kernel.git/drivers/media/usb, branch linux-4.13.y

media: dib0700: fix invalid dvb_detach argument

2017-11-21T09:24:33Z

commit eb0c19942288569e0ae492476534d5a485fb8ab4 upstream. dvb_detach(arg) calls symbol_put_addr(arg), where arg should be a pointer to a function. Right now a pointer to state->dib7000p_ops is passed to dvb_detach(), which causes a BUG() in symbol_put_addr() as discovered by syzkaller. Pass state->dib7000p_ops.set_wbd_ref instead. ------------[ cut here ]------------ kernel BUG at kernel/module.c:1081! invalid opcode: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 1151 Comm: kworker/1:1 Tainted: G W 4.14.0-rc1-42251-gebb2c2437d80 #224 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event task: ffff88006a336300 task.stack: ffff88006a7c8000 RIP: 0010:symbol_put_addr+0x54/0x60 kernel/module.c:1083 RSP: 0018:ffff88006a7ce210 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff880062a8d190 RCX: 0000000000000000 RDX: dffffc0000000020 RSI: ffffffff85876d60 RDI: ffff880062a8d190 RBP: ffff88006a7ce218 R08: 1ffff1000d4f9c12 R09: 1ffff1000d4f9ae4 R10: 1ffff1000d4f9bed R11: 0000000000000000 R12: ffff880062a8d180 R13: 00000000ffffffed R14: ffff880062a8d190 R15: ffff88006947c000 FS: 0000000000000000(0000) GS:ffff88006c900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6416532000 CR3: 00000000632f5000 CR4: 00000000000006e0 Call Trace: stk7070p_frontend_attach+0x515/0x610 drivers/media/usb/dvb-usb/dib0700_devices.c:1013 dvb_usb_adapter_frontend_init+0x32b/0x660 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:286 dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:86 dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:162 dvb_usb_device_init+0xf70/0x17f0 drivers/media/usb/dvb-usb/dvb-usb-init.c:277 dib0700_probe+0x171/0x5a0 drivers/media/usb/dvb-usb/dib0700_core.c:886 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Code: ff ff 48 85 c0 74 24 48 89 c7 e8 48 ea ff ff bf 01 00 00 00 e8 de 20 e3 ff 65 8b 05 b7 2f c2 7e 85 c0 75 c9 e8 f9 0b c1 ff eb c2 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 b8 00 00 RIP: symbol_put_addr+0x54/0x60 RSP: ffff88006a7ce210 ---[ end trace b75b357739e7e116 ]--- Signed-off-by: Andrey Konovalov Cc: Ben Hutchings Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

media: uvcvideo: Prevent heap overflow when accessing mapped controls

2017-09-27T12:43:20Z

commit 7e09f7d5c790278ab98e5f2c22307ebe8ad6e8ba upstream. The size of uvc_control_mapping is user controlled leading to a potential heap overflow in the uvc driver. This adds a check to verify the user provided size fits within the bounds of the defined buffer size. Originally-from: Richard Simmons Signed-off-by: Guenter Roeck Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

media: pulse8-cec: persistent_config should be off by default

2017-07-26T09:46:43Z

The persistent_config option is used to make the CEC settings persistent by using the eeprom inside the device to store this information. This was on by default, which caused confusion since this device now behaves differently from other CEC devices which all come up unconfigured. Another reason for doing this now is that I hope a more standard way of selecting persistent configuration will be created in the future. And for that to work all CEC drivers should behave the same and come up unconfigured by default. None of the open source CEC applications are using this CEC framework at the moment so change this behavior before it is too late. Signed-off-by: Hans Verkuil Cc: # for v4.10 and up Signed-off-by: Mauro Carvalho Chehab

media: dvb-usb-v2: lmedm04: remove unnecessary variable in lme2510_stream_restart()

2017-06-24T21:46:05Z

Remove unnecessary variable _ret_ and refactor the code. Addresses-Coverity-ID: 1226934 Signed-off-by: Gustavo A. R. Silva Signed-off-by: Mauro Carvalho Chehab

media: Replace initalized ->initialized

2017-06-24T18:46:24Z

While committing a change on em28xx, I got a warning of a typo there. So, fix it on em28xx and on two other media drivers with the same typo. Signed-off-by: Mauro Carvalho Chehab

media: em28xx: add support for new of Terratec H6

2017-06-24T18:45:28Z

There's a new version of Terratec H6 with uses USB ID 0ccd:10b2. This version is similar to the old one (with is supported via the HTC entry), except that this one has the eeprom on the second bus. On this board, one side of this board is labeled with: dvbc v2.0 The other side with: 94V-0, MO2, RK-4221 with huge digits: 1107 With those patches, the board is properly detected: em28xx 1-1.5:1.0: New device TERRATEC TERRATCE H5 MKII @ 480 Mbps (0ccd:10b2, interface 0, class 0) em28xx 1-1.5:1.0: Audio interface 0 found (Vendor Class) em28xx 1-1.5:1.0: Video interface 0 found: isoc em28xx 1-1.5:1.0: DVB interface 0 found: isoc em28xx 1-1.5:1.0: chip ID is em2884 em28xx eeprom 00000000: 26 00 00 00 02 0b 0f e5 f5 64 01 60 09 e5 f5 64 &........d.`...d em28xx eeprom 00000010: 09 60 03 c2 c6 22 e5 f7 b4 03 13 e5 f6 b4 87 03 .`...".......... em28xx eeprom 00000020: 02 0a b9 e5 f6 b4 93 03 02 09 46 c2 c6 22 c2 c6 ..........F..".. em28xx eeprom 00000030: 22 00 60 00 ef 70 08 85 3d 82 85 3c 83 93 ff ef ".`..p..=..<.... em28xx eeprom 00000040: 60 19 85 3d 82 85 3c 83 e4 93 12 07 a3 12 0a fe `..=..<......... em28xx eeprom 00000050: 05 3d e5 3d 70 02 05 3c 1f 80 e4 22 12 0b 06 02 .=.=p..<...".... em28xx eeprom 00000060: 07 e2 01 00 1a eb 67 95 cd 0c b2 10 f0 13 6b 03 ......g.......k. em28xx eeprom 00000070: 98 22 6a 1c 86 12 27 57 4e 16 29 00 60 00 00 00 ."j...'WN.).`... em28xx eeprom 00000080: 02 00 00 00 5e 00 13 00 f0 10 44 82 82 00 00 00 ....^.....D..... em28xx eeprom 00000090: 5b 81 c0 00 00 00 20 40 20 80 02 20 10 01 00 00 [..... @ .. .... em28xx eeprom 000000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ em28xx eeprom 000000b0: c6 40 00 00 81 00 00 00 00 00 00 00 00 c4 00 00 .@.............. em28xx eeprom 000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 03 ................ em28xx eeprom 000000d0: 31 00 32 00 33 00 34 00 35 00 36 00 37 00 38 00 1.2.3.4.5.6.7.8. em28xx eeprom 000000e0: 39 00 41 00 42 00 43 00 44 00 12 03 54 00 45 00 9.A.B.C.D...T.E. em28xx eeprom 000000f0: 52 00 52 00 41 00 54 00 45 00 43 00 22 03 54 00 R.R.A.T.E.C.".T. em28xx 1-1.5:1.0: eeprom 000100: ... (skipped) em28xx 1-1.5:1.0: EEPROM ID = 26 00 00 00, EEPROM hash = 0xbcd5a8cf em28xx 1-1.5:1.0: EEPROM info: em28xx 1-1.5:1.0: microcode start address = 0x0004, boot configuration = 0x00 em28xx 1-1.5:1.0: I2S audio, 5 sample rates em28xx 1-1.5:1.0: 500mA max power em28xx 1-1.5:1.0: Table at offset 0x27, strings=0x2298, 0x1c6a, 0x1286 em28xx 1-1.5:1.0: Identified as Terratec Cinergy H6 rev. 2 (card=101) em28xx 1-1.5:1.0: Currently, V4L2 is not supported on this model em28xx 1-1.5:1.0: dvb set to isoc mode. usbcore: registered new interface driver em28xx em28xx 1-1.5:1.0: Binding audio extension em28xx 1-1.5:1.0: em28xx-audio.c: Copyright (C) 2006 Markus Rechberger em28xx 1-1.5:1.0: em28xx-audio.c: Copyright (C) 2007-2016 Mauro Carvalho Chehab em28xx 1-1.5:1.0: Endpoint 0x83 high-speed on intf 0 alt 7 interval = 8, size 196 em28xx 1-1.5:1.0: Number of URBs: 1, with 64 packets and 192 size em28xx 1-1.5:1.0: Audio extension successfully initialized em28xx: Registered (Em28xx Audio Extension) extension em28xx 1-1.5:1.0: Binding DVB extension drxk: status = 0x639260d9 drxk: detected a drx-3926k, spin A3, xtal 20.250 MHz drxk: DRXK driver version 0.9.4300 drxk: frontend initialized. tda18271 4-0060: creating new instance tda18271: TDA18271HD/C2 detected @ 4-0060 dvbdev: DVB: registering new adapter (1-1.5:1.0) em28xx 1-1.5:1.0: DVB: registering adapter 0 frontend 0 (DRXK DVB-C DVB-T)... dvbdev: dvb_create_media_entity: media entity 'DRXK DVB-C DVB-T' registered. dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. em28xx 1-1.5:1.0: DVB extension successfully initialized em28xx: Registered (Em28xx dvb Extension) extension em28xx 1-1.5:1.0: Registering input extension rc rc0: 1-1.5:1.0 IR as /devices/platform/soc/3f980000.usb/usb1/1-1/1-1.5/1-1.5:1.0/rc/rc0 Registered IR keymap rc-nec-terratec-cinergy-xs input: 1-1.5:1.0 IR as /devices/platform/soc/3f980000.usb/usb1/1-1/1-1.5/1-1.5:1.0/rc/rc0/input0 em28xx 1-1.5:1.0: Input extension successfully initalized em28xx: Registered (Em28xx Input Extension) extension tda18271: performing RF tracking filter calibration tda18271: RF tracking filter calibration complete Signed-off-by: Mauro Carvalho Chehab

media: em28xx: Ignore errors while reading from eeprom

2017-06-24T18:43:51Z

While testing support for Terratec H6 rev. 2, it was noticed that reading from eeprom there causes a timeout error. Apparently, this is due to the need of properly setting GPIOs. In any case, the driver doesn't really require eeprom reading to succeed, as this is currently used only for debug. So, Ignore such errors. Signed-off-by: Mauro Carvalho Chehab Acked-by: Frank Schäfer Signed-off-by: Mauro Carvalho Chehab

media: dib0700: fix error handling in dib0700_i2c_xfer_legacy()

2017-06-24T18:41:57Z

Mostly this adds some unlocks to error paths. But, if you see where there were "break;" statements before, I changed those paths to return error codes instead of returning success. Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab

media: dib0700: fix locking in dib0700_i2c_xfer_new()

2017-06-24T18:38:37Z

This patch mostly adds unlocks to error paths. But one additional small change is that I made the first "break;" a "goto unlock;" which means that now we return failure instead of success on that path. Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab

media: rainshadow-cec: avoid -Wmaybe-uninitialized warning again

2017-06-24T12:37:28Z

Back in April I created a patch to address a false-positive warning: drivers/media/usb/rainshadow-cec/rainshadow-cec.c: In function 'rain_irq_work_handler': drivers/media/usb/rainshadow-cec/rainshadow-cec.c:171:31: error: 'data' may be used uninitialized in this function [-Werror=maybe-uninitialized] My patch was totally wrong and introduced a real bug, and Colin Ian King thankfully noticed it now and fixed my mistake. Unfortunately, fixing the actual uninitialized data in this case brought back the original bogus warning. This is a new version of the patch, which simplifies the code to the point where gcc notices the behavior is correct. Fixes: ca33784ba494 ("[media] rainshadow-cec: ensure exit_loop is intialized") Fixes: ea6a69defd3311 ("[media] rainshadow-cec: avoid -Wmaybe-uninitialized warning") Cc: Colin Ian King Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab