1. 11 Jan, 2012 1 commit
    • Thomas Petazzoni's avatar
      [media] cx231xx: fix crash after load/unload/load of module · a116a05c
      Thomas Petazzoni authored
      The following sequence of commands was triggering a kernel crash in
      cdev_get():
      
       modprobe cx231xx
       rmmod cx231xx
       modprobe cx231xx
       v4l2grab -n 1
      
      The problem was that cx231xx_usb_disconnect() was not doing anything
      because the test:
      
      	if (!dev->udev)
      		return;
      
      was reached (i.e, dev->udev was NULL).
      
      This is due to the fact that the 'dev' pointer placed as intfdata into
      the usb_interface structure had the wrong value, because
      cx231xx_probe() was doing the usb_set_intfdata() on the wrong
      usb_interface structure. For some reason, cx231xx_probe() was doing
      the following:
      
      static int cx231xx_usb_probe(struct usb_interface *interface,
      			     const struct usb_device_id *id)
      {
              struct usb_interface *lif = NULL;
      	[...]
              /* store the current interface */
              lif = interface;
      	[...]
              /* store the interface 0 back */
              lif = udev->actconfig->interface[0];
      	[...]
      	usb_set_intfdata(lif, dev);
      	[...]
      	retval = v4l2_device_register(&interface->dev, &dev->v4l2_dev);
      	[...]
      }
      
      So, the usb_set_intfdata() was done on udev->actconfig->interface[0]
      and not on the 'interface' passed as argument to the ->probe() and
      ->disconnect() hooks. Later on, v4l2_device_register() was
      initializing the intfdata of the correct usb_interface structure as a
      pointer to the v4l2_device structure.
      
      Upon unregistration, the ->disconnect() hook was getting the intfdata
      of the usb_interface passed as argument... and casted it to a 'struct
      cx231xx *' while it was in fact a 'struct v4l2_device *'.
      
      The correct fix seems to just be to set the intfdata on the proper
      interface from the beginning. Now, loading/unloading/reloading the
      driver allows to use the device properly.
      Signed-off-by: default avatarThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      a116a05c
  2. 10 Jan, 2012 1 commit
    • Mauro Carvalho Chehab's avatar
      [media] dvb_ca_en50221: fix compilation breakage · 624f0c18
      Mauro Carvalho Chehab authored
      As reported by Toralf:
      
      the build failed with :
        CC [M]  drivers/media/dvb/dvb-core/dvb_ca_en50221.o
      In file included from arch/x86/include/asm/uaccess.h:573:0,
                       from include/linux/poll.h:14,
                       from drivers/media/dvb/dvb-core/dvbdev.h:27,
                       from drivers/media/dvb/dvb-core/dvb_ca_en50221.h:27,
                       from drivers/media/dvb/dvb-core/dvb_ca_en50221.c:41:
      In function "copy_from_user", inlined from "dvb_ca_en50221_io_write" at drivers/media/dvb/dvb-core/dvb_ca_en50221.c:1314:26: arch/x86/include/asm/uaccess_32.h:211:26: error: call to "copy_from_user_overflow" declared with attribute error: copy_from_user() buffer size is not provably correct
      Reported-by: default avatarToralf Foerster <toralf.foerster@gmx.de>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      624f0c18
  3. 07 Jan, 2012 11 commits
  4. 06 Jan, 2012 27 commits