linux-stable.git/drivers/media, branch linux-2.6.20.y

[PATCH] V4L: cx88: Avoid a NULL pointer dereference during mpeg_open()

2007-10-17T19:30:32+00:00

(cherry picked from commit 48200baeab95fd39a7f4c4f3536c7142a64ac335)

[PATCH] V4L: cx88: Avoid a NULL pointer dereference during mpeg_open()

Bug: With a hardware encoder board installed as cx88[1] and a
non-encoder boards installed as cx88[0], an OOPS is generated
during cx8802_get_device() called from mpeg_open().

Signed-off-by: Steven Toth 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman

[PATCH] USB: fix DoS in pwc USB video driver

2007-10-17T19:30:27+00:00

the pwc driver has a disconnect method that waits for user space to
close the device. This opens up an opportunity for a DoS attack,
blocking the USB subsystem and making khubd's task busy wait in
kernel space. This patch shifts freeing resources to close if an opened
device is disconnected.

Signed-off-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

[PATCH] V4L: wm8775/wm8739: Fix memory leak when unloading module

2007-08-25T15:24:04+00:00

State struct was never freed.

(cherry picked from commit 1b2232ab879993fcf5b9391c3febf6ab5d78201e)

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

[PATCH] V4L: Add check for valid control ID to v4l2_ctrl_next

2007-08-25T15:24:03+00:00

If v4l2_ctrl_next is called without the V4L2_CTRL_FLAG_NEXT_CTRL then it
should check whether the passed control ID is valid and return 0 if it
isn't. Otherwise a for-loop over the control IDs will never end.

(cherry picked from commit a46c5fbc6912c4e34cb7ded314249b639dc244a6)

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

[PATCH] saa7134: fix thread shutdown handling

2007-08-15T08:02:34+00:00

This patch changes the test for the thread pid from >= 0 to > 0.

When the saa7134 driver initialization fails after a certain point, it goes
through the complete shutdown process for the driver.  Part of shutting it
down includes tearing down the thread for tv audio.

The test for tearing down the thread tests for >= 0.  Since the dev
structure is kzalloc'd, the test will always be true if we haven't tried to
start the thread yet.  We end up waiting on pid 0 to complete, which will
never happen, so we lock up.

This bug was observed in Novell Bugzilla 284718, when request_irq() failed.

Signed-off-by: Jeff Mahoney 
Acked-by: Mauro Carvalho Chehab 
Signed-off-by: Andrew Morton 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] V4L/DVB (5593): Budget-ci: Fix tuning for TDM 1316 (160..200 MHz)

2007-06-11T18:37:11+00:00

Revert changeset
  http://linuxtv.org/hg/v4l-dvb?cmd=changeset;node=e7c424bbf9aa;style=gitweb

Petri Helin found that this changeset broke tuning:

'Well, after going through the changes that might have had effect on
tuning, I found out the one which had caused this problem. I do not know
the actual reason behind the change, but the changelog says that it
was meant to "Fix TD1316 tuner for DVBC". But at least in my case it
seams to have broken the tuner instead.'

Signed-off-by: Oliver Endriss 
Thanks-to: Petri Helin 
Acked-by: e9hack 
Acked-by: Thomas Kaiser 
Signed-off-by: Mauro Carvalho Chehab 
Acked-by: Michael Krufky 
Signed-off-by: Chris Wright

DVB: pluto2: fix incorrect TSCR register setting

2007-04-13T20:47:02+00:00

DVB: pluto2: fix incorrect TSCR register setting

The ADEF bits in the TSCR register have different meanings in read
and write mode. For this reason ADEF has to be reset on every
read-modify-write operation.

This patch introduces a special write function for this register, which
takes care of it.

Thanks to Holger Magnussen for pointing my nose at this problem.

(cherry picked from commit 1489f90a49f0603a393e1800d729050f6e332bec)

Signed-off-by: Andreas Oberritter 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman

DVB: tda10086: fix DiSEqC message length

2007-04-13T20:47:02+00:00

DVB: tda10086: fix DiSEqC message length

Setting the message length to zero means to send one byte, so you need a
subtraction instead of an addition.

(cherry picked from commit d420cb44693b8370cbf06c3e31b4b5dec66c9f86)

Signed-off-by: Andreas Oberritter 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman

dvb-core: fix several locking related problems

2007-04-06T10:43:16+00:00

dvb-core: fix several locking related problems

Fix several instances of dvb-core functions using mutex_lock_interruptible
and returning -ERESTARTSYS where the calling function will either never
retry or never check the return value.

These cause a race condition with dvb_dmxdev_filter_free and
dvb_dvr_release, both of which are filesystem release functions whose
return value is ignored and will never be retried.  When this happens it
becomes impossible to open dvr0 again (-EBUSY) since it has not been
released properly.

(cherry picked from commit c278850206fd9df0bb62a72ca0b277fe20c5a452)

Signed-off-by: Simon Arlott 
Signed-off-by: Andrew Morton 
Acked-By: Johannes Stezenbach 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman

DVB: isl6421: don't reference freed memory

2007-04-06T10:43:16+00:00

DVB: isl6421: don't reference freed memory

After freeing a block there should be no reference to this block.

(cherry picked from commit 09d4895488d4df5c58b739573846f514ceabc911)

Signed-off-by: Thomas Viehweger 
Signed-off-by: Michael Krufky 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman