [videodev] [ 279.840167] ? v4l_enumstd+0x40/0x40 [videodev] [ 279.840177] ? __handle_mm_fault+0x9f9/0x1ba0 [ 279.840186] ? __pmd_alloc+0x2c0/0x2c0 [ 279.840193] ? __vfs_write+0xb6/0x350 [ 279.840200] ? kernel_read+0xa0/0xa0 [ 279.840244] ? video_usercopy+0x730/0x730 [videodev] [ 279.840284] v4l2_ioctl+0xa1/0xb0 [videodev] [ 279.840295] do_vfs_ioctl+0x117/0x8a0 [ 279.840303] ? selinux_file_ioctl+0x211/0x2f0 [ 279.840313] ? ioctl_preallocate+0x120/0x120 [ 279.840319] ? selinux_capable+0x20/0x20 [ 279.840332] ksys_ioctl+0x70/0x80 [ 279.840342] __x64_sys_ioctl+0x3d/0x50 [ 279.840351] do_syscall_64+0x6d/0x1c0 [ 279.840361] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 279.840367] RIP: 0033:0x7fdfb46275d7 [ 279.840369] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48 [ 279.840474] RSP: 002b:00007ffee1179038 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 [ 279.840483] RAX: ffffffffffffffda RBX: 00007ffee1179180 RCX: 00007fdfb46275d7 [ 279.840488] RDX: 00007ffee11790c0 RSI: 00000000c02c5625 RDI: 0000000000000003 [ 279.840493] RBP: 0000000000000002 R08: 0000000000000020 R09: 00000000009f0902 [ 279.840497] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffee117a5a0 [ 279.840501] R13: 00007ffee11790c0 R14: 0000000000000002 R15: 0000000000000000 [ 279.840515] The buggy address belongs to the variable: [ 279.840535] tvp5150_test_patterns+0x10/0xffffffffffffe360 [tvp5150] Fixes: c43875f6 ("[media] tvp5150: replace MEDIA_ENT_F_CONN_TEST by a control") Cc: stable@vger.kernel.org Signed-off-by:
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
-
- 12 Sep, 2018 39 commits
-
-
Gustavo A. R. Silva authored
Replace "falltrough" with a proper "fall through" annotation. This fix is part of the ongoing efforts to enabling -Wimplicit-fallthrough Signed-off-by:
Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by:
-
Rob Herring authored
In preparation to remove the node name pointer from struct device_node, convert printf users to use the %pOFn format specifier. Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com> Cc: Benoit Parrot <bparrot@ti.com> Cc: Philipp Zabel <p.zabel@pengutronix.de> Cc: Hyun Kwon <hyun.kwon@xilinx.com> Cc: Michal Simek <michal.simek@xilinx.com> Signed-off-by:
Rob Herring <robh@kernel.org> Reviewed-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Arnd Bergmann authored
The VIDEO_STILLPICTURE is only implemented by one driver, while VIDEO_GET_EVENT has two users in tree. In both cases, it is fairly easy to handle the compat ioctls in the native handler rather than relying on translation in fs/compat_ioctls. In effect, this means that now the drivers implement both structure layouts in both native and compat mode, but I don't see anything wrong with that. Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
Arnd Bergmann authored
Most DVB audio and video ioctl commands are completely compatible, and are implemented by just two drivers: ttpci and ivtv. In both cases, we can use the same ioctl handler for both native and compat ioctl handling, and remove the entries from the global lookup table. In case of ttpci, this directly hooks into the file_operations structure, and for ivtv, we have to set the compat_ioctl32 method in v4l2_file_operations. For all I can tell, setting it to video_ioctl2 will still do the right thing for all commands. Note that for the VIDEO_STILLPICTURE and VIDEO_GET_EVENT commands, a translation handler in fs/compat_ioctl.c is still used. This works because the command numbers are different on 32-bit systems. Signed-off-by:
-
Arnd Bergmann authored
All the CEC ioctls are compatible, and they are only implemented in one driver, so we can simply let this driver handle them natively. Signed-off-by:
Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by:
-
Arnd Bergmann authored
All dmx ioctls are compatible, and they are only implemented in one file, so we can replace the list of commands in fs/compat_ioctl.c with a single line in dmxdev. Signed-off-by:
-
Arnd Bergmann authored
The VIDEO_GET_EVENT and VIDEO_STILLPICTURE was added back in 2005 but it never worked because the command number is wrong. Using the right command number means we have a better chance of them actually doing the right thing, though clearly nobody has ever tried it successfully. I noticed these while auditing the remaining users of compat_time_t for y2038 bugs. This one is fine in that regard, it just never did anything. Fixes: 6e87abd0 ("[DVB]: Add compat ioctl handling.") Signed-off-by:
-
Kuninori Morimoto authored
This patch updates license to use SPDX-License-Identifier instead of verbose license text. Signed-off-by:
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Acked-by:
Ramesh Shanmugasundaram <Ramesh.shanmugasundaram@bp.renesas.com> Signed-off-by:
-
zhong jiang authored
dma_zalloc_coherent has implemented the dma_alloc_coherent() + memset(), We prefer to dma_zalloc_coherent instead of open-codeing. Signed-off-by:
zhong jiang <zhongjiang@huawei.com> Signed-off-by:
-
Lao Wei authored
Motion eye video4linux driver for Sony Vaio PictureBook desn't validate user-controlled parameter 'vma->vm_pgoff', a malicious process might access all of kernel memory from user space by trying pass different arbitrary address. Discussion: http://www.openwall.com/lists/oss-security/2018/07/06/1Signed-off-by:
Lao Wei <zrlw@qq.com> Signed-off-by:
-
Kieran Bingham authored
The ADV748x supports configurable slave addresses for its I2C pages. Document the page names, and provide an example for setting each of the pages explicitly. Signed-off-by:
Kieran Bingham <kieran.bingham@ideasonboard.com> Reviewed-by:
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by:
-
Kieran Bingham authored
The reg-names property in the documentation is missing an '='. Add it. Fixes: 9feb7868 ("media: dt-bindings: media: adv7604: Extend bindings to allow specifying slave map addresses") Signed-off-by:
-
Kieran Bingham authored
This entry was created with my personal e-mail address. Update with the correct work related account. Signed-off-by:
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
-
Kuninori Morimoto authored
This patch updates license to use SPDX-License-Identifier instead of verbose license text. As original license mentioned, it is GPL-2.0 in SPDX. Then, MODULE_LICENSE() should be "GPL v2" instead of "GPL". See ${LINUX}/include/linux/module.h "GPL" [GNU Public License v2 or later] "GPL v2" [GNU Public License v2] Signed-off-by:Simon Horman <horms+renesas@verge.net.au> Signed-off-by:
-
Kuninori Morimoto authored
This patch updates license to use SPDX-License-Identifier instead of verbose license text. As original license mentioned, it is GPL-2.0 in SPDX. Then, MODULE_LICENSE() should be "GPL v2" instead of "GPL". See ${LINUX}/include/linux/module.h "GPL" [GNU Public License v2 or later] "GPL v2" [GNU Public License v2] Signed-off-by: -
Kuninori Morimoto authored
Signed-off-by:
-
Kuninori Morimoto authored
Signed-off-by:
-
Kuninori Morimoto authored
As original license mentioned, it is GPL-2.0+ in SPDX. Then, MODULE_LICENSE() should be "GPL" instead of "GPL v2". See ${LINUX}/include/linux/module.h "GPL" [GNU Public License v2 or later] "GPL v2" [GNU Public License v2] Signed-off-by: -
Kuninori Morimoto authored
Signed-off-by:
-
Kuninori Morimoto authored
Signed-off-by:
-
Kuninori Morimoto authored
Signed-off-by:
-
Katsuhiro Suzuki authored
Add support for STMicroelectronics LNBH29 LNB supply driver. Signed-off-by:
Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com> Signed-off-by:
-
Philippe De Muyter authored
While v4l2_i2c_subdev_init does give a unique name to the subdev, matching the one appearing in dmesg for messages generated by dev_info and friends (e.g. imx185 30-0010), v4l2_spi_subdev_init does a poor job, copying only the driver name, but not the dev_name(), yielding e.g. "imx185", but missing the "spi1.1" part, and not generating a unique name. Fix that. Signed-off-by:
Philippe De Muyter <phdm@macqel.be> Acked-by:
-
Colin Ian King authored
The check for irq_mode == 2 occurs is always false and hence flags is always zero. This is because the check occurs in a path where irq_mode is >= 3. Clean up the code by removing the check and irq_mode and just pass 0. Detected by CoverityScan, CID#1472214 ("Logically dead code") Signed-off-by:Colin Ian King <colin.king@canonical.com> Cc: Ralph Metzler <rjkm@metzlerbros.de> Signed-off-by:
-
Daniel Scheller authored
I'm definitely not interested to try to maintain those drivers anymore. Signed-off-by:
Daniel Scheller <d.scheller@gmx.net> Signed-off-by:
-
Daniel Graefe authored
Added missing SPDX license identifiers to all files of the omap4iss driver. Most files already have license texts which clearly state them to be licensed under GPL 2.0 or later. SPDX identifiers were added accordingly. Some files do not have any license text. SPDX identifiers for GPL 2.0 were added to them, in accordance with the default license of the kernel. Signed-off-by:
Daniel Graefe <daniel.graefe@fau.de> Signed-off-by:
Roman Sommer <roman.sommer@fau.de> Signed-off-by:
-
Mauro Carvalho Chehab authored
As pointed by Daniel Scheller <d.scheller@gmx.net>, sparse warns that a segment may fall through. We're deprecating this warning in favor of gcc 8 equivalent warning. In this specific case, the code for DVB-S applies for DVB-S2. In a matter of fact, several things there (like rolloff factor logic) assume that the transponder is DVB-S2. So, add the corresponding fall-trough markup, for gcc to properly ignore it. Reported-by:
-
Sebastian Andrzej Siewior authored
Time "in interrupt" accounting with the help of `jiffies' is a pointless exercise. This variable isn't even used. Remove time_in_irq. Cc: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by:
Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by:
-
Sebastian Andrzej Siewior authored
The context in which sd_dq_callback() is non atomic, there is even msleep() at the end of the function. There is no need to use GFP_ATOMIC here - use GFP_KERNEL instead. Cc: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by:
-
Sebastian Andrzej Siewior authored
As far as I can tell em28xx_audio_urb_init() is called once during initialization from non atomic context. Memory allocation from non atomic context should use GFP_KERNEL to avoid using emergency pool for memory allocation. Use GFP_KERNEL for memory allocation. Signed-off-by:
-
Daniel Scheller authored
As both the MODULE_LICENSE and the boilerplates are now in sync and clear that the driver is licensed under the terms of the GPLv2-only, add a matching SPDX license identifier tag. Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Manfred Voelkel <mvoelkel@DigitalDevices.de> Signed-off-by:
-
Daniel Scheller authored
In commit 3db30defab4b ("use correct MODULE_LINCESE for GPL v2 only according to notice in header") in the upstream repository for the mentioned driver at https://github.com/DigitalDevices/dddvb.git, the MODULE_LICENSE was fixed to "GPL v2" and is now in sync with the GPL copyright boilerplate. Apply this change to the kernel tree driver as well. Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Manfred Voelkel <mvoelkel@DigitalDevices.de> Signed-off-by: -
Daniel Scheller authored
As it is clear that the driver is licensed under the terms of GPLv2-only by now, add a matching SPDX license identifier to all driver files. Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Manfred Voelkel <mvoelkel@DigitalDevices.de> Signed-off-by:
-
Daniel Scheller authored
The stv6111.h doesn't carry any header nor any licensing boilerplate at all, so copy this from the main driver file stv6111.c. [mchehab@kernel.org: kept only the part of this patch that copied the license from stv6111.c into stv6111.h] Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Manfred Voelkel <mvoelkel@DigitalDevices.de> Signed-off-by:
-
Daniel Scheller authored
As it is clear that the driver is licensed under the terms of GPLv2-only by now, add a matching SPDX license identifier to all driver files. Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Manfred Voelkel <mvoelkel@DigitalDevices.de> Signed-off-by:
-
Daniel Scheller authored
The stv0910.h doesn't carry any header nor any licensing boilerplate at all, so copy this from the main driver file stv0910.c. [mchehab@kernel.org: kept only the part of this patch that copied the license from stv0910.c into stv0910.h] Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Manfred Voelkel <mvoelkel@DigitalDevices.de> Signed-off-by:
-
Daniel Scheller authored
As it is clear that the driver is licensed under the terms of GPLv2-only by now, add a matching SPDX license identifier to all driver files. Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Manfred Voelkel <mvoelkel@DigitalDevices.de> Signed-off-by:
-
Daniel Scheller authored
mxl5xx.h doesn't carry any licensing boilerplate at all right now, so copy the boilerplate over from the main driver file mxl5xx.c. Also, mxl5xx_defs is missing a part of the licensing boilerplate text, so add it. [mchehab@kernel.org: kept only the part of this patch that copied the license from mxl5xx.c into mxl5xx.h] Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Manfred Voelkel <mvoelkel@DigitalDevices.de> Signed-off-by:
-
Daniel Scheller authored
Cleanup blank lines, remove wrong links to http://www.gnu.org/copyleft/gpl.html (the driver is licensed under the terms of GPLv2, but the link points to a copy of the GPLv3), and fix the filename reference in ddbridge-i2c.h. [mchehab@kernel.org: removed whitespace changes at the licensing text, as we didn't get any acks from the authors with regards to changing the text] Cc: Ralph Metzler <rjkm@metzlerbros.de> Cc: Manfred Voelkel <mvoelkel@DigitalDevices.de> Signed-off-by:
-
