- 01 Feb, 2016 2 commits
-
-
Mauro Carvalho Chehab authored
If struct xc2028_config is passed without a firmware name, the following trouble may happen: [11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner [11009.907491] ================================================================== [11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40 [11009.907992] Read of size 1 by task modprobe/28992 [11009.907994] ============================================================================= [11009.907997] BUG kmalloc-16 (Tainted: G W ): kasan: bad access detected [11009.907999] ----------------------------------------------------------------------------- [11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992 [11009.908012] ___slab_alloc+0x581/0x5b0 [11009.908014] __slab_alloc+0x51/0x90 [11009.908017] __kmalloc+0x27b/0x350 [11009.908022] xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] [11009.908026] usb_hcd_submit_urb+0x1e8/0x1c60 [11009.908029] usb_submit_urb+0xb0e/0x1200 [11009.908032] usb_serial_generic_write_start+0xb6/0x4c0 [11009.908035] usb_serial_generic_write+0x92/0xc0 [11009.908039] usb_console_write+0x38a/0x560 [11009.908045] call_console_drivers.constprop.14+0x1ee/0x2c0 [11009.908051] console_unlock+0x40d/0x900 [11009.908056] vprintk_emit+0x4b4/0x830 [11009.908061] vprintk_default+0x1f/0x30 [11009.908064] printk+0x99/0xb5 [11009.908067] kasan_report_error+0x10a/0x550 [11009.908070] __asan_report_load1_noabort+0x43/0x50 [11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992 [11009.908077] __slab_free+0x2ec/0x460 [11009.908080] kfree+0x266/0x280 [11009.908083] xc2028_set_config+0x90/0x630 [tuner_xc2028] [11009.908086] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908090] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908094] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908098] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908101] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908105] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908108] do_one_initcall+0x141/0x300 [11009.908111] do_init_module+0x1d0/0x5ad [11009.908114] load_module+0x6666/0x9ba0 [11009.908117] SyS_finit_module+0x108/0x130 [11009.908120] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x (null) flags=0x2ffff8000004080 [11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001 [11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00 ....*....(...... [11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff ...........j.... [11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G B W 4.5.0-rc1+ #43 [11009.908140] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015 [11009.908142] ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80 [11009.908148] ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280 [11009.908153] ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4 [11009.908158] Call Trace: [11009.908162] [<ffffffff81932007>] dump_stack+0x4b/0x64 [11009.908165] [<ffffffff81556759>] print_trailer+0xf9/0x150 [11009.908168] [<ffffffff8155ccb4>] object_err+0x34/0x40 [11009.908171] [<ffffffff8155f260>] kasan_report_error+0x230/0x550 [11009.908175] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908179] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908182] [<ffffffff8155f5c3>] __asan_report_load1_noabort+0x43/0x50 [11009.908185] [<ffffffff8155ea00>] ? __asan_register_globals+0x50/0xa0 [11009.908189] [<ffffffff8194cea6>] ? strcmp+0x96/0xb0 [11009.908192] [<ffffffff8194cea6>] strcmp+0x96/0xb0 [11009.908196] [<ffffffffa13ba4ac>] xc2028_set_config+0x15c/0x630 [tuner_xc2028] [11009.908200] [<ffffffffa13bac90>] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908203] [<ffffffff8155ea78>] ? memset+0x28/0x30 [11009.908206] [<ffffffffa13ba980>] ? xc2028_set_config+0x630/0x630 [tuner_xc2028] [11009.908211] [<ffffffffa157a59a>] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908215] [<ffffffffa157aa2a>] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb] [11009.908219] [<ffffffffa157a3a1>] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb] [11009.908222] [<ffffffffa01795ac>] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x] [11009.908226] [<ffffffffa01793e0>] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x] [11009.908230] [<ffffffff812e87d0>] ? ref_module.part.15+0x10/0x10 [11009.908233] [<ffffffff812e56e0>] ? module_assert_mutex_or_preempt+0x80/0x80 [11009.908238] [<ffffffffa157af92>] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908242] [<ffffffffa157a6ae>] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb] [11009.908245] [<ffffffff8195222d>] ? string+0x14d/0x1f0 [11009.908249] [<ffffffff8195381f>] ? symbol_string+0xff/0x1a0 [11009.908253] [<ffffffff81953720>] ? uuid_string+0x6f0/0x6f0 [11009.908257] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908260] [<ffffffff8104b02f>] ? print_context_stack+0x7f/0xf0 [11009.908264] [<ffffffff812e9846>] ? __module_address+0xb6/0x360 [11009.908268] [<ffffffff8137fdc9>] ? is_ftrace_trampoline+0x99/0xe0 [11009.908271] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908275] [<ffffffff81240a70>] ? debug_check_no_locks_freed+0x290/0x290 [11009.908278] [<ffffffff8104a24b>] ? dump_trace+0x11b/0x300 [11009.908282] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908285] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908289] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908292] [<ffffffff812404dd>] ? trace_hardirqs_on+0xd/0x10 [11009.908296] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908299] [<ffffffff822dcbb0>] ? mutex_trylock+0x400/0x400 [11009.908302] [<ffffffff810021a1>] ? do_one_initcall+0x131/0x300 [11009.908306] [<ffffffff81296dc7>] ? call_rcu_sched+0x17/0x20 [11009.908309] [<ffffffff8159e708>] ? put_object+0x48/0x70 [11009.908314] [<ffffffffa1579f11>] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908317] [<ffffffffa13e81f9>] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908320] [<ffffffffa0150000>] ? 0xffffffffa0150000 [11009.908324] [<ffffffffa0150010>] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908327] [<ffffffff810021b1>] do_one_initcall+0x141/0x300 [11009.908330] [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40 [11009.908333] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908337] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908340] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908343] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908346] [<ffffffff8155ea37>] ? __asan_register_globals+0x87/0xa0 [11009.908350] [<ffffffff8144da7b>] do_init_module+0x1d0/0x5ad [11009.908353] [<ffffffff812f2626>] load_module+0x6666/0x9ba0 [11009.908356] [<ffffffff812e9c90>] ? symbol_put_addr+0x50/0x50 [11009.908361] [<ffffffffa1580037>] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb] [11009.908366] [<ffffffff812ebfc0>] ? module_frob_arch_sections+0x20/0x20 [11009.908369] [<ffffffff815bc940>] ? open_exec+0x50/0x50 [11009.908374] [<ffffffff811671bb>] ? ns_capable+0x5b/0xd0 [11009.908377] [<ffffffff812f5e58>] SyS_finit_module+0x108/0x130 [11009.908379] [<ffffffff812f5d50>] ? SyS_init_module+0x1f0/0x1f0 [11009.908383] [<ffffffff81004044>] ? lockdep_sys_exit_thunk+0x12/0x14 [11009.908394] [<ffffffff822e6936>] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908396] Memory state around the buggy address: [11009.908398] ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908401] ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [11009.908405] ^ [11009.908407] ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908409] ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908411] ================================================================== In order to avoid it, let's set the cached value of the firmware name to NULL after freeing it. While here, return an error if the memory allocation fails. Signed-off-by:Mauro Carvalho Chehab <mchehab@osg.samsung.com>
-
Mauro Carvalho Chehab authored
The em28xx driver have lots of different input types but only 4 of such types are actually used. The others are bogus. Remove them, in order to cleanup the driver. Signed-off-by:
-
- 29 Jan, 2016 2 commits
-
-
Laurent Pinchart authored
This patch enables the tvp5150 decoder driver to be used with the media controller framework by adding pad-level subdev operations and init the media entity pad. Signed-off-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
Javier Martinez Canillas <javier@osg.samsung.com>
-
Laurent Pinchart authored
The tvp5150 output video is interlaced so mark the format field as alternate and reduce the height to the half. [javier: split patch and write commit message] Signed-off-by:
-
- 26 Jan, 2016 2 commits
-
-
Mauro Carvalho Chehab authored
This patch were a workaround for a regression at tvp5150, but it causes troubles on devices with omap3+tvp5151 when working in non-parallel bus mode. Now that em28xx was fixed, we can get rid of that. This reverts commit 47de9bf8. Signed-off-by:
-
Mauro Carvalho Chehab authored
On em28xx driver, s_stream subdev ops was not implemented properly. It was used only to disable stream, never enabling it. That was the root cause of the regression when we added support for s_stream on tvp5150 driver. With that, we can get rid of the changes on tvp5150 side, e. g. changeset 47de9bf8 ('[media] tvp5150: Fix breakage for serial usage'). Tested video output on em2820+tvp5150 on WinTV USB2 and video and/or vbi output on em288x+tvp5150 on HVR 950. Signed-off-by:
-
- 25 Jan, 2016 34 commits
-
-
Heiner Kallweit authored
At least on Zotac CI321 ACPI provides an ioport range for the wake up part but accessing these ioports has no effect. Instead the ioport base address is set to another value already (0xa20 in my case) and accessing this ioport range works. Therefore set a new ioport base address only if the current ioport base address is 0 (register reset default). The need to use the existing base address instead of trying to set an own one doesn't seem to be limited to this specific device as other drivers like hwmon/nct6775 do it the same way. This change was successfully tested on the mentioned device. And the change should be generic enough to not break the driver for other chips (however due to lack of appropriate hardware I wasn't able to test this). [mchehab@osg.samsung.com: Tested on Intel NUC NUC5i7RYB with BIOS version RYBDWi35.86A.0350.2015.0812.1722] Signed-off-by:
Heiner Kallweit <hkallweit1@gmail.com> Tested-by:
-
Heiner Kallweit authored
Calling nvt_set_cir_iren separately is not needed as this is done by nvt_cir_regs_init. Signed-off-by:
-
Heiner Kallweit authored
Selecting the logical device in the interrupt handler is not needed as no configuration register is accessed. Signed-off-by:
-
Heiner Kallweit authored
Only enable the logical devices after the registers have been initialized. The call to nvt_enable_logical_dev in nvt_resume is not needed as this is done implicitely by nvt_cir_regs_init now. [mchehab@osg.samsung.com: fixed multiline comment to kernel CodingStyle] Signed-off-by:
-
Heiner Kallweit authored
Factor out enabling of a logical device. Signed-off-by:
-
Heiner Kallweit authored
Switch to using the recently introduced IR default timeout value (IR_DEFAULT_TIMEOUT) and consider the value of SAMPLE_PERIOD when calculating the limit count register value. Signed-off-by:
-
Heiner Kallweit authored
At least on NVT6779D clearing the wake fifo works in learning mode only (although this condition is not mentioned in the chip spec). Setting the clear fifo bit has no effect in wake up mode. Even if clearing the wake fifo should work in wake up mode on other chips this workaround doesn't hurt. If needed the caller of nvt_clear_cir_wake_fifo has to take care of locking. Signed-off-by:
-
Heiner Kallweit authored
Factor out disabling of a logical device. Signed-off-by:
-
Heiner Kallweit authored
Simplify nvt_cir_tx_inactive. Signed-off-by:
-
Heiner Kallweit authored
Use nvt_cr_write to simplify nvt_select_logical_ dev. Signed-off-by:
-
Heiner Kallweit authored
The two EFM ioports are accessed by drivers for other parts of the Nuvoton Super-IO chips too. Therefore access to these ioports needs to be protected by using request_muxed_region (like it's implemented e.g. in hwmon/nct6775 already). Signed-off-by:
-
Markus Elfring authored
This issue was detected by using the Coccinelle software. Return the value from a call of the msi2500_ctrl_msg() function without using an extra check for the variable "ret" at the end. Signed-off-by:
Markus Elfring <elfring@users.sourceforge.net> Signed-off-by:
-
Markus Elfring authored
The variable "rc" will be set to an appropriate value from a call of the r820t_set_tv_standard() function. Thus let us omit the explicit initialisation at the beginning. Signed-off-by:
-
Markus Elfring authored
This issue was detected by using the Coccinelle software. 1. Let us return directly if a call of the regmap_write() function failed. 2. Delete the jump label "err" then. 3. Return zero as a constant at the end. Signed-off-by:
-
Markus Elfring authored
This issue was detected by using the Coccinelle software. 1. Let us return directly if a call of the si2165_readreg8() function failed. 2. Reduce the scope for the local variables "ret" and "tmp" to one branch of an if statement. 3. Delete the jump label "err" then. 4. Return the value from a call of the si2165_writereg8() function without using an extra assignment for the variable "ret" at the end. Signed-off-by:
Matthias Schwarzott <zzam@gentoo.org> Signed-off-by:
-
Grygorii Strashko authored
The ov2659 driver performs device detection and initialization in the following way: - send reset command REG_SOFTWARE_RESET - load array of predefined register's setting (~150 values) - read device version REG_SC_CHIP_ID_H/REG_SC_CHIP_ID_L - check version and exit if invalid. As result, for not connected device there will be >~150 i2c transactions executed before device version checking and exit (there are no failures detected because ov2659 declared as I2C_CLIENT_SCCB and NACKs are ignored in this case). Let's fix that by checking the chip version first and start initialization only if it's supported. Cc: Benoit Parrot <bparrot@ti.com> Signed-off-by:
Grygorii Strashko <grygorii.strashko@ti.com> Acked-by:
Lad, Prabhakar <prabhakar.csengg@gmail.com> Signed-off-by:
-
Markus Elfring authored
The data type "int" was used by the variable "ret" in the gsc_m2m_poll() function despite of the aspect that the type "unsigned int" will usually be needed for the return value from a call of the v4l2_m2m_poll() function. Improve this implementation detail by addition of the type modifier then. This issue was detected by using the Coccinelle software. Signed-off-by:
-
Sudip Mukherjee authored
checkpatch complains about missing space around operators. [mchehab@osg.samsung.com: removed obsolete hunks] Signed-off-by:
Sudip Mukherjee <sudip@vectorindia.org> Signed-off-by:
-
Sudip Mukherjee authored
checkpatch complains about space after type cast. [mchehab@osg.samsung.com: removed an obsolete hunk] Signed-off-by:
-
Sudip Mukherjee authored
A NULL comparison can be written as if (var) or if (!var). Reported by checkpatch. Signed-off-by:
-
Markus Pargmann authored
Add optional reset and standby gpios. The reset gpio is used to reset the chip in power_on(). The standby gpio is not used currently. It is just unset, so the chip is not in standby. Signed-off-by:
Markus Pargmann <mpa@pengutronix.de> Reviewed-by:
Philipp Zabel <p.zabel@pengutronix.de> Acked-by:
Rob Herring <robh@kernel.org> Acked-by:
-
Al Viro authored
Passing a physical address to free_pages() is a bad idea. config_params->fault_pxl.fpc_table_addr is set to virt_to_phys() of __get_free_pages() return value; what we should pass to free_pages() is its phys_to_virt(). ccdc_close() does that properly, but ccdc_update_raw_params() doesn't. Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> Acked-by:
-
Mauro Carvalho Chehab authored
changeset 460b6c08 ("tvp5150: Add s_stream subdev operation support") broke for em28xx-based devices with uses tvp5150. On those devices, touching the TVP5150_MISC_CTL register causes em28xx to stop streaming. I suspect that it uses the 27 MHz clock provided by tvp5150 to feed em28xx. So, change the logic to do nothing on s_stream if the tvp5150 is not set up to work with V4L2_MBUS_PARALLEL. Tested with Hauppauge WinTV USB 2 model 42012 Rev. C186 (USB ID: 2040:4200). Cc: Javier Martinez Canillas <javier@osg.samsung.com> Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Linus Walleij authored
This makes the driver use the data pointer added to the gpio_chip to store a pointer to the state container instead of relying on container_of(). Cc: Antti Palosaari <crope@iki.fi> Signed-off-by:
Linus Walleij <linus.walleij@linaro.org> Signed-off-by:
-
Matthias Schwarzott authored
The si2165 does not support bandwidth auto-detection. Reject the request. Signed-off-by:
-
Mauro Carvalho Chehab authored
Now that this was defined at usb-id.h, update the values for USB_PID_TERRATEC_CINERGY_S2_R1 and USB_PID_TERRATEC_CINERGY_S2_R2. Signed-off-by: -
Benjamin Larsson authored
Also Add Terratec Cinergy S2 usb id's Signed-off-by:
Benjamin Larsson <benjamin@southpole.se> Signed-off-by:
-
Heiner Kallweit authored
The FIFO is used for ir_raw_event records, however for some historic reason the FIFO is used on a per byte basis. IMHO this adds unneeded complexity. Therefore set up the FIFO for ir_raw_event records. This also allows to define the FIFO statically as part of ir_raw_event_ctrl instead of having to allocate the FIFO dynamically. In addition: - When writing into the FIFO and it's full return ENOSPC instead of ENOMEM thus making it easier to tell between "FIFO full" and "Dynamic memory allocation failed" when the error is propagated to a higher level. Also add an error message. - When reading from the FIFO check whether it's empty. This is not strictly needed here but kfifo_out is annotated "must check" anyway. Successfully tested it with the nuvoton-cir driver. Signed-off-by:
-
Heiner Kallweit authored
When requesting resources use different names for the normal and the wakeup part. This makes it easier to interpret the output of e.g. /proc/interrupts and /proc/ioports. Signed-off-by:
-
Nicolas Sugino authored
MyGica/Geniatech S2870 is very similar to the S870 but with dual tuner. The card is recognised as Geniatech STK8096-PVR. [mchehab@osg.samsung.com: Fix some checkpatch.pl issues] Signed-off-by:
Nicolas Sugino <nsugino@3way.com.ar> Signed-off-by:
-
Patrick Boettcher authored
Soon my dibcom.fr/parrot.com-address won't respond anymore. Thus I'm replacing it. And, while being at it, let's adapt some other (old) email-addresses as well. Signed-off-by:
Patrick Boettcher <patrick.boettcher@posteo.de> Signed-off-by:
-
Eduard Gavin authored
The Documentation/devicetree/bindings/media/i2c/tvp5150.txt DT binding doc lists "ti,tvp5150" as the device compatible string but the driver does not have an OF match table. Add the table to the driver so the I2C core can do an OF style match. Signed-off-by:
Eduard Gavin <egavinc@gmail.com> Signed-off-by:
-
Javier Martinez Canillas authored
The video decoder supports either 8-bit 4:2:2 YUV with discrete syncs or 8-bit ITU-R BT.656 with embedded syncs output format but currently BT.656 it's always reported. Allow to configure the format to use via either platform data or a device tree definition. Signed-off-by:
-
Javier Martinez Canillas authored
After power-up, the tvp5150 decoder is in a unknown state until the RESETB pin is driven LOW which reset all the registers and restarts the chip's internal state machine. The init sequence has some timing constraints and the RESETB signal can only be used if the PDN (Power-down) pin is first released. So, the initialization sequence is as follows: 1- PDN (active-low) is driven HIGH so the chip is power-up 2- A 20 ms delay is needed before sending a RESETB (active-low) signal. 3- The RESETB pulse duration is 500 ns. 4- A 200 us delay is needed for the I2C client to be active after reset. This patch used as a reference the logic in the IGEPv2 board file from the ISEE 2.6.37 vendor tree. Signed-off-by:
-
