#
912472fd |
|
09-Nov-2023 |
Benjamin Gaignard <benjamin.gaignard@collabora.com> |
media: usb: airspy: Stop direct calls to queue num_buffers field Use vb2_get_num_buffers() to avoid using queue num_buffers field directly. This allows us to change how the number of buffers is computed in the future. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
#
23bc5eb5 |
|
10-Aug-2022 |
Dongliang Mu <mudongliangabcd@gmail.com> |
media: airspy: fix memory leak in airspy probe The commit ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing deallocation in the success path. Fix this by freeing buf in the success path since this variable does not have any references in other code. Fixes: ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") Reported-by: syzbot+bb25f85e5aa482864dc0@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolution.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
#
f068a6ce |
|
10-Aug-2022 |
Hans Verkuil <hverkuil-cisco@xs4all.nl> |
media: avoid use of 'videobuf' The term 'videobuf' typically refers to the old videobuf version 1 framework. Avoid using this word in drivers that are converted to vb2. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
#
ca9dc8d0 |
|
18-May-2022 |
Oliver Neukum <oneukum@suse.com> |
media: airspy: respect the DMA coherency rules If we want to avoid memory corruption on incoherent architectures, buffers for DMA must not reside - on the stack - embedded within other structures Allocate them separately. v2: fix uninitialized return value Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
#
a9be3931 |
|
15-Aug-2021 |
Nil Yi <teroincn@163.com> |
media: usb: airspy: clean the freed pointer and counter After urb was freed, the pointer and counter need to be cleaned. Signed-off-by: Nil Yi <teroincn@163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
|
#
b2cd0b31 |
|
22-Apr-2021 |
Hans Verkuil <hverkuil-cisco@xs4all.nl> |
media: rtl2832_sdr/vivid/airspy/hackrf/msi2500: drop memset of fmt.sdr.reserved The V4L2 core already zeroes fmt.sdr.reserved, so there is no need for drivers to do the same. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
|
#
009cb7d5 |
|
11-Jun-2019 |
Hans Verkuil <hverkuil-cisco@xs4all.nl> |
media: media/usb: don't set description in ENUM_FMT The V4L2 core sets the description for the driver in order to ensure consistent naming. So drop the strscpy of the description in drivers. Also remove any description strings in driver-internal structures since those are no longer needed. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
8c3854d0 |
|
04-Jun-2019 |
Hans Verkuil <hverkuil-cisco@xs4all.nl> |
media: media/usb: set device_caps in struct video_device Instead of filling in the struct v4l2_capability device_caps field, fill in the struct video_device device_caps field. That way the V4L2 core knows what the capabilities of the video device are. But this only really works if all drivers use this, so convert all usb drivers in this patch. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
c942fddf |
|
27-May-2019 |
Thomas Gleixner <tglx@linutronix.de> |
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 Based on 3 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version [author] [kishon] [vijay] [abraham] [i] [kishon]@[ti] [com] this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version [author] [graeme] [gregory] [gg]@[slimlogic] [co] [uk] [author] [kishon] [vijay] [abraham] [i] [kishon]@[ti] [com] [based] [on] [twl6030]_[usb] [c] [author] [hema] [hk] [hemahk]@[ti] [com] this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 1105 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Reviewed-by: Richard Fontana <rfontana@redhat.com> Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070033.202006027@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
c0decac1 |
|
10-Sep-2018 |
Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
media: use strscpy() instead of strlcpy() The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL terminated strings. Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
86844942 |
|
26-Aug-2017 |
Bhumika Goyal <bhumirks@gmail.com> |
media: usb: make video_device const Make these const as they are only used during a copy operation. Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Acked-by: Mike Isely <isely@pobox.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
7fb2e072 |
|
13-Aug-2017 |
Arvind Yadav <arvind.yadav.cs@gmail.com> |
media: usb: constify usb_device_id usb_device_id are not supposed to change at runtime. All functions working with usb_device_id provided by <linux/usb.h> work with const usb_device_id. So mark the non-const structs as const. 'drivers/media/usb/b2c2/flexcop-usb.c' Fix checkpatch.pl error: ERROR: space prohibited before open square bracket '['. Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
1bc17717 |
|
08-Sep-2016 |
Julia Lawall <Julia.Lawall@lip6.fr> |
[media] usb: constify vb2_ops structures Check for vb2_ops structures that are only stored in the ops field of a vb2_queue structure. That field is declared const, so vb2_ops structures that have this property can be declared as const also. The semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // <smpl> @r disable optional_qualifier@ identifier i; position p; @@ static struct vb2_ops i@p = { ... }; @ok@ identifier r.i; struct vb2_queue e; position p; @@ e.ops = &i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; struct vb2_ops e; @@ e@i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct vb2_ops i = { ... }; // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
05476e64 |
|
11-Aug-2016 |
Wolfram Sang <wsa-dev@sang-engineering.com> |
media: usb: airspy: airspy: don't print error when allocating urb fails kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
80ae3197 |
|
11-Aug-2016 |
Wolfram Sang <wsa-dev@sang-engineering.com> |
[media] media: usb: airspy: airspy: don't print error when allocating urb fails kmalloc will print enough information in case of failure. Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
aa93d1fe |
|
15-Jul-2016 |
James Patrick-Evans <james@jmp-e.com> |
media: fix airspy usb probe error path Fix a memory leak on probe error of the airspy usb device driver. The problem is triggered when more than 64 usb devices register with v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV. The memory leak is caused by the probe function of the airspy driver mishandeling errors and not freeing the corresponding control structures when an error occours registering the device to v4l2 core. A badusb device can emulate 64 of these devices, and then through continual emulated connect/disconnect of the 65th device, cause the kernel to run out of RAM and crash the kernel, thus causing a local DOS vulnerability. Fixes CVE-2016-5400 Signed-off-by: James Patrick-Evans <james@jmp-e.com> Reviewed-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org # 3.17+ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
#
785ef73d |
|
14-Jul-2016 |
James Patrick-Evans <james@jmp-e.com> |
[media] airspy: fix error logic during device register This patch addresses CVE-2016-5400, a local DOS vulnerability caused by a memory leak in the airspy usb device driver. The vulnerability is triggered when more than 64 usb devices register with v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.A badusb device can emulate 64 of these devices then through continual emulated connect/disconnect of the 65th device, cause the kernel to run out of RAM and crash the kernel. The vulnerability exists in kernel versions from 3.17 to current 4.7. The memory leak is caused by the probe function of the airspy driver mishandeling errors and not freeing the corresponding control structures when an error occours registering the device to v4l2 core. Signed-off-by: James Patrick-Evans <james@jmp-e.com> Cc: stable@vger.kernel.org # Up to Kernel 3.17 Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
36c0f8b3 |
|
15-Apr-2016 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] vb2: replace void *alloc_ctxs by struct device *alloc_devs Make this a proper typed array. Drop the old allocate context code since that is no longer used. Note that the memops functions now get a struct device pointer instead of the struct device ** that was there initially (actually a void pointer to a struct containing only a struct device pointer). This code is now a lot cleaner. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Sakari Ailus <sakari.ailus@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
f6f7b58e |
|
27-Feb-2016 |
Mauro Carvalho Chehab <mchehab@kernel.org> |
[media] airspy: fix bit set/clean mess on s->flags As warned by smatch: drivers/media/usb/airspy/airspy.c:541 airspy_start_streaming() warn: test_bit() takes a bit number drivers/media/usb/airspy/airspy.c:569 airspy_start_streaming() warn: test_bit() takes a bit number drivers/media/usb/airspy/airspy.c:605 airspy_stop_streaming() warn: test_bit() takes a bit number set_bit/clear_bit argument is the bit number, and not 1 << bit. Thankfully, one of the bits was not used (URB_BUF), with would otherwise cause a driver misfunctioning. Clean this mess by always using set_bit/clear_bit/test_bit and removing the unused bit. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
aa0850e1 |
|
26-Oct-2015 |
Antti Palosaari <crope@iki.fi> |
[media] airspy: increase USB control message buffer size Driver requested device firmware version string during probe using only 24 byte long buffer. That buffer is too small for newer firmware versions, which causes device firmware hang - device stops responding to any commands after that. Increase buffer size to 128 which should be enough for any current and future version strings. Link: https://github.com/airspy/host/issues/27 Cc: <stable@vger.kernel.org> # 3.17+ Reported-by: Benjamin Vernoux <bvernoux@gmail.com> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
d6dd645e |
|
03-Nov-2015 |
Junghak Sung <jh1009.sung@samsung.com> |
[media] media: videobuf2: Move timestamp to vb2_buffer Move timestamp from struct vb2_v4l2_buffer to struct vb2_buffer for common use, and change its type to u64 in order to handling y2038 problem. This patch also includes all device drivers' changes related to this restructuring. Signed-off-by: Junghak Sung <jh1009.sung@samsung.com> Signed-off-by: Geunyoung Kim <nenggun.kim@samsung.com> Acked-by: Seung-Woo Kim <sw0312.kim@samsung.com> Acked-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Hans Verkuil <hansverk@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
df9ecb0c |
|
27-Oct-2015 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] vb2: drop v4l2_format argument from queue_setup The queue_setup callback has a void pointer that is just for V4L2 and is the pointer to the v4l2_format struct that was passed to VIDIOC_CREATE_BUFS. The idea was that drivers would use the information from that struct to buffers suitable for the requested format. After the vb2 split series this pointer is now a void pointer, which is ugly, and the reality is that all existing drivers will effectively just look at the sizeimage field of v4l2_format. To make this more generic the queue_setup callback is changed: the void pointer is dropped, instead if the *num_planes argument is 0, then use the current format size, if it is non-zero, then it contains the number of requested planes and the sizes array contains the requested sizes. If either is unsupported, then return -EINVAL, otherwise use the requested size(s). Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
33119e80 |
|
06-Oct-2015 |
Junghak Sung <jh1009.sung@samsung.com> |
[media] media: videobuf2: Change queue_setup argument Replace struct v4l2_format * with void * to make queue_setup() for common use. And then, modify all device drivers related with this change. Signed-off-by: Junghak Sung <jh1009.sung@samsung.com> Signed-off-by: Geunyoung Kim <nenggun.kim@samsung.com> Acked-by: Seung-Woo Kim <sw0312.kim@samsung.com> Acked-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> [hans.verkuil@cisco.com: fix missing const in fimc-lite.c] Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
2d700715 |
|
22-Sep-2015 |
Junghak Sung <jh1009.sung@samsung.com> |
[media] media: videobuf2: Restructure vb2_buffer Remove v4l2 stuff - v4l2_buf, v4l2_plane - from struct vb2_buffer. Add new member variables - bytesused, length, offset, userptr, fd, data_offset - to struct vb2_plane in order to cover all information of v4l2_plane. struct vb2_plane { <snip> unsigned int bytesused; unsigned int length; union { unsigned int offset; unsigned long userptr; int fd; } m; unsigned int data_offset; } Replace v4l2_buf with new member variables - index, type, memory - which are common fields for buffer management. struct vb2_buffer { <snip> unsigned int index; unsigned int type; unsigned int memory; unsigned int num_planes; struct vb2_plane planes[VIDEO_MAX_PLANES]; <snip> }; v4l2 specific fields - flags, field, timestamp, timecode, sequence - are moved to vb2_v4l2_buffer in videobuf2-v4l2.c struct vb2_v4l2_buffer { struct vb2_buffer vb2_buf; __u32 flags; __u32 field; struct timeval timestamp; struct v4l2_timecode timecode; __u32 sequence; }; Signed-off-by: Junghak Sung <jh1009.sung@samsung.com> Signed-off-by: Geunyoung Kim <nenggun.kim@samsung.com> Acked-by: Seung-Woo Kim <sw0312.kim@samsung.com> Acked-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
a73df858 |
|
25-Jun-2015 |
Maninder Singh <maninder1.s@samsung.com> |
[media] usb/airspy: removing unneeded goto This patch removes unneded goto, reported by coccinelle. Signed-off-by: Maninder Singh <maninder1.s@samsung.com> Reviewed-by: Akhilesh Kumar <akhilesh.k@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
b8843c79 |
|
24-Aug-2014 |
Antti Palosaari <crope@iki.fi> |
[media] airspy: enhance sample rate debug calculation precision Sample rate calculation gives a little bit too large results because in real life there was around one milliseconds (~one usb packet) too much data for given time. Calculate time more accurate in order to provide better results. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
8880f2cb |
|
24-Aug-2014 |
Antti Palosaari <crope@iki.fi> |
[media] airspy: remove unneeded spinlock irq flags initialization There is no need to init flags before calling spin_lock_irqsave(). spin_lock_irqsave is a macro which stores value to 'flags'. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
617123ae |
|
24-Aug-2014 |
Antti Palosaari <crope@iki.fi> |
[media] airspy: logging changes Kernel logging system needs pointer to usb interface device in order to print names and bus numbers properly. There was wrong device pointer given and log printings wasn't correct. Remove some debug logging from v4l2 ioctl functions. v4l2 core debug prints almost same information when enabled. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
7057005d |
|
24-Aug-2014 |
Antti Palosaari <crope@iki.fi> |
[media] airspy: coding style issues Fix issues reported by checkpatch.pl. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
6b831d78 |
|
24-Aug-2014 |
Antti Palosaari <crope@iki.fi> |
[media] airspy: fix error handling on start streaming Free all reserved USB buffers and URBs on failure. Return all queued buffers to vb2 with state queued on error case. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
1b303e1a |
|
18-Jul-2014 |
Antti Palosaari <crope@iki.fi> |
[media] airspy: fill FMT buffer size Fill FMT buffer size field in order to inform app which will be used streaming buffer size. Currently driver doesn't allow buffer size value proposed by application. Cc: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
|
#
ac4f90ca |
|
17-Jul-2014 |
Antti Palosaari <crope@iki.fi> |
[media] airspy: print notice to point SDR API is not 100% stable yet Print notice on driver load: "SDR API is still slightly experimental and functionality changes may follow". It is just remind possible used SDR API is very new and surprises may occur. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
|
#
f3e77596 |
|
17-Jul-2014 |
Antti Palosaari <crope@iki.fi> |
[media] airspy: move out of staging into drivers/media/usb Move it out of staging into media like all the other SDR drivers too. There is no good reasons to keep these SDR drivers in staging. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
|