kernel.git/drivers/media/radio, branch linux-5.5.y

media: si470x-i2c: add missed operations in remove

2019-11-10T06:28:15Z

The driver misses calling v4l2_ctrl_handler_free and v4l2_device_unregister in remove like what is done in probe failure. Add the calls to fix it. Signed-off-by: Chuhong Yuan Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: radio: wl1273: fix interrupt masking on release

2019-11-05T11:50:34Z

If a process is interrupted while accessing the radio device and the core lock is contended, release() could return early and fail to update the interrupt mask. Note that the return value of the v4l2 release file operation is ignored. Fixes: 87d1a50ce451 ("[media] V4L2: WL1273 FM Radio: TI WL1273 FM radio driver") Cc: stable # 2.6.38 Cc: Matti Aaltonen Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: don't do a 31 bit shift on a signed int

2019-08-26T17:11:10Z

On 32-bits archs, a signed integer has 31 bits plus on extra bit for signal. Due to that, touching the 32th bit with something like: int bar = 1 << 31; has an undefined behavior in C on 32 bit architectures, as it touches the signal bit. This is warned by cppcheck. Instead, force the numbers to be unsigned, in order to solve this issue. Signed-off-by: Mauro Carvalho Chehab

media: use the BIT() macro

2019-08-26T17:08:50Z

As warned by cppcheck: [drivers/media/dvb-frontends/cx24123.c:434]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour [drivers/media/pci/bt8xx/bttv-input.c:87]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour [drivers/media/pci/bt8xx/bttv-input.c:98]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour ... [drivers/media/v4l2-core/v4l2-ioctl.c:1391]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour There are lots of places where we're doing 1 << 31. That's bad, as, depending on the architecture, this has an undefined behavior. The BIT() macro is already prepared to handle this, so, let's just switch all "1 << number" macros by BIT(number) at the header files with has 1 << 31. Reviewed-by: Sylwester Nawrocki # exynos4-is and s3c-camif Reviewed-by: Laurent Pinchart # omap3isp, vsp1, xilinx, wl128x and ipu3 Reviewed-by: Benoit Parrot # am437x and ti-vpe Signed-off-by: Mauro Carvalho Chehab

media: remove include stdarg.h from some drivers

2019-08-26T17:01:44Z

It doesn't make any sense to have gcc's stdarg.h included inside the Linux Kernel. Get rid of those includes. Signed-off-by: Mauro Carvalho Chehab

media: radio/si470x: kill urb on error

2019-08-19T15:08:06Z

In the probe() function radio->int_in_urb was not killed if an error occurred in the probe sequence. It was also missing in the disconnect. This caused this syzbot issue: https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99 Reported-and-tested-by: syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: radio: si470x: Convert to new i2c device probe()

2019-08-13T14:52:08Z

The I2C core framework provides a simplified probe framework from commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new() call-back type"). This driver does not utilise the i2c_device_id table in the probe, so we can easily convert it to utilise the simplified i2c driver registration. Signed-off-by: Kieran Bingham Reviewed-by: Wolfram Sang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: radio: si4713: Convert to new i2c device probe()

2019-08-13T14:51:50Z

media: radio-raremono: change devm_kalloc to kalloc

2019-06-27T11:35:24Z

Change devm_k*alloc to k*alloc to manually allocate memory The manual allocation and freeing of memory is necessary because when the USB radio is disconnected, the memory associated with devm_k*alloc is freed. Meaning if we still have unresolved references to the radio device, then we get use-after-free errors. This patch fixes this by manually allocating memory, and freeing it in the v4l2.release callback that gets called when the last radio device exits. Reported-and-tested-by: syzbot+a4387f5b6b799f6becbf@syzkaller.appspotmail.com Signed-off-by: Luke Nowakowski-Krijger Signed-off-by: Hans Verkuil [hverkuil-cisco@xs4all.nl: cleaned up two small checkpatch.pl warnings] [hverkuil-cisco@xs4all.nl: prefix subject with driver name] Signed-off-by: Mauro Carvalho Chehab

Merge tag 'v5.2-rc4' into media/master

2019-06-11T16:09:28Z

There are some conflicts due to SPDX changes. We also have more patches being merged via media tree touching them. So, let's merge back from upstream and address those. Linux 5.2-rc4 * tag 'v5.2-rc4': (767 commits) Linux 5.2-rc4 MAINTAINERS: Karthikeyan Ramasubramanian is MIA i2c: xiic: Add max_read_len quirk lockref: Limit number of cmpxchg loop retries uaccess: add noop untagged_addr definition x86/insn-eval: Fix use-after-free access to LDT entry kbuild: use more portable 'command -v' for cc-cross-prefix s390/unwind: correct stack switching during unwind block, bfq: add weight symlink to the bfq.weight cgroup parameter cgroup: let a symlink too be created with a cftype file drm/nouveau/secboot/gp10[2467]: support newer FW to fix SEC2 failures on some boards drm/nouveau/secboot: enable loading of versioned LS PMU/SEC2 ACR msgqueue FW drm/nouveau/secboot: split out FW version-specific LS function pointers drm/nouveau/secboot: pass max supported FW version to LS load funcs drm/nouveau/core: support versioned firmware loading drm/nouveau/core: pass subdev into nvkm_firmware_get, rather than device block: free sched's request pool in blk_cleanup_queue pktgen: do not sleep with the thread lock held. net: mvpp2: Use strscpy to handle stat strings net: rds: fix memory leak in rds_ib_flush_mr_pool ... Signed-off-by: Mauro Carvalho Chehab