linux-stable.git/drivers/media/usb, branch linux-4.1.y

media: usbtv: prevent double free in error case

2018-05-23T01:33:57+00:00

[ Upstream commit 50e7044535537b2a54c7ab798cd34c7f6d900bd2 ]

Quoting the original report:

It looks like there is a double-free vulnerability in Linux usbtv driver
on an error path of usbtv_probe function. When audio registration fails,
usbtv_video_free function ends up freeing usbtv data structure, which
gets freed the second time under usbtv_video_fail label.

usbtv_audio_fail:

        usbtv_video_free(usbtv); =>

           v4l2_device_put(&usbtv->v4l2_dev);

              => v4l2_device_put

                  => kref_put

                      => v4l2_device_release

  => usbtv_release (CALLBACK)

                             => kfree(usbtv) (1st time)

usbtv_video_fail:

        usb_set_intfdata(intf, NULL);

        usb_put_dev(usbtv->udev);

        kfree(usbtv); (2nd time)

So, as we have refcounting, use it

Reported-by: Yavuz, Tuba 
Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: cpia2: Fix a couple off by one bugs

2018-05-23T01:33:46+00:00

[ Upstream commit d5ac225c7d64c9c3ef821239edc035634e594ec9 ]

The cam->buffers[] array has cam->num_frames elements so the > needs to
be changed to >= to avoid going beyond the end of the array.  The
->buffers[] array is allocated in cpia2_allocate_buffers() if you want
to confirm.

Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support")

Signed-off-by: Dan Carpenter 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] hdpvr: hide unused variable

2018-03-04T15:28:32+00:00

[ Upstream commit b97baa3e22e18dac42001e665cf27ad1211bf878 ]

The i2c client pointer is only used when CONFIG_I2C is set, and
otherwise produces a compile-time warning:

drivers/media/usb/hdpvr/hdpvr-core.c: In function 'hdpvr_probe':
drivers/media/usb/hdpvr/hdpvr-core.c:276:21: error: unused variable 'client' [-Werror=unused-variable]

This uses the same #ifdef to hide the variable when the code using
it is hidden.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] em28xx: only use mt9v011 if camera support is enabled

2018-03-04T15:28:32+00:00

[ Upstream commit 190b23b4eb997767afad186bd8c96badceabf39e ]

In randconfig builds that select VIDEO_EM28XX_V4L2 and
MEDIA_SUBDRV_AUTOSELECT, but not MEDIA_CAMERA_SUPPORT, we get
a Kconfig warning:

 warning: (VIDEO_EM28XX_V4L2) selects VIDEO_MT9V011 which has unmet direct dependencies (MEDIA_SUPPORT && I2C && VIDEO_V4L2 && MEDIA_CAMERA_SUPPORT)

This avoids the warning by making that 'select' conditional on
MEDIA_CAMERA_SUPPORT. Alternatively we could mark EM28XX as
'depends on MEDIA_CAMERA_SUPPORT', but it does not seem to
have any real dependency on that itself.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] go7007: add MEDIA_CAMERA_SUPPORT dependency

2018-03-04T15:28:32+00:00

[ Upstream commit fa6317eedd6341f2144ed1097706d8c34f18b6e4 ]

If MEDIA_SUBDRV_AUTOSELECT and VIDEO_GO7007 are both set, we
automatically select VIDEO_OV7640, but that depends on MEDIA_CAMERA_SUPPORT,
so we get a Kconfig warning if that is disabled:

warning: (VIDEO_GO7007) selects VIDEO_OV7640 which has unmet direct dependencies (MEDIA_SUPPORT && I2C && VIDEO_V4L2 && MEDIA_CAMERA_SUPPORT)

This adds another dependency so we don't accidentally select
it when it is unavailable.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] pwc: hide unused label

2018-03-04T15:28:30+00:00

[ Upstream commit 1f6bcd011464cb36059e2562f72baf75f98b732d ]

The pwc driver causes a warning when CONFIG_USB_PWC_INPUT_EVDEV is unset:

drivers/media/usb/pwc/pwc-if.c: In function 'usb_pwc_probe':
drivers/media/usb/pwc/pwc-if.c:1115:1: warning: label 'err_video_unreg' defined but not used [-Wunused-label]

This moves the unused label and code inside another #ifdef to
get rid of the warning.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: cxusb, dib0700: ignore XC2028_I2C_FLUSH

2018-03-04T15:28:21+00:00

[ Upstream commit 9893b905e743ded332575ca04486bd586c0772f7 ]

The XC2028_I2C_FLUSH only needs to be implemented on a few
devices. Others can safely ignore it.

That prevents filling the dmesg with lots of messages like:

	dib0700: stk7700ph_xc3028_callback: unknown command 2, arg 0

Cc: stable@vger.kernel.org
Fixes: 4d37ece757a8 ("[media] tuner/xc2028: Add I2C flush callback")
Reported-by: Enrico Mioso 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner

2018-03-01T03:09:50+00:00

[ Upstream commit 7bf7a7116ed313c601307f7e585419369926ab05 ]

When the tuner was split from m88rs2000 the attach function is in wrong
place.

Move to dm04_lme2510_tuner to trap errors on failure and removing
a call to lme_coldreset.

Prevents driver starting up without any tuner connected.

Fixes to trap for ts2020 fail.
LME2510(C): FE Found M88RS2000
ts2020: probe of 0-0060 failed with error -11
...
LME2510(C): TUN Found RS2000 tuner
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN

Reported-by: Andrey Konovalov 
Signed-off-by: Malcolm Priestley 
Tested-by: Andrey Konovalov 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: dvb-usb-v2: lmedm04: Improve logic checking of warm start

2018-03-01T03:09:50+00:00

[ Upstream commit 3d932ee27e852e4904647f15b64dedca51187ad7 ]

Warm start has no check as whether a genuine device has
connected and proceeds to next execution path.

Check device should read 0x47 at offset of 2 on USB descriptor read
and it is the amount requested of 6 bytes.

Fix for
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access as

Reported-by: Andrey Konovalov 
Signed-off-by: Malcolm Priestley 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: usbtv: add a new usbid

2018-03-01T03:09:47+00:00

[ Upstream commit 04226916d2360f56d57ad00bc48d2d1854d1e0b0 ]

A new usbid of UTV007 is found in a newly bought device.

The usbid is 1f71:3301.

The ID on the chip is:
UTV007
A89029.1
1520L18K1

Both video and audio is tested with the modified usbtv driver.

Signed-off-by: Icenowy Zheng 
Acked-by: Lubomir Rintel 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin