linux-stable.git/drivers/media/dvb-core, branch linux-3.18.y Linux kernel stable tree media: dvb_frontend: fix locking issues at dvb_frontend_get_event() 2018-07-03T09:18:48+00:00 Mauro Carvalho Chehab mchehab@s-opensource.com 2018-04-05T09:30:52+00:00 ea5c4686be7fc4d6d618529910e06d1b5255fcc2 commit 76d81243a487c09619822ef8e7201a756e58a87d upstream. As warned by smatch: drivers/media/dvb-core/dvb_frontend.c:314 dvb_frontend_get_event() warn: inconsistent returns 'sem:&fepriv->sem'. Locked on: line 288 line 295 line 306 line 314 Unlocked on: line 303 The lock implementation for get event is wrong, as, if an interrupt occurs, down_interruptible() will fail, and the routine will call up() twice when userspace calls the ioctl again. The bad code is there since when Linux migrated to git, in 2005. Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 76d81243a487c09619822ef8e7201a756e58a87d upstream.

As warned by smatch:
	drivers/media/dvb-core/dvb_frontend.c:314 dvb_frontend_get_event() warn: inconsistent returns 'sem:&fepriv->sem'.
	  Locked on:   line 288
	               line 295
	               line 306
	               line 314
	  Unlocked on: line 303

The lock implementation for get event is wrong, as, if an
interrupt occurs, down_interruptible() will fail, and the
routine will call up() twice when userspace calls the ioctl
again.

The bad code is there since when Linux migrated to git, in
2005.

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media: dmxdev: fix error code for invalid ioctls 2018-05-30T05:47:35+00:00 Mauro Carvalho Chehab mchehab@s-opensource.com 2018-02-11T10:44:21+00:00 7b86d81c3aba790638ccedc3817b83a3fa67e439 [ Upstream commit a145f64c6107d3aa5a7cec9f8977d04ac2a896c9 ] Returning -EINVAL when an ioctl is not implemented is a very bad idea, as it is hard to distinguish from other error contitions that an ioctl could lead. Replace it by its right error code: -ENOTTY. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
[ Upstream commit a145f64c6107d3aa5a7cec9f8977d04ac2a896c9 ]

Returning -EINVAL when an ioctl is not implemented is a very
bad idea, as it is hard to distinguish from other error
contitions that an ioctl could lead. Replace it by its
right error code: -ENOTTY.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media/dvb-core: Race condition when writing to CAM 2018-03-24T09:57:32+00:00 Jasmin J jasmin@anw.at 2017-03-18T02:04:20+00:00 eba5af302e5c42711feaa5bd07cf36ee64e15a22 [ Upstream commit e7080d4471d805d921a9ea21b32f911a91e248cb ] It started with a sporadic message in syslog: "CAM tried to send a buffer larger than the ecount size" This message is not the fault itself, but a consecutive fault, after a read error from the CAM. This happens only on several CAMs, several hardware, and of course sporadic. It is a consecutive fault, if the last read from the CAM did fail. I guess this will not happen on all CAMs, but at least it did on mine. There was a write error to the CAM and during the re-initialization procedure, the CAM finished the last read, although it got a RS. The write error to the CAM happened because a race condition between HC write, checking DA and FR. This patch added an additional check for DA(RE), just after checking FR. It is important to read the CAMs status register again, to give the CAM the necessary time for a proper reaction to HC. Please note the description within the source code (patch below). [mchehab@s-opensource.com: make checkpatch happy] Signed-off-by: Jasmin jessich <jasmin@anw.at> Tested-by: Ralph Metzler <rjkm@metzlerbros.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
[ Upstream commit e7080d4471d805d921a9ea21b32f911a91e248cb ]

It started with a sporadic message in syslog: "CAM tried to send a
buffer larger than the ecount size" This message is not the fault
itself, but a consecutive fault, after a read error from the CAM. This
happens only on several CAMs, several hardware, and of course sporadic.

It is a consecutive fault, if the last read from the CAM did fail. I
guess this will not happen on all CAMs, but at least it did on mine.
There was a write error to the CAM and during the re-initialization
procedure, the CAM finished the last read, although it got a RS.

The write error to the CAM happened because a race condition between HC
write, checking DA and FR.

This patch added an additional check for DA(RE), just after checking FR.
It is important to read the CAMs status register again, to give the CAM
the necessary time for a proper reaction to HC. Please note the
description within the source code (patch below).

[mchehab@s-opensource.com: make checkpatch happy]

Signed-off-by: Jasmin jessich <jasmin@anw.at>
Tested-by: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[media] media: dvb_ringbuffer: Add memory barriers 2016-08-22T16:23:05+00:00 Soeren Moch smoch@web.de 2016-05-11T16:49:11+00:00 5d3e4a33748513a81c22c730865fef30810c5229 [ Upstream commit ca6e6126db5494f18c6c6615060d4d803b528bff ] Implement memory barriers according to Documentation/circular-buffers.txt: - use smp_store_release() to update ringbuffer read/write pointers - use smp_load_acquire() to load write pointer on reader side - use ACCESS_ONCE() to load read pointer on writer side This fixes data stream corruptions observed e.g. on an ARM Cortex-A9 quad core system with different types (PCI, USB) of DVB tuners. Signed-off-by: Soeren Moch <smoch@web.de> Cc: stable@vger.kernel.org # 3.14+ Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> 
[ Upstream commit ca6e6126db5494f18c6c6615060d4d803b528bff ]

Implement memory barriers according to Documentation/circular-buffers.txt:
- use smp_store_release() to update ringbuffer read/write pointers
- use smp_load_acquire() to load write pointer on reader side
- use ACCESS_ONCE() to load read pointer on writer side

This fixes data stream corruptions observed e.g. on an ARM Cortex-A9
quad core system with different types (PCI, USB) of DVB tuners.

Signed-off-by: Soeren Moch <smoch@web.de>
Cc: stable@vger.kernel.org # 3.14+
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
[media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode 2016-02-02T18:53:21+00:00 Malcolm Priestley tvboxspy@gmail.com 2015-08-31T09:13:45+00:00 0e351468a27de5df81b9f4657d8e7dfd6fcbcd5e [ Upstream commit c9d57de6103e343f2d4e04ea8d9e417e10a24da7 ] When in FE_TUNE_MODE_ONESHOT the frontend must report the actual capabilities so user can take appropriate action. With frontends that can't do auto inversion this is done by dvb-core automatically so CAN_INVERSION_AUTO is valid. However, when in FE_TUNE_MODE_ONESHOT this is not true. So only set FE_CAN_INVERSION_AUTO in modes other than FE_TUNE_MODE_ONESHOT Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit c9d57de6103e343f2d4e04ea8d9e417e10a24da7 ]

When in FE_TUNE_MODE_ONESHOT the frontend must report
the actual capabilities so user can take appropriate
action.

With frontends that can't do auto inversion this is done
by dvb-core automatically so CAN_INVERSION_AUTO is valid.

However, when in FE_TUNE_MODE_ONESHOT this is not true.

So only set FE_CAN_INVERSION_AUTO in modes other than
FE_TUNE_MODE_ONESHOT

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
[media] dvb-core: set default properties of ISDB-S 2014-11-03T18:40:09+00:00 Akihiro Tsukada tskd08@gmail.com 2014-10-31T13:19:39+00:00 8e281fafda676df6f554a9074a28439039005418 Signed-off-by: Akihiro Tsukada <tskd08@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> 
Signed-off-by: Akihiro Tsukada <tskd08@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[media] dvb_frontend: Fix __user namespace 2014-09-26T09:47:52+00:00 Mauro Carvalho Chehab mchehab@osg.samsung.com 2014-09-24T13:15:22+00:00 71d1b2bec07c8aec4252111a84699273f50fdc52 As reported by smatch: drivers/media/dvb-core/dvb_frontend.c:1960:45: warning: incorrect type in argument 2 (different address spaces) drivers/media/dvb-core/dvb_frontend.c:1960:45: expected void const [noderef] <asn:1>*from drivers/media/dvb-core/dvb_frontend.c:1960:45: got struct dtv_property *[noderef] <asn:1>props drivers/media/dvb-core/dvb_frontend.c:1992:45: warning: incorrect type in argument 2 (different address spaces) drivers/media/dvb-core/dvb_frontend.c:1992:45: expected void const [noderef] <asn:1>*from drivers/media/dvb-core/dvb_frontend.c:1992:45: got struct dtv_property *[noderef] <asn:1>props drivers/media/dvb-core/dvb_frontend.c:2014:38: warning: incorrect type in argument 1 (different address spaces) drivers/media/dvb-core/dvb_frontend.c:2014:38: expected void [noderef] <asn:1>*to drivers/media/dvb-core/dvb_frontend.c:2014:38: got struct dtv_property *[noderef] <asn:1>props drivers/media/dvb-core/dvb_frontend.c:1946:17: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1947:17: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1951:22: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1951:42: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1954:31: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1960:41: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1960:54: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1965:33: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1978:17: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1979:17: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1983:22: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1983:42: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1986:31: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1992:41: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:1992:54: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:2007:33: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:2014:34: warning: dereference of noderef expression drivers/media/dvb-core/dvb_frontend.c:2014:52: warning: dereference of noderef expression Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> 
As reported by smatch:

drivers/media/dvb-core/dvb_frontend.c:1960:45: warning: incorrect type in argument 2 (different address spaces)
drivers/media/dvb-core/dvb_frontend.c:1960:45:    expected void const [noderef] <asn:1>*from
drivers/media/dvb-core/dvb_frontend.c:1960:45:    got struct dtv_property *[noderef] <asn:1>props
drivers/media/dvb-core/dvb_frontend.c:1992:45: warning: incorrect type in argument 2 (different address spaces)
drivers/media/dvb-core/dvb_frontend.c:1992:45:    expected void const [noderef] <asn:1>*from
drivers/media/dvb-core/dvb_frontend.c:1992:45:    got struct dtv_property *[noderef] <asn:1>props
drivers/media/dvb-core/dvb_frontend.c:2014:38: warning: incorrect type in argument 1 (different address spaces)
drivers/media/dvb-core/dvb_frontend.c:2014:38:    expected void [noderef] <asn:1>*to
drivers/media/dvb-core/dvb_frontend.c:2014:38:    got struct dtv_property *[noderef] <asn:1>props
drivers/media/dvb-core/dvb_frontend.c:1946:17: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1947:17: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1951:22: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1951:42: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1954:31: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1960:41: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1960:54: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1965:33: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1978:17: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1979:17: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1983:22: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1983:42: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1986:31: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1992:41: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:1992:54: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:2007:33: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:2014:34: warning: dereference of noderef expression
drivers/media/dvb-core/dvb_frontend.c:2014:52: warning: dereference of noderef expression

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[media] af9035: Add support for IT930x USB bridge 2014-09-24T00:49:42+00:00 Olli Salonen olli.salonen@iki.fi 2014-09-21T10:53:19+00:00 5b5560842a7ee002d208a20866f88fafd63198eb Add support for IT930x USB bridge and IT9303 reference design. It is a DVB-T/T2/C tuner with the following components: - IT9303 USB bridge - Si2168-B40 demodulator - Si2147-A30 tuner The IT9303 requires firmware that can be downloaded here: http://trsqr.net/olli/linux/firmwares/it930x/ The Si2168-B40 requires firmware, but the one that is used by PCTV 292e can be used. http://palosaari.fi/linux/v4l-dvb/firmware/Si2168/Si2168-B40/ The Si2147-A30 tuner does not require firmware loading. Signed-off-by: Olli Salonen <olli.salonen@iki.fi> Reviewed-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> 
Add support for IT930x USB bridge and IT9303 reference design.

It is a DVB-T/T2/C tuner with the following components:
- IT9303 USB bridge
- Si2168-B40 demodulator
- Si2147-A30 tuner

The IT9303 requires firmware that can be downloaded here:
http://trsqr.net/olli/linux/firmwares/it930x/

The Si2168-B40 requires firmware, but the one that is used by PCTV 292e can be used.
http://palosaari.fi/linux/v4l-dvb/firmware/Si2168/Si2168-B40/

The Si2147-A30 tuner does not require firmware loading.

Signed-off-by: Olli Salonen <olli.salonen@iki.fi>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Merge remote-tracking branch 'linus/master' into patchwork 2014-09-21T19:40:04+00:00 Mauro Carvalho Chehab mchehab@osg.samsung.com 2014-09-21T19:40:04+00:00 3cf0c6bd68915aee3b5827b960e485de201e42c1 There are some patches that depends on media-v3.16-rc6. So, merge back from upstream before applying them. * linus/master: (1123 commits) drm/nouveau: ltc/gf100-: fix cbc issues on certain boards drm/bochs: add missing drm_connector_register call drm/cirrus: add missing drm_connector_register call staging: vt6655: buffer overflow in ioctl USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter USB: EHCI: unlink QHs even after the controller has stopped [SCSI] fix for bidi use after free [SCSI] fix regression that accidentally disabled block-based tcq [SCSI] libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu drm/radeon: Fix typo 'addr' -> 'entry' in rs400_gart_set_page drm/nouveau/runpm: fix module unload drm/radeon/px: fix module unload vgaswitcheroo: add vga_switcheroo_fini_domain_pm_ops drm/radeon: don't reset dma on r6xx-evergreen init drm/radeon: don't reset sdma on CIK init drm/radeon: don't reset dma on NI/SI init drm/radeon/dpm: fix resume on mullins drm/radeon: Disable HDP flush before every CS again for < r600 ... 
There are some patches that depends on media-v3.16-rc6.
So, merge back from upstream before applying them.

* linus/master: (1123 commits)
  drm/nouveau: ltc/gf100-: fix cbc issues on certain boards
  drm/bochs: add missing drm_connector_register call
  drm/cirrus: add missing drm_connector_register call
  staging: vt6655: buffer overflow in ioctl
  USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters
  USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter
  USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter
  USB: EHCI: unlink QHs even after the controller has stopped
  [SCSI] fix for bidi use after free
  [SCSI] fix regression that accidentally disabled block-based tcq
  [SCSI] libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu
  drm/radeon: Fix typo 'addr' -> 'entry' in rs400_gart_set_page
  drm/nouveau/runpm: fix module unload
  drm/radeon/px: fix module unload
  vgaswitcheroo: add vga_switcheroo_fini_domain_pm_ops
  drm/radeon: don't reset dma on r6xx-evergreen init
  drm/radeon: don't reset sdma on CIK init
  drm/radeon: don't reset dma on NI/SI init
  drm/radeon/dpm: fix resume on mullins
  drm/radeon: Disable HDP flush before every CS again for < r600
  ...
[media] ngene: properly handle __user ptr 2014-09-08T13:00:52+00:00 Mauro Carvalho Chehab m.chehab@samsung.com 2014-09-03T23:44:04+00:00 04da2daee383391954b34e7d0fe0281d75447d61 Sparse is complaining about ngene's bad usage of a __user ptr: >> drivers/media/pci/ngene/ngene-dvb.c:62:48: sparse: incorrect type in argument 2 (different address spaces) drivers/media/pci/ngene/ngene-dvb.c:62:48: expected unsigned char const [usertype] *buf drivers/media/pci/ngene/ngene-dvb.c:62:48: got char const [noderef] <asn:1>*buf As this is intercepting a .write() file ops, we can't just memcpy. We need to use copy_from_user. Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> 
Sparse is complaining about ngene's bad usage of a __user ptr:

>> drivers/media/pci/ngene/ngene-dvb.c:62:48: sparse: incorrect type in argument 2 (different address spaces)
   drivers/media/pci/ngene/ngene-dvb.c:62:48:    expected unsigned char const [usertype] *buf
   drivers/media/pci/ngene/ngene-dvb.c:62:48:    got char const [noderef] <asn:1>*buf

As this is intercepting a .write() file ops, we can't just memcpy. We need to use
copy_from_user.

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>