kernel.git/drivers/media/rc, branch linux-4.13.y

media: imon: Fix null-ptr-deref in imon_probe

2017-11-21T09:24:33Z

commit 58fd55e838276a0c13d1dc7c387f90f25063cbf3 upstream. It seems that the return value of usb_ifnum_to_if() can be NULL and needs to be checked. Signed-off-by: Arvind Yadav Tested-by: Andrey Konovalov Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman

media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls"

2017-09-27T12:43:20Z

commit a607f51e5a4c421e2097077db88105402099c528 upstream. This reverts commit 5be2b76a9ca4ea5fd3e221114d62eeb0d78267ca. Only when the lirc device is freed, should we drop our reference to rc_dev, else we the rc_dev is freed to early. If userspace has a file descriptor open during unplug, it goes bang. ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10 Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609 -snip- mutex_lock_nested+0x1b/0x20 ? mutex_lock_nested+0x1b/0x20 rc_close.part.6+0x20/0x60 [rc_core] rc_close+0x13/0x20 [rc_core] lirc_dev_fop_close+0x62/0xd0 [lirc_dev] __fput+0x236/0x410 ? fput+0xb0/0xb0 ? do_raw_spin_trylock+0x110/0x110 ? set_rq_offline.part.70+0xa0/0xa0 ____fput+0xe/0x10 task_work_run+0x116/0x180 ? task_work_cancel+0x170/0x170 ? _raw_spin_unlock+0x27/0x40 ? switch_task_namespaces+0x5f/0x90 do_exit+0x68b/0xe80 Fixes: 5be2b76a9ca4 ("[media] lirc_dev: remove superfluous get/put_device() calls") Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds

2017-07-26T09:46:42Z

Since commit e8f4818895b3 ("[media] lirc: advertise LIRC_CAN_GET_REC_RESOLUTION and improve") lircd uses the ioctl LIRC_GET_REC_RESOLUTION to determine the shortest pulse or space that the hardware can detect. This breaks decoding in lirc because lircd expects the answer in microseconds, but nanoseconds is returned. Cc: # v2.6.36+ Reported-by: Derek Tested-by: Derek Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] rc-core: cleanup rc_register_device pt2

2017-06-13T16:55:01Z

Now that rc_register_device() is reorganised, the dev->initialized hack can be removed. Any driver which calls rc_register_device() must be prepared for the device to go live immediately. The dev->initialized commits that are relevant are commit c73bbaa4ec3e ("[media] rc-core: don't lock device at rc_register_device()") and commit 08aeb7c9a42a ("[media] rc: add locking to fix register/show race"). The original problem was that show_protocols() would access dev->rc_map.* and various other bits which are now properly initialized before device_add() is called. At the same time, remove the bogus "device is being removed" check. Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] rc-core: cleanup rc_register_device

2017-06-13T16:53:50Z

The device core infrastructure is based on the presumption that once a driver calls device_add(), it must be ready to accept userspace interaction. This requires splitting rc_setup_rx_device() into two functions and reorganizing rc_register_device() so that as much work as possible is performed before calling device_add(). Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] sir_ir: annotate hardware config module parameters

2017-06-13T16:49:24Z

This module was merged after commit 5a8fc6a3cebb ("Annotate hardware config module parameters in drivers/media/"), so add add the missing hardware annotations. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] ir-spi: Fix issues with lirc API

2017-06-07T12:40:55Z

The ir-spi driver has 2 issues which prevents it from working with lirc: 1. The ir-spi driver uses 16 bits of SPI data to create one cycle of the waveform. As such our SPI clock needs to be 16x faster than the carrier frequency. The driver is inconsistent in how it currently handles this. It initializes it to the carrier frequency: But the commit message has some example code which initialises it to 16x the carrier frequency: val = 608000; ret = ioctl(fd, LIRC_SET_SEND_CARRIER, &val); To maintain compatibility with lirc, always do the frequency adjustment in the driver. 2. lirc presents pulses in microseconds, but the ir-spi driver treats them as cycles of the carrier. Similar to other lirc drivers, do the conversion with DIV_ROUND_CLOSEST(). Fixes: fe052da49201 ("[media] rc: add support for IR LEDs driven through SPI") Cc: stable@vger.kernel.org Signed-off-by: Anton Blanchard Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] mceusb: drop redundant urb reinitialisation

2017-06-07T12:39:52Z

Drop a since commit e1159cb35712 ("[media] mceusb: remove pointless mce_flush_rx_buffer function") redundant reinitialisation of two urb fields immediately after they have been initialised. Signed-off-by: Johan Hovold Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] mceusb: fix memory leaks in error path

2017-06-07T12:39:19Z

Fix urb and transfer-buffer leaks in an urb-submission error path which may be hit when a device is disconnected. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: stable # 2.6.36 Cc: Jarod Wilson Signed-off-by: Johan Hovold Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

Merge tag 'media/v4.12-2' into patchwork

2017-06-07T10:50:49Z

media fixes for v4.12-rc4 * tag 'media/v4.12-2': (598 commits) [media] rc-core: race condition during ir_raw_event_register() [media] cec: drop MEDIA_CEC_DEBUG [media] cec: rename MEDIA_CEC_NOTIFIER to CEC_NOTIFIER [media] cec: select CEC_CORE instead of depend on it [media] rainshadow-cec: ensure exit_loop is intialized [media] atomisp: don't treat warnings as errors Linux 4.12-rc3 x86/ftrace: Make sure that ftrace trampolines are not RWX x86/mm/ftrace: Do not bug in early boot on irqs_disabled in cpu_flush_range() selftests/ftrace: Add a testcase for many kprobe events kprobes/x86: Fix to set RWX bits correctly before releasing trampoline ftrace: Fix memory leak in ftrace_graph_release() ipv4: add reference counting to metrics net: ethernet: ax88796: don't call free_irq without request_irq first ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets sctp: fix ICMP processing if skb is non-linear net: llc: add lock_sock in llc_ui_bind to avoid a race condition PCI/msi: fix the pci_alloc_irq_vectors_affinity stub blk-mq: Only register debugfs attributes for blk-mq queues x86/timers: Move simple_udelay_calibration past init_hypervisor_platform ... Signed-off-by: Mauro Carvalho Chehab