summaryrefslogtreecommitdiff
path: root/drivers/media/usb
AgeCommit message (Collapse)Author
2019-12-16media: pulse8-cec: schedule next ping after current ping finishedHans Verkuil
Don't schedule the next ping before the current ping is sent, schedule it after. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-16media: pulse8-cec: use adap_free callbackHans Verkuil
Don't free everything in the disconnect callback, instead use the adap_free callback, which is called when the last open filehandle is closed. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-16media: pulse8-cec: queue received messages in an arrayHans Verkuil
It turns out that received CEC messages can arrive faster than can be processed by the CEC framework, resulting in lost messages. Instead of storing only one CEC message, store up to 8. Also fix a bug where the EOM bit wasn't checked for a received message of length 1, so POLL messages weren't properly reported. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-16media: pulse8-cec: move the transmit to a workqueueHans Verkuil
Instead of adap_transmit waiting until the full message is transmitted (and thus hoarding the adap->lock mutex), have it kick off a transmit workqueue. This prevents adap->lock from being locked for a very long time. Also skip FAILED_ACK reports for broadcast messages: this makes no sense, and it seems a spurious message coming from the Pulse-Eight, since some time later I see the SUCCEEDED message. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-16media: pulse8-cec: set tx_done_status for transmit_done statusHans Verkuil
Instead of translating work_result to a transmit_done status in pulse8_irq_work_handler(), pass the CEC_TX_STATUS via a new tx_done_status field. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-16media: pulse8-cec: add 2nd debug levelHans Verkuil
Use debug level 2 to show the low-level Pulse-Eight commands. Also show the message to transmit on debug level 1 and add a debug log to show where the transmit failed. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-16media: pulse8-cec: locking improvementsHans Verkuil
Drop the write_lock, rename config_lock to plain lock since this now locks access to the adapter. Use 'lock' when transmitting a message, ensuring that nothing interferes with the transmit. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-16media: pulse8-cec: reorganize function orderHans Verkuil
Reorganize the order of the functions in the source, going from low-level to high-level. No functional changes were made. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-16media: pulse8-cec: improve debuggingHans Verkuil
Add and use pulse8_msgname() to show the message codes as a human readable text instead of a number. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: Drop superfluous ioctl PCM opsTakashi Iwai
PCM core deals the empty ioctl field now as default. Let's kill the redundant lines. Cc: Bluecherry Maintainers <maintainers@bluecherrydvr.com> Cc: Anton Sviridenko <anton@corp.bluecherry.net> Cc: Andrey Utkin <andrey.utkin@corp.bluecherry.net> Cc: Ismael Luceno <ismael@iodev.co.uk> Cc: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: tm6000: Clean up ALSA PCM API usagesTakashi Iwai
With the recent change in ALSA PCM core, the whole open-coded vmalloc buffer handling in this driver can be dropped by replacing with the managed buffer allocation. Also, snd_tm6000_capture_free() is dropped since the check of stream_started flag makes no sense; hw_free callback is guaranteed to be called after the stream gets stopped. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: go7007: Clean up ALSA PCM API usagesTakashi Iwai
With the recent change in ALSA PCM core, the whole open-coded vmalloc buffer handling in this driver can be dropped by replacing with the managed buffer allocation. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: em28xx: Clean up ALSA PCM API usagesTakashi Iwai
With the recent change in ALSA PCM core, the whole open-coded vmalloc buffer handling in this driver can be dropped by replacing with the managed buffer allocation. Also, snd_em28xx_hw_capture_free() is dropped since the check of stream_started flag makes no sense; hw_free callback is guaranteed to be called after the stream gets stopped. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: cs231xx: Clean up ALSA PCM API usagesTakashi Iwai
With the recent change in ALSA PCM core, the whole open-coded vmalloc buffer handling in this driver can be dropped by replacing with the managed buffer allocation. Also, snd_cx231xx_hw_capture_free() is dropped since the check of stream_started flag makes no sense; hw_free callback is guaranteed to be called after the stream gets stopped. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: usbtv: Use managed buffer allocationTakashi Iwai
Clean up the driver with the new managed buffer allocation API. The hw_params and hw_free callbacks became superfluous and dropped. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: go7007: fix a miss of snd_card_freeChuhong Yuan
go7007_snd_init() misses a snd_card_free() in an error path. Add the missed call to fix it. Signed-off-by: Chuhong Yuan <hslester96@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: usb: go7007: s2250-board: add missed i2c_unregister_deviceChuhong Yuan
The driver forgets to call i2c_unregister_device in remove like what is done in probe failure. Add the missed call to fix it. Signed-off-by: Chuhong Yuan <hslester96@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0Hans Verkuil
This fixes a syzbot failure since actlen could be uninitialized, but it was still used. Syzbot link: https://syzkaller.appspot.com/bug?extid=6bf9606ee955b646c0e1 Reported-and-tested-by: syzbot+6bf9606ee955b646c0e1@syzkaller.appspotmail.com Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Acked-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: gspca: zero usb_bufHans Verkuil
Allocate gspca_dev->usb_buf with kzalloc instead of kmalloc to ensure it is property zeroed. This fixes various syzbot errors about uninitialized data. Syzbot links: https://syzkaller.appspot.com/bug?extid=32310fc2aea76898d074 https://syzkaller.appspot.com/bug?extid=99706d6390be1ac542a2 https://syzkaller.appspot.com/bug?extid=64437af5c781a7f0e08e Reported-and-tested-by: syzbot+32310fc2aea76898d074@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+99706d6390be1ac542a2@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+64437af5c781a7f0e08e@syzkaller.appspotmail.com Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-12-13media: pulse8-cec: fix lost cec_transmit_attempt_done() callHans Verkuil
The periodic PING command could interfere with the result of a CEC transmit, causing a lost cec_transmit_attempt_done() call. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Cc: <stable@vger.kernel.org> # for v4.10 and up Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-11-27Merge tag 'usb-5.5-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB updates from Greg KH: "Here is the big set of USB patches for 5.5-rc1 Lots of little things in here: - typec updates and additions - usb-serial drivers cleanups and fixes - misc USB drivers cleanups and fixes - gadget drivers new features and controllers added - usual xhci additions - other minor changes All of these have been in linux-next with no reported issues" * tag 'usb-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (223 commits) usb: gadget: udc: gr_udc: create debugfs directory under usb root usb: gadget: atmel: create debugfs directory under usb root usb: musb: create debugfs directory under usb root usb: serial: Fix Kconfig indentation usb: misc: Fix Kconfig indentation usb: gadget: Fix Kconfig indentation usb: host: Fix Kconfig indentation usb: dwc3: Fix Kconfig indentation usb: gadget: configfs: Fix missing spin_lock_init() usb-storage: Disable UAS on JMicron SATA enclosure USB: documentation: flags on usb-storage versus UAS USB: uas: heed CAPACITY_HEURISTICS USB: uas: honor flag to avoid CAPACITY16 usb: host: xhci-tegra: Correct phy enable sequence usb-serial: cp201x: support Mark-10 digital force gauge usb: chipidea: imx: pinctrl for HSIC is optional usb: chipidea: imx: refine the error handling for hsic usb: chipidea: imx: change hsic power regulator as optional usb: chipidea: imx: check data->usbmisc_data against NULL before access usb: chipidea: core: change vbus-regulator as optional ...
2019-11-26Merge tag 'media/v5.5-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - uAPI documentation for stateless decoders - Added a new CEC ioctl together with its documentation - Improved IPU3 documentation - New i2c drivers: hi556 and imx290 - Added support on Vivid driver for meta streams - Added de-interlace support for sunxi subdriver - Added a few new remote controler keymaps - Added H.265 support for Sunxi Cedrus driver - Another round of random driver cleanups, fixes and improvements * tag 'media/v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (361 commits) media: Revert "media: mtk-vcodec: Remove extra area allocation in an input buffer on encoding" media: hantro: Set H264 FIELDPIC_FLAG_E flag correctly media: hantro: Remove now unused H264 pic_size media: hantro: Use output buffer width and height for H264 decoding media: hantro: Reduce H264 extra space for motion vectors media: hantro: Fix H264 motion vector buffer offset media: ti-vpe: vpe: fix compatible to match bindings media: dt-bindings: media: ti-vpe: Document VPE driver media: zr364xx: remove redundant assigmnent to idx, clean up code media: Documentation: media: *_DEFAULT targets for subdevs media: hantro: Fix s_fmt for dynamic resolution changes media: i2c: Use the correct style for SPDX License Identifier media: siano: Use the correct style for SPDX License Identifier media: vicodec: media_device_cleanup was called too early media: vim2m: media_device_cleanup was called too early media: cedrus: Increase maximum supported size media: cedrus: Fix H264 4k support media: cedrus: Properly signal size in mode register media: v4l2-ctrl: Lock main_hdl on operations of requests_queued. media: si470x-i2c: add missed operations in remove ...
2019-11-25Merge tag 'asoc-v5.5-2' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: More updates for v5.5 Some more development work for v5.5. Highlights include: - More cleanups from Morimoto-san. - Trigger word detection for RT5677. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-14media: uvcvideo: drop error check of debugfs_create_dir()Chunfeng Yun
No need check the return value of debugfs_create_dir() Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/1573541519-28488-1-git-send-email-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-11media: solo6x10: Remove superfluous snd_dma_continuous_data()Takashi Iwai
The recent change (commit 08422d2c559d: "ALSA: memalloc: Allow NULL device for SNDRV_DMA_TYPE_CONTINOUS type") made the PCM preallocation helper accepting NULL as the device pointer for the default usage. Drop the snd_dma_continuous_data() usage that became superfluous from the callers. Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-10media: zr364xx: remove redundant assigmnent to idx, clean up codeColin Ian King
The variable cable_type is being initialized with a value that is never read and is being re-assigned a little later on. Replace the redundant initializtion with the assignment that occurs a little later. Also initialize frm too rather than have a later assignment. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2019-11-09media: dvbsky: remove unused codeJan Pieter van Woerkom
remove unused code Signed-off-by: Jan Pieter van Woerkom <jp@jpvw.nl> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2019-11-09media: flexcop-usb: ensure -EIO is returned on error conditionColin Ian King
An earlier commit hard coded a return 0 to function flexcop_usb_i2c_req even though the an -EIO was intended to be returned in the case where ret != buflen. Fix this by replacing the return 0 with the return of ret to return the error return code. Addresses-Coverity: ("Unused value") Fixes: b430eaba0be5 ("[media] flexcop-usb: don't use stack for DMA") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2019-11-09media: b2c2-flexcop-usb: add sanity checkingOliver Neukum
The driver needs an isochronous endpoint to be present. It will oops in its absence. Add checking for it. Reported-by: syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2019-11-09media: pvrusb2: Fix oops on tear-down when radio support is not presentMike Isely
In some device configurations there's no radio or radio support in the driver. That's OK, as the driver sets itself up accordingly. However on tear-down in these caes it's still trying to tear down radio related context when there isn't anything there, leading to dereferences through a null pointer and chaos follows. How this bug survived unfixed for 11 years in the pvrusb2 driver is a mystery to me. [hverkuil: fix two checkpatch warnings] Signed-off-by: Mike Isely <isely@pobox.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2019-11-08media: em28xx: fix two smatch warningsHans Verkuil
Use sizeof instead of ARRAY_SIZE to fix this smatch warning: drivers/media/usb/em28xx/em28xx-i2c.c:952 em28xx_do_i2c_scan() warn: calling memset(x, y, ARRAY_SIZE()); Do the same for the em28xx_hash_mem() call in the same function. smatch didn't pick that up, but there too it should use sizeof instead of ARRAY_SIZE. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2019-11-05media: cx231xx: remove redundant assignment to variable statusColin Ian King
Variable status is being initialized with a value that is never read and is being re-assigned a later on. The assignment is redundant and hence can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2019-10-24media: gspca: remove redundant assignment to variable retColin Ian King
The variable ret is being initialized with a value that is never read and is being re-assigned a little later on. The assignment is redundant and hence can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-24media: usb: fix memory leak in af9005_identify_stateNavid Emamdoost
In af9005_identify_state when returning -EIO the allocated buffer should be released. Replace the "return -EIO" with assignment into ret and move deb_info() under a check. Fixes: af4e067e1dcf ("V4L/DVB (5625): Add support for the AF9005 demodulator from Afatech") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-16media: uvcvideo: Fix a typo in UVC_METATADA_BUF_SIZEChristophe JAILLET
It is likely that it should be UVC_METADATA_BUF_SIZE instead. Fix it and use it. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-16media: uvcvideo: Fix error path in control parsing failureLaurent Pinchart
When parsing the UVC control descriptors fails, the error path tries to cleanup a media device that hasn't been initialised, potentially resulting in a crash. Fix this by initialising the media device before the error handling path can be reached. Fixes: 5a254d751e52 ("[media] uvcvideo: Register a v4l2_device") Reported-by: syzbot+c86454eb3af9e8a4da20@syzkaller.appspotmail.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-16media: cxusb: detect cxusb_ctrl_msg error in queryVito Caputo
Don't use uninitialized ircode[] in cxusb_rc_query() when cxusb_ctrl_msg() fails to populate its contents. syzbot reported: dvb-usb: bulk message failed: -22 (1/-30591) ===================================================== BUG: KMSAN: uninit-value in ir_lookup_by_scancode drivers/media/rc/rc-main.c:494 [inline] BUG: KMSAN: uninit-value in rc_g_keycode_from_table drivers/media/rc/rc-main.c:582 [inline] BUG: KMSAN: uninit-value in rc_keydown+0x1a6/0x6f0 drivers/media/rc/rc-main.c:816 CPU: 1 PID: 11436 Comm: kworker/1:2 Not tainted 5.3.0-rc7+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events dvb_usb_read_remote_control Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x13a/0x2b0 mm/kmsan/kmsan_report.c:108 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250 bsearch+0x1dd/0x250 lib/bsearch.c:41 ir_lookup_by_scancode drivers/media/rc/rc-main.c:494 [inline] rc_g_keycode_from_table drivers/media/rc/rc-main.c:582 [inline] rc_keydown+0x1a6/0x6f0 drivers/media/rc/rc-main.c:816 cxusb_rc_query+0x2e1/0x360 drivers/media/usb/dvb-usb/cxusb.c:548 dvb_usb_read_remote_control+0xf9/0x290 drivers/media/usb/dvb-usb/dvb-usb-remote.c:261 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:150 [inline] kmsan_internal_chain_origin+0xd2/0x170 mm/kmsan/kmsan.c:314 __msan_chain_origin+0x6b/0xe0 mm/kmsan/kmsan_instr.c:184 rc_g_keycode_from_table drivers/media/rc/rc-main.c:583 [inline] rc_keydown+0x2c4/0x6f0 drivers/media/rc/rc-main.c:816 cxusb_rc_query+0x2e1/0x360 drivers/media/usb/dvb-usb/cxusb.c:548 dvb_usb_read_remote_control+0xf9/0x290 drivers/media/usb/dvb-usb/dvb-usb-remote.c:261 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 Local variable description: ----ircode@cxusb_rc_query Variable was created at: cxusb_rc_query+0x4d/0x360 drivers/media/usb/dvb-usb/cxusb.c:543 dvb_usb_read_remote_control+0xf9/0x290 drivers/media/usb/dvb-usb/dvb-usb-remote.c:261 Signed-off-by: Vito Caputo <vcaputo@pengaru.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-16media: dvbsky: add support for eyeTV Geniatech T2 liteThomas Voegtle
Adds USB ID for the eyeTV Geniatech T2 lite to the dvbsky driver. This is a Geniatech T230C based stick without IR and a different USB ID. Signed-off-by: Thomas Voegtle <tv@lio96.de> Tested-by: Jan Pieter van Woerkom <jp@jpvw.nl> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-10media: usbvision: Fix races among open, close, and disconnectAlan Stern
Visual inspection of the usbvision driver shows that it suffers from three races between its open, close, and disconnect handlers. In particular, the driver is careful to update its usbvision->user and usbvision->remove_pending flags while holding the private mutex, but: usbvision_v4l2_close() and usbvision_radio_close() don't hold the mutex while they check the value of usbvision->remove_pending; usbvision_disconnect() doesn't hold the mutex while checking the value of usbvision->user; and also, usbvision_v4l2_open() and usbvision_radio_open() don't check whether the device has been unplugged before allowing the user to open the device files. Each of these can potentially lead to usbvision_release() being called twice and use-after-free errors. This patch fixes the races by reading the flags while the mutex is still held and checking for pending removes before allowing an open to succeed. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-10media: usbvision: Fix invalid accesses after device disconnectAlan Stern
The syzbot fuzzer found two invalid-access bugs in the usbvision driver. These bugs occur when userspace keeps the device file open after the device has been disconnected and usbvision_disconnect() has set usbvision->dev to NULL: When the device file is closed, usbvision_radio_close() tries to issue a usb_set_interface() call, passing the NULL pointer as its first argument. If userspace performs a querycap ioctl call, vidioc_querycap() calls usb_make_path() with the same NULL pointer. This patch fixes the problems by making the appropriate tests beforehand. Note that vidioc_querycap() is protected by usbvision->v4l2_lock, acquired in a higher layer of the V4L2 subsystem. Reported-and-tested-by: syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-10media: gspca: make array st6422_bridge_init static, makes object smallerColin Ian King
Don't populate the array st6422_bridge_init on the stack but instead make it static. Makes the object code smaller by 231 bytes. Before: text data bss dec hex filename 3419 752 64 4235 108b gspca/stv06xx/stv06xx_st6422.o After: text data bss dec hex filename 3124 816 64 4004 fa4 gspca/stv06xx/stv06xx_st6422.o (gcc version 9.2.1, amd64) Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-10media: cx231xx: remove duplicated include from cx231xx-417.cYueHaibing
Remove duplicated include. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-10media: usb: null check create_singlethread_workqueueNavid Emamdoost
In sd_start return value of create_singlethread_workqueue needs null check. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-10media: gspca: null check create_singlethread_workqueueNavid Emamdoost
In sd_start the return value of create_singlethread_workqueue needs null check. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-10media: af9035: add support for Logilink VG0022A.Gon Solo
This includes a hack for the device as it returns only 0xff after a new firmware is loaded. To quote Mauro: "When the [...] firmware that came with the device is replaced by a new one, any I2C data received from the tuner will be replaced by 0xff. Probably, the vendor firmware has some patch specifically designed for this device. So, we can't replace by the generic firmware. The right solution would be to extract the [...] firmware from the original driver and ask the driver to load the specifically designed firmware, but, while we don't have that, the next best solution is to just keep the original firmware at the device." Signed-off-by: Gon Solo <gonsolo@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-10media: af9035: add the formula used for the I2C speedMauro Carvalho Chehab
A very old patch sent to the media ML used to contain the I2C speed formula: https://lore.kernel.org/linux-media/1312539895.2763.33.camel@Jason-Linux/ When the ite9135 code was merged with af9035, the formula was lost. As we might need to slow down the speed for some devices, add the formula again. No functional changes. Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-07media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()Yang Yingliang
If usb_set_interface() failed, iface->cur_altsetting will not be assigned and it will be used in flexcop_usb_transfer_init() It may lead a NULL pointer dereference. Check usb_set_interface() return value in flexcop_usb_init() and return failed to avoid using this NULL pointer. Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-07media: dvb-usb-gl861: support I2C read from tuner via demodAkihiro Tsukada
Support Friio devices to read from tuner via demod tc90522, by enabling the config option. Signed-off-by: Akihiro Tsukada <tskd08@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-07media: dvb-usb-v2/gl861: remove an un-used header fileAkihiro Tsukada
The header contained just internal definitions and they are not used anymore. Signed-off-by: Akihiro Tsukada <tskd08@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-10-07media: dvb-usb-v2/gl861: remove device-specific i2c algoAkihiro Tsukada
For Friio dvb cards, a distinct I2C algo was provided to support some "long" I2C messages used in relaying tuner I2C via demod. Since the other (generic) i2c algo in this module has been patched to support those messages in a more generic way, this patch replaces and integrates the device-specific i2c algo with the generic one and simplifies the code. Signed-off-by: Akihiro Tsukada <tskd08@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-29 06:18:28 +0000