linux-stable.git/drivers/media/rc, branch linux-4.1.y

[media] mceusb: sporadic RX truncation corruption fix

2018-05-23T01:36:28+00:00

[ Upstream commit 8e175b22e8640bf3a58e071af54190b909e4a944 ]

Intermittent RX truncation and loss of IR received data. This resulted
in receive stream synchronization errors where driver attempted to
incorrectly parse IR data (eg 0x90 below) as command response.

[ 3969.139898] mceusb 1-1.2:1.0: processed IR data
[ 3969.151315] mceusb 1-1.2:1.0: rx data: 00 90 (length=2)
[ 3969.151321] mceusb 1-1.2:1.0: Unknown command 0x00 0x90
[ 3969.151336] mceusb 1-1.2:1.0: rx data: 98 0a 8d 0a 8e 0a 8e 0a 8e 0a 8e 0a 9a 0a 8e 0a 0b 3a 8e 00 80 41 59 00 00 (length=25)
[ 3969.151341] mceusb 1-1.2:1.0: Raw IR data, 24 pulse/space samples
[ 3969.151348] mceusb 1-1.2:1.0: Storing space with duration 500000

Bug trigger appears to be normal, but heavy, IR receiver use.

Signed-off-by: A Sun 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: rc: check for integer overflow

2017-12-08T23:01:08+00:00

[ Upstream commit 3e45067f94bbd61dec0619b1c32744eb0de480c8 ]

The ioctl LIRC_SET_REC_TIMEOUT would set a timeout of 704ns if called
with a timeout of 4294968us.

Cc: 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: imon: Fix null-ptr-deref in imon_probe

2017-12-07T02:20:08+00:00

[ Upstream commit 58fd55e838276a0c13d1dc7c387f90f25063cbf3 ]

It seems that the return value of usb_ifnum_to_if() can be NULL and
needs to be checked.

Signed-off-by: Arvind Yadav 
Tested-by: Andrey Konovalov 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds

2017-09-10T20:36:00+00:00

[ Upstream commit 9f5039ba440e499d85c29b1ddbc3cbc9dc90e44b ]

Since commit e8f4818895b3 ("[media] lirc: advertise
LIRC_CAN_GET_REC_RESOLUTION and improve") lircd uses the ioctl
LIRC_GET_REC_RESOLUTION to determine the shortest pulse or space that
the hardware can detect. This breaks decoding in lirc because lircd
expects the answer in microseconds, but nanoseconds is returned.

Cc:  # v2.6.36+
Reported-by: Derek 
Tested-by: Derek 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] ir-core: fix gcc-7 warning on bool arithmetic

2017-09-01T18:24:27+00:00

[ Upstream commit bd7e31bbade02bc1e92aa00d5cf2cee2da66838a ]

gcc-7 suggests that an expression using a bitwise not and a bitmask
on a 'bool' variable is better written using boolean logic:

drivers/media/rc/imon.c: In function 'imon_incoming_scancode':
drivers/media/rc/imon.c:1725:22: error: '~' on a boolean expression [-Werror=bool-operation]
    ictx->pad_mouse = ~(ictx->pad_mouse) & 0x1;
                      ^
drivers/media/rc/imon.c:1725:22: note: did you mean to use logical not?

I agree.

Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] mceusb: fix NULL-deref at probe

2017-05-17T19:07:43+00:00

[ Upstream commit 03eb2a557ed552e920a0942b774aaf931596eec1 ]

Make sure to check for the required out endpoint to avoid dereferencing
a NULL-pointer in mce_request_packet should a malicious device lack such
an endpoint. Note that this path is hit during probe.

Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver")

Cc: stable 	# 2.6.36
Signed-off-by: Johan Hovold 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] Fix RC5 decoding with Fintek CIR chipset

2016-08-17T16:58:31+00:00

[ Upstream commit bbdb34c90aeb8b2253eae88029788ebe1d7f2fd4 ]

Fix RC5 decoding with Fintek CIR chipset

Commit e87b540be2dd02552fb9244d50ae8b4e4619a34b tightened up the RC5
decoding by adding a check for trailing silence to ensure a valid RC5
command had been received. Unfortunately the trailer length checked was
10 units and the Fintek CIR device does not want to provide details of a
space longer than 6350us. This meant that RC5 remotes working on a
Fintek setup on 3.16 failed on 3.17 and later. Fix this by shortening
the trailer check to 6 units (allowing for a previous space in the
received remote command).

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=117221

Signed-off-by: Jonathan McDowell 
Cc: stable@vger.kernel.org
Signed-off-by: David Härdeman 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] rc: sunxi-cir: Initialize the spinlock properly

2016-02-01T17:39:47+00:00

[ Upstream commit 768acf46e1320d6c41ed1b7c4952bab41c1cde79 ]

The driver allocates the spinlock but fails to initialize it correctly.
The kernel reports a BUG indicating bad spinlock magic when spinlock
debugging is enabled.

Call spin_lock_init() on it to initialize it correctly.

Fixes: b4e3e59fb59c ("[media] rc: add sunxi-ir driver")

Signed-off-by: Chen-Yu Tsai 
Acked-by: Hans de Goede 
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

rc-core: fix remove uevent generation

2015-09-29T17:26:06+00:00

commit a66b0c41ad277ae62a3ae6ac430a71882f899557 upstream.

The input_dev is already gone when the rc device is being unregistered
so checking for its presence only means that no remove uevent will be
generated.

Signed-off-by: David Härdeman 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'drm-next-merged' of git://people.freedesktop.org/~airlied/linux into v4l_for_linus

2015-04-21T12:44:55+00:00

* 'drm-next-merged' of git://people.freedesktop.org/~airlied/linux: (9717 commits)
  media-bus: Fixup RGB444_1X12, RGB565_1X16, and YUV8_1X24 media bus format
  hexdump: avoid warning in test function
  fs: take i_mutex during prepare_binprm for set[ug]id executables
  smp: Fix error case handling in smp_call_function_*()
  iommu-common: Fix PARISC compile-time warnings
  sparc: Make LDC use common iommu poll management functions
  sparc: Make sparc64 use scalable lib/iommu-common.c functions
  Break up monolithic iommu table/lock into finer graularity pools and lock
  sparc: Revert generic IOMMU allocator.
  tools/power turbostat: correct dumped pkg-cstate-limit value
  tools/power turbostat: calculate TSC frequency from CPUID(0x15) on SKL
  tools/power turbostat: correct DRAM RAPL units on recent Xeon processors
  tools/power turbostat: Initial Skylake support
  tools/power turbostat: Use $(CURDIR) instead of $(PWD) and add support for O= option in Makefile
  tools/power turbostat: modprobe msr, if needed
  tools/power turbostat: dump MSR_TURBO_RATIO_LIMIT2
  tools/power turbostat: use new MSR_TURBO_RATIO_LIMIT names
  Bluetooth: hidp: Fix regression with older userspace and flags validation
  config: Enable NEED_DMA_MAP_STATE by default when SWIOTLB is selected
  perf/x86/intel/pt: Fix and clean up error handling in pt_event_add()
  ...

That solves several merge conflicts:
	Documentation/DocBook/media/v4l/subdev-formats.xml
	Documentation/devicetree/bindings/vendor-prefixes.txt
	drivers/staging/media/mn88473/mn88473.c
	include/linux/kconfig.h
	include/uapi/linux/media-bus-format.h

The ones at subdev-formats.xml and media-bus-format.h are not trivial.
That's why we opted to merge from DRM.