linux-stable.git/drivers/media, branch v3.14.8 Linux kernel stable tree rtl28xxu: add [1b80:d3af] Sveon STV27 2014-06-16T20:40:33+00:00 Alessandro Miceli angelofsky1980@gmail.com 2014-05-04T10:50:31+00:00 4395894f1e3831a9379bdf3d9fd4f64c6f97da9d commit 74a86272f05c3dae40f2d7b17ff09a0608cf3304 upstream. Added support for Sveon STV27 device (rtl2832u + FC0013 tuner) Signed-off-by: Alessandro Miceli <angelofsky1980@gmail.com> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 74a86272f05c3dae40f2d7b17ff09a0608cf3304 upstream.

Added support for Sveon STV27 device (rtl2832u + FC0013 tuner)

Signed-off-by: Alessandro Miceli <angelofsky1980@gmail.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
rtl28xxu: add [1b80:d39d] Sveon STV20 2014-06-16T20:40:33+00:00 Alessandro Miceli angelofsky1980@gmail.com 2014-05-04T10:37:15+00:00 dcbf9b09aed2e7b79a0c3f6e446e3b2b06197157 commit f27f5b0ee4967babfb8b03511f5e76b79d781014 upstream. Added Sveon STV20 device based on Realtek RTL2832U and FC0012 tuner Signed-off-by: Alessandro Miceli <angelofsky1980@gmail.com> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit f27f5b0ee4967babfb8b03511f5e76b79d781014 upstream.

Added Sveon STV20 device based on Realtek RTL2832U and FC0012 tuner

Signed-off-by: Alessandro Miceli <angelofsky1980@gmail.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
rtl28xxu: add 1b80:d395 Peak DVB-T USB 2014-06-16T20:40:33+00:00 Brian Healy healybrian@gmail.com 2014-05-04T21:43:39+00:00 a5112aedf3cafc304687f4f358b26f3593251c46 commit 9ca24ae4083665bda38da45f4b5dc9bbaf936bc0 upstream. Add USB ID for Peak DVB-T USB. [crope@iki.fi: fix Brian email address and indentation] Signed-off-by: Brian Healy <healybrian@gmail.com> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> 
commit 9ca24ae4083665bda38da45f4b5dc9bbaf936bc0 upstream.

Add USB ID for Peak DVB-T USB.

[crope@iki.fi: fix Brian email address and indentation]
Signed-off-by: Brian Healy <healybrian@gmail.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
rtl28xxu: add chipset version comments into device list 2014-06-16T20:40:33+00:00 Jan Vcelak jv@fcelda.cz 2014-02-26T18:33:40+00:00 fa7bb9b1311b76948464c2efbc31bcc6c8f515a3 commit 60aa4c6fa5723af72cff154a5cd33ac4995d1e0a upstream. Signed-off-by: Jan Vcelak <jv@fcelda.cz> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 60aa4c6fa5723af72cff154a5cd33ac4995d1e0a upstream.

Signed-off-by: Jan Vcelak <jv@fcelda.cz>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
rtl28xxu: add USB ID for Genius TVGo DVB-T03 2014-06-16T20:40:33+00:00 Jan Vcelak jv@fcelda.cz 2014-02-26T18:33:39+00:00 7425ce27dd89070144178cc19c485e41dd388a8b commit ac298ccdde4fe9b0a966e548a232ff4e8a6b8a31 upstream. 0458:707f KYE Systems Corp. (Mouse Systems) TVGo DVB-T03 [RTL2832] The USB dongle uses RTL2832U demodulator and FC0012 tuner. Signed-off-by: Jan Vcelak <jv@fcelda.cz> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit ac298ccdde4fe9b0a966e548a232ff4e8a6b8a31 upstream.

0458:707f KYE Systems Corp. (Mouse Systems) TVGo DVB-T03 [RTL2832]

The USB dongle uses RTL2832U demodulator and FC0012 tuner.

Signed-off-by: Jan Vcelak <jv@fcelda.cz>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
rtl28xxu: add ID [0ccd:00b4] TerraTec NOXON DAB Stick (rev 3) 2014-06-16T20:40:33+00:00 Till Dörges till@doerges.net 2014-02-11T20:27:57+00:00 ff3ca2bd5c9e4cf87f9826ef252a078ae99e037c commit a24bc323eb07e2a3a751e23c172b68d1b239db67 upstream. I've got the following DAB USB stick that also works fine with the DVB_USB_RTL28XXU driver after I added its USB ID: Bus 001 Device 009: ID 0ccd:00b4 TerraTec Electronic GmbH [crope@iki.fi: apply patch partly manually] Signed-off-by: Till Dörges <till@doerges.net> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit a24bc323eb07e2a3a751e23c172b68d1b239db67 upstream.

I've got the following DAB USB stick that also works fine with the
DVB_USB_RTL28XXU driver after I added its USB ID:
	Bus 001 Device 009: ID 0ccd:00b4 TerraTec Electronic GmbH

[crope@iki.fi: apply patch partly manually]
Signed-off-by: Till Dörges <till@doerges.net>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media: V4L2: fix VIDIOC_CREATE_BUFS in 64- / 32-bit compatibility mode 2014-06-07T17:28:29+00:00 Guennadi Liakhovetski g.liakhovetski@gmx.de 2014-04-26T15:51:31+00:00 3372ac6f0c1617a381f8a69ff1e7cc2e6751bdd3 commit 97d9d23dda6f37d90aefeec4ed619d52df525382 upstream. If a struct contains 64-bit fields, it is aligned on 64-bit boundaries within containing structs in 64-bit compilations. This is the case with struct v4l2_window, which contains pointers and is embedded into struct v4l2_format, and that one is embedded into struct v4l2_create_buffers. Unlike some other structs, used as a part of the kernel ABI as ioctl() arguments, that are packed, these structs aren't packed. This isn't a problem per se, but the ioctl-compat code for VIDIOC_CREATE_BUFS contains a bug, that triggers in such 64-bit builds. That code wrongly assumes, that in struct v4l2_create_buffers, struct v4l2_format immediately follows the __u32 memory field, which in fact isn't the case. This bug wasn't visible until now, because until recently hardly any applications used this ioctl() and mostly embedded 32-bit only drivers implemented it. This is changing now with addition of this ioctl() to some USB drivers, e.g. UVC. This patch fixes the bug by copying parts of struct v4l2_create_buffers separately. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 97d9d23dda6f37d90aefeec4ed619d52df525382 upstream.

If a struct contains 64-bit fields, it is aligned on 64-bit boundaries
within containing structs in 64-bit compilations. This is the case with
struct v4l2_window, which contains pointers and is embedded into struct
v4l2_format, and that one is embedded into struct v4l2_create_buffers.
Unlike some other structs, used as a part of the kernel ABI as ioctl()
arguments, that are packed, these structs aren't packed. This isn't a
problem per se, but the ioctl-compat code for VIDIOC_CREATE_BUFS contains
a bug, that triggers in such 64-bit builds. That code wrongly assumes,
that in struct v4l2_create_buffers, struct v4l2_format immediately follows
the __u32 memory field, which in fact isn't the case. This bug wasn't
visible until now, because until recently hardly any applications used
this ioctl() and mostly embedded 32-bit only drivers implemented it. This
is changing now with addition of this ioctl() to some USB drivers, e.g.
UVC. This patch fixes the bug by copying parts of struct
v4l2_create_buffers separately.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media: V4L2: ov7670: fix a wrong index, potentially Oopsing the kernel from user-space 2014-06-07T17:28:28+00:00 Guennadi Liakhovetski g.liakhovetski@gmx.de 2014-04-14T13:49:34+00:00 d0c47e5d003514bef6b7be36a49a4c87058a732a commit cfece5857ca51d1dcdb157017aba226f594e9dcf upstream. Commit 75e2bdad8901a0b599e01a96229be922eef1e488 "ov7670: allow configuration of image size, clock speed, and I/O method" uses a wrong index to iterate an array. Apart from being wrong, it also uses an unchecked value from user-space, which can cause access to unmapped memory in the kernel, triggered by a normal desktop user with rights to use V4L2 devices. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Jonathan Corbet <corbet@lwn.net> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit cfece5857ca51d1dcdb157017aba226f594e9dcf upstream.

Commit 75e2bdad8901a0b599e01a96229be922eef1e488 "ov7670: allow
configuration of image size, clock speed, and I/O method" uses a wrong
index to iterate an array. Apart from being wrong, it also uses an
unchecked value from user-space, which can cause access to unmapped
memory in the kernel, triggered by a normal desktop user with rights to
use V4L2 devices.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media: fc2580: fix tuning failure on 32-bit arch 2014-06-07T17:28:28+00:00 Antti Palosaari crope@iki.fi 2014-04-11T00:18:16+00:00 24d0dd75ef19c885309cf06990267cd2cbf49fa4 commit 8845cc6415ec28ef8d57b3fb81c75ef9bce69c5f upstream. There was some frequency calculation overflows which caused tuning failure on 32-bit architecture. Use 64-bit numbers where needed in order to avoid calculation overflows. Thanks for the Finnish person, who asked remain anonymous, reporting, testing and suggesting the fix. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 8845cc6415ec28ef8d57b3fb81c75ef9bce69c5f upstream.

There was some frequency calculation overflows which caused tuning
failure on 32-bit architecture. Use 64-bit numbers where needed in
order to avoid calculation overflows.

Thanks for the Finnish person, who asked remain anonymous, reporting,
testing and suggesting the fix.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media: media-device: fix infoleak in ioctl media_enum_entities() 2014-06-07T17:28:19+00:00 Salva Peiró speiro@ai2.upv.es 2014-04-30T17:48:02+00:00 429f444ee6aea8146c115dded7b8b0214cea5e2d commit e6a623460e5fc960ac3ee9f946d3106233fd28d8 upstream. This fixes CVE-2014-1739. Signed-off-by: Salva Peiró <speiro@ai2.upv.es> Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit e6a623460e5fc960ac3ee9f946d3106233fd28d8 upstream.

This fixes CVE-2014-1739.

Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>