Sean Young [Mon, 31 Oct 2016 17:52:27 +0000 (15:52 -0200)]
[media] lirc: use-after free while reading from device and unplugging
Many lirc drivers have their own receive buffers which are freed on
unplug (e.g. ir_lirc_unregister). This means that ir->buf->wait_poll
will be freed directly after unplug so do not remove yourself from the
wait queue.
Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Sean Young [Mon, 31 Oct 2016 17:52:25 +0000 (15:52 -0200)]
[media] lirc: might sleep error in lirc_dev_fop_read
[ 101.457944] ------------[ cut here ]------------
[ 101.457954] WARNING: CPU: 3 PID: 1819 at kernel/sched/core.c:7708 __might_sleep+0x7e/0x80
[ 101.457960] do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffffc0364bc2>] lirc_dev_fop_read+0x292/0x4e0 [lirc_dev]
Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Sean Young [Mon, 31 Oct 2016 21:13:11 +0000 (19:13 -0200)]
[media] redrat3: enable carrier reports using wideband receiver
The wideband receiver is a little awkward on the redrat3. Data arrives
on a different endpoint, and the learning command must be reissued
every time data is learned.
Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Sean Young [Mon, 31 Oct 2016 17:52:22 +0000 (15:52 -0200)]
[media] redrat3: fix error paths in probe
If redrat3_delete() is called, ensure ep_in and udev members are set
up so we don't dereference null in the error path. Also ensure that
rc dev device exists before we enable the receiver and that the
led urb exists before we create the led device.
Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Sean Young [Mon, 31 Oct 2016 17:52:21 +0000 (15:52 -0200)]
[media] redrat3: remove dead code and pointless messages
Cleanup the error logic, removing checks for things that
should be always initialized when the routines are called,
and remove some bogus messages.
[mchehab@s-opensource.com: fix some merge conflicts] Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Arnd Bergmann [Wed, 26 Oct 2016 09:43:43 +0000 (07:43 -0200)]
[media] media: mtk-mdp: mark PM functions as __maybe_unused
A previous patch tried to fix a build error, but introduced another
warning:
drivers/media/platform/mtk-mdp/mtk_mdp_core.c:71:13: error: ‘mtk_mdp_clock_off’ defined but not used [-Werror=unused-function]
drivers/media/platform/mtk-mdp/mtk_mdp_core.c:62:13: error: ‘mtk_mdp_clock_on’ defined but not used [-Werror=unused-function]
This marks all the PM functions as __maybe_unused and removes
the #ifdef around them, as that will always do the right thing.
While this patch sounded a good idea, unfortunately, it causes
bad dependencies, as drivers that would otherwise work without
the DVB core will now break:
Note: as the argument for the release ops changed from "int"
to "void", we needed to change it at the revert patch, to
avoid compilation issues like:
drivers/media/tuners/tea5767.c:437:23: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
.release = tea5767_release,
^~~~~~~~~~~~~~~
This was never supposed to work, but changeset 22a613e89825
("[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations")
caused it to be exposed:
drivers/built-in.o: In function `fc0011_attach':
(.text+0x1598fb): undefined reference to `dvb_tuner_simple_release'
drivers/built-in.o:(.rodata+0x55e58): undefined reference to `dvb_tuner_simple_release'
drivers/built-in.o:(.rodata+0x57398): undefined reference to `dvb_tuner_simple_release'
Spinlock nvt_lock is a member of struct nvt_dev and there's no need
to prefix it with nvt_. So remove this prefix.
[mchehab@s-opensource.org: change the prefix also at the open function,
as the patch removing it were not applied (yet?)] Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Using a separate spinlock to protect access to substruct tx of struct
nvt_dev doesn't provide any actual benefit. We can use spinlock
nvt_lock to protect all access to struct nvt_dev and get rid of
nvt->tx.lock.
Heiner Kallweit [Tue, 25 Oct 2016 19:23:37 +0000 (17:23 -0200)]
[media] media: rc: nuvoton: eliminate member pdev from struct nvt_dev
Member pdev of struct nvt_dev is needed only to access &pdev->dev.
We can get rid of this it by using rdev->dev.parent instead
(both point to the same struct device).
Setting rdev->dev.parent can be removed from the probe function
as this is done by devm_rc_allocate_device now.
Max Kellermann [Tue, 9 Aug 2016 21:33:03 +0000 (18:33 -0300)]
[media] drivers/media/media-device: fix double free bug in _unregister()
While removing all interfaces in media_device_unregister(), all
media_interface pointers are freed. This is illegal and results in
double kfree() if any media_interface is still linked at this point;
maybe because a userspace process still has a file handle. Once the
process closes the file handle, dvb_media_device_free() gets called,
which frees the dvb_device.intf_devnode again.
This patch removes the unnecessary kfree() call, and documents who's
responsible for really freeing it.
Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Max Kellermann [Tue, 9 Aug 2016 21:32:57 +0000 (23:32 +0200)]
[media] media-entity: clear media_gobj.mdev in _destroy()
media_gobj_destroy() may be called twice on one instance - once by
media_device_unregister() and again by dvb_media_device_free(). The
function media_remove_intf_links() establishes and documents the
convention that mdev==NULL means that the object is not registered,
but nobody ever NULLs this variable. So this patch really implements
this behavior, and adds another mdev==NULL check to
media_gobj_destroy() to protect against double removal.
Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Max Kellermann [Tue, 9 Aug 2016 21:32:51 +0000 (18:32 -0300)]
[media] dvb_frontend: move kref to struct dvb_frontend
This commit amends my old commit fe35637b0a9f ("[media] dvb_frontend:
eliminate blocking wait in dvb_unregister_frontend()"), which added
kref to struct dvb_frontend_private. It turned out that there are
several use-after-free bugs left, which affect the struct
dvb_frontend. Protecting it with kref also protects struct
dvb_frontend_private, so we can simply move it.
This is how the use-after-free looks like in KASAN:
Max Kellermann [Tue, 9 Aug 2016 21:32:41 +0000 (18:32 -0300)]
[media] dvb_frontend: add "detach" callback
Prepare for making "release" asynchronous (via kref). Some operations
may need to be run synchronously in dvb_frontend_detach(), and that's
why we need a "detach" callback.
Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
It is not clear what this return value means. All implemenations
return 0, and the one caller ignores the value. Let's remove this
useless return value completely.
Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Most release callback functions are identical: free the "tuner_priv"
and clear it. Let's eliminate some bloat by providing this simple
implementation in the dvb_frontend library.
Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Max Kellermann [Tue, 9 Aug 2016 21:32:16 +0000 (18:32 -0300)]
[media] dvb-core/en50221: use dvb_remove_device()
Commit da677fe14364 ("[media] dvb-core/en50221: use kref to manage
struct dvb_ca_private") moved the dvb_unregister_device() call to the
kref callback, but that left lots of stale device state visible to
userspace (e.g. in sysfs). By using dvb_remove_device() and
dvb_free_device() instead of dvb_unregister_device(), we can avoid
that.
Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Max Kellermann [Tue, 9 Aug 2016 21:32:11 +0000 (18:32 -0300)]
[media] dvbdev: split dvb_unregister_device()
dvb_unregister_device() has a major problem: it combines unregistering
with memory disposal. Sometimes, it is necessary to unregister a
device, but no memory can be freed yet, because a process still has a
(stale) file handle. Therefore, we need to split
dvb_unregister_device(). This will allow sanitizing a few callers.
With my new design, dvb_unregister_device() appears misnamed, but to
reduce patch noise, I'm not renaming it just yet.
Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Max Kellermann [Tue, 9 Aug 2016 21:32:06 +0000 (18:32 -0300)]
[media] rc-main: clear rc_map.name in ir_free_table()
rc_unregister_device() will first call ir_free_table(), and later
device_del(); however, the latter causes a call to rc_dev_uevent(),
which prints rc_map.name, which at this point has already bee freed.
This fixes a use-after-free bug found with KASAN.
As reported by Shuah:
"I am seeing the following when I do rmmod on au0828
Dan Carpenter [Thu, 14 Jul 2016 10:18:14 +0000 (07:18 -0300)]
[media] blackfin: check devm_pinctrl_get() for errors
devm_pinctrl_get() can fail so we should check for that.
Fixes: 0a6824bc10de ('[media] v4l2: blackfin: select proper pinctrl state in ppi_set_params if CONFIG_PINCTRL is enabled') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
When saa7134 module driving a Medion 7134 card is reloaded reads of this
card EEPROM (required for automatic detection of tuner model) will be
corrupted due to I2C gate in DVB-T demod being left closed.
This sometimes also happens on first saa7134 module load after a warm
reboot.
Fix this by opening this I2C gate before doing EEPROM read during i2c
initialization.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Now that CLK_PROC_STFE is defined as a critical clock in
DT, we can remove the commented clk_disable_unprepare from
the c8sectpfe driver. This means we now have balanced
clk*enable/disable calls in the driver, but on STiH407
family the clock in reality will never actually be disabled.
This is due to a HW bug where once the IP has been configured
and the SLIM core is running, disabling the clock causes a
unrecoverable bus lockup.
Markus Elfring [Fri, 14 Oct 2016 05:19:00 +0000 (02:19 -0300)]
[media] winbond-cir: Use kmalloc_array() in wbcir_tx()
A multiplication for the size determination of a memory allocation
indicated that an array data structure should be processed.
Thus use the corresponding function "kmalloc_array".
This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Markus Elfring [Thu, 13 Oct 2016 11:23:22 +0000 (08:23 -0300)]
[media] RedRat3: Improve another size determination in redrat3_reset()
Replace the specification of a data type by a pointer dereference
as the parameter for the operator "sizeof" to make the corresponding size
determination a bit safer.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Markus Elfring [Thu, 13 Oct 2016 06:35:57 +0000 (03:35 -0300)]
[media] RedRat3: Use kcalloc() in two functions
* Multiplications for the size determination of memory allocations
indicated that array data structures should be processed.
Thus use the corresponding function "kcalloc".
This issue was detected by using the Coccinelle software.
* Replace the specification of data types by pointer dereferences
to make the corresponding size determination a bit safer according to
the Linux coding style convention.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[media] tvp5150: Get rid of direct calls to printk()
When returning results via v4l2_subdev_core_ops.log_status,
use dev_foo() call, instead of just calling printk()
directly, without even specifying the log message level.
[media] em28xx: convert it from pr_foo() to dev_foo()
Instead of using pr_foo(), use dev_foo(), with provides a
better output. As this device is a multi-interface one,
we'll set the device name to show the chipset and the driver
used.
While here, get rid of printk continuation messages.
[media] v4l2-common: add a debug macro to be used with dev_foo()
Currently, there's a mess at the V4L2 printk macros: some drivers
use their own macros, others use pr_foo() or v4l_foo() macros,
while more modern drivers use dev_foo() macros.
The best is to get rid of v4l_foo() macros, as they can be
replaced by either dev_foo() or pr_foo(). Yet, such change can
be disruptive, as dev_foo() cannot use KERN_CONT. So, the best
is to do such change driver by driver.
There are replacements for most v4l_foo() macros, but it lacks
a way to enable debug messages per level. So, add such macro,
in order to make the conversion easier.
[media] af9005: remove a printk that would require a KERN_CONT
The dvb-usb system has its own macro to print hexa dumps
(debug_dump). Such macro doesn't support messages with
KERN_CONT after commit 563873318d32 ("Merge branch 'printk-cleanups'").
So, let's get rid of a printk() that would be assuming that
this would work.
[media] dibx000_common: use pr_foo() instead of printk()
The dprintk() macro relies on continuation lines. This is not
a good practice and will break after commit 563873318d32
("Merge branch 'printk-cleanups'").
So, instead of directly calling printk(), use pr_foo() macros,
adding a \n leading char on each macro call.
The dprintk() macro relies on continuation lines. This is not
a good practice and will break after commit 563873318d32
("Merge branch 'printk-cleanups'").
So, instead of directly calling printk(), use pr_foo() macros,
adding a\n leading char on each macro call.
The dprintk() macro relies on continuation lines. This is not
a good practice and will break after commit 563873318d32
("Merge branch 'printk-cleanups'").
So, instead of directly calling printk(), use pr_foo() macros,
adding a\n leading char on each macro call.
[media] dib7000p: use pr_foo() instead of printk()
The dprintk() macro relies on continuation lines. This is not
a good practice and will break after commit 563873318d32
("Merge branch 'printk-cleanups'").
So, instead of directly calling printk(), use pr_foo() macros,
adding a \n leading char on each macro call.
[media] dib7000m: use pr_foo() instead of printk()
The dprintk() macro relies on continuation lines. This is not
a good practice and will break after commit 563873318d32
("Merge branch 'printk-cleanups'").
So, instead of directly calling printk(), use pr_foo() macros,
adding a \n leading char on each macro call.
[media] dib3000mc: use pr_foo() instead of printk()
The dprintk() macro relies on continuation lines. This is not
a good practice and will break after commit 563873318d32
("Merge branch 'printk-cleanups'").
So, instead of directly calling printk(), use pr_foo() macros,
adding a \n leading char on each macro call.
[media] dib3000mb: use pr_foo() instead of printk()
The dprintk() macro relies on continuation lines. This is not
a good practice and will break after commit 563873318d32
("Merge branch 'printk-cleanups'").
So, instead of directly calling printk(), use pr_foo() macros,
adding a \n leading char on each macro call.
The frontend settings also rely on continuation lines. Change
it to avoid the need of adding pr_cont() calls.
The dprintk() macro relies on continuation lines. This is not
a good practice and will break after commit 563873318d32
("Merge branch 'printk-cleanups").
So, instead of directly calling printk(), use pr_foo() macros,
adding a \n leading char on each macro call.
The dprintk() macro relies on continuation lines. This is not
a good practice and will break after commit 563873318d32
("Merge branch 'printk-cleanups").
So, instead of directly calling printk(), use pr_foo() macros,
adding a \n leading char on each macro call.
[media] ttpci: cleanup debug macros and remove dead code
Continuation lines without KERN_CONT won't work anymore.
However, the way dprintk() was defined leads to the usage
of continuation lines, with should be avoided when possible.
So, redefine those macros.
While hre, remove some dead code at av7110.c with also
relies on continuation lines.
This driver is old, and have lots of checkpatch violations.
As we're touching a lot on this driver due to the printk
conversions, let's run checkpatch --fix on it, in order to
solve some of those issues.
Also, do a few manual adjustments:
- remove the FSF address and use the usual coding style
for the initial comments;
- use WARN_ON() instead of BUG_ON();
- remove an unused typedef;
- break a few long lines.
This file was converted to a separate module at commit 7a0786c19d65
("gp8psk: Fix DVB frontend attach"), because the DVB attach routines
require it to work. However, I forgot to copy the MODULE_foo() macros
from the original module, causing this warning:
WARNING: modpost: missing MODULE_LICENSE() in drivers/media/dvb-frontends/gp8psk-fe.o
This driver has printk continuation lines for debugging purposes.
Since commit 563873318d32 ("Merge branch 'printk-cleanups'")',
this won't work as expected anymore.
[media] stb0899_drv: get rid of continuation lines
This driver has printk continuation lines for debugging purposes.
Since commit 563873318d32 ("Merge branch 'printk-cleanups'")',
this won't work as expected anymore.
Marek Szyprowski [Mon, 14 Nov 2016 14:09:26 +0000 (12:09 -0200)]
[media] s5p-mfc: Fix clock management in s5p_mfc_release() function
Clock control indirectly requires access to MFC device, so call it only
if we are sure that the device exists in s5p_mfc_release function.
s5p_mfc_remove() calls s5p_mfc_final_pm(), which releases all PM related
resources, including clocks, so any call to clocks related functions
is not valid after s5p_mfc_final_pm().
Marek Szyprowski [Thu, 10 Nov 2016 10:31:23 +0000 (08:31 -0200)]
[media] s5p-mfc: Use clock gating only on MFC v5 hardware
Newer MFC hardware have internal clock gating feature, so additional
software-triggered clock gating sometimes causes misbehavior of the MFC
firmware and results in freeze or crash. This patch changes the driver
to use software-triggered clock gating only when working with v5 MFC
hardware, where it has been proven to work properly.
Donghwa Lee [Thu, 10 Nov 2016 10:31:22 +0000 (08:31 -0200)]
[media] s5p-mfc: Skip incomplete frame
Currently, when incomplete frame is received in the middle of
decoding, driver treats it as an error, so src/dst queue and
clock are cleaned. Although it is obviously error case, it is
needed to maintain video decoding in case of necessity. This
patch supports skip incomplete frame to next.
Signed-off-by: Donghwa Lee <dh09.lee@samsung.com> Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[media] exynos-gsc: Add support for Exynos5433 specific version
This patch adds support for Exynos5433 specific version of the GScaler
module. The main difference between Exynos 5433 and earlier is addition
of new clocks that have to be controlled.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com> Tested-by: Javier Martinez Canillas <javier@osg.samsung.com> Acked-by: Krzysztof Kozlowski <krzk@kernel.org> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
projects / linux-beck.git / log