1. 13 Dec, 2017 18 commits
  2. 12 Dec, 2017 17 commits
  3. 11 Dec, 2017 5 commits
    • Andrey Konovalov's avatar
      media: pvrusb2: properly check endpoint types · 72c27a68
      Andrey Konovalov authored
      As syzkaller detected, pvrusb2 driver submits bulk urb withount checking
      the the endpoint type is actually blunk. Add a check.
      
      usb 1-1: BOGUS urb xfer, pipe 3 != type 1
      ------------[ cut here ]------------
      WARNING: CPU: 1 PID: 2713 at drivers/usb/core/urb.c:449 usb_submit_urb+0xf8a/0x11d0
      Modules linked in:
      CPU: 1 PID: 2713 Comm: pvrusb2-context Not tainted
      4.14.0-rc1-42251-gebb2c243 #210
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
      task: ffff88006b7a18c0 task.stack: ffff880069978000
      RIP: 0010:usb_submit_urb+0xf8a/0x11d0 drivers/usb/core/urb.c:448
      RSP: 0018:ffff88006997f990 EFLAGS: 00010286
      RAX: 0000000000000029 RBX: ffff880063661900 RCX: 0000000000000000
      RDX: 0000000000000029 RSI: ffffffff86876d60 RDI: ffffed000d32ff24
      RBP: ffff88006997fa90 R08: 1ffff1000d32fdca R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1000d32ff39
      R13: 0000000000000001 R14: 0000000000000003 R15: ffff880068bbed68
      FS:  0000000000000000(0000) GS:ffff88006c600000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000001032000 CR3: 000000006a0ff000 CR4: 00000000000006f0
      Call Trace:
       pvr2_send_request_ex+0xa57/0x1d80 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3645
       pvr2_hdw_check_firmware drivers/media/usb/pvrusb2/pvrusb2-hdw.c:1812
       pvr2_hdw_setup_low drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2107
       pvr2_hdw_setup drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2250
       pvr2_hdw_initialize+0x548/0x3c10 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2327
       pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:118
       pvr2_context_thread_func+0x361/0x8c0 drivers/media/usb/pvrusb2/pvrusb2-context.c:167
       kthread+0x3a1/0x470 kernel/kthread.c:231
       ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
      Code: 48 8b 85 30 ff ff ff 48 8d b8 98 00 00 00 e8 ee 82 89 fe 45 89
      e8 44 89 f1 4c 89 fa 48 89 c6 48 c7 c7 40 c0 ea 86 e8 30 1b dc fc <0f>
      ff e9 9b f7 ff ff e8 aa 95 25 fd e9 80 f7 ff ff e8 50 74 f3
      ---[ end trace 6919030503719da6 ]---
      Signed-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      72c27a68
    • Mauro Carvalho Chehab's avatar
      media: led-class-flash: better handle NULL flash struct · 09db1a46
      Mauro Carvalho Chehab authored
      The logic at V4L2 led core assumes that the flash struct
      can be null. However, it doesn't check for null while
      trying to set, causing some smatch  to warn:
      
      	drivers/media/v4l2-core/v4l2-flash-led-class.c:210 v4l2_flash_s_ctrl() error: we previously assumed 'fled_cdev' could be null (see line 200)
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      Acked-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      09db1a46
    • Mauro Carvalho Chehab's avatar
      media: dvb_frontend: be sure to init dvb_frontend_handle_ioctl() return code · a9cb97c3
      Mauro Carvalho Chehab authored
      As smatch warned:
      	drivers/media/dvb-core/dvb_frontend.c:2468 dvb_frontend_handle_ioctl() error: uninitialized symbol 'err'.
      
      The ioctl handler actually got a regression here: before changeset
      d73dcf0c ("media: dvb_frontend: cleanup ioctl handling logic"),
      the code used to return -EOPNOTSUPP if an ioctl handler was not
      implemented on a driver. After the change, it may return a random
      value.
      
      Fixes: d73dcf0c ("media: dvb_frontend: cleanup ioctl handling logic")
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      Tested-by: default avatarDaniel Scheller <d.scheller@gmx.net>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      a9cb97c3
    • Mauro Carvalho Chehab's avatar
      media: xc5000: better handle I2C error messages · 7621b8c4
      Mauro Carvalho Chehab authored
      As warned by smatch, there are several places where the I2C
      transfer may fail, leading into inconsistent behavior:
      
      	drivers/media/tuners/xc5000.c:689 xc_debug_dump() error: uninitialized symbol 'regval'.
      	drivers/media/tuners/xc5000.c:841 xc5000_is_firmware_loaded() error: uninitialized symbol 'id'.
      	drivers/media/tuners/xc5000.c:939 xc5000_set_tv_freq() error: uninitialized symbol 'pll_lock_status'.
      	drivers/media/tuners/xc5000.c:1195 xc_load_fw_and_init_tuner() error: uninitialized symbol 'pll_lock_status'.
      
      Handle the return codes from the I2C transfer, in order to
      address those issues.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      7621b8c4
    • Mauro Carvalho Chehab's avatar
      media: mxl111sf: improve error handling logic · ad7b57d5
      Mauro Carvalho Chehab authored
      As reported by smatch:
      	drivers/media/usb/dvb-usb-v2/mxl111sf-demod.c:485 mxl111sf_demod_read_signal_strength() error: uninitialized symbol 'modulation'.
      
      The mxl111sf_demod_read_signal_strength() just ignores if something
      gets wrong while reading snr or modulation.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      ad7b57d5