#
935ae6f8 |
|
03-Aug-2023 |
Hans Verkuil <hverkuil-cisco@xs4all.nl> |
media: usb: pvrusb2: fix inconsistent indenting This resolves a new smatch warning; drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3293 pvr2_hdw_get_tuner_status() warn: inconsistent indenting Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
|
#
292a089d |
|
20-Dec-2022 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
treewide: Convert del_timer*() to timer_shutdown*() Due to several bugs caused by timers being re-armed after they are shutdown and just before they are freed, a new state of timers was added called "shutdown". After a timer is set to this state, then it can no longer be re-armed. The following script was run to find all the trivial locations where del_timer() or del_timer_sync() is called in the same function that the object holding the timer is freed. It also ignores any locations where the timer->function is modified between the del_timer*() and the free(), as that is not considered a "trivial" case. This was created by using a coccinelle script and the following commands: $ cat timer.cocci @@ expression ptr, slab; identifier timer, rfield; @@ ( - del_timer(&ptr->timer); + timer_shutdown(&ptr->timer); | - del_timer_sync(&ptr->timer); + timer_shutdown_sync(&ptr->timer); ) ... when strict when != ptr->timer ( kfree_rcu(ptr, rfield); | kmem_cache_free(slab, ptr); | kfree(ptr); ) $ spatch timer.cocci . > /tmp/t.patch $ patch -p1 < /tmp/t.patch Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/ Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ] Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ] Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
#
b813aa3d |
|
23-Jun-2022 |
Jiang Jian <jiangjian@cdjrlc.com> |
media: pvrusb2: drop unexpected word 'a' in comments there is an unexpected word 'a' in the comments that need to be dropped file - drivers/media/usb/pvrusb2/pvrusb2-hdw.c line - 5044 But now it's a a chicken and egg problem...) */ changed to: But now it's a chicken and egg problem...) */ Signed-off-by: Jiang Jian <jiangjian@cdjrlc.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
#
945a9a8e |
|
09-Jun-2022 |
Dongliang Mu <mudongliangabcd@gmail.com> |
media: pvrusb2: fix memory leak in pvr_probe The error handling code in pvr2_hdw_create forgets to unregister the v4l2 device. When pvr2_hdw_create returns back to pvr2_context_create, it calls pvr2_context_destroy to destroy context, but mp->hdw is NULL, which leads to that pvr2_hdw_destroy directly returns. Fix this by adding v4l2_device_unregister to decrease the refcount of usb interface. Reported-by: syzbot+77b432d57c4791183ed4@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
#
471bec68 |
|
15-Apr-2022 |
Pavel Skripkin <paskripkin@gmail.com> |
media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init Syzbot reported that -1 is used as array index. The problem was in missing validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work. Reported-and-tested-by: syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
#
339df438 |
|
24-Nov-2021 |
Hans Verkuil <hverkuil-cisco@xs4all.nl> |
media: pvrusb2: fix inconsistent indenting Fix these smatch warnings: drivers/media/usb/pvrusb2/pvrusb2-encoder.c:288 pvr2_encoder_cmd() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-hdw.c:1730 pvr2_hdw_set_streaming() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3461 pvr2_hdw_cpufw_set_enabled() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3501 pvr2_hdw_cpufw_get() warn: inconsistent indenting Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
|
#
b82bf9b9 |
|
25-Oct-2021 |
Johan Hovold <johan@kernel.org> |
media: pvrusb2: fix control-message timeouts USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Cc: stable@vger.kernel.org # 2.6.18 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
|
#
f8194e5e |
|
04-May-2021 |
Anirudh Rayabharam <mail@anirudhrb.com> |
media: pvrusb2: fix warning in pvr2_i2c_core_done syzbot has reported the following warning in pvr2_i2c_done: sysfs group 'power' not found for kobject '1-0043' When the device is disconnected (pvr_hdw_disconnect), the i2c adapter is not unregistered along with the USB and v4l2 teardown. As part of the USB device disconnect, the sysfs files of the subdevices are also deleted. So, by the time pvr_i2c_core_done is called by pvr_context_destroy, the sysfs files have been deleted. To fix this, unregister the i2c adapter too in pvr_hdw_disconnect. Make the device deregistration code shared by calling pvr_hdw_disconnect from pvr2_hdw_destroy. Reported-by: syzbot+e74a998ca8f1df9cc332@syzkaller.appspotmail.com Tested-by: syzbot+e74a998ca8f1df9cc332@syzkaller.appspotmail.com Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
|
#
ab0e9fa1 |
|
20-Aug-2020 |
Tong Zhang <ztong0001@gmail.com> |
media: pvrusb2: fix parsing error pvr2_std_str_to_id() returns 0 on failure and 1 on success, however the caller is checking failure case using <0 Acked-by: Mike Isely <isely@pobox.com> Co-developed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Tong Zhang <ztong0001@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
|
#
0fb68ce0 |
|
26-Aug-2019 |
Yizhuo <yzhai003@ucr.edu> |
media: pvrusb2: qctrl.flag will be uninitlaized if cx2341x_ctrl_query() returns error code Inside function ctrl_cx2341x_getv4lflags(), qctrl.flag will be uninitlaized if cx2341x_ctrl_query() returns -EINVAL. However, it will be used in the later if statement, which is potentially unsafe. Signed-off-by: Yizhuo <yzhai003@ucr.edu> Acked-by: Mike Isely <isely@pobox.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
95c52069 |
|
22-Aug-2019 |
Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
media: don't do a 31 bit shift on a signed int On 32-bits archs, a signed integer has 31 bits plus on extra bit for signal. Due to that, touching the 32th bit with something like: int bar = 1 << 31; has an undefined behavior in C on 32 bit architectures, as it touches the signal bit. This is warned by cppcheck. Instead, force the numbers to be unsigned, in order to solve this issue. Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
5db8a692 |
|
27-Jun-2019 |
Fuqian Huang <huangfq.daxian@gmail.com> |
media: pvrusb2: use kzalloc instead of kmalloc and memset Replace kmalloc followed by a memset with kzalloc. Signed-off-by: Fuqian Huang <huangfq.daxian@gmail.com> Acked-by: Mike Isely <isely@pobox.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil-cisco@xs4all.nl: add pvrusb2: prefix in Subject] [hverkuil-cisco@xs4all.nl: fix checkpatch whitespace warnings] Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
2504ba9f |
|
02-Jun-2019 |
Thomas Gleixner <tglx@linutronix.de> |
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 235 Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 53 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Reviewed-by: Alexios Zavras <alexios.zavras@intel.com> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190602204653.904365654@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
dd60bf43 |
|
05-Jun-2019 |
Brad Love <brad@nextdimension.cc> |
media: pvrusb2: Add Hauppauge HVR1955/1975 devices Includes support to identify and use two Hauppauge device. - LGDT3306a ATSC/QAM demod - si2177 tuner - cx25840 decoder for analog tv/composite/s-video/audio HVR-1975 dual-frontend: - LGDT3306a ATSC/QAM demod - si2168 DVB-C/T/T2 demod - si2177 tuner - cx25840 decoder for analog tv/composite/s-video/audio Signed-off-by: Brad Love <brad@nextdimension.cc> Reviewed-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
1753c7c4 |
|
01-May-2019 |
Andrey Konovalov <andreyknvl@google.com> |
media: pvrusb2: use a different format for warnings When the pvrusb2 driver detects that there's something wrong with the device, it prints a warning message. Right now those message are printed in two different formats: 1. ***WARNING*** message here 2. WARNING: message here There's an issue with the second format. Syzkaller recognizes it as a message produced by a WARN_ON(), which is used to indicate a bug in the kernel. However pvrusb2 prints those warnings to indicate an issue with the device, not the bug in the kernel. This patch changes the pvrusb2 driver to consistently use the first warning message format. This will unblock syzkaller testing of this driver. Reported-by: syzbot+af8f8d2ac0d39b0ed3a0@syzkaller.appspotmail.com Reported-by: syzbot+170a86bf206dd2c6217e@syzkaller.appspotmail.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
c1ced46c |
|
08-Apr-2019 |
Dan Carpenter <dan.carpenter@oracle.com> |
media: pvrusb2: Prevent a buffer overflow The ctrl_check_input() function is called from pvr2_ctrl_range_check(). It's supposed to validate user supplied input and return true or false depending on whether the input is valid or not. The problem is that negative shifts or shifts greater than 31 are undefined in C. In practice with GCC they result in shift wrapping so this function returns true for some inputs which are not valid and this could result in a buffer overflow: drivers/media/usb/pvrusb2/pvrusb2-ctrl.c:205 pvr2_ctrl_get_valname() warn: uncapped user index 'names[val]' The cptr->hdw->input_allowed_mask mask is configured in pvr2_hdw_create() and the highest valid bit is BIT(4). Fixes: 7fb20fa38caa ("V4L/DVB (7299): pvrusb2: Improve logic which handles input choice availability") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
85709cbf |
|
10-Sep-2018 |
Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
media: replace strncpy() by strscpy() The strncpy() function is being deprecated upstream. Replace it by the safer strscpy(). While here, replace a few occurences of strlcpy() that were recently added to also use strscpy(). Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
87c9f197 |
|
29-Nov-2018 |
Colin Ian King <colin.king@canonical.com> |
media: pvrusb2: fix spelling mistake "statuss" -> "status" There is a spelling mistake in a pvr2_trace trace message, fix it. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
8f845c63 |
|
08-Oct-2018 |
Dafna Hirschfeld <dafna3@gmail.com> |
media: pvrusb2: replace `printk` with `pr_*` Replace calls to `printk` with the appropriate `pr_*` macro. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
|
#
6396bb22 |
|
12-Jun-2018 |
Kees Cook <keescook@chromium.org> |
treewide: kzalloc() -> kcalloc() The kzalloc() function has a 2-factor argument form, kcalloc(). This patch replaces cases of: kzalloc(a * b, gfp) with: kcalloc(a * b, gfp) as well as handling cases of: kzalloc(a * b * c, gfp) with: kzalloc(array3_size(a, b, c), gfp) as it's slightly less ugly than: kzalloc_array(array_size(a, b), c, gfp) This does, however, attempt to ignore constant size factors like: kzalloc(4 * 1024, gfp) though any constants defined via macros get caught up in the conversion. Any factors with a sizeof() of "unsigned char", "char", and "u8" were dropped, since they're redundant. The Coccinelle script used for this was: // Fix redundant parens around sizeof(). @@ type TYPE; expression THING, E; @@ ( kzalloc( - (sizeof(TYPE)) * E + sizeof(TYPE) * E , ...) | kzalloc( - (sizeof(THING)) * E + sizeof(THING) * E , ...) ) // Drop single-byte sizes and redundant parens. @@ expression COUNT; typedef u8; typedef __u8; @@ ( kzalloc( - sizeof(u8) * (COUNT) + COUNT , ...) | kzalloc( - sizeof(__u8) * (COUNT) + COUNT , ...) | kzalloc( - sizeof(char) * (COUNT) + COUNT , ...) | kzalloc( - sizeof(unsigned char) * (COUNT) + COUNT , ...) | kzalloc( - sizeof(u8) * COUNT + COUNT , ...) | kzalloc( - sizeof(__u8) * COUNT + COUNT , ...) | kzalloc( - sizeof(char) * COUNT + COUNT , ...) | kzalloc( - sizeof(unsigned char) * COUNT + COUNT , ...) ) // 2-factor product with sizeof(type/expression) and identifier or constant. @@ type TYPE; expression THING; identifier COUNT_ID; constant COUNT_CONST; @@ ( - kzalloc + kcalloc ( - sizeof(TYPE) * (COUNT_ID) + COUNT_ID, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * COUNT_ID + COUNT_ID, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * (COUNT_CONST) + COUNT_CONST, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * COUNT_CONST + COUNT_CONST, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * (COUNT_ID) + COUNT_ID, sizeof(THING) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * COUNT_ID + COUNT_ID, sizeof(THING) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * (COUNT_CONST) + COUNT_CONST, sizeof(THING) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * COUNT_CONST + COUNT_CONST, sizeof(THING) , ...) ) // 2-factor product, only identifiers. @@ identifier SIZE, COUNT; @@ - kzalloc + kcalloc ( - SIZE * COUNT + COUNT, SIZE , ...) // 3-factor product with 1 sizeof(type) or sizeof(expression), with // redundant parens removed. @@ expression THING; identifier STRIDE, COUNT; type TYPE; @@ ( kzalloc( - sizeof(TYPE) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kzalloc( - sizeof(TYPE) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kzalloc( - sizeof(TYPE) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kzalloc( - sizeof(TYPE) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kzalloc( - sizeof(THING) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kzalloc( - sizeof(THING) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kzalloc( - sizeof(THING) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kzalloc( - sizeof(THING) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) ) // 3-factor product with 2 sizeof(variable), with redundant parens removed. @@ expression THING1, THING2; identifier COUNT; type TYPE1, TYPE2; @@ ( kzalloc( - sizeof(TYPE1) * sizeof(TYPE2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kzalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kzalloc( - sizeof(THING1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kzalloc( - sizeof(THING1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kzalloc( - sizeof(TYPE1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) | kzalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) ) // 3-factor product, only identifiers, with redundant parens removed. @@ identifier STRIDE, SIZE, COUNT; @@ ( kzalloc( - (COUNT) * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - COUNT * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - COUNT * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - (COUNT) * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - COUNT * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - (COUNT) * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - (COUNT) * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - COUNT * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) ) // Any remaining multi-factor products, first at least 3-factor products, // when they're not all constants... @@ expression E1, E2, E3; constant C1, C2, C3; @@ ( kzalloc(C1 * C2 * C3, ...) | kzalloc( - (E1) * E2 * E3 + array3_size(E1, E2, E3) , ...) | kzalloc( - (E1) * (E2) * E3 + array3_size(E1, E2, E3) , ...) | kzalloc( - (E1) * (E2) * (E3) + array3_size(E1, E2, E3) , ...) | kzalloc( - E1 * E2 * E3 + array3_size(E1, E2, E3) , ...) ) // And then all remaining 2 factors products when they're not all constants, // keeping sizeof() as the second factor argument. @@ expression THING, E1, E2; type TYPE; constant C1, C2, C3; @@ ( kzalloc(sizeof(THING) * C2, ...) | kzalloc(sizeof(TYPE) * C2, ...) | kzalloc(C1 * C2 * C3, ...) | kzalloc(C1 * C2, ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * (E2) + E2, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * E2 + E2, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * (E2) + E2, sizeof(THING) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * E2 + E2, sizeof(THING) , ...) | - kzalloc + kcalloc ( - (E1) * E2 + E1, E2 , ...) | - kzalloc + kcalloc ( - (E1) * (E2) + E1, E2 , ...) | - kzalloc + kcalloc ( - E1 * E2 + E1, E2 , ...) ) Signed-off-by: Kees Cook <keescook@chromium.org>
|
#
510bb915 |
|
27-Dec-2017 |
Julia Lawall <Julia.Lawall@lip6.fr> |
media: pvrusb2: drop unneeded newline pvr2_trace prints a newline at the end of the message string, so the message string does not need to include a newline explicitly. Done using Coccinelle. Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
72c27a68 |
|
02-Nov-2017 |
Andrey Konovalov <andreyknvl@google.com> |
media: pvrusb2: properly check endpoint types As syzkaller detected, pvrusb2 driver submits bulk urb withount checking the the endpoint type is actually blunk. Add a check. usb 1-1: BOGUS urb xfer, pipe 3 != type 1 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 2713 at drivers/usb/core/urb.c:449 usb_submit_urb+0xf8a/0x11d0 Modules linked in: CPU: 1 PID: 2713 Comm: pvrusb2-context Not tainted 4.14.0-rc1-42251-gebb2c2437d80 #210 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88006b7a18c0 task.stack: ffff880069978000 RIP: 0010:usb_submit_urb+0xf8a/0x11d0 drivers/usb/core/urb.c:448 RSP: 0018:ffff88006997f990 EFLAGS: 00010286 RAX: 0000000000000029 RBX: ffff880063661900 RCX: 0000000000000000 RDX: 0000000000000029 RSI: ffffffff86876d60 RDI: ffffed000d32ff24 RBP: ffff88006997fa90 R08: 1ffff1000d32fdca R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1000d32ff39 R13: 0000000000000001 R14: 0000000000000003 R15: ffff880068bbed68 FS: 0000000000000000(0000) GS:ffff88006c600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001032000 CR3: 000000006a0ff000 CR4: 00000000000006f0 Call Trace: pvr2_send_request_ex+0xa57/0x1d80 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3645 pvr2_hdw_check_firmware drivers/media/usb/pvrusb2/pvrusb2-hdw.c:1812 pvr2_hdw_setup_low drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2107 pvr2_hdw_setup drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2250 pvr2_hdw_initialize+0x548/0x3c10 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2327 pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:118 pvr2_context_thread_func+0x361/0x8c0 drivers/media/usb/pvrusb2/pvrusb2-context.c:167 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Code: 48 8b 85 30 ff ff ff 48 8d b8 98 00 00 00 e8 ee 82 89 fe 45 89 e8 44 89 f1 4c 89 fa 48 89 c6 48 c7 c7 40 c0 ea 86 e8 30 1b dc fc <0f> ff e9 9b f7 ff ff e8 aa 95 25 fd e9 80 f7 ff ff e8 50 74 f3 ---[ end trace 6919030503719da6 ]--- Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
8da0edf2 |
|
20-Oct-2017 |
Kees Cook <keescook@chromium.org> |
media: pvrusb2: Convert timers to use timer_setup() In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Cc: Mike Isely <isely@pobox.com> Cc: Mauro Carvalho Chehab <mchehab@kernel.org> Cc: linux-media@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Acked-By: Mike Isely <isely@pobox.com> Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
|
#
bcb63314 |
|
28-Oct-2016 |
Sakari Ailus <sakari.ailus@linux.intel.com> |
[media] media: Drop FSF's postal address from the source code files Drop the FSF's postal address from the source code files that typically contain mostly the license text. Of the 628 removed instances, 578 are outdated. The patch has been created with the following command without manual edits: git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \ drivers/media/ include/media|while read i; do i=$i perl -e ' open(F,"< $ENV{i}"); $a=join("", <F>); $a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m && $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m; close(F); open(F, "> $ENV{i}"); print F $a; close(F);'; done Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
#
96292c89 |
|
18-Oct-2016 |
Mauro Carvalho Chehab <mchehab@kernel.org> |
[media] pvrusb2: don't break long lines Due to the 80-cols restrictions, and latter due to checkpatch warnings, several strings were broken into multiple lines. This is not considered a good practice anymore, as it makes harder to grep for strings at the source code. As we're right now fixing other drivers due to KERN_CONT, we need to be able to identify what printk strings don't end with a "\n". It is a way easier to detect those if we don't break long lines. So, join those continuation lines. The patch was generated via the script below, and manually adjusted if needed. </script> use Text::Tabs; while (<>) { if ($next ne "") { $c=$_; if ($c =~ /^\s+\"(.*)/) { $c2=$1; $next =~ s/\"\n$//; $n = expand($next); $funpos = index($n, '('); $pos = index($c2, '",'); if ($funpos && $pos > 0) { $s1 = substr $c2, 0, $pos + 2; $s2 = ' ' x ($funpos + 1) . substr $c2, $pos + 2; $s2 =~ s/^\s+//; $s2 = ' ' x ($funpos + 1) . $s2 if ($s2 ne ""); print unexpand("$next$s1\n"); print unexpand("$s2\n") if ($s2 ne ""); } else { print "$next$c2\n"; } $next=""; next; } else { print $next; } $next=""; } else { if (m/\"$/) { if (!m/\\n\"$/) { $next=$_; next; } } } print $_; } </script> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
29a3006e |
|
16-Jul-2016 |
Bhaktipriya Shridhar <bhaktipriya96@gmail.com> |
[media] pvrusb2: Remove deprecated create_singlethread_workqueue The workqueue "workqueue" is involved in polling the pvrusb2 hardware (pvr2_hdw). It has a single work item(&hdw->workpoll) and hence doesn't require ordering. Also, it is not being used on a memory reclaim path. Hence, the singlethreaded workqueue has been replaced with the use of system_wq. System workqueues have been able to handle high level of concurrency for a long time now and hence it's not required to have a singlethreaded workqueue just to gain concurrency. Unlike a dedicated per-cpu workqueue created with create_singlethread_workqueue(), system_wq allows multiple work items to overlap executions even on the same CPU; however, a per-cpu workqueue doesn't have any CPU locality or global ordering guarantee unless the target CPU is explicitly specified and thus the increase of local concurrency shouldn't make any difference. Work item has been flushed in pvr2_hdw_destroy to ensure that there are no pending tasks while disconnecting the driver. Signed-off-by: Bhaktipriya Shridhar <bhaktipriya96@gmail.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
b5b97f34 |
|
03-Jul-2016 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] pvrusb2: use v4l2_s_ctrl instead of the s_ctrl op This op is deprecated and should not be used anymore. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
#
62220293 |
|
14-Apr-2016 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] pvrusb2: fix smatch errors These are false positives, but still easy to fix. pvrusb2-hdw.c:3676 pvr2_send_request_ex() error: we previously assumed 'write_data' could be null (see line 3648) pvrusb2-hdw.c:3829 pvr2_send_request_ex() error: we previously assumed 'read_data' could be null (see line 3649) Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
2e158d45 |
|
22-Feb-2016 |
Mauro Carvalho Chehab <mchehab@kernel.org> |
[media] pvrusb2: don't go past buf array That fixes the following smatch warning: drivers/media/usb/pvrusb2/pvrusb2-hdw.c:4909 pvr2_hdw_state_log_state() error: buffer overflow 'buf' 256 <= 4294967294 Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
ebf984bb |
|
09-Apr-2015 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] v4l2: replace s_mbus_fmt by set_fmt in bridge drivers Replace all calls to s_mbus_fmt in bridge drivers by calls to the set_fmt pad op. Remove the old try/s_mbus_fmt video ops since they are now no longer used. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Prabhakar Lad <prabhakar.csengg@gmail.com> Acked-by: Scott Jiang <scott.jiang.linux@gmail.com> Cc: Jonathan Corbet <corbet@lwn.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
f419edd4 |
|
29-Apr-2015 |
Mauro Carvalho Chehab <mchehab@kernel.org> |
[media] pvrusb2: fix inconsistent indenting smatch complains about multiple issues here: drivers/media/usb/pvrusb2/pvrusb2-context.c:402 pvr2_channel_claim_stream() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-ioread.c:240 pvr2_ioread_setup() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-ioread.c:255 pvr2_ioread_set_enabled() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-ioread.c:485 pvr2_ioread_read() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:522 pvr2_stream_set_callback() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:561 pvr2_stream_set_buffer_count() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:640 pvr2_buffer_queue() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:667 pvr2_buffer_set_buffer() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:668 pvr2_buffer_set_buffer() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2614 pvr2_hdw_create() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2740 pvr2_hdw_destroy() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3353 pvr2_hdw_trigger_module_log() warn: inconsistent indenting Let's get rid of those, in order to cleanup as much as possible the smatch error log. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
3edf7eb8 |
|
22-Jan-2015 |
Nicholas Mc Guire <der.herr@hofr.at> |
[media] pvrusb2: use msecs_to_jiffies for conversion This is only an API consolidation and should make things more readable Signed-off-by: Nicholas Mc Guire <der.herr@hofr.at> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
811afabf |
|
10-Jan-2015 |
Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se> |
[media] usb: pvrusb2: pvrusb2-hdw: Remove unused function Remove the function pvr2_hdw_cmd_powerdown() that is not used anywhere. This was partially found by using a static code analysis program called cppcheck. Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
03f23fc5 |
|
26-Dec-2014 |
Julia Lawall <Julia.Lawall@lip6.fr> |
[media] pvrusb2: Use setup_timer Convert a call to init_timer and accompanying intializations of the timer's data and function fields to a call to setup_timer. A simplified version of the semantic match that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression t,f,d; @@ -init_timer(&t); +setup_timer(&t,f,d); -t.data = d; -t.function = f; // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
18cb5ec3 |
|
10-Nov-2014 |
Boris Brezillon <bbrezillon@kernel.org> |
[media] usb: Make use of media_bus_format enum In order to have subsytem agnostic media bus format definitions we've moved media bus definition to include/uapi/linux/media-bus-format.h and prefixed enum values with MEDIA_BUS_FMT instead of V4L2_MBUS_FMT. Reference new definitions in all usb drivers. Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
8774bed9 |
|
28-Apr-2014 |
Laurent Pinchart <laurent.pinchart@ideasonboard.com> |
[media] v4l: subdev: Move [gs]_std operation to video ops The g_std and s_std operations are video-related, move them to the video ops where they belong. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
|
#
45bc3fce |
|
04-Oct-2013 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] pvrusb2: fix sparse warning drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2871:13: warning: symbol 'pvr2_hdw_get_detected_std' was not declared. Should it be static? Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Mike Isely <isely@pobox.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
|
#
a28fbd04 |
|
10-Jun-2013 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] pvrusb2: use v4l2_dev instead of the deprecated parent field Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Mike Isely <isely@pobox.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
#
43aea901 |
|
29-May-2013 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] pvrusb2: drop g/s_register ioctls Register access to subdevices no longer needs bridge support for those ioctls. The v4l2 core handles that these days. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: Mike Isely <isely@isely.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
#
625b3522 |
|
13-May-2013 |
Lad, Prabhakar <prabhakar.csengg@gmail.com> |
[media] media: usb: remove duplicate checks for EPERM in vidioc_g/s_register This patch removes check for EPERM in vidioc_g/s_register as this check is already performed by core. Signed-off-by: Lad, Prabhakar <prabhakar.csengg@gmail.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
#
977ba3b1 |
|
24-Mar-2013 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] v4l2: add const to argument of write-only s_register ioctl This ioctl is defined as IOW, so pass the argument as const. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
#
6c058fb6 |
|
25-Oct-2012 |
Alan Cox <alan@linux.intel.com> |
[media] pvr2: fix minor storage This should have break statements in it. Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Mike Isely <isely@pobox.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
#
0c0d06ca |
|
13-Aug-2012 |
Mauro Carvalho Chehab <mchehab@kernel.org> |
[media] rename most media/video usb drivers to media/usb Rename all USB drivers with their own directory under drivers/media/video into drivers/media/usb and update the building system. Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|