linux-stable.git/drivers/media/rc, branch linux-3.16.y

media: iguanair: fix endpoint sanity check

2020-05-22T20:19:24+00:00

commit 1b257870a78b0a9ce98fdfb052c58542022ffb5b upstream.

Make sure to use the current alternate setting, which need not be the
first one by index, when verifying the endpoint descriptors and
initialising the URBs.

Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: 26ff63137c45 ("[media] Add support for the IguanaWorks USB IR Transceiver")
Fixes: ab1cbdf159be ("media: iguanair: add sanity checks")
Cc: Oliver Neukum 
Signed-off-by: Johan Hovold 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

media: iguanair: add sanity checks

2020-05-22T20:19:23+00:00

commit ab1cbdf159beba7395a13ab70bc71180929ca064 upstream.

The driver needs to check the endpoint types, too, as opposed
to the number of endpoints. This also requires moving the check earlier.

Reported-by: syzbot+01a77b82edaa374068e1@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

ir-core: fix gcc-7 warning on bool arithmetic

2018-11-20T18:06:02+00:00

commit bd7e31bbade02bc1e92aa00d5cf2cee2da66838a upstream.

gcc-7 suggests that an expression using a bitwise not and a bitmask
on a 'bool' variable is better written using boolean logic:

drivers/media/rc/imon.c: In function 'imon_incoming_scancode':
drivers/media/rc/imon.c:1725:22: error: '~' on a boolean expression [-Werror=bool-operation]
    ictx->pad_mouse = ~(ictx->pad_mouse) & 0x1;
                      ^
drivers/media/rc/imon.c:1725:22: note: did you mean to use logical not?

I agree.

Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

media: rc: mce_kbd decoder: fix stuck keys

2018-11-20T18:04:48+00:00

commit 63039c29f7a4ce8a8bd165173840543c0098d7b0 upstream.

The MCE Remote sends a 0 scancode when keys are released. If this is not
received or decoded, then keys can get "stuck"; the keyup event is not
sent since the input_sync() is missing from the timeout handler.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16: s/raw->mce_kbd\.idev/mce_kbd->idev/]
Signed-off-by: Ben Hutchings

media: rc: oops in ir_timer_keyup after device unplug

2018-10-21T07:44:56+00:00

commit 8d4068810d9926250dd2435719a080b889eb44c3 upstream.

If there is IR in the raw kfifo when ir_raw_event_unregister() is called,
then kthread_stop() causes ir_raw_event_thread to be scheduled, decode
some scancodes and re-arm timer_keyup. The timer_keyup then fires when
the rc device is long gone.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16:
 - There's no timer_repeat to move
 - Adjust context]
Signed-off-by: Ben Hutchings

media: rc: check for integer overflow

2018-02-13T18:42:06+00:00

commit 3e45067f94bbd61dec0619b1c32744eb0de480c8 upstream.

The ioctl LIRC_SET_REC_TIMEOUT would set a timeout of 704ns if called
with a timeout of 4294968us.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

media: imon: Fix null-ptr-deref in imon_probe

2017-11-26T13:50:38+00:00

commit 58fd55e838276a0c13d1dc7c387f90f25063cbf3 upstream.

It seems that the return value of usb_ifnum_to_if() can be NULL and
needs to be checked.

Signed-off-by: Arvind Yadav 
Tested-by: Andrey Konovalov 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds

2017-11-11T13:33:08+00:00

commit 9f5039ba440e499d85c29b1ddbc3cbc9dc90e44b upstream.

Since commit e8f4818895b3 ("[media] lirc: advertise
LIRC_CAN_GET_REC_RESOLUTION and improve") lircd uses the ioctl
LIRC_GET_REC_RESOLUTION to determine the shortest pulse or space that
the hardware can detect. This breaks decoding in lirc because lircd
expects the answer in microseconds, but nanoseconds is returned.

Reported-by: Derek 
Tested-by: Derek 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

mceusb: fix memory leaks in error path

2017-10-12T14:27:45+00:00

commit 2d5a6ce71c72d98d4f7948672842e3e8c265a8b7 upstream.

Fix urb and transfer-buffer leaks in an urb-submission error path which
may be hit when a device is disconnected.

Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver")

Cc: Jarod Wilson 
Signed-off-by: Johan Hovold 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16:
 - Add check on urb_type, as async_buf and async_urb aren't always allocated
 - Adjust context]
Signed-off-by: Ben Hutchings

rc-core: race condition during ir_raw_event_register()

2017-09-15T17:29:56+00:00

commit 963761a0b2e85663ee4a5630f72930885a06598a upstream.

A rc device can call ir_raw_event_handle() after rc_allocate_device(),
but before rc_register_device() has completed. This is racey because
rcdev->raw is set before rcdev->raw->thread has a valid value.

Reported-by: kbuild test robot 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16: adjust filename, context, indentation]
Signed-off-by: Ben Hutchings