- 13 Jul, 2016 35 commits
-
-
Heiner Kallweit authored
If a system configures the Nuvoton chip to use the alternative EFM IO address (CR_EFIR2) then after probing the primary EFM IO address (CR_EFIR) this region is not released. If a driver for another function of the Nuvoton Super I/O chip uses the same probing mechanism then it will hang if loaded after the nuvoton-cir driver. This was reported for the nct6775 hwmon driver. Fix this by properly releasing the region after probing CR_EFIR. This regression was introduced with kernel 4.6 so cc it to stable. Reported-by:
Antti Seppälä <a.seppala@gmail.com> Signed-off-by:
Heiner Kallweit <hkallweit1@gmail.com> Tested-by:
Mauro Carvalho Chehab <mchehab@s-opensource.com>
-
Max Kellermann authored
Don't free the object until the file handle has been closed. Fixes use-after-free bug which occurs when I disconnect my DVB-S received while VDR is running. This is a crash dump of such a use-after-free: general protection fault: 0000 [#1] SMP CPU: 0 PID: 2541 Comm: CI adapter on d Not tainted 4.7.0-rc1-hosting+ #49 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff880027d7ce00 ti: ffff88003d8f8000 task.ti: ffff88003d8f8000 RIP: 0010:[<ffffffff812f3d1f>] [<ffffffff812f3d1f>] dvb_ca_en50221_io_read_condition.isra.7+0x6f/0x150 RSP: 0018:ffff88003d8fba98 EFLAGS: 00010206 RAX: 0000000059534255 RBX: 000000753d470f90 RCX: ffff88003c74d181 RDX: 00000001bea04ba9 RSI: ffff88003d8fbaf4 RDI: 3a3030a56d763fc0 RBP: ffff88003d8fbae0 R08: ffff88003c74d180 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88003c480e00 R13: 00000000ffffffff R14: 0000000059534255 R15: 0000000000000000 FS: 00007fb4209b4700(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f06445f4078 CR3: 000000003c55b000 CR4: 00000000000006b0 Stack: ffff88003d8fbaf4 000000003c2170c0 0000000000004000 0000000000000000 ffff88003c480e00 ffff88003d8fbc80 ffff88003c74d180 ffff88003d8fbb8c 0000000000000000 ffff88003d8fbb10 ffffffff812f3e37 ffff88003d8fbb00 Call Trace: [<ffffffff812f3e37>] dvb_ca_en50221_io_poll+0x37/0xa0 [<ffffffff8113109b>] do_sys_poll+0x2db/0x520 This is a backtrace of the kernel attempting to lock a freed mutex: #0 0xffffffff81083d40 in rep_nop () at ./arch/x86/include/asm/processor.h:569 #1 cpu_relax () at ./arch/x86/include/asm/processor.h:574 #2 virt_spin_lock (lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:57 #3 native_queued_spin_lock_slowpath (lock=0xffff88003c480e90, val=761492029) at kernel/locking/qspinlock.c:304 #4 0xffffffff810d1a06 in pv_queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/paravirt.h:669 #5 queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:28 #6 queued_spin_lock (lock=<optimized out>) at include/asm-generic/qspinlock.h:107 #7 __mutex_lock_common (use_ww_ctx=<optimized out>, ww_ctx=<optimized out>, ip=<optimized out>, nest_lock=<optimized out>, subclass=<optimized out>, state=<optimized out>, lock=<optimized out>) at kernel/locking/mutex.c:526 #8 mutex_lock_interruptible_nested (lock=0xffff88003c480e88, subclass=<optimized out>) at kernel/locking/mutex.c:647 #9 0xffffffff812f49fe in dvb_ca_en50221_io_do_ioctl (file=<optimized out>, cmd=761492029, parg=0x1 <irq_stack_union+1>) at drivers/media/dvb-core/dvb_ca_en50221.c:1210 #10 0xffffffff812ee660 in dvb_usercopy (file=<optimized out>, cmd=761492029, arg=<optimized out>, func=<optimized out>) at drivers/media/dvb-core/dvbdev.c:883 #11 0xffffffff812f3410 in dvb_ca_en50221_io_ioctl (file=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at drivers/media/dvb-core/dvb_ca_en50221.c:1284 #12 0xffffffff8112eddd in vfs_ioctl (arg=<optimized out>, cmd=<optimized out>, filp=<optimized out>) at fs/ioctl.c:43 #13 do_vfs_ioctl (filp=0xffff88003c480e90, fd=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at fs/ioctl.c:674 #14 0xffffffff8112f30c in SYSC_ioctl (arg=<optimized out>, cmd=<optimized out>, fd=<optimized out>) at fs/ioctl.c:689 #15 SyS_ioctl (fd=6, cmd=2148298626, arg=140734533693696) at fs/ioctl.c:680 #16 0xffffffff8103feb2 in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:207 Signed-off-by:Max Kellermann <max@duempel.org> Signed-off-by:
-
Max Kellermann authored
The wait_event() call in dvb_unregister_frontend() waits synchronously for other tasks to free a file descriptor, but it does that while holding several mutexes. That alone is a bad idea, but if one user process happens to keep a (defunct) file descriptor open indefinitely, the kernel will correctly detect a hung task: INFO: task kworker/0:1:314 blocked for more than 30 seconds. Not tainted 4.7.0-rc1-hosting+ #50 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:1 D ffff88003daf7a50 0 314 2 0x00000000 Workqueue: usb_hub_wq hub_event ffff88003daf7a50 0000000000000296 ffff88003daf7a30 ffff88003fc13f98 ffff88003dadce00 ffff88003daf8000 ffff88003e3fc010 ffff88003d48d4f8 ffff88003e3b5030 ffff88003e3f8898 ffff88003daf7a68 ffffffff810cf860 Call Trace: [<ffffffff810cf860>] schedule+0x30/0x80 [<ffffffff812f88d3>] dvb_unregister_frontend+0x93/0xc0 [<ffffffff8107a000>] ? __wake_up_common+0x80/0x80 [<ffffffff813019c7>] dvb_usb_adapter_frontend_exit+0x37/0x70 [<ffffffff81300614>] dvb_usb_exit+0x34/0xb0 [<ffffffff81300d4a>] dvb_usb_device_exit+0x3a/0x50 [<ffffffff81302dc2>] pctv452e_usb_disconnect+0x52/0x60 [<ffffffff81295a07>] usb_unbind_interface+0x67/0x1e0 [<ffffffff810609f3>] ? __blocking_notifier_call_chain+0x53/0x70 [<ffffffff8127ba67>] __device_release_driver+0x77/0x110 [<ffffffff8127c2d3>] device_release_driver+0x23/0x30 [<ffffffff8127ab5d>] bus_remove_device+0x10d/0x150 [<ffffffff8127879b>] device_del+0x13b/0x260 [<ffffffff81299dea>] ? usb_remove_ep_devs+0x1a/0x30 [<ffffffff8129468e>] usb_disable_device+0x9e/0x1e0 [<ffffffff8128bb09>] usb_disconnect+0x89/0x260 [<ffffffff8128db8d>] hub_event+0x30d/0xfc0 [<ffffffff81059475>] process_one_work+0x1c5/0x4a0 [<ffffffff8105940c>] ? process_one_work+0x15c/0x4a0 [<ffffffff81059799>] worker_thread+0x49/0x480 [<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0 [<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0 [<ffffffff8105f65e>] kthread+0xee/0x110 [<ffffffff810400bf>] ret_from_fork+0x1f/0x40 [<ffffffff8105f570>] ? __kthread_unpark+0x70/0x70 5 locks held by kworker/0:1/314: #0: ("usb_hub_wq"){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0 #1: ((&hub->events)){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0 #2: (&dev->mutex){......}, at: [<ffffffff8128d8cb>] hub_event+0x4b/0xfc0 #3: (&dev->mutex){......}, at: [<ffffffff8128bad2>] usb_disconnect+0x52/0x260 #4: (&dev->mutex){......}, at: [<ffffffff8127c2cb>] device_release_driver+0x1b/0x30 This patch removes the blocking wait, and postpones the kfree() call until all file handles have been closed by using struct kref. Signed-off-by: -
Aayush Gupta authored
Signed-off-by:
Aayush Gupta <aayustark007@gmail.com> Signed-off-by:
-
Andi Shyti authored
The LIRC_CAN_REC() returns a boolean "flag & LIRC_CAN_REC_MASK" to check whether the device can receive data. Signed-off-by:
Andi Shyti <andi.shyti@samsung.com> Signed-off-by:
-
Andi Shyti authored
When opening or closing a lirc character device, the framework provides to the user the possibility to keep track of opening or closing of the device by calling two functions: - set_use_inc() when opening the device - set_use_dec() when closing the device if those are not set by the lirc user, the system segfaults. Check the pointer value before calling the above functions. Signed-off-by:
-
Andi Shyti authored
Signed-off-by:
-
Andi Shyti authored
If ioctl is called, it cannot be a case of invalid system call number (ENOSYS), that is a ENOTTY case which means that the device doesn't support that specific ioctl command. So, replace ENOSYS with ENOTTY. Signed-off-by:
-
Andi Shyti authored
When comparing a variable with a constant, the comparison should start from the variable and not from the constant. It's also written in the human DNA. Swap the terms of comparisons whenever the constant comes first and fix the following checkpatch warning: WARNING: Comparisons should place the constant on the right side of the test Signed-off-by:
-
Andi Shyti authored
The three if statements check the same thing, merge them in only one statement. Signed-off-by:
-
Andi Shyti authored
There are two if ... else which check the same thing in different part of the code, they can be merged in a single check. Signed-off-by:
-
Andi Shyti authored
The whole function is inside an 'if' statement ("if (ir->d.add_to_buf)"). Check the opposite of that statement at the beginning and exit, this way we can have one level less of indentation. Signed-off-by: -
Andi Shyti authored
... use "do .. while" instead. Signed-off-by:
-
Andi Shyti authored
The code can be rearranged so that some goto paths can be removed Signed-off-by:
-
Andi Shyti authored
This patch mutes also all the checkpatch warnings related to printk. Reword all the printouts so that the string doesn't need to be split, which fixes the following checkpatch warning: WARNING: quoted string split across lines Signed-off-by:
-
Andi Shyti authored
Signed-off-by:
-
Andi Shyti authored
Transmitters don't necessarily need to have a FIFO managed buffer for their transfers. When registering the driver, before allocating the buffer, check whether the device is a transmitter or receiver. Allocate the buffer only for receivers. Signed-off-by:
-
Andi Shyti authored
During the driver registration, move the buffer allocation on a separate function. Signed-off-by:
-
Arnd Bergmann authored
The newly added FCP support in the vsp1 driver causes a link error when CONFIG_RENESAS_FCP=m, since it's not reachable by built-in code: drivers/media/built-in.o: In function `vsp1_remove': :(.text+0xdeca0): undefined reference to `rcar_fcp_put' drivers/media/built-in.o: In function `vsp1_probe': :(.text+0xdef44): undefined reference to `rcar_fcp_get' We already have a conditional dependency on FCP that requires it for ARM64, so for all others we just have to prevent setting RENESAS_VSP1=y when RENESAS_FCP=m by extending the FCP dependency. Fixes: 94fcdf82 ("[media] v4l: vsp1: Add FCP support") Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
Arnd Bergmann authored
Building without CONFIG_PM results in a harmless warning from slightly incorrect #ifdef guards: drivers/media/platform/vsp1/vsp1_drv.c:525:12: error: 'vsp1_pm_runtime_resume' defined but not used [-Werror=unused-function] drivers/media/platform/vsp1/vsp1_drv.c:516:12: error: 'vsp1_pm_runtime_suspend' defined but not used [-Werror=unused-function] This removes the existing #ifdef and instead marks all four PM functions as __maybe_unused. Fixes: 1e6af546 ("[media] v4l: vsp1: Implement runtime PM support") Signed-off-by:
-
Mauro Carvalho Chehab authored
* topic/vsp1: (36 commits) [media] v4l: vsp1: wpf: Add flipping support [media] v4l: vsp1: rwpf: Support runtime modification of controls [media] v4l: vsp1: Simplify alpha propagation [media] v4l: vsp1: clu: Support runtime modification of controls [media] v4l: vsp1: lut: Support runtime modification of controls [media] v4l: vsp1: Support runtime modification of controls [media] v4l: vsp1: Add Cubic Look Up Table (CLU) support [media] v4l: vsp1: lut: Expose configuration through a control [media] v4l: vsp1: lut: Initialize the mutex [media] v4l: vsp1: dl: Don't free fragments with interrupts disabled [media] v4l: vsp1: Set entities functions [media] v4l: vsp1: Don't create LIF entity when the userspace API is enabled [media] v4l: vsp1: Don't register media device when userspace API is disabled [media] v4l: vsp1: Base link creation on availability of entities [media] media: Add video statistics computation functions [media] media: Add video processing entity functions [media] v4l: vsp1: sru: Fix intensity control ID [media] v4l: vsp1: Stop the pipeline upon the first STREAMOFF [media] v4l: vsp1: Constify operation structures [media] v4l: vsp1: pipe: Fix typo in comment ...
-
Ezequiel Garcia authored
Now that the frame rate can be properly set, this commit adds support for S_PARM and G_PARM. Signed-off-by:
Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Signed-off-by:
-
Mauro Carvalho Chehab authored
Instead of using two tables to estimate the temporal decimation factor, use a formula. This allows to get the closest fps, which sounds better than the current tables. Also, the current code doesn't store the real framerate. This patch fixes the above issues. [Ezequiel: - introduce a TW686X_MAX_FPS macro for max_fps. - use hweight_long instead of open coding the set bits count.] Signed-off-by:
Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by:
-
Dan Carpenter authored
My static checker complains that if adap->props.num_frontends is 0 then "ret" is uninitialized. I don't think that can happen. But "ret" is always zero here so we can just remove the condition. This extra check was added in commit 0d3ab841 ('[media] dvb core: must check dvb_create_media_graph()'). Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Colin Ian King authored
trivial fix to spelling mistake in dev_err message Signed-off-by:
Colin Ian King <colin.king@canonical.com> Acked-by:
Abylay Ospan <aospan@netup.ru> Signed-off-by:
-
Olli Salonen authored
Add the USB ID for Terratec Cinergy S2 Rev.3 (0ccd:0102). Curiously dvb-usb-ids included already the USB ID for TERRATEC_CINERGY_S2_R3 even if the device was not supported. Reported-by:
Christian Knippel <namerp@googlemail.com> Signed-off-by:
Olli Salonen <olli.salonen@iki.fi> Signed-off-by:
-
Saso Slavicic authored
Tuning a card with Sony ASCOT2E produces the following error: kernel: i2c i2c-9: wr reg=0006: len=11 is too big! MAX_WRITE_REGSIZE is defined as 10, buf[MAX_WRITE_REGSIZE + 1] buffer is used in ascot2e_write_regs(). The problem is that exactly 10 bytes are written in ascot2e_set_params(): /* Set BW_OFFSET (0x0F) value from parameter table */ data[9] = ascot2e_sett[tv_system].bw_offset; ascot2e_write_regs(priv, 0x06, data, 10); The test in write_regs is as follows: if (len + 1 >= sizeof(buf)) 10 + 1 = 11 and that would be exactly the size of buf. Since 10 bytes + buf[0] = reg would seem to fit into buf[], this shouldn't be an error. Signed-off-by: -
Wei Yongjun authored
Fixes the following sparse warning: drivers/staging/media/pulse8-cec/pulse8-cec.c:427:27: warning: symbol 'pulse8_cec_adap_ops' was not declared. Should it be static? Signed-off-by:
Wei Yongjun <yongjun_wei@trendmicro.com.cn> Signed-off-by:
-
Wei Yongjun authored
There is a error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Signed-off-by:
Tiffany Lin <tiffany.lin@mediatek.com> Signed-off-by:
Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by:
-
Wei Yongjun authored
In case of error, the function devm_clk_get() returns ERR_PTR() and not returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Signed-off-by:
-
Wei Yongjun authored
There is a error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Signed-off-by:
-
Wei Yongjun authored
In case of error, the function devm_clk_get() returns ERR_PTR() and not returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Signed-off-by:
-
Hans Verkuil authored
When transmitting a message and waiting for a reply it would be good to know the time between when the message was transmitted and when the reply arrived. With only one timestamp field it was set to when the reply arrived and the original transmit time was overwritten. Just taking the timestamp in userspace right before CEC_TRANSMIT is called is not reliable, since the actual transmit can be delayed if the CEC bus is busy. Only the driver can fill this in accurately. So split up the ts field into an rx_ts and a tx_ts. Also move the status fields to after the 'reply' field: they were placed in a strange position and make much more sense when grouped with the other status-related fields. This patch also makes sure that the timestamp is taken as soon as possible. Signed-off-by:
-
Hans Verkuil authored
Check (and warn) if the msg->len is too long or if it is 0. Should never happen, but just in case... Signed-off-by:
-
Jonathan McDowell authored
The DW2102 DVB-S/S2 driver uses the info() logging function from dvb-usb.h. This function already appends a newline to the provided log message, causing the dmesg output from DW2102 to include blank lines. Fix this by removing the newline in the calls to info(). Signed-off-by:
Jonathan McDowell <noodles@earth.li> Signed-off-by:
-
- 12 Jul, 2016 5 commits
-
-
Sudip Mukherjee authored
We have assigned memory while requesting the firmware but if the sanity check fails then we are not releasing the firmware. Signed-off-by:
Sudip Mukherjee <sudip.mukherjee@codethink.co.uk> Signed-off-by:
-
Andrew Morton authored
drivers/staging/media/cec/cec-adap.c: In function 'cec_queue_msg_fh': drivers/staging/media/cec/cec-adap.c:141: error: unknown field 'lost_msgs' specified in initializer Fixes: 9881fe0c ("[media] cec: add HDMI CEC framework (adapter)") Cc: Hans Verkuil <hans.verkuil@cisco.com> Cc: Kamil Debski <kamil@wypas.org> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
-
Mauro Carvalho Chehab authored
drivers/staging/media/pulse8-cec/pulse8-cec.c:104:6: warning: no previous prototype for 'pulse8_irq_work_handler' [-Wmissing-prototypes] void pulse8_irq_work_handler(struct work_struct *work) ^~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: -
Hans Verkuil authored
Explain what needs to be done to move this driver out of staging. Signed-off-by:
-
Hans Verkuil authored
Add entry for the pulse8-cec driver. Signed-off-by:
-
