linux-stable.git/drivers/media, branch v3.16.46

dvb-usb-firmware: don't do DMA on stack

2017-07-18T17:40:10+00:00

commit 67b0503db9c29b04eadfeede6bebbfe5ddad94ef upstream.

The buffer allocation for the firmware data was changed in
commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
but the same applies for the reset value.

Fixes: 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
Signed-off-by: Stefan Brüns 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

dvb-usb: don't use stack for firmware load

2017-07-18T17:40:09+00:00

commit 43fab9793c1f44e665b4f98035a14942edf03ddc upstream.

As reported by Marc Duponcheel , firmware load on
dvb-usb is using the stack, with is not allowed anymore on default
Kernel configurations:

[ 1025.958836] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in cold state, will try to load a firmware
[ 1025.958853] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[ 1025.958855] dvb-usb: could not stop the USB controller CPU.
[ 1025.958856] dvb-usb: error while transferring firmware (transferred size: -11, block size: 3)
[ 1025.958856] dvb-usb: firmware download failed at 8 with -22
[ 1025.958867] usbcore: registered new interface driver dvb_usb_dtt200u

[    2.789902] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[    2.789905] ------------[ cut here ]------------
[    2.789911] WARNING: CPU: 3 PID: 2196 at drivers/usb/core/hcd.c:1584 usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789912] transfer buffer not dma capable
[    2.789912] Modules linked in: btusb dvb_usb_dtt200u(+) dvb_usb_af9035(+) btrtl btbcm dvb_usb dvb_usb_v2 btintel dvb_core bluetooth rc_core rfkill x86_pkg_temp_thermal intel_powerclamp coretemp crc32_pclmul aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd drm_kms_helper syscopyarea sysfillrect pcspkr i2c_i801 sysimgblt fb_sys_fops drm i2c_smbus i2c_core r8169 lpc_ich mfd_core mii thermal fan rtc_cmos video button acpi_cpufreq processor snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd crc32c_intel ahci libahci libata xhci_pci ehci_pci xhci_hcd ehci_hcd usbcore usb_common dm_mirror dm_region_hash dm_log dm_mod
[    2.789936] CPU: 3 PID: 2196 Comm: systemd-udevd Not tainted 4.9.0-gentoo #1
[    2.789937] Hardware name: ASUS All Series/H81I-PLUS, BIOS 0401 07/23/2013
[    2.789938]  ffffc9000339b690 ffffffff812bd397 ffffc9000339b6e0 0000000000000000
[    2.789939]  ffffc9000339b6d0 ffffffff81055c86 000006300339b6a0 ffff880116c0c000
[    2.789941]  0000000000000000 0000000000000000 0000000000000001 ffff880116c08000
[    2.789942] Call Trace:
[    2.789945]  [] dump_stack+0x4d/0x66
[    2.789947]  [] __warn+0xc6/0xe0
[    2.789948]  [] warn_slowpath_fmt+0x4a/0x50
[    2.789952]  [] usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789954]  [] ? io_schedule_timeout+0xd8/0x110
[    2.789956]  [] usb_hcd_submit_urb+0x9c/0x980 [usbcore]
[    2.789958]  [] ? copy_page_to_iter+0x14f/0x2b0
[    2.789960]  [] ? pagecache_get_page+0x28/0x240
[    2.789962]  [] ? touch_atime+0x20/0xa0
[    2.789964]  [] usb_submit_urb+0x2c4/0x520 [usbcore]
[    2.789967]  [] usb_start_wait_urb+0x5a/0xe0 [usbcore]
[    2.789969]  [] usb_control_msg+0xbc/0xf0 [usbcore]
[    2.789970]  [] usb_cypress_writemem+0x3d/0x40 [dvb_usb]
[    2.789972]  [] usb_cypress_load_firmware+0x4f/0x130 [dvb_usb]
[    2.789973]  [] ? console_unlock+0x2fe/0x5d0
[    2.789974]  [] ? vprintk_emit+0x27c/0x410
[    2.789975]  [] ? vprintk_default+0x1a/0x20
[    2.789976]  [] ? printk+0x43/0x4b
[    2.789977]  [] dvb_usb_download_firmware+0x60/0xd0 [dvb_usb]
[    2.789979]  [] dvb_usb_device_init+0x3d8/0x610 [dvb_usb]
[    2.789981]  [] dtt200u_usb_probe+0x92/0xd0 [dvb_usb_dtt200u]
[    2.789984]  [] usb_probe_interface+0xfc/0x270 [usbcore]
[    2.789985]  [] driver_probe_device+0x215/0x2d0
[    2.789986]  [] __driver_attach+0x96/0xa0
[    2.789987]  [] ? driver_probe_device+0x2d0/0x2d0
[    2.789988]  [] bus_for_each_dev+0x5b/0x90
[    2.789989]  [] driver_attach+0x19/0x20
[    2.789990]  [] bus_add_driver+0x11c/0x220
[    2.789991]  [] driver_register+0x5b/0xd0
[    2.789994]  [] usb_register_driver+0x7c/0x130 [usbcore]
[    2.789994]  [] ? 0xffffffffa06a5000
[    2.789996]  [] dtt200u_usb_driver_init+0x1e/0x20 [dvb_usb_dtt200u]
[    2.789997]  [] do_one_initcall+0x38/0x140
[    2.789998]  [] ? __vunmap+0x7c/0xc0
[    2.789999]  [] ? do_init_module+0x22/0x1d2
[    2.790000]  [] do_init_module+0x5a/0x1d2
[    2.790002]  [] load_module+0x1e11/0x2580
[    2.790003]  [] ? show_taint+0x30/0x30
[    2.790004]  [] ? kernel_read_file+0x100/0x190
[    2.790005]  [] SyS_finit_module+0xba/0xc0
[    2.790007]  [] entry_SYSCALL_64_fastpath+0x13/0x94
[    2.790008] ---[ end trace c78a74e78baec6fc ]---

So, allocate the structure dynamically.

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

dvb-usb-v2: avoid use-after-free

2017-06-05T20:17:22+00:00

commit 005145378c9ad7575a01b6ce1ba118fb427f583a upstream.

I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:

drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.

This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

uvcvideo: Fix a wrong macro

2017-06-05T20:17:01+00:00

commit 17c341ec0115837a610b2da15e32546e26068234 upstream.

Don't mix up UVC_BUF_STATE_* and VB2_BUF_STATE_* codes.

Fixes: 6998b6fb4b1c ("[media] uvcvideo: Use videobuf2-vmalloc")

Signed-off-by: Guennadi Liakhovetski 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

media: fix dm1105.c build error

2017-06-05T20:17:01+00:00

commit e3bb3cddd177550d63a3e4909cf1a7782f13414d upstream.

Fix dm1105 build error when CONFIG_I2C_ALGOBIT=m and
CONFIG_DVB_DM1105=y.

drivers/built-in.o: In function `dm1105_probe':
dm1105.c:(.text+0x2836e7): undefined reference to `i2c_bit_add_bus'

Signed-off-by: Randy Dunlap 
Reported-by: kbuild test robot 
Cc: Javier Martinez Canillas 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

adv7604: Initialize drive strength to default when using DT

2017-06-05T20:17:00+00:00

commit da8892d410db224d9a24104529794e6e37e0c100 upstream.

The adv7604 driver platform data contains fields for configuring the drive
strength of the output pins. When probing the driver through DT these
fields are not explicitly initialized, which means they are left at 0. This
is a reserved setting for the drive strength configuration though and can
cause signal integrity issues.

Whether these signal integrity issues are visible depends on the PCB
specifics (e.g. the higher the load capacitance for the output the more
visible the issue). But it has been observed on existing solutions at high
pixel clock rates.

Initialize the drive strength settings to the power-on-reset value of the
device when probing through devicetree to avoid this issue.

Fixes: 0e158be0162b ("adv7604: Add DT support")

Signed-off-by: Lars-Peter Clausen 
Reviewed-by: Laurent Pinchart 
Tested-by: Niklas Söderlund 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

siano: make it work again with CONFIG_VMAP_STACK

2017-03-16T02:27:13+00:00

commit f9c85ee67164b37f9296eab3b754e543e4e96a1c upstream.

Reported as a Kaffeine bug:
	https://bugs.kde.org/show_bug.cgi?id=375811

The USB control messages require DMA to work. We cannot pass
a stack-allocated buffer, as it is not warranted that the
stack would be into a DMA enabled area.

On Kernel 4.9, the default is to not accept DMA on stack anymore
on x86 architecture. On other architectures, this has been a
requirement since Kernel 2.2. So, after this patch, this driver
should likely work fine on all archs.

Tested with USB ID 2040:5510: Hauppauge Windham

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

s5k4ecgx: select CRC32 helper

2017-03-16T02:26:39+00:00

commit c739c0a7c3c2472d7562b8f802cdce44d2597c8b upstream.

A rare randconfig build failure shows up in this driver when
the CRC32 helper is not there:

drivers/media/built-in.o: In function `s5k4ecgx_s_power':
s5k4ecgx.c:(.text+0x9eb4): undefined reference to `crc32_le'

This adds the 'select' that all other users of this function have.

Fixes: 8b99312b7214 ("[media] Add v4l2 subdev driver for S5K4ECGX sensor")

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

DaVinci-VPFE-Capture: fix error handling

2017-03-16T02:26:25+00:00

commit d3d83ee20afda16ad0133ba00f63c11a8d842a35 upstream.

A recent cleanup had the right idea to remove the initialization
of the error variable, but missed the actual benefit of that,
which is that we get warnings if there is a bug in it. Now
we get a warning about a bug that was introduced by this cleanup:

drivers/media/platform/davinci/vpfe_capture.c: In function 'vpfe_probe':
drivers/media/platform/davinci/vpfe_capture.c:1992:9: error: 'ret' may be used uninitialized in this function [-Werror=maybe-uninitialized]

This adds the missing initialization that the warning is about,
and another one that was preexisting and that we did not get
a warning for. That second bug has existed since the driver
was first added.

Fixes: efb74461f5a6 ("[media] DaVinci-VPFE-Capture: Delete an unnecessary variable initialisation in vpfe_probe()")
Fixes: 7da8a6cb3e5b ("V4L/DVB (12248): v4l: vpfe capture bridge driver for DM355 and DM6446")

[mchehab@s-opensource.com: fix a merge conflict]
Signed-off-by: Arnd Bergmann 

Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

ite-cir: initialize use_demodulator before using it

2017-03-16T02:26:17+00:00

commit 7ec03e60ef81c19b5d3a46dd070ee966774b860f upstream.

Function ite_set_carrier_params() uses variable use_demodulator after
having initialized it to false in some if branches, but this variable is
never set to true otherwise.

This bug has been found using clang -Wsometimes-uninitialized warning
flag.

Fixes: 620a32bba4a2 ("[media] rc: New rc-based ite-cir driver for
several ITE CIRs")

Signed-off-by: Nicolas Iooss 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings