linux-stable.git/drivers/media/dvb-frontends, branch linux-4.1.y Linux kernel stable tree media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart 2018-05-23T01:33:51+00:00 Ron Economos w6rz@comcast.net 2017-12-12T00:51:53+00:00 3500c8e1566ceb401775d81757a141b3b2190cb1 [ Upstream commit 380a6c86457573aa42d27ae11e025eb25941a0b7 ] On faster CPUs a delay is required after the resume command and the restart command. Without the delay, the restart command often returns -EREMOTEIO and the Si2168 does not restart. Note that this patch fixes the same issue as https://patchwork.linuxtv.org/patch/44304/, but I believe my udelay() fix addresses the actual problem. Signed-off-by: Ron Economos <w6rz@comcast.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> 
[ Upstream commit 380a6c86457573aa42d27ae11e025eb25941a0b7 ]

On faster CPUs a delay is required after the resume command and the restart command. Without the delay, the restart command often returns -EREMOTEIO and the Si2168 does not restart.

Note that this patch fixes the same issue as https://patchwork.linuxtv.org/patch/44304/, but I believe my udelay() fix addresses the actual problem.

Signed-off-by: Ron Economos <w6rz@comcast.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
[media] tda1004x: only update the frontend properties if locked 2016-02-15T20:45:34+00:00 Mauro Carvalho Chehab mchehab@osg.samsung.com 2016-02-03T19:33:48+00:00 b35f45f2ebf224e06836ced6ccebb05ec700a6a9 [ Upstream commit e8beb02343e7582980c6705816cd957cf4f74c7a ] The tda1004x was updating the properties cache before locking. If the device is not locked, the data at the registers are just random values with no real meaning. This caused the driver to fail with libdvbv5, as such library calls GET_PROPERTY from time to time, in order to return the DVB stats. Tested with a saa7134 card 78: ASUSTeK P7131 Dual, vendor PCI ID: 1043:4862 Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit e8beb02343e7582980c6705816cd957cf4f74c7a ]

The tda1004x was updating the properties cache before locking.
If the device is not locked, the data at the registers are just
random values with no real meaning.

This caused the driver to fail with libdvbv5, as such library
calls GET_PROPERTY from time to time, in order to return the
DVB stats.

Tested with a saa7134 card 78:
	ASUSTeK P7131 Dual, vendor PCI ID: 1043:4862

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
si2168: Bounds check firmware 2015-11-09T22:33:33+00:00 Laura Abbott labbott@fedoraproject.org 2015-09-30T00:10:09+00:00 76d6f9644b3c9029e920b315c7187605e7acf260 commit 47810b4341ac9d2f558894bc5995e6fa2a1298f9 upstream. When reading the firmware and sending commands, the length must be bounds checked to avoid overrunning the size of the command buffer and smashing the stack if the firmware is not in the expected format: si2168 11-0064: found a 'Silicon Labs Si2168-B40' si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw' si2168 11-0064: firmware download failed -95 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f Add the proper check. Reported-by: Stuart Auchterlonie <sauchter@redhat.com> Reviewed-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Laura Abbott <labbott@fedoraproject.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 47810b4341ac9d2f558894bc5995e6fa2a1298f9 upstream.

When reading the firmware and sending commands, the length must
be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the expected
format:

si2168 11-0064: found a 'Silicon Labs Si2168-B40'
si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
si2168 11-0064: firmware download failed -95
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f

Add the proper check.

Reported-by: Stuart Auchterlonie <sauchter@redhat.com>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cx24116: fix a buffer overflow when checking userspace params 2015-08-03T16:29:03+00:00 Mauro Carvalho Chehab mchehab@osg.samsung.com 2015-04-28T21:51:17+00:00 27b76178c496bdb4fc24278ff9e659dc0a5db10f commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows to write up much more values: drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23 Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
s5h1420: fix a buffer overflow when checking userspace params 2015-08-03T16:29:03+00:00 Mauro Carvalho Chehab mchehab@osg.samsung.com 2015-04-28T21:34:40+00:00 22ab213ceae3260d181316f7361419fbe4a5682c commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows to write up to 7 values: drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7 Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up to 7 values:
	drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
af9013: Don't accept invalid bandwidth 2015-08-03T16:29:02+00:00 Mauro Carvalho Chehab mchehab@osg.samsung.com 2015-04-28T22:02:19+00:00 16eeb2182fb8f31a91e831f6f1ead91f373df4f6 commit d7b76c91f471413de9ded837bddeca2164786571 upstream. If userspace sends an invalid bandwidth, it should either return EINVAL or switch to auto mode. This driver will go past an array and program the hardware on a wrong way if this happens. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit d7b76c91f471413de9ded837bddeca2164786571 upstream.

If userspace sends an invalid bandwidth, it should either return
EINVAL or switch to auto mode.

This driver will go past an array and program the hardware on a
wrong way if this happens.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cx24117: fix a buffer overflow when checking userspace params 2015-08-03T16:29:02+00:00 Mauro Carvalho Chehab mchehab@osg.samsung.com 2015-04-28T22:03:59+00:00 ce99975dce28f20447fb72ddc8f8bf482d4f2559 commit 82e3b88b679049f043fe9b03991d6d66fc0a43c8 upstream. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows to write up much more values: drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23 Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 82e3b88b679049f043fe9b03991d6d66fc0a43c8 upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'drm-next-merged' of git://people.freedesktop.org/~airlied/linux into v4l_for_linus 2015-04-21T12:44:55+00:00 Mauro Carvalho Chehab mchehab@osg.samsung.com 2015-04-21T09:33:03+00:00 64131a87f2aae2ed9e05d8227c5b009ca6c50d98 * 'drm-next-merged' of git://people.freedesktop.org/~airlied/linux: (9717 commits) media-bus: Fixup RGB444_1X12, RGB565_1X16, and YUV8_1X24 media bus format hexdump: avoid warning in test function fs: take i_mutex during prepare_binprm for set[ug]id executables smp: Fix error case handling in smp_call_function_*() iommu-common: Fix PARISC compile-time warnings sparc: Make LDC use common iommu poll management functions sparc: Make sparc64 use scalable lib/iommu-common.c functions Break up monolithic iommu table/lock into finer graularity pools and lock sparc: Revert generic IOMMU allocator. tools/power turbostat: correct dumped pkg-cstate-limit value tools/power turbostat: calculate TSC frequency from CPUID(0x15) on SKL tools/power turbostat: correct DRAM RAPL units on recent Xeon processors tools/power turbostat: Initial Skylake support tools/power turbostat: Use $(CURDIR) instead of $(PWD) and add support for O= option in Makefile tools/power turbostat: modprobe msr, if needed tools/power turbostat: dump MSR_TURBO_RATIO_LIMIT2 tools/power turbostat: use new MSR_TURBO_RATIO_LIMIT names Bluetooth: hidp: Fix regression with older userspace and flags validation config: Enable NEED_DMA_MAP_STATE by default when SWIOTLB is selected perf/x86/intel/pt: Fix and clean up error handling in pt_event_add() ... That solves several merge conflicts: Documentation/DocBook/media/v4l/subdev-formats.xml Documentation/devicetree/bindings/vendor-prefixes.txt drivers/staging/media/mn88473/mn88473.c include/linux/kconfig.h include/uapi/linux/media-bus-format.h The ones at subdev-formats.xml and media-bus-format.h are not trivial. That's why we opted to merge from DRM. 
* 'drm-next-merged' of git://people.freedesktop.org/~airlied/linux: (9717 commits)
  media-bus: Fixup RGB444_1X12, RGB565_1X16, and YUV8_1X24 media bus format
  hexdump: avoid warning in test function
  fs: take i_mutex during prepare_binprm for set[ug]id executables
  smp: Fix error case handling in smp_call_function_*()
  iommu-common: Fix PARISC compile-time warnings
  sparc: Make LDC use common iommu poll management functions
  sparc: Make sparc64 use scalable lib/iommu-common.c functions
  Break up monolithic iommu table/lock into finer graularity pools and lock
  sparc: Revert generic IOMMU allocator.
  tools/power turbostat: correct dumped pkg-cstate-limit value
  tools/power turbostat: calculate TSC frequency from CPUID(0x15) on SKL
  tools/power turbostat: correct DRAM RAPL units on recent Xeon processors
  tools/power turbostat: Initial Skylake support
  tools/power turbostat: Use $(CURDIR) instead of $(PWD) and add support for O= option in Makefile
  tools/power turbostat: modprobe msr, if needed
  tools/power turbostat: dump MSR_TURBO_RATIO_LIMIT2
  tools/power turbostat: use new MSR_TURBO_RATIO_LIMIT names
  Bluetooth: hidp: Fix regression with older userspace and flags validation
  config: Enable NEED_DMA_MAP_STATE by default when SWIOTLB is selected
  perf/x86/intel/pt: Fix and clean up error handling in pt_event_add()
  ...

That solves several merge conflicts:
	Documentation/DocBook/media/v4l/subdev-formats.xml
	Documentation/devicetree/bindings/vendor-prefixes.txt
	drivers/staging/media/mn88473/mn88473.c
	include/linux/kconfig.h
	include/uapi/linux/media-bus-format.h

The ones at subdev-formats.xml and media-bus-format.h are not trivial.
That's why we opted to merge from DRM.
Merge branch 'patchwork' into v4l_for_linus 2015-04-21T09:12:35+00:00 Mauro Carvalho Chehab mchehab@osg.samsung.com 2015-04-21T09:12:35+00:00 676ee36be04985062522804c2de04f0764212be6 * patchwork: (404 commits) [media] uvcvideo: add support for VIDIOC_QUERY_EXT_CTRL [media] uvcvideo: fix cropcap v4l2-compliance failure [media] media: omap3isp: remove unused clkdev [media] coda: Add tracing support [media] coda: drop dma_sync_single_for_device in coda_bitstream_queue [media] coda: fix fill bitstream errors in nonstreaming case [media] coda: call SEQ_END when the first queue is stopped [media] coda: fail to start streaming if userspace set invalid formats [media] coda: remove duplicate error messages for buffer allocations [media] coda: move parameter buffer in together with context buffer allocation [media] coda: allocate bitstream buffer from REQBUFS, size depends on the format [media] coda: allocate per-context buffers from REQBUFS [media] coda: use strlcpy instead of snprintf [media] coda: bitstream payload is unsigned [media] coda: fix double call to debugfs_remove [media] coda: check kasprintf return value in coda_open [media] coda: bitrate can only be set in kbps steps [media] v4l2-mem2mem: no need to initialize b in v4l2_m2m_next_buf and v4l2_m2m_buf_remove [media] s5p-mfc: set allow_zero_bytesused flag for vb2_queue_init [media] coda: set allow_zero_bytesused flag for vb2_queue_init ... 
* patchwork: (404 commits)
  [media] uvcvideo: add support for VIDIOC_QUERY_EXT_CTRL
  [media] uvcvideo: fix cropcap v4l2-compliance failure
  [media] media: omap3isp: remove unused clkdev
  [media] coda: Add tracing support
  [media] coda: drop dma_sync_single_for_device in coda_bitstream_queue
  [media] coda: fix fill bitstream errors in nonstreaming case
  [media] coda: call SEQ_END when the first queue is stopped
  [media] coda: fail to start streaming if userspace set invalid formats
  [media] coda: remove duplicate error messages for buffer allocations
  [media] coda: move parameter buffer in together with context buffer allocation
  [media] coda: allocate bitstream buffer from REQBUFS, size depends on the format
  [media] coda: allocate per-context buffers from REQBUFS
  [media] coda: use strlcpy instead of snprintf
  [media] coda: bitstream payload is unsigned
  [media] coda: fix double call to debugfs_remove
  [media] coda: check kasprintf return value in coda_open
  [media] coda: bitrate can only be set in kbps steps
  [media] v4l2-mem2mem: no need to initialize b in v4l2_m2m_next_buf and v4l2_m2m_buf_remove
  [media] s5p-mfc: set allow_zero_bytesused flag for vb2_queue_init
  [media] coda: set allow_zero_bytesused flag for vb2_queue_init
  ...
media: cxd2820r: use DIV_ROUND_CLOSEST_ULL() 2015-04-17T13:03:56+00:00 Javi Merino javi.merino@arm.com 2015-04-16T19:43:54+00:00 512eb720c9892261d68f86ba880a55cdbb74710d Now that the kernel provides DIV_ROUND_CLOSEST_ULL(), drop the internal implementation and use the kernel one. Signed-off-by: Javi Merino <javi.merino@arm.com> Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Acked-by: Antti Palosaari <crope@iki.fi> Reviewed-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
Now that the kernel provides DIV_ROUND_CLOSEST_ULL(), drop the internal
implementation and use the kernel one.

Signed-off-by: Javi Merino <javi.merino@arm.com>
Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Antti Palosaari <crope@iki.fi>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>