linux-stable.git/drivers/media, branch linux-3.8.y

media: [REGRESSION] bt8xx: Fix too large height in cropcap

2013-04-05T16:26:01+00:00

commit 35ccecef6ed48a5602755ddf580c45a026a1dc05 upstream.

Since commit a1fd287780c8e91fed4957b30c757b0c93021162:
"[media] bttv-driver: fix two warnings"
cropcap.defrect.height and cropcap.bounds.height for the PAL entry are 32
resp 30 pixels too large, if a userspace app (ie xawtv) actually tries to use
the full advertised height, the resulting image is broken in ways only a
screenshot can describe.
The cause of this is the fix for this warning:
drivers/media/pci/bt8xx/bttv-driver.c:308:3: warning: initialized field overwritten [-Woverride-init]
In this chunk of the commit:
@@ -301,11 +301,10 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                        /* totalwidth */ 1135,
                        /* sqwidth */ 944,
                        /* vdelay */ 0x20,
-                       /* sheight */ 576,
-                       /* videostart0 */ 23)
                /* bt878 (and bt848?) can capture another
                   line below active video. */
-               .cropcap.bounds.height = (576 + 2) + 0x20 - 2,
+                       /* sheight */ (576 + 2) + 0x20 - 2,
+                       /* videostart0 */ 23)
        },{
                .v4l2_id        = V4L2_STD_NTSC_M | V4L2_STD_NTSC_M_KR,
                .name           = "NTSC",
Which replaces the overriding of cropcap.bounds.height initialization outside
of the CROPCAP macro (which also initializes it), with passing a
different sheight value to the CROPCAP macro.
There are 2 problems with this warning fix:
1) The sheight value is used twice in the CROPCAP macro, and the old code
   only changed one resulting value.
2) The old code increased the .cropcap.bounds.height value (and did not
   touch the .cropcap.defrect.height value at all) by 2, where as the fixed
   code increases it by 32, as the fixed code passes (576 + 2) + 0x20 - 2
   to the CROPCAP macro, but the + 0x20 - 2 is already done by the macro so
   now is done twice for .cropcap.bounds.height, and also is applied to
   .cropcap.defrect.height where it should not be applied at all.
This patch fixes this by adding an extraheight parameter to the CROPCAP entry
and using it for the PAL entry.

Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: rc: unlock on error in show_protocols()

2013-03-03T22:03:36+00:00

commit 30ebc5e44d057a1619ad63fe32c8c1670c37c4b8 upstream.

We recently introduced a new return -ENODEV in this function but we need
to unlock before returning.

[mchehab@redhat.com: found two patches with the same fix. Merged SOB's/acks into one patch]
Acked-by: Herton R. Krzesinski 
Signed-off-by: Dan Carpenter 
Signed-off-by: Douglas Bagnall 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: omap_vout: find_vma() needs ->mmap_sem held

2013-03-03T22:03:36+00:00

commit 55ee64b30a38d688232e5eb2860467dddc493573 upstream.

Walking rbtree while it's modified is a Bad Idea(tm); besides,
the result of find_vma() can be freed just as it's getting returned
to caller.  Fortunately, it's easy to fix - just take ->mmap_sem a bit
earlier (and don't bother with find_vma() at all if virtp >= PAGE_OFFSET -
in that case we don't even look at its result).

While we are at it, what prevents VIDIOC_PREPARE_BUF calling
v4l_prepare_buf() -> (e.g) vb2_ioctl_prepare_buf() -> vb2_prepare_buf() ->
__buf_prepare() -> __qbuf_userptr() -> vb2_vmalloc_get_userptr() -> find_vma(),
AFAICS without having taken ->mmap_sem anywhere in process?  The code flow
is bloody convoluted and depends on a bunch of things done by initialization,
so I certainly might've missed something...

Signed-off-by: Al Viro 
Cc: Sakari Ailus 
Cc: Laurent Pinchart 
Cc: Archit Taneja 
Cc: Prabhakar Lad 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: v4l: Reset subdev v4l2_dev field to NULL if registration fails

2013-03-03T22:03:36+00:00

commit 317efce991620adc589b3005b9baed433dcb2a56 upstream.

When subdev registration fails the subdev v4l2_dev field is left to a
non-NULL value. Later calls to v4l2_device_unregister_subdev() will
consider the subdev as registered and will module_put() the subdev
module without any matching module_get().
Fix this by setting the subdev v4l2_dev field to NULL in
v4l2_device_register_subdev() when the function fails.

Signed-off-by: Laurent Pinchart 
Acked-by: Sylwester Nawrocki 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: cx18/ivtv: fix regression: remove __init from a non-init function

2013-03-03T22:03:36+00:00

commit cfb046cb800ba306b211fbbe4ac633486e11055f upstream.

Commits 5e6e81b2890db3969527772a8350825a85c22d5c (cx18) and
2aebbf6737212265b917ed27c875c59d3037110a (ivtv) added an __init
annotation to the cx18-alsa-load and ivtv-alsa-load functions. However,
these functions are called *after* initialization by the main cx18/ivtv
driver. By that time the memory containing those functions is already
freed and your machine goes BOOM.

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

Revert "[media] dvb_frontend: return -ENOTTY for unimplement IOCTL"

2013-02-15T20:11:23+00:00

As reported by Klaus Schmidinger:
 "In VDR I use an ioctl() call with FE_READ_UNCORRECTED_BLOCKS on a
  device (using stb0899).  After this call I check 'errno' for
  EOPNOTSUPP to determine whether this device supports this call.  This
  used to work just fine, until a few months ago I noticed that my
  devices using stb0899 didn't display their signal quality in VDR's OSD
  any more.  After further investigation I found that
  ioctl(FE_READ_UNCORRECTED_BLOCKS) no longer returns EOPNOTSUPP, but
  rather ENOTTY.  And since I stop getting the signal quality in case
  any unknown errno value appears, this broke my signal quality query
  function."

While the changes reflect what is there at:

  http://comments.gmane.org/gmane.linux.kernel/1235728

it does cause regression on userspace.  So, revert it to stop the
damage.

This reverts commit 177ffe506cf8 ("[media] dvb_frontend: return -ENOTTY
for unimplement IOCTL").

Reported-by: Klaus Schmidinger 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Linus Torvalds

Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2013-02-05T21:36:12+00:00

Pull media fixes from Mauro Carvalho Chehab:
 "For a regression fix on a few radio drivers that were preventing radio
  TX to work on those devices"

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] radio: set vfl_dir correctly to fix modulator regression

[media] radio: set vfl_dir correctly to fix modulator regression

2013-01-24T20:54:14+00:00

The vfl_dir field should be set to indicate whether a device can receive
data, output data or can do both. This is used to let the v4l core know
which ioctls should be accepted and which can be refused.
Unfortunately, when this field was added the radio modulator drivers were
not updated: radio modulators transmit and so vfl_dir should be set to
VFL_DIR_TX (or VFL_DIR_M2M in the special case of wl128x).
Because of this omission it is not possible to call g/s_modulator for these
drivers, which effectively renders them useless.
This patch sets the correct vfl_dir value for these drivers, correcting
this bug.
Thanks to Paul Grinberg for bringing this to my attention.

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

Merge tag 'fixes-for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2013-01-24T20:42:50+00:00

Pull ARM SoC fixes from Olof Johansson:
 "Here's a long-pending fixes pull request for arm-soc (I didn't send
  one in the -rc4 cycle).

  The larger deltas are from:

   - A fixup of error paths in the mvsdio driver

   - Header file move for a driver that hadn't been properly converted
     to multiplatform on i.MX, which was causing build failures when
     included

   - Device tree updates for at91 dealing mostly with their new pinctrl
     setup merged in 3.8 and mistakes in those initial configs

  The rest are the normal mix of small fixes all over the place; sunxi,
  omap, imx, mvebu, etc, etc."

* tag 'fixes-for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (40 commits)
  mfd: vexpress-sysreg: Don't skip initialization on probe
  ARM: vexpress: Enable A7 cores in V2P-CA15_A7's Device Tree
  ARM: vexpress: extend the MPIDR range used for pen release check
  ARM: at91/dts: correct comment in at91sam9x5.dtsi for mii
  ARM: at91/at91_dt_defconfig: add at91sam9n12 SoC to DT defconfig
  ARM: at91/at91_dt_defconfig: remove memory specification to cmdline
  ARM: at91/dts: add macb mii pinctrl config for kizbox
  ARM: at91: rm9200: remake the BGA as default version
  ARM: at91: fix gpios on i2c-gpio for RM9200 DT
  ARM: at91/at91sam9x5 DTS: add SCK USART pins
  ARM: at91/at91sam9x5 DTS: correct wrong PIO BANK values on u(s)arts
  ARM: at91/at91-pinctrl documentation: fix typo and add some details
  ARM: kirkwood: fix missing #interrupt-cells property
  mmc: mvsdio: use devm_ API to simplify/correct error paths.
  clk: mvebu/clk-cpu.c: fix memory leakage
  ARM: OMAP2+: omap4-panda: add UART2 muxing for WiLink shared transport
  ARM: OMAP2+: DT node Timer iteration fix
  ARM: OMAP2+: Fix section warning for omap_init_ocp2scp()
  ARM: OMAP2+: fix build break for omapdrm
  ARM: OMAP2: Fix missing omap2xxx_clkt_vps_late_init function calls
  ...

Merge tag 'imx-fixes-rc' of git://git.pengutronix.de/git/imx/linux-2.6 into fixes

2013-01-22T08:22:12+00:00

From Sascha Hauer:

ARM i.MX fixes for -rc.

This contains a single compilation fix for the CODA driver.

* tag 'imx-fixes-rc' of git://git.pengutronix.de/git/imx/linux-2.6:
  [media] coda: Fix build due to iram.h rename