linux-stable.git/drivers/media, branch linux-3.4.y

rc-core: fix remove uevent generation

2016-04-27T10:55:13+00:00

commit a66b0c41ad277ae62a3ae6ac430a71882f899557 upstream.

The input_dev is already gone when the rc device is being unregistered
so checking for its presence only means that no remove uevent will be
generated.

Signed-off-by: David Härdeman 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Zefan Li

media: media-device: fix infoleak in ioctl media_enum_entities()

2014-06-07T23:02:02+00:00

commit e6a623460e5fc960ac3ee9f946d3106233fd28d8 upstream.

This fixes CVE-2014-1739.

Signed-off-by: Salva Peiró 
Acked-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: saa7164: fix return value check in saa7164_initdev()

2014-04-14T13:44:33+00:00

commit 89f4d45b2752df5d222b5f63919ce59e2d8afaf4 upstream.

In case of error, the function kthread_run() returns ERR_PTR()
and never returns NULL. The NULL test in the return value check
should be replaced with IS_ERR().

Signed-off-by: Wei Yongjun 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

media: hdpvr: fix iteration over uninitialized lists in hdpvr_probe()

2014-04-14T13:44:33+00:00

commit 2e923a0527ac439e135b9961e58d3acd876bba10 upstream.

free_buff_list and rec_buff_list are initialized in the middle of hdpvr_probe(),
but if something bad happens before that, error handling code calls hdpvr_delete(),
which contains iteration over the lists (via hdpvr_free_buffers()).
The patch moves the lists initialization to the beginning and by the way fixes
goto label in error handling of registering videodev.
Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

media: hdpvr: register the video node at the end of probe

2014-04-14T13:44:33+00:00

commit 280847b532433ffe7a22795f926327805a127162 upstream.

Video nodes can be used at once after registration, so make sure the full
initialization is done before registering them.

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

media: dmxdev: remove dvb_ringbuffer_flush() on writer side

2014-04-14T13:44:33+00:00

commit 414abbd2cd4c2618895f02ed3a76ec6647281436 upstream.

In dvb_ringbuffer lock-less synchronizationof reader and writer threads is done
with separateread and write pointers. Sincedvb_ringbuffer_flush() modifies the
read pointer, this function must not be called from the writer thread.
This patch removes the dvb_ringbuffer_flush() calls in the dmxdev ringbuffer
write functions, this fixes Oopses "Unable to handle kernel paging request"
I could observe for the call chaindvb_demux_read ->dvb_dmxdev_buffer_read ->
dvb_ringbuffer_read_user -> __copy_to_user (the reader side of the ringbuffer).
The flush calls at the write side are not necessary anyway since ringbuffer_flush
is also called in dvb_dmxdev_buffer_read() when an error condition is set in the
ringbuffer.
This patch should also be applied to stable kernels.

Signed-off-by: Soeren Moch 
Reviewed-by: Sakari Ailus 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

media: omap_vout: find_vma() needs ->mmap_sem held

2014-04-14T13:44:33+00:00

commit 55ee64b30a38d688232e5eb2860467dddc493573 upstream.

Walking rbtree while it's modified is a Bad Idea(tm); besides,
the result of find_vma() can be freed just as it's getting returned
to caller.  Fortunately, it's easy to fix - just take ->mmap_sem a bit
earlier (and don't bother with find_vma() at all if virtp >= PAGE_OFFSET -
in that case we don't even look at its result).

While we are at it, what prevents VIDIOC_PREPARE_BUF calling
v4l_prepare_buf() -> (e.g) vb2_ioctl_prepare_buf() -> vb2_prepare_buf() ->
__buf_prepare() -> __qbuf_userptr() -> vb2_vmalloc_get_userptr() -> find_vma(),
AFAICS without having taken ->mmap_sem anywhere in process?  The code flow
is bloody convoluted and depends on a bunch of things done by initialization,
so I certainly might've missed something...

Signed-off-by: Al Viro 
Cc: Sakari Ailus 
Cc: Laurent Pinchart 
Cc: Archit Taneja 
Cc: Prabhakar Lad 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

media: v4l: Reset subdev v4l2_dev field to NULL if registration fails

2014-04-14T13:44:33+00:00

commit 317efce991620adc589b3005b9baed433dcb2a56 upstream.

When subdev registration fails the subdev v4l2_dev field is left to a
non-NULL value. Later calls to v4l2_device_unregister_subdev() will
consider the subdev as registered and will module_put() the subdev
module without any matching module_get().
Fix this by setting the subdev v4l2_dev field to NULL in
v4l2_device_register_subdev() when the function fails.

Signed-off-by: Laurent Pinchart 
Acked-by: Sylwester Nawrocki 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust context, filename]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

media: gspca_kinect: add Kinect for Windows USB id

2014-04-14T13:44:33+00:00

commit 98fd485795db064d0885150e2c0c7f296d8fe06e upstream.

Add the USB ID for the Kinect for Windows RGB camera so it can be used
with the gspca_kinect driver.

Signed-off-by: Jacob Schloss 
Signed-off-by: Antonio Ospite 
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings 
Cc: Jianguo Wu 
Signed-off-by: Greg Kroah-Hartman

saa7134: Fix unlocked snd_pcm_stop() call

2014-03-11T23:10:06+00:00

commit e6355ad7b1c6f70e2f48ae159f5658b441ccff95 upstream.

snd_pcm_stop() must be called in the PCM substream lock context.

Signed-off-by: Takashi Iwai 
[wml: Backported to 3.4: Adjust filename]
Signed-off-by: Weng Meiling 
Signed-off-by: Greg Kroah-Hartman