linux-stable.git/drivers/media/dvb, branch v3.2.91

dvb-usb-firmware: don't do DMA on stack

2017-07-18T17:38:31+00:00

commit 67b0503db9c29b04eadfeede6bebbfe5ddad94ef upstream.

The buffer allocation for the firmware data was changed in
commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
but the same applies for the reset value.

Fixes: 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
Signed-off-by: Stefan Brüns 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

dvb-usb: don't use stack for firmware load

2017-07-18T17:38:31+00:00

commit 43fab9793c1f44e665b4f98035a14942edf03ddc upstream.

As reported by Marc Duponcheel , firmware load on
dvb-usb is using the stack, with is not allowed anymore on default
Kernel configurations:

[ 1025.958836] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in cold state, will try to load a firmware
[ 1025.958853] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[ 1025.958855] dvb-usb: could not stop the USB controller CPU.
[ 1025.958856] dvb-usb: error while transferring firmware (transferred size: -11, block size: 3)
[ 1025.958856] dvb-usb: firmware download failed at 8 with -22
[ 1025.958867] usbcore: registered new interface driver dvb_usb_dtt200u

[    2.789902] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[    2.789905] ------------[ cut here ]------------
[    2.789911] WARNING: CPU: 3 PID: 2196 at drivers/usb/core/hcd.c:1584 usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789912] transfer buffer not dma capable
[    2.789912] Modules linked in: btusb dvb_usb_dtt200u(+) dvb_usb_af9035(+) btrtl btbcm dvb_usb dvb_usb_v2 btintel dvb_core bluetooth rc_core rfkill x86_pkg_temp_thermal intel_powerclamp coretemp crc32_pclmul aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd drm_kms_helper syscopyarea sysfillrect pcspkr i2c_i801 sysimgblt fb_sys_fops drm i2c_smbus i2c_core r8169 lpc_ich mfd_core mii thermal fan rtc_cmos video button acpi_cpufreq processor snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd crc32c_intel ahci libahci libata xhci_pci ehci_pci xhci_hcd ehci_hcd usbcore usb_common dm_mirror dm_region_hash dm_log dm_mod
[    2.789936] CPU: 3 PID: 2196 Comm: systemd-udevd Not tainted 4.9.0-gentoo #1
[    2.789937] Hardware name: ASUS All Series/H81I-PLUS, BIOS 0401 07/23/2013
[    2.789938]  ffffc9000339b690 ffffffff812bd397 ffffc9000339b6e0 0000000000000000
[    2.789939]  ffffc9000339b6d0 ffffffff81055c86 000006300339b6a0 ffff880116c0c000
[    2.789941]  0000000000000000 0000000000000000 0000000000000001 ffff880116c08000
[    2.789942] Call Trace:
[    2.789945]  [] dump_stack+0x4d/0x66
[    2.789947]  [] __warn+0xc6/0xe0
[    2.789948]  [] warn_slowpath_fmt+0x4a/0x50
[    2.789952]  [] usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789954]  [] ? io_schedule_timeout+0xd8/0x110
[    2.789956]  [] usb_hcd_submit_urb+0x9c/0x980 [usbcore]
[    2.789958]  [] ? copy_page_to_iter+0x14f/0x2b0
[    2.789960]  [] ? pagecache_get_page+0x28/0x240
[    2.789962]  [] ? touch_atime+0x20/0xa0
[    2.789964]  [] usb_submit_urb+0x2c4/0x520 [usbcore]
[    2.789967]  [] usb_start_wait_urb+0x5a/0xe0 [usbcore]
[    2.789969]  [] usb_control_msg+0xbc/0xf0 [usbcore]
[    2.789970]  [] usb_cypress_writemem+0x3d/0x40 [dvb_usb]
[    2.789972]  [] usb_cypress_load_firmware+0x4f/0x130 [dvb_usb]
[    2.789973]  [] ? console_unlock+0x2fe/0x5d0
[    2.789974]  [] ? vprintk_emit+0x27c/0x410
[    2.789975]  [] ? vprintk_default+0x1a/0x20
[    2.789976]  [] ? printk+0x43/0x4b
[    2.789977]  [] dvb_usb_download_firmware+0x60/0xd0 [dvb_usb]
[    2.789979]  [] dvb_usb_device_init+0x3d8/0x610 [dvb_usb]
[    2.789981]  [] dtt200u_usb_probe+0x92/0xd0 [dvb_usb_dtt200u]
[    2.789984]  [] usb_probe_interface+0xfc/0x270 [usbcore]
[    2.789985]  [] driver_probe_device+0x215/0x2d0
[    2.789986]  [] __driver_attach+0x96/0xa0
[    2.789987]  [] ? driver_probe_device+0x2d0/0x2d0
[    2.789988]  [] bus_for_each_dev+0x5b/0x90
[    2.789989]  [] driver_attach+0x19/0x20
[    2.789990]  [] bus_add_driver+0x11c/0x220
[    2.789991]  [] driver_register+0x5b/0xd0
[    2.789994]  [] usb_register_driver+0x7c/0x130 [usbcore]
[    2.789994]  [] ? 0xffffffffa06a5000
[    2.789996]  [] dtt200u_usb_driver_init+0x1e/0x20 [dvb_usb_dtt200u]
[    2.789997]  [] do_one_initcall+0x38/0x140
[    2.789998]  [] ? __vunmap+0x7c/0xc0
[    2.789999]  [] ? do_init_module+0x22/0x1d2
[    2.790000]  [] do_init_module+0x5a/0x1d2
[    2.790002]  [] load_module+0x1e11/0x2580
[    2.790003]  [] ? show_taint+0x30/0x30
[    2.790004]  [] ? kernel_read_file+0x100/0x190
[    2.790005]  [] SyS_finit_module+0xba/0xc0
[    2.790007]  [] entry_SYSCALL_64_fastpath+0x13/0x94
[    2.790008] ---[ end trace c78a74e78baec6fc ]---

So, allocate the structure dynamically.

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

media: fix dm1105.c build error

2017-06-05T20:13:45+00:00

commit e3bb3cddd177550d63a3e4909cf1a7782f13414d upstream.

Fix dm1105 build error when CONFIG_I2C_ALGOBIT=m and
CONFIG_DVB_DM1105=y.

drivers/built-in.o: In function `dm1105_probe':
dm1105.c:(.text+0x2836e7): undefined reference to `i2c_bit_add_bus'

Signed-off-by: Randy Dunlap 
Reported-by: kbuild test robot 
Cc: Javier Martinez Canillas 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

siano: make it work again with CONFIG_VMAP_STACK

2017-03-16T02:18:50+00:00

commit f9c85ee67164b37f9296eab3b754e543e4e96a1c upstream.

Reported as a Kaffeine bug:
	https://bugs.kde.org/show_bug.cgi?id=375811

The USB control messages require DMA to work. We cannot pass
a stack-allocated buffer, as it is not warranted that the
stack would be into a DMA enabled area.

On Kernel 4.9, the default is to not accept DMA on stack anymore
on x86 architecture. On other architectures, this has been a
requirement since Kernel 2.2. So, after this patch, this driver
should likely work fine on all archs.

Tested with USB ID 2040:5510: Hauppauge Windham

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2:
 - s/sms_msg_hdr/SmsMsgHdr_ST/
 - Adjust filename, context]
Signed-off-by: Ben Hutchings

dib0700: fix nec repeat handling

2017-02-23T03:51:00+00:00

commit ba13e98f2cebd55a3744c5ffaa08f9dca73bf521 upstream.

When receiving a nec repeat, ensure the correct scancode is repeated
rather than a random value from the stack.  This removes the need for
the bogus uninitialized_var() and also fixes the warnings:

    drivers/media/usb/dvb-usb/dib0700_core.c: In function ‘dib0700_rc_urb_completion’:
    drivers/media/usb/dvb-usb/dib0700_core.c:679: warning: ‘protocol’ may be used uninitialized in this function

[sean addon: So after writing the patch and submitting it, I've bought the
             hardware on ebay. Without this patch you get random scancodes
             on nec repeats, which the patch indeed fixes.]

Signed-off-by: Sean Young 
Tested-by: Sean Young 
Signed-off-by: Arnd Bergmann 
Signed-off-by: Linus Torvalds 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

mb86a20s: fix the locking logic

2017-02-23T03:50:49+00:00

commit dafb65fb98d85d8e78405e82c83e81975e5d5480 upstream.

On this frontend, it takes a while to start output normal
TS data. That only happens on state S9. On S8, the TS output
is enabled, but it is not reliable enough.

However, the zigzag loop is too fast to let it sync.

As, on practical tests, the zigzag software loop doesn't
seem to be helping, but just slowing down the tuning, let's
switch to hardware algorithm, as the tuners used on such
devices are capable of work with frequency drifts without
any help from software.

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

tda1004x: only update the frontend properties if locked

2016-02-27T14:28:46+00:00

commit e8beb02343e7582980c6705816cd957cf4f74c7a upstream.

The tda1004x was updating the properties cache before locking.
If the device is not locked, the data at the registers are just
random values with no real meaning.

This caused the driver to fail with libdvbv5, as such library
calls GET_PROPERTY from time to time, in order to return the
DVB stats.

Tested with a saa7134 card 78:
	ASUSTeK P7131 Dual, vendor PCI ID: 1043:4862

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode

2016-02-13T10:34:03+00:00

commit c9d57de6103e343f2d4e04ea8d9e417e10a24da7 upstream.

When in FE_TUNE_MODE_ONESHOT the frontend must report
the actual capabilities so user can take appropriate
action.

With frontends that can't do auto inversion this is done
by dvb-core automatically so CAN_INVERSION_AUTO is valid.

However, when in FE_TUNE_MODE_ONESHOT this is not true.

So only set FE_CAN_INVERSION_AUTO in modes other than
FE_TUNE_MODE_ONESHOT

Signed-off-by: Malcolm Priestley 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

cx24116: fix a buffer overflow when checking userspace params

2015-08-12T14:33:11+00:00

commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

s5h1420: fix a buffer overflow when checking userspace params

2015-08-12T14:33:11+00:00

commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up to 7 values:
	drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings