media: dvb_frontend: Use wait_event_freezable_timeout() for freezable kthread

A freezable kernel thread can enter frozen state during freezing by
either calling try_to_freeze() or using wait_event_freezable() and its
variants. So for the following snippet of code in a kernel thread loop:
wait_event_interruptible_timeout();
try_to_freeze();

We can change it to a simple wait_event_freezable_timeout() and
then eliminate a function call.

Signed-off-by: Kevin Hao <haokexin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

media: drivers/media/dvb-core: copy user arrays safely

At several positions in dvb_frontend.c, memdup_user() is utilized to
copy userspace arrays. This is done without overflow checks.

Use the new wrapper memdup_array_user() to copy the arrays more safely.

Link: https://lore.kernel.org/linux-media/20231102191633.52592-2-pstanner@redhat.com
Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

Revert "media: dvb-core: Fix use-after-free on race condition at dvb_frontend"

As reported by Thomas Voegtle <tv@lio96.de>, sometimes a DVB card does
not initialize properly booting Linux 6.4-rc4. This is not always, maybe
in 3 out of 4 attempts.

After double-checking, the root cause seems to be related to the
UAF fix, which is causing a race issue:

[ 26.332149] tda10071 7-0005: found a 'NXP TDA10071' in cold state, will try to load a firmware
[ 26.340779] tda10071 7-0005: downloading firmware from file 'dvb-fe-tda10071.fw'
[ 989.277402] INFO: task vdr:743 blocked for more than 491 seconds.
[ 989.283504] Not tainted 6.4.0-rc5-i5 #249
[ 989.288036] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 989.295860] task:vdr state:D stack:0 pid:743 ppid:711 flags:0x00004002
[ 989.295865] Call Trace:
[ 989.295867] <TASK>
[ 989.295869] __schedule+0x2ea/0x12d0
[ 989.295877] ? asm_sysvec_apic_timer_interrupt+0x16/0x20
[ 989.295881] schedule+0x57/0xc0
[ 989.295884] schedule_preempt_disabled+0xc/0x20
[ 989.295887] __mutex_lock.isra.16+0x237/0x480
[ 989.295891] ? dvb_get_property.isra.10+0x1bc/0xa50
[ 989.295898] ? dvb_frontend_stop+0x36/0x180
[ 989.338777] dvb_frontend_stop+0x36/0x180
[ 989.338781] dvb_frontend_open+0x2f1/0x470
[ 989.338784] dvb_device_open+0x81/0xf0
[ 989.338804] ? exact_lock+0x20/0x20
[ 989.338808] chrdev_open+0x7f/0x1c0
[ 989.338811] ? generic_permission+0x1a2/0x230
[ 989.338813] ? link_path_walk.part.63+0x340/0x380
[ 989.338815] ? exact_lock+0x20/0x20
[ 989.338817] do_dentry_open+0x18e/0x450
[ 989.374030] path_openat+0xca5/0xe00
[ 989.374031] ? terminate_walk+0xec/0x100
[ 989.374034] ? path_lookupat+0x93/0x140
[ 989.374036] do_filp_open+0xc0/0x140
[ 989.374038] ? __call_rcu_common.constprop.91+0x92/0x240
[ 989.374041] ? __check_object_size+0x147/0x260
[ 989.374043] ? __check_object_size+0x147/0x260
[ 989.374045] ? alloc_fd+0xbb/0x180
[ 989.374048] ? do_sys_openat2+0x243/0x310
[ 989.374050] do_sys_openat2+0x243/0x310
[ 989.374052] do_sys_open+0x52/0x80
[ 989.374055] do_syscall_64+0x5b/0x80
[ 989.421335] ? __task_pid_nr_ns+0x92/0xa0
[ 989.421337] ? syscall_exit_to_user_mode+0x20/0x40
[ 989.421339] ? do_syscall_64+0x67/0x80
[ 989.421341] ? syscall_exit_to_user_mode+0x20/0x40
[ 989.421343] ? do_syscall_64+0x67/0x80
[ 989.421345] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 989.421348] RIP: 0033:0x7fe895d067e3
[ 989.421349] RSP: 002b:00007fff933c2ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
[ 989.421351] RAX: ffffffffffffffda RBX: 00007fff933c2c10 RCX: 00007fe895d067e3
[ 989.421352] RDX: 0000000000000802 RSI: 00005594acdce160 RDI: 00000000ffffff9c
[ 989.421353] RBP: 0000000000000802 R08: 0000000000000000 R09: 0000000000000000
[ 989.421353] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
[ 989.421354] R13: 00007fff933c2ca0 R14: 00000000ffffffff R15: 00007fff933c2c90
[ 989.421355] </TASK>

This reverts commit 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f.

Fixes: 6769a0b7ee0c ("media: dvb-core: Fix use-after-free on race condition at dvb_frontend")
Link: https://lore.kernel.org/all/da5382ad-09d6-20ac-0d53-611594b30861@lio96.de/
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()

Using a semaphore in the wait_event*() condition is no good idea.
It hits a kernel WARN_ON() at prepare_to_wait_event() like:
do not call blocking ops when !TASK_RUNNING; state=1 set at
prepare_to_wait_event+0x6d/0x690

For avoiding the potential deadlock, rewrite to an open-coded loop
instead. Unlike the loop in wait_event*(), this uses wait_woken()
after the condition check, hence the task state stays consistent.

CVE-2023-31084 was assigned to this bug.

Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/

Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@suse.de
Reported-by: Yu Hao <yhao016@ucr.edu>
Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb-core: Fix use-after-free on race condition at dvb_frontend

If the device node of dvb_frontend is open() and the device is
disconnected, many kinds of UAFs may occur when calling close()
on the device node.

The root cause of this is that wake_up() for dvbdev->wait_queue
is implemented in the dvb_frontend_release() function, but
wait_event() is not implemented in the dvb_frontend_stop() function.

So, implement wait_event() function in dvb_frontend_stop() and
add 'remove_mutex' which prevents race condition for 'fe->exit'.

[mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic]

Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb-core: Fix ignored return value in dvb_register_frontend()

In dvb_register_frontend(), dvb_register_device() is possible to fail
but its return value is ignored.

It will cause use-after-free when module is removed, because in
dvb_unregister_frontend() it tries to unregister a not registered
device.

BUG: KASAN: use-after-free in dvb_remove_device+0x18b/0x1f0 [dvb_core]
Read of size 4 at addr ffff88800dff4824 by task rmmod/428
CPU: 3 PID: 428 Comm: rmmod
Call Trace:
<TASK>
...
dvb_remove_device+0x18b/0x1f0 [dvb_core]
dvb_unregister_frontend+0x7b/0x130 [dvb_core]
vidtv_bridge_remove+0x6e/0x160 [dvb_vidtv_bridge]
...

Fix this by catching return value of dvb_register_device().
However the fe->refcount can't be put to zero immediately, because
there are still modules calling dvb_frontend_detach() when
dvb_register_frontend() fails.

Link: https://lore.kernel.org/linux-media/20221108033005.169095-1-chenzhongjin@huawei.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvbdev: adopts refcnt to avoid UAF

dvb_unregister_device() is known that prone to use-after-free.
That is, the cleanup from dvb_unregister_device() releases the dvb_device
even if there are pointers stored in file->private_data still refer to it.

This patch adds a reference counter into struct dvb_device and delays its
deallocation until no pointer refers to the object.

Link: https://lore.kernel.org/linux-media/20220807145952.10368-1-linma@zju.edu.cn
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb-core: Enhance shared multi-frontend support

Drivers for devices with multiple frontends which cannot be used
concurrently due to hardware limitations which enforce that restriction
by setting the mfe_shared field to 1 exhibit rather unfriendly behavior
towards applications: The unavailable frontend devices cannot be opened
at all, not even for read-only access to query information. Even worse,
any open call is blocked for 5 seconds by default.

Allow drivers for such devices to behave like regular busy frontend
devices instead, i.e. still allowing concurrent read access to the
unavailable frontend and denying concurrent write access with -EBUSY
without delay.

This patch does not alter the behavior of any existing driver to avoid
regressions. Driver developers who wish to take advantage of this must
ensure their driver can handle all read-only accesses to the unavailable
frontend, and indicate the capability by setting the mfe_shared field to
2 instead of 1.

Add a check to dvb-usb-init.c when automatically setting the mfe_shared
field that when a driver has already set the field to 2, it is not
overwritten.

Document the additional capability in the code comment about mfe_shared.

Link: https://lore.kernel.org/linux-media/trinity-22c77578-26b0-4867-9ff7-2668e5d22c64-1642799929896@3c-app-gmx-bap04
Signed-off-by: Robert Schlabbach <robert_s@gmx.net>
Tested-by: Robert Schlabbach <robert_s@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb_frontend: add missing DSS switch cases

While the documentation mentions the delivery system DSS as a satellite
system, it was missing from all but one switch statement in the DVB
frontend code, leading to tuning failures, because the frequency was not
correctly handled as being in kHz rather than Hz.

Add the missing switch cases so that DSS is handled like the other
satellite systems. For the rolloff, assume 0.20 as per one publication
found via Internet search.

Link: https://lore.kernel.org/linux-media/trinity-5f5afda9-657a-4a91-bf15-842f4f249535-1641958421391@3c-app-gmx-bap21
Signed-off-by: Robert Schlabbach <robert_s@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb-core: dvb_frontend: address some clang warnings

The typecasts at the dvb-core generate clang warnings when W=1
is enabled.

The warns are harmless, but they cause the build to break with
CONFIG_WERROR, so do the cast on a way that it won't produce
warnings anymore.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

media: media dvb_frontend: add suspend and resume callbacks to dvb_frontend_ops

While dvb_tuner_ops already has dedicated suspend and resume callbacks,
dvb_frontend_ops currently does not have them. Add those callbacks and
use them for suspend and resume. If they are not set, the old behavior
of calling sleep or init is used.

This allows dvb_frontend drivers to handle resume differently from init,
and suspend differently from sleep. No change is required for drivers
not needing this functionality.

Link: https://lore.kernel.org/linux-media/20210418001204.7453-2-kernel@tuxforce.de

Cc: Lukas Middendorf <kernel@tuxforce.de>, Antti Palosaari <crope@iki.fi>, Mauro Carvalho Chehab <mchehab@kernel.org>, Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Lukas Middendorf <kernel@tuxforce.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

media: dvb-core: frontend: make GET/SET safer

The implementation for FE_SET_PROPERTY/FE_GET_PROPERTY has
a debug code that might be explored via spectre.
Improve the logic in order to mitigate such risk.

It should be noticed that, before this patch, the logic
which implements FE_GET_PROPERTY doesn't check the length passed
by the user, which might lead to expose some information. This
is probably not exploitable, though, as the frontend drivers
won't rely on the buffer length value set by userspace, but
it helps to return a valid value back to userspace.

The code was changed to only try to access an array based on
userspace values only when DVB debug is turned on, helping to
reduce the attack surface, as a speculation attack would work
only if DVB dev_dbg() macros are enabled, which is usually
enabled only on test Kernels or by the root user.

As a side effect, a const array size can now be reduced by
~570 bytes, as it now needs to contain just the name of each
DTV command.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

media: dvb_frontend: warn if frontend driver has API issues

the kAPI for a frontend can use 3 different tuning methods:

1. The hardware tracks internally frequency shifts via its
own internal zigzag logic;
2. The hardware has a custom zigzag method, implemented via
fe search() ops;
3. The hardware doesn't have any internal zigzag logic. So,
the Kernel needs to implement it.

Drivers that use the in-kernel software zigzag are required to
provide some parameters for the zigzag code to work. Failing
to do that will just make the Kernel to tune several times
to the very same frequency, delaying the tuning time for
no good reason. This is actually a kAPI violation
(and an uAPI one, as the frequency shift is exported to the
uAPI).

Emit a warning on such case, as the driver needs to be fixed.

Link: https://lore.kernel.org/linux-media/6d5941e3ba77439bbc401207cd87d9b8748d5cb8.1616427172.git.mchehab+huawei@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

media: dvb_frontend: don't call dvb_frontend_get_stepsize() twice

Avoid calling the function twice, as it was just called at the
previous line.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

media: dvb_frontend: move algo-specific settings to a function

As we're planning to call this code from somewhere else,
let's first move it to its own function.

Link: https://lore.kernel.org/linux-media/daa69edd80e7fcf979062273f3067cb7b5573d52.1592419750.git.mchehab+huawei@kernel.org
Reviewed-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

media: dvb_frontend: Fix fall-through warnings for Clang

In preparation to enable -Wimplicit-fallthrough for Clang, fix a warning
by explicitly adding a break statement instead of letting the code fall
through to the next case.

Link: https://github.com/KSPP/linux/issues/115

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

media: don't drop front-end reference count for ->detach

A bugfix introduce a link failure in configurations without CONFIG_MODULES:

In file included from drivers/media/usb/dvb-usb/pctv452e.c:20:0:
drivers/media/usb/dvb-usb/pctv452e.c: In function 'pctv452e_frontend_attach':
drivers/media/dvb-frontends/stb0899_drv.h:151:36: error: weak declaration of 'stb0899_attach' being applied to a already existing, static definition

The problem is that the !IS_REACHABLE() declaration of stb0899_attach()
is a 'static inline' definition that clashes with the weak definition.

I further observed that the bugfix was only done for one of the five users
of stb0899_attach(), the other four still have the problem. This reverts
the bugfix and instead addresses the problem by not dropping the reference
count when calling '->detach()', instead we call this function directly
in dvb_frontend_put() before dropping the kref on the front-end.

I first submitted this in early 2018, and after some discussion it
was apparently discarded. While there is a long-term plan in place,
that plan is obviously not nearing completion yet, and the current
kernel is still broken unless this patch is applied.

Link: https://patchwork.kernel.org/patch/10140175/
Link: https://patchwork.linuxtv.org/patch/54831/

Cc: Max Kellermann <max.kellermann@gmail.com>
Cc: Wolfgang Rohdewald <wolfgang@rohdewald.de>
Cc: stable@vger.kernel.org
Fixes: f686c14364ad ("[media] stb0899: move code to "detach" callback")
Fixes: 6cdeaed3b142 ("media: dvb_usb_pctv452e: module refcount changes were unbalanced")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb_frontend: split dvb_frontend_handle_ioctl function

Over time, dvb_frontend_handle_ioctl() has grown to the point where
we now get a warning from the compiler about excessive stack usage:

drivers/media/dvb-core/dvb_frontend.c: In function 'dvb_frontend_handle_ioctl':
drivers/media/dvb-core/dvb_frontend.c:2692:1: error: the frame size of 1048 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Almost all of this is used by the dtv_frontend_properties structure
in the FE_GET_PROPERTY and FE_GET_FRONTEND commands. Splitting those
into separate function reduces the stack usage of the main function
to just 136 bytes, the others are under 500 each.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 113

Based on 1 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version this program is distributed in the
hope that it will be useful but without any warranty without even
the implied warranty of merchantability or fitness for a particular
purpose see the gnu general public license for more details to
obtain the license point your browser to http www gnu org copyleft
gpl html

extracted by the scancode license scanner the SPDX license identifier

GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 26 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Richard Fontana <rfontana@redhat.com>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190523091650.572604764@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: dvb: warning about dvb frequency limits produces too much noise

This can be a debug message. Favour dev_dbg() over dprintk() as this is
already used much more than dprintk().

dvb_frontend: dvb_frontend_get_frequency_limits: frequency interval: tuner: 45000000...860000000, frontend: 44250000...867250000

Fixes: 00ecd6bc7128 ("media: dvb_frontend: add debug message for frequency intervals")

Cc: <stable@vger.kernel.org> # 5.0
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb-core: fix several typos

Use codespell to fix lots of typos over frontends.

Manually verified to avoid false-positives.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb_frontend: add debug message for frequency intervals

As we did an internal change inside the subsystem to always
represent min/max frequencies in Hz, add a debug message, as this
would help to discover bugs on drivers, if any.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb_frontend: don't print function names twice

The dvb_frontend dprintk() macro already prints __func__. So,
we don't need to add it again at the printed message.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: replace strcpy() by strscpy()

The strcpy() function is being deprecated upstream. Replace
it by the safer strscpy().

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb_frontend: ensure that the step is ok for both FE and tuner

The frequency step should take into account the tuner step,
as, if tuner step is bigger than frontend step, the zigzag
algorithm won't be doing the right thing, as it will be
tuning multiple times at the same frequency.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb: represent min/max/step/tolerance freqs in Hz

Right now, satellite frontend drivers specify frequencies in kHz,
while terrestrial/cable ones specify in Hz. That's confusing
for developers.

However, the main problem is that universal frontends capable
of handling both satellite and non-satelite delivery systems
are appearing. We end by needing to hack the drivers in
order to support such hybrid frontends.

So, convert everything to specify frontend frequencies in Hz.

Tested-by: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb: convert tuner_info frequencies to Hz

Right now, satellite tuner drivers specify frequencies in kHz,
while terrestrial/cable ones specify in Hz. That's confusing
for developers.

However, the main problem is that universal tuners capable
of handling both satellite and non-satelite delivery systems
are appearing. We end by needing to hack the drivers in
order to support such hybrid tuners.

So, convert everything to specify tuner frequencies in Hz.

Plese notice that a similar patch is also needed for frontends.

Tested-by: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
Acked-by: Michael Büsch <m@bues.ch>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb_frontend: cleanup some coding style errors

This is a core media file... it shoudn't have so many coding
style issues! The last patch ended by being submitted with
an error like that, very likely due to some cut and paste
issue.

Maybe it is time to clean it up. Do it with the auto
fix logic:

./scripts/checkpatch.pl -f drivers/media/dvb-core/dvb_frontend.c --strict --fix-inplace

Then manually fix the errors introduced by it.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvbdev: add a mutex protecting the "mdev" pointer

During destruction, a race condition in
dvb_media_controller_disable_source() can cause a kernel crash,
because the "mdev" pointer has been read successfully while another
task executes dvb_usb_media_device_unregister(), which destroys the
object. Example for such a crash:

general protection fault: 0000 [#1] SMP
CPU: 1 PID: 301 Comm: vdr Not tainted 4.8.1-nuc+ #102
[142B blob data]
task: ffff8802301f2040 task.stack: ffff880233728000
RIP: 0010:[<ffffffff816c296b>] [<ffffffff816c296b>] dvb_frontend_release+0xcb/0x120
RSP: 0018:ffff88023372bdd8 EFLAGS: 00010202
RAX: 001fd55c000000da RBX: ffff880236bad810 RCX: 0000000000000000
RDX: ffff880235bd81f0 RSI: 0000000000000246 RDI: ffff880235bd81e8
RBP: ffff88023372be00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88022f009910 R12: 0000000000000000
R13: ffff880235a21a80 R14: ffff880235bd8000 R15: ffff880235bb8a78
FS: 0000000000000000(0000) GS:ffff88023fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f96edd69818 CR3: 0000000002406000 CR4: 00000000001006e0
Stack:
ffff88022f009900 0000000000000008 ffff880235bb8a78 ffff8802344fbb20
ffff880236437b40 ffff88023372be48 ffffffff8117a81e ffff880235bb8a78
ffff88022f009910 ffff8802335a7400 ffff8802301f2040 ffff88022f009900
Call Trace:
[<ffffffff8117a81e>] __fput+0xde/0x1d0
[<ffffffff8117a949>] ____fput+0x9/0x10
[<ffffffff810a9fce>] task_work_run+0x7e/0xa0
[<ffffffff81094bab>] do_exit+0x27b/0xa50
[<ffffffff810407e3>] ? __do_page_fault+0x1c3/0x430
[<ffffffff81095402>] do_group_exit+0x42/0xb0
[<ffffffff8109547f>] SyS_exit_group+0xf/0x10
[<ffffffff8108bedb>] entry_SYSCALL_64_fastpath+0x13/0x8f
Code: 31 c9 49 8d be e8 01 00 00 ba 01 00 00 00 be 03 00 00 00 e8 68 2d a0 ff 48 8b 83 10 03 00 00 48 8b 80 88 00 00 00 48 85 c0 74 12 <48> 8b 80 88 02 00 00 48 85 c0 74 06 49 8b 7d
RIP [<ffffffff816c296b>] dvb_frontend_release+0xcb/0x120

[mchehab+samsung@kernel.org: fix a Coding Style issue]
Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb-core/dvb_frontend: set better default for ISDB-T

DTV_ISDBT_LAYER_ENABLED parameter should be set to "All" by default,
instead of "None", as described in the API document.

Signed-off-by: Akihiro Tsukada <tskd08@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: dvb_frontend: fix locking issues at dvb_frontend_get_event()

As warned by smatch:
drivers/media/dvb-core/dvb_frontend.c:314 dvb_frontend_get_event() warn: inconsistent returns 'sem:&fepriv->sem'.
Locked on: line 288
line 295
line 306
line 314
Unlocked on: line 303

The lock implementation for get event is wrong, as, if an
interrupt occurs, down_interruptible() will fail, and the
routine will call up() twice when userspace calls the ioctl
again.

The bad code is there since when Linux migrated to git, in
2005.

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: fix wrong cast in compat_ioctl

FE_GET_PROPERTY has always failed as following situations:
- Use compatible ioctl
- The array of 'struct dtv_property' has 2 or more items

This patch fixes wrong cast to a pointer 'struct dtv_property' from a
pointer of 2nd or after item of 'struct compat_dtv_property' array.

Signed-off-by: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: add proper __user annotations

Solves those warnings:
drivers/media/dvb-core/dvb_frontend.c:2297:39: warning: incorrect type in argument 1 (different address spaces)
drivers/media/dvb-core/dvb_frontend.c:2297:39: expected void const [noderef] <asn:1>*<noident>
drivers/media/dvb-core/dvb_frontend.c:2297:39: got struct dtv_property *props
drivers/media/dvb-core/dvb_frontend.c:2331:39: warning: incorrect type in argument 1 (different address spaces)
drivers/media/dvb-core/dvb_frontend.c:2331:39: expected void const [noderef] <asn:1>*<noident>
drivers/media/dvb-core/dvb_frontend.c:2331:39: got struct dtv_property *props

No functional changes.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

vfs: do bulk POLL* -> EPOLL* replacement

This is the mindless scripted replacement of kernel use of POLL*
variables as described by Al, done by this script:

for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done
done

with de-mangling cleanups yet to come.

NOTE! On almost all architectures, the EPOLL* constants have the same
values as the POLL* constants do. But they keyword here is "almost".
For various bad reasons they aren't the same, and epoll() doesn't
actually work quite correctly in some cases due to this on Sparc et al.

The next patch from Al will sort out the final differences, and we
should be all done.

Scripted-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

media: move dvb kAPI headers to include/media

Except for DVB, all media kAPI headers are at include/media.

Move the headers to it.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: add physical layer scrambling support

This commit adds a new property DTV_SCRAMBLING_SEQUENCE_INDEX.

This 18 bit field, when present, carries the index of the DVB-S2 physical
layer scrambling sequence as defined in clause 5.5.4 of EN 302 307.
There is no explicit signalling method to convey scrambling sequence index
to the receiver. If S2 satellite delivery system descriptor is available
it can be used to read the scrambling sequence index (EN 300 468 table 41).

By default, gold scrambling sequence index 0 is used. The valid scrambling
sequence index range is from 0 to 262142.

Increase the DVB API version in order userspace to be aware of the changes.

Signed-off-by: Athanasios Oikonomou <athoik@gmail.com>
Acked-by: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: Add commands implementation for compat ioct

The dtv_properties structure and the dtv_property structure are
different sizes in 32-bit and 64-bit system. This patch provides
FE_SET_PROPERTY and FE_GET_PROPERTY ioctl commands implementation for
32-bit user space applications.

Signed-off-by: Jaedon Shin <jaedon.shin@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: Add compat_ioctl callback

Adds compat_ioctl for 32-bit user space applications on a 64-bit system.

[m.chehab@osg.samsung.com: add missing include compat.h]
Signed-off-by: Jaedon Shin <jaedon.shin@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: Add unlocked_ioctl in dvb_frontend.c

Adds unlocked ioctl function directly in dvb_frontend.c instead of using
dvb_generic_ioctl().

Signed-off-by: Jaedon Shin <jaedon.shin@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: fix ifnullfree.cocci warnings

drivers/media/dvb-core/dvb_frontend.c:154:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values.

NULL check before some freeing functions is not needed.

Based on checkpatch warning
"kfree(NULL) is safe this check is probably not required"
and kfreeaddr.cocci by Julia Lawall.

Generated by: scripts/coccinelle/free/ifnullfree.cocci

Fixes: b1cb7372fa82 ("dvb_frontend: don't use-after-free the frontend struct")

Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: fix return error code

The correct error code when a function is not defined is
-ENOTSUPP. It was typoed wrong as -EOPNOTSUPP, with,
unfortunately, exists, but it is not used by the DVB core.

Thanks-to: Geert Uytterhoeven <geert@linux-m68k.org>
Thanks-to: Arnd Bergmann <arnd@arndb.de>

To make me revisit this code.

Fixes: a9cb97c3e628 ("media: dvb_frontend: be sure to init dvb_frontend_handle_ioctl() return code")
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: be sure to init dvb_frontend_handle_ioctl() return code

As smatch warned:
drivers/media/dvb-core/dvb_frontend.c:2468 dvb_frontend_handle_ioctl() error: uninitialized symbol 'err'.

The ioctl handler actually got a regression here: before changeset
d73dcf0cdb95 ("media: dvb_frontend: cleanup ioctl handling logic"),
the code used to return -EOPNOTSUPP if an ioctl handler was not
implemented on a driver. After the change, it may return a random
value.

Fixes: d73dcf0cdb95 ("media: dvb_frontend: cleanup ioctl handling logic")

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Tested-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: annotate ->poll() instances

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

media: dvb_frontend fix kernel_doc markups

There were some troubles there:
drivers/media/dvb-core/dvb_frontend.c:379: warning: No description found for parameter 'fe'
drivers/media/dvb-core/dvb_frontend.c:379: warning: No description found for parameter 'check_wrapped'
drivers/media/dvb-core/dvb_frontend.c:1265: warning: No description found for parameter 'p_out'

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

dvb_frontend: don't use-after-free the frontend struct

dvb_frontend_invoke_release() may free the frontend struct.
So, the free logic can't update it anymore after calling it.

That's OK, as __dvb_frontend_free() is called only when the
krefs are zeroed, so nobody is using it anymore.

That should fix the following KASAN error:

The KASAN report looks like this (running on kernel 3e0cc09a3a2c40ec1ffb6b4e12da86e98feccb11 (4.14-rc5+)):
==================================================================
BUG: KASAN: use-after-free in __dvb_frontend_free+0x113/0x120
Write of size 8 at addr ffff880067d45a00 by task kworker/0:1/24

CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc5-43687-g06ab8a23e0e6 #545
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:16
dump_stack+0x292/0x395 lib/dump_stack.c:52
print_address_description+0x78/0x280 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351
kasan_report+0x23d/0x350 mm/kasan/report.c:409
__asan_report_store8_noabort+0x1c/0x20 mm/kasan/report.c:435
__dvb_frontend_free+0x113/0x120 drivers/media/dvb-core/dvb_frontend.c:156
dvb_frontend_put+0x59/0x70 drivers/media/dvb-core/dvb_frontend.c:176
dvb_frontend_detach+0x120/0x150 drivers/media/dvb-core/dvb_frontend.c:2803
dvb_usb_adapter_frontend_exit+0xd6/0x160 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:340
dvb_usb_adapter_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:116
dvb_usb_exit+0x9b/0x200 drivers/media/usb/dvb-usb/dvb-usb-init.c:132
dvb_usb_device_exit+0xa5/0xf0 drivers/media/usb/dvb-usb/dvb-usb-init.c:295
usb_unbind_interface+0x21c/0xa90 drivers/usb/core/driver.c:423
__device_release_driver drivers/base/dd.c:861
device_release_driver_internal+0x4f1/0x5c0 drivers/base/dd.c:893
device_release_driver+0x1e/0x30 drivers/base/dd.c:918
bus_remove_device+0x2f4/0x4b0 drivers/base/bus.c:565
device_del+0x5c4/0xab0 drivers/base/core.c:1985
usb_disable_device+0x1e9/0x680 drivers/usb/core/message.c:1170
usb_disconnect+0x260/0x7a0 drivers/usb/core/hub.c:2124
hub_port_connect drivers/usb/core/hub.c:4754
hub_port_connect_change drivers/usb/core/hub.c:5009
port_event drivers/usb/core/hub.c:5115
hub_event+0x1318/0x3740 drivers/usb/core/hub.c:5195
process_one_work+0xc73/0x1d90 kernel/workqueue.c:2119
worker_thread+0x221/0x1850 kernel/workqueue.c:2253
kthread+0x363/0x440 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

Allocated by task 24:
save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772
kmalloc ./include/linux/slab.h:493
kzalloc ./include/linux/slab.h:666
dtt200u_fe_attach+0x4c/0x110 drivers/media/usb/dvb-usb/dtt200u-fe.c:212
dtt200u_frontend_attach+0x35/0x80 drivers/media/usb/dvb-usb/dtt200u.c:136
dvb_usb_adapter_frontend_init+0x32b/0x660 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:286
dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:86
dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:162
dvb_usb_device_init+0xf73/0x17f0 drivers/media/usb/dvb-usb/dvb-usb-init.c:277
dtt200u_usb_probe+0xa1/0xe0 drivers/media/usb/dvb-usb/dtt200u.c:155
usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
really_probe drivers/base/dd.c:413
driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
__device_attach+0x26b/0x3c0 drivers/base/dd.c:710
device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
device_add+0xd0b/0x1660 drivers/base/core.c:1835
usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932
generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
really_probe drivers/base/dd.c:413
driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
__device_attach+0x26b/0x3c0 drivers/base/dd.c:710
device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
device_add+0xd0b/0x1660 drivers/base/core.c:1835
usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
hub_port_connect drivers/usb/core/hub.c:4903
hub_port_connect_change drivers/usb/core/hub.c:5009
port_event drivers/usb/core/hub.c:5115
hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195
process_one_work+0xc73/0x1d90 kernel/workqueue.c:2119
worker_thread+0x221/0x1850 kernel/workqueue.c:2253
kthread+0x363/0x440 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

Freed by task 24:
save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459
kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524
slab_free_hook mm/slub.c:1390
slab_free_freelist_hook mm/slub.c:1412
slab_free mm/slub.c:2988
kfree+0xf6/0x2f0 mm/slub.c:3919
dtt200u_fe_release+0x3c/0x50 drivers/media/usb/dvb-usb/dtt200u-fe.c:202
dvb_frontend_invoke_release.part.13+0x1c/0x30 drivers/media/dvb-core/dvb_frontend.c:2790
dvb_frontend_invoke_release drivers/media/dvb-core/dvb_frontend.c:2789
__dvb_frontend_free+0xad/0x120 drivers/media/dvb-core/dvb_frontend.c:153
dvb_frontend_put+0x59/0x70 drivers/media/dvb-core/dvb_frontend.c:176
dvb_frontend_detach+0x120/0x150 drivers/media/dvb-core/dvb_frontend.c:2803
dvb_usb_adapter_frontend_exit+0xd6/0x160 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:340
dvb_usb_adapter_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:116
dvb_usb_exit+0x9b/0x200 drivers/media/usb/dvb-usb/dvb-usb-init.c:132
dvb_usb_device_exit+0xa5/0xf0 drivers/media/usb/dvb-usb/dvb-usb-init.c:295
usb_unbind_interface+0x21c/0xa90 drivers/usb/core/driver.c:423
__device_release_driver drivers/base/dd.c:861
device_release_driver_internal+0x4f1/0x5c0 drivers/base/dd.c:893
device_release_driver+0x1e/0x30 drivers/base/dd.c:918
bus_remove_device+0x2f4/0x4b0 drivers/base/bus.c:565
device_del+0x5c4/0xab0 drivers/base/core.c:1985
usb_disable_device+0x1e9/0x680 drivers/usb/core/message.c:1170
usb_disconnect+0x260/0x7a0 drivers/usb/core/hub.c:2124
hub_port_connect drivers/usb/core/hub.c:4754
hub_port_connect_change drivers/usb/core/hub.c:5009
port_event drivers/usb/core/hub.c:5115
hub_event+0x1318/0x3740 drivers/usb/core/hub.c:5195
process_one_work+0xc73/0x1d90 kernel/workqueue.c:2119
worker_thread+0x221/0x1850 kernel/workqueue.c:2253
kthread+0x363/0x440 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

The buggy address belongs to the object at ffff880067d45500
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 1280 bytes inside of
2048-byte region [ffff880067d45500, ffff880067d45d00)
The buggy address belongs to the page:
page:ffffea00019f5000 count:1 mapcount:0 mapping: (null)
index:0x0 compound_mapcount: 0
flags: 0x100000000008100(slab|head)
raw: 0100000000008100 0000000000000000 0000000000000000 00000001000f000f
raw: dead000000000100 dead000000000200 ffff88006c002d80 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff880067d45900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880067d45980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880067d45a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff880067d45a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880067d45b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Fixes: ead666000a5f ("media: dvb_frontend: only use kref after initialized")

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Suggested-by: Matthias Schwarzott <zzam@gentoo.org>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb-core: always call invoke_release() in fe_free()

Follow-up to: ead666000a5f ("media: dvb_frontend: only use kref after initialized")

The aforementioned commit fixed refcount OOPSes when demod driver attaching
succeeded but tuner driver didn't. However, the use count of the attached
demod drivers don't go back to zero and thus couldn't be cleanly unloaded.
Improve on this by calling dvb_frontend_invoke_release() in
__dvb_frontend_free() regardless of fepriv being NULL, instead of returning
when fepriv is NULL. This is safe to do since _invoke_release() will check
for passed pointers being valid before calling the .release() function.

[mchehab@s-opensource.com: changed the logic a little bit to reduce
conflicts with another bug fix patch under review]
Fixes: ead666000a5f ("media: dvb_frontend: only use kref after initialized")
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb: do some coding style cleanup

Fix a bunch of coding style issues found by checkpatch on the
part of the code that the previous patches touched.

WARNING: please, no space before tabs
+ * ^I^Icallback.$

ERROR: space required before the open parenthesis '('
+ switch(cmd) {

WARNING: line over 80 characters
+ err = dtv_property_process_get(fe, &getp, tvp + i, file);

WARNING: line over 80 characters
+ err = fe->ops.diseqc_recv_slave_reply(fe, (struct dvb_diseqc_slave_reply*) parg);

ERROR: "(foo*)" should be "(foo *)"
+ err = fe->ops.diseqc_recv_slave_reply(fe, (struct dvb_diseqc_slave_reply*) parg);

WARNING: line over 80 characters
+ err = fe->ops.read_signal_strength(fe, (__u16 *) parg);

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: get rid of dtv_get_property_dump()

Simplify the get property handling and move it to the existing
code at dtv_property_process_get() directly.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: dtv_property_process_set() cleanups

Since all properties in the func dtv_property_process_set() use
at most 4 bytes arguments, change the code to pass
u32 cmd and u32 data as function arguments, instead of passing a
pointer to the entire struct dtv_property *tvp.

Instead of having a generic dtv_property_dump(), added its own
properties debug logic in the dtv_property_process_set().

Signed-off-by: Satendra Singh Thakur <satendra.t@samsung.com>
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: fix return values for FE_SET_PROPERTY

There are several problems with regards to the return of
FE_SET_PROPERTY. The original idea were to return per-property
return codes via tvp->result field, and to return an updated
set of values.

However, that never worked. What's actually implemented is:

- the FE_SET_PROPERTY implementation doesn't call .get_frontend
callback in order to get the actual parameters after return;

- the tvp->result field is only filled if there's no error.
So, it is always filled with zero;

- FE_SET_PROPERTY doesn't call memdup_user() nor any other
copy_to_user() function. So, any changes to the properties
will be lost;

- FE_SET_PROPERTY is declared as a write-only ioctl (IOW).

While we could fix the above, it could cause regressions.

So, let's just assume what the code really does, updating
the documentation accordingly and removing the logic that
would update the discarded tvp->result.

Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: better document the -EPERM condition

Two readonly ioctls can't be allowed if the frontend device
is opened in read only mode. Explain why.

Reviewed by: Shuah Khan <shuahkh@osg.samsung.com>

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: get rid of property cache's state

In the past, I guess the idea was to use state in order to
allow an autofush logic. However, in the current code, it is
used only for debug messages, on a poor man's solution, as
there's already a debug message to indicate when the properties
got flushed.

So, just get rid of it for good.

Reviewed-by: Shuah Khan <shuahkg@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: cleanup ioctl handling logic

Currently, there are two handlers for ioctls:
- dvb_frontend_ioctl_properties()
- dvb_frontend_ioctl_legacy()

Despite their names, both handles non-legacy DVB ioctls.

Besides that, there's no reason why to not handle all ioctls
on a single handler function.

So, merge them into a single function (dvb_frontend_handle_ioctl)
and reorganize the ioctl's to indicate what's the current DVB
API and what's deprecated.

Despite the big diff, the handling logic for each ioctl is the
same as before.

Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: cleanup dvb_frontend_ioctl_properties()

Use a switch() on this function, just like on other ioctl
handlers and handle parameters inside each part of the
switch.

That makes it easier to integrate with the already existing
ioctl handler function.

Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: get rid of set_property() callback

Now that all clients of set_property() were removed, get rid
of this callback.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: get rid of get_property() callback

Only lg2160 implement gets_property, but there's no need for that,
as no other driver calls this callback, as get_frontend() does the
same, and set_frontend() also calls lg2160 get_frontend().

So, get rid of it.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Reviewed-by: Michael Ira Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: only use kref after initialized

As reported by Laurent, when a DVB frontend need to register
two drivers (e. g. a tuner and a demod), if the second driver
fails to register (for example because it was not compiled),
the error handling logic frees the frontend by calling
dvb_frontend_detach(). That used to work fine, but changeset
1f862a68df24 ("[media] dvb_frontend: move kref to struct dvb_frontend")
added a kref at struct dvb_frontend. So, now, instead of just
freeing the data, the error handling do a kref_put().

That works fine only after dvb_register_frontend() succeeds.

While it would be possible to add a helper function that
would be initializing earlier the kref, that would require
changing every single DVB frontend on non-trivial ways, and
would make frontends different than other drivers.

So, instead of doing that, let's focus on the real issue:
only call kref_put() after kref_init(). That's easy to
check, as, when the dvb frontend is successfuly registered,
it will allocate its own private struct. So, if such
struct is allocated, it means that it is safe to use
kref_put(). If not, then nobody is using yet the frontend,
and it is safe to just deallocate it.

Fixes: 1f862a68df24 ("[media] dvb_frontend: move kref to struct dvb_frontend")

Reported-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb/frontend.h: move out a private internal structure

struct dtv_cmds_h is just an ancillary struct used by the
dvb_frontend.c to internally store frontend commands.

It doesn't belong to the userspace header, nor it is used anywhere,
except inside the DVB core. So, remove it from the header.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: initialize variable s with FE_NONE instead of 0

GIT_AUTHOR_NAME=Colin King
GIT_AUTHOR_EMAIL=colin.king@canonical.com

In a previous commit, we added FE_NONE as an unknown fe_status.
Initialize variable s to FE_NONE instead of the more opaque value 0.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: dvb_frontend: ensure that inital front end status initialized

The fe_status variable s is not initialized meaning it can have any
random garbage status. This could be problematic if fe->ops.tune is
false as s is not updated by the call to fe->ops.tune() and a
subsequent check on the change status will using a garbage value.
Fix this by adding FE_NONE to the enum fe_status and initializing
s to this.

Detected by CoverityScan, CID#112887 ("Uninitialized scalar variable")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>

Fix up affected files that include this signal functionality via sched.h.

Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>

[media] media: Protect enable_source and disable_source handler code paths

Drivers might try to access and run enable_source and disable_source
handlers when the driver that implements these handlers is clearing
the handlers during its unregister.

Fix the following race condition:

process 1 process 2

request video streaming unbind au0828
v4l2 checks if tuner is free
... ...

au0828_unregister_media_device()
... ...
(doesn't hold graph_mutex)
mdev->enable_source = NULL;
if (mdev && mdev->enable_source) mdev->disable_source = NULL;
mdev->enable_source()
(enable_source holds graph_mutex)

As shown above enable_source check is done without holding the graph_mutex.
If unbind happens to be in progress, au0828 could clear enable_source and
disable_source handlers leading to null pointer de-reference.

Fix it by protecting enable_source and disable_source set and clear and
protecting enable_source and disable_source handler access and the call
itself.

process 1 process 2

request video streaming unbind au0828
v4l2 checks if tuner is free
... ...

au0828_unregister_media_device()
... ...
(hold graph_mutex while clearing)
mdev->enable_source = NULL;
if (mdev) mdev->disable_source = NULL;
(hold graph_mutex to check and
call enable_source)
if (mdev->enable_source)
mdev->enable_source()

If graph_mutex is held to just heck for handler being null and needs to be
released before calling the handler, there will be another window for the
handlers to be cleared. Hence, enable_source and disable_source handlers
no longer hold the graph_mutex and expect callers to hold it to avoid
forcing them release the graph_mutex before calling the handlers.

Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] media: Drop FSF's postal address from the source code files

Drop the FSF's postal address from the source code files that typically
contain mostly the license text. Of the 628 removed instances, 578 are
outdated.

The patch has been created with the following command without manual edits:

git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \
drivers/media/ include/media|while read i; do i=$i perl -e '
open(F,"< $ENV{i}");
$a=join("", <F>);
$a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m
&& $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m;
close(F);
open(F, "> $ENV{i}");
print F $a;
close(F);'; done

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>

Revert "[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations"

While this patch sounded a good idea, unfortunately, it causes
bad dependencies, as drivers that would otherwise work without
the DVB core will now break:

ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5767.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5761.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda827x.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda18218.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/qt1010.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2266.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt20xx.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2060.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mc44s803.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0013.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0012.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0011.ko] undefined!

So, we have to revert it.

Note: as the argument for the release ops changed from "int"
to "void", we needed to change it at the revert patch, to
avoid compilation issues like:
drivers/media/tuners/tea5767.c:437:23: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
.release = tea5767_release,
^~~~~~~~~~~~~~~

This reverts commit 22a613e89825ea7a3984a968463cc6d425bd8856.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] dvb_frontend: move kref to struct dvb_frontend

This commit amends my old commit fe35637b0a9f ("[media] dvb_frontend:
eliminate blocking wait in dvb_unregister_frontend()"), which added
kref to struct dvb_frontend_private. It turned out that there are
several use-after-free bugs left, which affect the struct
dvb_frontend. Protecting it with kref also protects struct
dvb_frontend_private, so we can simply move it.

This is how the use-after-free looks like in KASAN:

BUG: KASAN: use-after-free in string+0x60/0xb1 at addr ffff880033bd9fc0
Read of size 1 by task kworker/0:2/617
CPU: 0 PID: 617 Comm: kworker/0:2 Not tainted 4.8.0-rc1-hosting+ #60
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
0000000000000000 ffff880033757218 ffffffff81394e50 ffff880033bd9fd0
ffff880035c03b00 ffff880033757240 ffffffff811f271d ffff880033bd9fc0
1ffff1000677b3f8 ffffed000677b3f8 ffff8800337572b8 ffffffff811f2afe
Call Trace:
[...]
[<ffffffff813a2d2f>] vsnprintf+0x39d/0x7e9
[<ffffffff813993f9>] add_uevent_var+0x10f/0x1dc
[<ffffffff814fe5ca>] rc_dev_uevent+0x55/0x6f
[<ffffffff814438f8>] dev_uevent+0x2e1/0x316
[<ffffffff81399744>] kobject_uevent_env+0x27e/0x701
[<ffffffff81399bd2>] kobject_uevent+0xb/0xd
[<ffffffff81443445>] device_del+0x322/0x383
[<ffffffff81500c0c>] rc_unregister_device+0x98/0xc3
[<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90
[<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5
[<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
[<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80
[...]
Object at ffff880033bd9fc0, in cache kmalloc-16 size: 16
Allocated:
[...]
Freed:
PID = 617
[...]
[<ffffffff811f034c>] kfree+0xd9/0x166
[<ffffffff814fe513>] ir_free_table+0x2f/0x51
[<ffffffff81500bc1>] rc_unregister_device+0x4d/0xc3
[<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90
[<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5
[<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
[<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80

Another one:

BUG: KASAN: use-after-free in do_sys_poll+0x336/0x6b8 at addr ffff88003563fcc0
Read of size 8 by task tuner on fronte/1042
CPU: 1 PID: 1042 Comm: tuner on fronte Tainted: G B 4.8.0-rc1-hosting+ #60
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
0000000000000000 ffff88003353f910 ffffffff81394e50 ffff88003563fd80
ffff880035c03200 ffff88003353f938 ffffffff811f271d ffff88003563fc80
1ffff10006ac7f98 ffffed0006ac7f98 ffff88003353f9b0 ffffffff811f2afe
Call Trace:
[...]
[<ffffffff812289b3>] do_sys_poll+0x336/0x6b8
[...]
[<ffffffff81228ed9>] SyS_poll+0xa9/0x194
[...]
Object at ffff88003563fc80, in cache kmalloc-256 size: 256
Allocated:
[...]
Freed:
PID = 617
[...]
[<ffffffff811f034c>] kfree+0xd9/0x166
[<ffffffff814eb60d>] dvb_unregister_device+0xd6/0xe5
[<ffffffff814fa4ed>] dvb_unregister_frontend+0x4b/0x66
[<ffffffff8150810b>] dvb_usb_adapter_frontend_exit+0x69/0xac
[<ffffffff8150617d>] dvb_usb_exit+0x43/0xe5
[<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
[<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] dvb_frontend: add "detach" callback

Prepare for making "release" asynchronous (via kref). Some operations
may need to be run synchronously in dvb_frontend_detach(), and that's
why we need a "detach" callback.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] dvb_frontend: merge the two dvb_frontend_detach() versions

This code duplication is confusing and error prone. Let's merge them
by moving the release/dvb_detach call into one function with one

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] dvb_frontend: tuner_ops.release returns void

It is not clear what this return value means. All implemenations
return 0, and the one caller ignores the value. Let's remove this
useless return value completely.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations

Most release callback functions are identical: free the "tuner_priv"
and clear it. Let's eliminate some bloat by providing this simple
implementation in the dvb_frontend library.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] squash lines for simple wrapper functions

Remove unneeded variables and assignments.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] dvb-core: use pr_foo() instead of printk()

The dvb-core directly calls printk() without using the modern
printk macros, or using the proper printk levels. Change it
to use pr_foo().

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] dvb_frontend: Use memdup_user() rather than duplicating its implementation

* Reuse existing functionality from memdup_user() instead of keeping
duplicate source code.

This issue was detected by using the Coccinelle software.

* Return directly if this copy operation failed.

* Replace the specification of data structures by pointer dereferences
to make the corresponding size determination a bit safer according to
the Linux coding style convention.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] dvb_frontend: eliminate blocking wait in dvb_unregister_frontend()

The wait_event() call in dvb_unregister_frontend() waits synchronously
for other tasks to free a file descriptor, but it does that while
holding several mutexes. That alone is a bad idea, but if one user
process happens to keep a (defunct) file descriptor open indefinitely,
the kernel will correctly detect a hung task:

INFO: task kworker/0:1:314 blocked for more than 30 seconds.
Not tainted 4.7.0-rc1-hosting+ #50
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/0:1 D ffff88003daf7a50 0 314 2 0x00000000
Workqueue: usb_hub_wq hub_event
ffff88003daf7a50 0000000000000296 ffff88003daf7a30 ffff88003fc13f98
ffff88003dadce00 ffff88003daf8000 ffff88003e3fc010 ffff88003d48d4f8
ffff88003e3b5030 ffff88003e3f8898 ffff88003daf7a68 ffffffff810cf860
Call Trace:
[<ffffffff810cf860>] schedule+0x30/0x80
[<ffffffff812f88d3>] dvb_unregister_frontend+0x93/0xc0
[<ffffffff8107a000>] ? __wake_up_common+0x80/0x80
[<ffffffff813019c7>] dvb_usb_adapter_frontend_exit+0x37/0x70
[<ffffffff81300614>] dvb_usb_exit+0x34/0xb0
[<ffffffff81300d4a>] dvb_usb_device_exit+0x3a/0x50
[<ffffffff81302dc2>] pctv452e_usb_disconnect+0x52/0x60
[<ffffffff81295a07>] usb_unbind_interface+0x67/0x1e0
[<ffffffff810609f3>] ? __blocking_notifier_call_chain+0x53/0x70
[<ffffffff8127ba67>] __device_release_driver+0x77/0x110
[<ffffffff8127c2d3>] device_release_driver+0x23/0x30
[<ffffffff8127ab5d>] bus_remove_device+0x10d/0x150
[<ffffffff8127879b>] device_del+0x13b/0x260
[<ffffffff81299dea>] ? usb_remove_ep_devs+0x1a/0x30
[<ffffffff8129468e>] usb_disable_device+0x9e/0x1e0
[<ffffffff8128bb09>] usb_disconnect+0x89/0x260
[<ffffffff8128db8d>] hub_event+0x30d/0xfc0
[<ffffffff81059475>] process_one_work+0x1c5/0x4a0
[<ffffffff8105940c>] ? process_one_work+0x15c/0x4a0
[<ffffffff81059799>] worker_thread+0x49/0x480
[<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0
[<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0
[<ffffffff8105f65e>] kthread+0xee/0x110
[<ffffffff810400bf>] ret_from_fork+0x1f/0x40
[<ffffffff8105f570>] ? __kthread_unpark+0x70/0x70
5 locks held by kworker/0:1/314:
#0: ("usb_hub_wq"){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0
#1: ((&hub->events)){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0
#2: (&dev->mutex){......}, at: [<ffffffff8128d8cb>] hub_event+0x4b/0xfc0
#3: (&dev->mutex){......}, at: [<ffffffff8128bad2>] usb_disconnect+0x52/0x260
#4: (&dev->mutex){......}, at: [<ffffffff8127c2cb>] device_release_driver+0x1b/0x30

This patch removes the blocking wait, and postpones the kfree() call
until all file handles have been closed by using struct kref.

Signed-off-by: Max Kellermann <max@duempel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

[media] media: dvb-frontend invoke enable/disable_source handlers

Change dvb frontend to check if tuner is free when device opened in RW
mode.

Call to enable_source handler either returns with an active pipeline to
tuner or error if tuner is busy.

Tuner is released when frontend is released calling the disable_source
handler.

Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb_frontend: Don't let drivers to trash data at cache

GET_FRONTEND and G_PROPERTY can be called anytime, even when the
tuner/demod is not fully locked. However, several parameters
returned by those calls are available only after the demod get
VITERBI lock.

While several drivers do the right thing by checking the status before
returning the parameter, some drivers simply blindly update the
DTV properties cache without checking if the registers at the
hardware contain valid values.

Due to that, programs that call G_PROPERTY (or GET_FRONTEND)
before having a tuner lock may interfere at the zigzag logic,
as the DVB kthread calls the set_frontend() callback several
times, to fine tune the frequency and to identify if the signal
is inverted or not.

While the drivers should be fixed to report the right status,
we should prevent that such bugs would actually interfere at the
device operation.

So, let's use a separate var for userspace calls to get frontend.

As we copy the content of the cache, this should not cause any
troubles.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb_frontend: pass the props cache to get_frontend() as arg

Instead of using the DTV properties cache directly, pass the get
frontend data as an argument. For now, everything should remain
the same, but the next patch will prevent get_frontend to
affect the global cache.

This is needed because several drivers don't care enough to only
change the properties if locked. Due to that, calling
G_PROPERTY before locking on those drivers will make them to
never lock. Ok, those drivers are crap and should never be
merged like that, but the core should not rely that the drivers
would be doing the right thing.

Reviewed-by: Michael Ira Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb_frontend: add props argument to dtv_get_frontend()

Instead of implicitly using the DTV cache properties at
dtv_get_frontend(), pass it as an additional argument.

This patch prepares to use a separate cache for G_PROPERTY,
in order to avoid it to mangle with the DVB thread
zigzag logic.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb_frontend: print DTV property dump also for SET_PROPERTY

When debugging troubles with DTV properties get/set, it is
important to be able to see not only the properties from get, but
also the ones from set. So, improve the dumps to allow reporting
both.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb-frontend: Use boottime

Wall time obtained from ktime_get_real is susceptible to sudden jumps due to
user setting the time or due to NTP. Boot time is constantly increasing time
better suited for comparing two timestamps.

[mchehab@osg.samsung.com: fix trivial merge conflicts]
Signed-off-by: Abhilash Jindal <klock.android@gmail.com>

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb: modify core to implement interfaces/entities at MC new gen

The Media Controller New Generation redefines the types for both
interfaces and entities to be used on DVB. Make the needed
changes at the DVB core for all interfaces, entities and
data and interface links to appear in the graph.

Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] media: convert links from array to list

The entire logic that represent graph links were developed on a
time where there were no needs to dynamic remove links. So,
although links are created/removed one by one via some
functions, they're stored as an array inside the entity struct.

As the array may grow, there's a logic inside the code that
checks if the amount of space is not enough to store
the needed links. If it isn't the core uses krealloc()
to change the size of the link, with is bad, as it
leaves the memory fragmented.

So, convert links into a list.

Also, currently, both source and sink entities need the link
at the graph traversal logic inside media_entity. So there's
a logic duplicating all links. That makes it to spend
twice the memory needed. This is not a big deal for today's
usage, where the number of links are not big.

Yet, if during the MC workshop discussions, it was said that
IIO graphs could have up to 4,000 entities. So, we may
want to remove the duplication on some future. The problem
is that it would require a separate linked list to store
the backlinks inside the entity, or to use a more complex
algorithm to do graph backlink traversal, with is something
that the current graph traversal inside the core can't cope
with. So, let's postpone a such change if/when it is actually
needed.

It should also be noticed that the media_link structure uses
44 bytes on 32-bit architectures and 84 bytes on 64-bit
architecture. It will thus be allocated out of the 64-bytes and
96-bytes pools respectively. That's a 12.5% memory waste on
64-bit architectures and 31.25% on 32-bit architecture.
A linked list is less efficient than an array in this case, but
this could later be optimized if we can get rid of the reverse
links (with would reduce memory allocation by 50%).

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] fix dvb_frontend_sleep_until() logic

As pointed by Laurent Navet:
"Calling ktime_add_us() seems useless as is only useful
for it's return value which is ignored."

That's reported by coverity CID 1309761.

Laurent proposed to just remove ktime_add_us, but the fact is that
the logic of this function is broken. Instead, we need to use the
value of the timeout, and ensure that it will work on the loops
to emulate the legacy DiSEqC ioctl (FE_DISHNETWORK_SEND_LEGACY_CMD).

Please notice that the logic was also broken if, for any reason,
msleep() would sleep a little less than what it was expected, as
newdelta would be smaller than delta, and udelay() would not be called.

It should also be noticed that nobody noticed that trouble before
likely because the FE_DISHNETWORK_SEND_LEGACY_CMD is not used
anymore by modern DVB applications.

Reported-by: Laurent Navet <laurent.navet@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode

When in FE_TUNE_MODE_ONESHOT the frontend must report
the actual capabilities so user can take appropriate
action.

With frontends that can't do auto inversion this is done
by dvb-core automatically so CAN_INVERSION_AUTO is valid.

However, when in FE_TUNE_MODE_ONESHOT this is not true.

So only set FE_CAN_INVERSION_AUTO in modes other than
FE_TUNE_MODE_ONESHOT

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb_frontend: resume tone and voltage

As SEC tone and voltage could have changed during
suspend(), restore them to their previous values at
resume().

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb: document dvb_frontend_sleep_until()

This function is used mainly at the DVB core, in order to provide
emulation for a legacy ioctl. The only current exception is
the stv0299 driver, with takes more than 8ms to switch voltage,
breaking the emulation for FE_DISHNETWORK_SEND_LEGACY_CMD.

Document that.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb: Use DVBFE_ALGO_HW where applicable

The dvb_frontend.c core defines a FE_ALGO_HW symbol that it is
never used. Also, both cx24123 returns 1 to get_algo() callback
instead of using DVBFE_ALGO_HW.

Probably, those are some left overs from some code cleanup.

Let's stop returning magic numbers and use the proper macro
value.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Jonathan Corbet <corbet@lwn.net>

[media] dvb-core: prevent some corruption the legacy ioctl

Quite a few of the ->diseqc_send_master_cmd() implementations don't
check cmd->msg_len so it can lead to memory corruption.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb-frontend: Replace timeval with ktime_t

struct timeval uses a 32-bit seconds representation which will
overflow in the year 2038 and beyond. This patch replaces
the usage of struct timeval with ktime_t which is a 64-bit
timestamp and is year 2038 safe.
This patch is part of a larger attempt to remove all instances
of 32-bit timekeeping variables (timeval, timespec, time_t)
which are not year 2038 safe, from the kernel.

[mchehab@osg.samsung.com: add a missing parenthesis, breaking compilation]
Suggested-by: Arnd Bergmann <arndb@arndb.de>
Signed-off-by: Tina Ruchandani <ruchandani.tina@gmail.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb: Get rid of typedev usage for enums

The DVB API was originally defined using typedefs. This is against
Kernel CodingStyle, and there's no good usage here. While we can't
remove its usage on userspace, we can avoid its usage in Kernelspace.

So, let's do it.

This patch was generated by this shell script:

for j in $(grep typedef include/uapi/linux/dvb/frontend.h |cut -d' ' -f 3); do for i in $(find drivers/media -name '*.[ch]' -type f) $(find drivers/staging/media -name '*.[ch]' -type f); do sed "s,${j}_t,enum $j," <$i >a && mv a $i; done; done

While here, make CodingStyle fixes on the affected lines.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de> # for drivers/media/firewire/*

[media] dvb-core: fix 32-bit overflow during bandwidth calculation

Frontend bandwidth calculation overflows on very high DVB-S/S2
symbol rates. Use mult_frac() macro in order to keep calculation
correct.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb-frontend: remove a warning

if CONFIG_MEDIA_CONTROLLER_DVB is not selected, it is now
producing this warning:

drivers/media/dvb-core/dvb_frontend.c: In function ‘dvb_frontend_thread’:
drivers/media/dvb-core/dvb_frontend.c:695:6: warning: unused variable ‘ret’ [-Wunused-variable]
int ret;
^

Reported-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb core: only start media entity if not NULL

The logic there tries to start the media entity even if it
doesn't exist, causing this bug:

[ 314.356162] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[ 314.356202] IP: [<ffffffffa02ef74c>] media_entity_pipeline_start+0x1c/0x390 [media]

Reported-by: Gert-Jan van der Stroom <gjstroom@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb_frontend: start media pipeline while thread is running

While the DVB thread is running, the media pipeline should be
streaming. This should prevent any attempt of using the analog
TV while digital TV is working, and vice-versa.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb-frontend: enable tuner link when the FE thread starts

If the dvb frontend thread starts, the tuner should be switched
to the frontend. Add a code that ensures that this will happen,
using the media controller.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb_frontend: add media controller support for DVB frontend

Now that the dvb core is capable of registering devices via the
media controller, add support for the DVB frontend devices.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb-core: set default properties of ISDB-S

Signed-off-by: Akihiro Tsukada <tskd08@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb_frontend: Fix __user namespace

As reported by smatch:

drivers/media/dvb-core/dvb_frontend.c:1960:45: warning: incorrect type in argument 2 (different address spaces)
drivers/media/dvb-core/dvb_frontend.c:1960:45: expected void const [noderef] <asn:1>*from
drivers/media/dvb-core/dvb_frontend.c:1960:45: got struct dtv_property *[noderef] <asn:1>props
drivers/media/dvb-core/dvb_frontend.c:1992:45: warning: incorrect type in argument 2 (different address spaces)
drivers/media/dvb-core/dvb_frontend.c:1992:45: expected void const [noderef] <asn:1>*from
drivers/media/dvb-core/dvb_frontend.c:1992:45: got struct dtv_property *[noderef] <asn:1>props
drivers/media/dvb-core/dvb_frontend.c:2014:38: warning: incorrect type in argument 1 (different address spaces)
drivers/media/dvb-core/dvb_frontend.c:2014:38: expected void [noderef] <asn:1>*to
drivers/media/dvb-core/dvb_frontend.c:2014:38: got struct dtv_property *[noderef] <asn:1>props
drivers/media/dvb-core/dvb_frontend.c:1946:17: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1947:17: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1951:22: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1951:42: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1954:31: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1960:41: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1960:54: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1965:33: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1978:17: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1979:17: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1983:22: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1983:42: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1986:31: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1992:41: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1992:54: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:2007:33: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:2014:34: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:2014:52: warning: dereference of noderef expression

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

[media] dvb_frontend: estimate bandwidth also for DVB-S/S2/Turbo

The needed bandwidth can be estimated using the symbol rate and
the rolloff factor. This could be useful for the frontend drivers,
as they don't need to calculate it themselves.

Reported-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

[media] dvb-frontend: add core support for tuner suspend/resume

While several tuners have some sort of suspend/resume
implementation, this is currently mangled with an optional
.sleep callback that it is also used to put the device on
low power mode.

Not all drivers implement it, as returning the driver from
low power may require to re-load the firmware, with takes
some time. Also, some drivers may delay it.

So, the more coherent is to add two new optional callbacks
that will let the tuners to directy implement suspend and
resume callbacks if they need.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

[media] media: dvb-core add new flag exit flag value for resume

Some fe drivers will have to do additional initialization
in their fe ops.init interfaces when called during resume.
Without the additional initialization, fe and tuner driver
resume fails. A new fe exit flag value DVB_FE_DEVICE_RESUME
is necessary to detect resume case. This patch adds a new
define and changes dvb_frontend_resume() to set it prior to
calling fe init and tuner init calls and resets it back to
DVB_FE_NO_EXIT once fe and tuner init is done.

Signed-off-by: Shuah Khan <shuah.kh@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

[media] media: dvb-core move fe exit flag from fepriv to fe for driver access

Some fe drivers attempt to access the device for power control from
their release routines. When release routines are called after device
is disconnected, the attempts fail. fe drivers should avoid accessing
the device, from their release interfaces when called from disconnect
path. dvb-frontend maintains exit flag to keep track when fe device is
disconnected in its private data structures. Export the flag in fe to
enable drivers to check the device status from their release interfaces.

Signed-off-by: Shuah Khan <shuah.kh@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

[media] dvbdev: add a dvb_detach() macro

The dvb_attach() was unbalanced, as there was no dvb_dettach. Ok,
on current cases, the dettach is done by dvbdev, but that are some
future corner cases where we may need to do this before registering
the frontend.

So, add a dvb_detach() and use it at dvb_frontend.c.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

[media] dvb_frontend: Fix possible read out of bounds

Check if index is within bounds _before_ accessing the value.

Signed-off-by: Ole Ernst <olebowle@gmx.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

[media] dvb_frontend: better handle lna set errors

If an attempt to set LNA fails, restore the cache to LNA_AUTO,
in order to make it to reflect the current LNA status.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

dvb_frontend: don't mess with ->f_op in ->release()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

[media] dvb-core: don't clear stats at DTV_CLEAR

The stats are cleared by the frontend. Don't do it at DTV_CLEAR.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb_frontend: Simplify the emulation logic

The current logic was broken and too complex; while it works
fine for DVB-S2/DVB-S, it is broken for ISDB-T.
Make the logic simpler, fixes it for ISDB-T and make it clearer.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb-frontend: split set_delivery_system()

This function is complex, and has different workflows, one for
DVBv3 calls, and another one for DVBv5 calls. Break it into 3
functions, in order to make easier to understand what each
block does.
No functional changes so far. A few comments got improved.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Revert "[media] dvb_frontend: return -ENOTTY for unimplement IOCTL"

As reported by Klaus Schmidinger:
"In VDR I use an ioctl() call with FE_READ_UNCORRECTED_BLOCKS on a
device (using stb0899). After this call I check 'errno' for
EOPNOTSUPP to determine whether this device supports this call. This
used to work just fine, until a few months ago I noticed that my
devices using stb0899 didn't display their signal quality in VDR's OSD
any more. After further investigation I found that
ioctl(FE_READ_UNCORRECTED_BLOCKS) no longer returns EOPNOTSUPP, but
rather ENOTTY. And since I stop getting the signal quality in case
any unknown errno value appears, this broke my signal quality query
function."

While the changes reflect what is there at:

http://comments.gmane.org/gmane.linux.kernel/1235728

it does cause regression on userspace. So, revert it to stop the
damage.

This reverts commit 177ffe506cf8 ("[media] dvb_frontend: return -ENOTTY
for unimplement IOCTL").

Reported-by: Klaus Schmidinger <Klaus.Schmidinger@tvdr.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

[media] dvb_frontend: print a msg if a property doesn't exist

If userspace calls a property that doesn't exist, it currently
just returns -EINVAL. However, this is more likely a problem at
the userspace application, calling it with a non-existing property.
So, add a debug message to help tracking it.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb: the core logic to handle the DVBv5 QoS properties

Add the logic to poll, reset counters and report the QoS stats
to the end user.
The idea is that the core will periodically poll the frontend for
the stats. The frontend may return -EBUSY, if the previous collect
didn't finish, or it may fill the cached data.
The value returned to the end user is always the cached data.

Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb-core: Replace memcpy with struct assignment

This kind of memcpy() is error-prone. Its replacement with a struct
assignment is prefered because it's type-safe and much easier to read.
Found by coccinelle. Hand patched and reviewed.
Tested by compilation only.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
identifier struct_name;
struct struct_name to;
struct struct_name from;
expression E;
@@
-memcpy(&(to), &(from), E);
+to = from;
// </smpl>

Signed-off-by: Peter Senna Tschudin <peter.senna@gmail.com>
Signed-off-by: Ezequiel Garcia <elezegarcia@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb_frontend: fix ioctls failing if frontend open/closed too fast

That likely fixes this MythTV ticket:
http://code.mythtv.org/trac/ticket/10830
(which btw affects all usb tuners I tested as well, pctv452e,
dib0700, af9015) pctv452e is still possibly broken with MythTV
even after this fix; it does work with VDR here tho despite I2C
errors.
Reduced testcase:
http://people.freebsd.org/~nox/tmp/ioctltst.c
Thanx to devinheitmueller and crope from #linuxtv for helping with
this fix! :)

Signed-off-by: Juergen Lock <nox@jelal.kn-bremen.de>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb_frontend: Don't declare values twice at a table

drivers/media/dvb-core/dvb_frontend.c:1032:2: warning: initialized field overwritten [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1032:2: warning: (near initialization for 'dtv_cmds[36]') [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1033:2: warning: initialized field overwritten [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1033:2: warning: (near initialization for 'dtv_cmds[37]') [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1034:2: warning: initialized field overwritten [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1034:2: warning: (near initialization for 'dtv_cmds[38]') [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1035:2: warning: initialized field overwritten [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1035:2: warning: (near initialization for 'dtv_cmds[39]') [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1036:2: warning: initialized field overwritten [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1036:2: warning: (near initialization for 'dtv_cmds[40]') [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1037:2: warning: initialized field overwritten [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1037:2: warning: (near initialization for 'dtv_cmds[60]') [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1045:2: warning: initialized field overwritten [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1045:2: warning: (near initialization for 'dtv_cmds[46]') [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1051:2: warning: initialized field overwritten [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1051:2: warning: (near initialization for 'dtv_cmds[52]') [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1060:2: warning: initialized field overwritten [-Woverride-init]
drivers/media/dvb-core/dvb_frontend.c:1060:2: warning: (near initialization for 'dtv_cmds[61]') [-Woverride-init]

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb: LNA implementation changes

* use dvb property cache
* implement get (thus API minor++)
* PCTV 290e: 1=LNA ON, all the other values LNA OFF
Also fix PCTV 290e LNA comment, it is disabled by default
Hans and Mauro proposed use of cache implementation of get as they
were planning to extend LNA usage for analog side too.

Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Reported-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] drivers/media: Remove unnecessary semicolon

A simplified version of the semantic patch that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r1@
statement S;
position p,p1;
@@
S@p1;@p
@script:python r2@
p << r1.p;
p1 << r1.p1;
@@
if p[0].line != p1[0].line_end:
cocci.include_match(False)
@@
position r1.p;
@@
-;@p
// </smpl>

[mchehab@redhat.com: some hunks got bitroted; applied only the
ones that succeeds]
Signed-off-by: Peter Senna Tschudin <peter.senna@gmail.com>
[crope@iki.fi: For my drivers a8293, af9013, af9015, af9035]
Acked-by: Antti Palosaari <crope@iki.fi>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] add LNA support for DVB API

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb_frontend: do not allow statistic IOCTLs when sleeping

Demodulator cannot perform statistic IOCTLs when it is not tuned.
Return -EAGAIN in such case.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb_frontend: add multistream support

Unify multistream support at the DVBAPI: several delivery systems
allow it. Yet, each one had its own name. So, instead of adding
a third version of this field, remove the per-standard naming,
unifying it into a common name.

The legacy code number can still be used by old applications.

Version increased to 5.8.

[mchehab@redhat.com: joined the va1j5jf007s patch, in order to
avoid compilation breakage]
Signed-off-by: Evgeny Plehov <EvgenyPlehov@ukr.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb_frontend: return -ENOTTY for unimplement IOCTL

Earlier it was returning -EOPNOTSUPP.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb_frontend: use Kernel dev_* logging

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb_frontend: implement suspend / resume

Move initial suspend / resume support from dvb_usb_v2 to dvb_frontend
as it is dvb general feature that could be used all dvb devices.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb_core: export function to perform retune

We need to retune when resume from suspend.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dvb: move the dvb core one level up

just like the V4L2 core, move the DVB core to drivers/media, as the
intention is to get rid of both "video" and "dvb" directories.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>