linux-stable.git/drivers/media, branch v3.18.52

xc2028: unlock on error in xc2028_set_config()

2017-05-08T05:44:07+00:00

commit 210bd104c6acd31c3c6b8b075b3f12d4a9f6b60d upstream.

We have to unlock before returning -ENOMEM.

Fixes: 8dfbcc4351a0 ('[media] xc2028: avoid use after free')

Signed-off-by: Dan Carpenter 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

xc2028: avoid use after free

2017-04-30T03:49:17+00:00

commit 8dfbcc4351a0b6d2f2d77f367552f48ffefafe18 upstream.

If struct xc2028_config is passed without a firmware name,
the following trouble may happen:

[11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner
[11009.907491] ==================================================================
[11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40
[11009.907992] Read of size 1 by task modprobe/28992
[11009.907994] =============================================================================
[11009.907997] BUG kmalloc-16 (Tainted: G        W      ): kasan: bad access detected
[11009.907999] -----------------------------------------------------------------------------

[11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992
[11009.908012] 	___slab_alloc+0x581/0x5b0
[11009.908014] 	__slab_alloc+0x51/0x90
[11009.908017] 	__kmalloc+0x27b/0x350
[11009.908022] 	xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd]
[11009.908026] 	usb_hcd_submit_urb+0x1e8/0x1c60
[11009.908029] 	usb_submit_urb+0xb0e/0x1200
[11009.908032] 	usb_serial_generic_write_start+0xb6/0x4c0
[11009.908035] 	usb_serial_generic_write+0x92/0xc0
[11009.908039] 	usb_console_write+0x38a/0x560
[11009.908045] 	call_console_drivers.constprop.14+0x1ee/0x2c0
[11009.908051] 	console_unlock+0x40d/0x900
[11009.908056] 	vprintk_emit+0x4b4/0x830
[11009.908061] 	vprintk_default+0x1f/0x30
[11009.908064] 	printk+0x99/0xb5
[11009.908067] 	kasan_report_error+0x10a/0x550
[11009.908070] 	__asan_report_load1_noabort+0x43/0x50
[11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992
[11009.908077] 	__slab_free+0x2ec/0x460
[11009.908080] 	kfree+0x266/0x280
[11009.908083] 	xc2028_set_config+0x90/0x630 [tuner_xc2028]
[11009.908086] 	xc2028_attach+0x310/0x8a0 [tuner_xc2028]
[11009.908090] 	em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]
[11009.908094] 	em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]
[11009.908098] 	em28xx_dvb_init+0x81/0x8a [em28xx_dvb]
[11009.908101] 	em28xx_register_extension+0xd9/0x190 [em28xx]
[11009.908105] 	em28xx_dvb_register+0x10/0x1000 [em28xx_dvb]
[11009.908108] 	do_one_initcall+0x141/0x300
[11009.908111] 	do_init_module+0x1d0/0x5ad
[11009.908114] 	load_module+0x6666/0x9ba0
[11009.908117] 	SyS_finit_module+0x108/0x130
[11009.908120] 	entry_SYSCALL_64_fastpath+0x16/0x76
[11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x          (null) flags=0x2ffff8000004080
[11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001

[11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00  ....*....(......
[11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff  ...........j....
[11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G    B   W       4.5.0-rc1+ #43
[11009.908140] Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015
[11009.908142]  ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80
[11009.908148]  ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280
[11009.908153]  ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4
[11009.908158] Call Trace:
[11009.908162]  [] dump_stack+0x4b/0x64
[11009.908165]  [] print_trailer+0xf9/0x150
[11009.908168]  [] object_err+0x34/0x40
[11009.908171]  [] kasan_report_error+0x230/0x550
[11009.908175]  [] ? trace_hardirqs_off_caller+0x21/0x290
[11009.908179]  [] ? kasan_unpoison_shadow+0x36/0x50
[11009.908182]  [] __asan_report_load1_noabort+0x43/0x50
[11009.908185]  [] ? __asan_register_globals+0x50/0xa0
[11009.908189]  [] ? strcmp+0x96/0xb0
[11009.908192]  [] strcmp+0x96/0xb0
[11009.908196]  [] xc2028_set_config+0x15c/0x630 [tuner_xc2028]
[11009.908200]  [] xc2028_attach+0x310/0x8a0 [tuner_xc2028]
[11009.908203]  [] ? memset+0x28/0x30
[11009.908206]  [] ? xc2028_set_config+0x630/0x630 [tuner_xc2028]
[11009.908211]  [] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]
[11009.908215]  [] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb]
[11009.908219]  [] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb]
[11009.908222]  [] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x]
[11009.908226]  [] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x]
[11009.908230]  [] ? ref_module.part.15+0x10/0x10
[11009.908233]  [] ? module_assert_mutex_or_preempt+0x80/0x80
[11009.908238]  [] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]
[11009.908242]  [] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb]
[11009.908245]  [] ? string+0x14d/0x1f0
[11009.908249]  [] ? symbol_string+0xff/0x1a0
[11009.908253]  [] ? uuid_string+0x6f0/0x6f0
[11009.908257]  [] ? __kernel_text_address+0x7e/0xa0
[11009.908260]  [] ? print_context_stack+0x7f/0xf0
[11009.908264]  [] ? __module_address+0xb6/0x360
[11009.908268]  [] ? is_ftrace_trampoline+0x99/0xe0
[11009.908271]  [] ? __kernel_text_address+0x7e/0xa0
[11009.908275]  [] ? debug_check_no_locks_freed+0x290/0x290
[11009.908278]  [] ? dump_trace+0x11b/0x300
[11009.908282]  [] ? em28xx_register_extension+0x23/0x190 [em28xx]
[11009.908285]  [] ? trace_hardirqs_off_caller+0x21/0x290
[11009.908289]  [] ? trace_hardirqs_on_caller+0x16/0x590
[11009.908292]  [] ? trace_hardirqs_on+0xd/0x10
[11009.908296]  [] ? em28xx_register_extension+0x23/0x190 [em28xx]
[11009.908299]  [] ? mutex_trylock+0x400/0x400
[11009.908302]  [] ? do_one_initcall+0x131/0x300
[11009.908306]  [] ? call_rcu_sched+0x17/0x20
[11009.908309]  [] ? put_object+0x48/0x70
[11009.908314]  [] em28xx_dvb_init+0x81/0x8a [em28xx_dvb]
[11009.908317]  [] em28xx_register_extension+0xd9/0x190 [em28xx]
[11009.908320]  [] ? 0xffffffffa0150000
[11009.908324]  [] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb]
[11009.908327]  [] do_one_initcall+0x141/0x300
[11009.908330]  [] ? try_to_run_init_process+0x40/0x40
[11009.908333]  [] ? trace_hardirqs_on_caller+0x16/0x590
[11009.908337]  [] ? kasan_unpoison_shadow+0x36/0x50
[11009.908340]  [] ? kasan_unpoison_shadow+0x36/0x50
[11009.908343]  [] ? kasan_unpoison_shadow+0x36/0x50
[11009.908346]  [] ? __asan_register_globals+0x87/0xa0
[11009.908350]  [] do_init_module+0x1d0/0x5ad
[11009.908353]  [] load_module+0x6666/0x9ba0
[11009.908356]  [] ? symbol_put_addr+0x50/0x50
[11009.908361]  [] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb]
[11009.908366]  [] ? module_frob_arch_sections+0x20/0x20
[11009.908369]  [] ? open_exec+0x50/0x50
[11009.908374]  [] ? ns_capable+0x5b/0xd0
[11009.908377]  [] SyS_finit_module+0x108/0x130
[11009.908379]  [] ? SyS_init_module+0x1f0/0x1f0
[11009.908383]  [] ? lockdep_sys_exit_thunk+0x12/0x14
[11009.908394]  [] entry_SYSCALL_64_fastpath+0x16/0x76
[11009.908396] Memory state around the buggy address:
[11009.908398]  ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[11009.908401]  ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc
[11009.908405]                                            ^
[11009.908407]  ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[11009.908409]  ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[11009.908411] ==================================================================

In order to avoid it, let's set the cached value of the firmware
name to NULL after freeing it. While here, return an error if
the memory allocation fails.

Signed-off-by: Mauro Carvalho Chehab 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

uvcvideo: uvc_scan_fallback() for webcams with broken chain

2017-04-22T05:15:06+00:00

commit e950267ab802c8558f1100eafd4087fd039ad634 upstream.

Some devices have invalid baSourceID references, causing uvc_scan_chain()
to fail, but if we just take the entities we can find and put them
together in the most sensible chain we can think of, turns out they do
work anyway. Note: This heuristic assumes there is a single chain.

At the time of writing, devices known to have such a broken chain are
  - Acer Integrated Camera (5986:055a)
  - Realtek rtl157a7 (0bda:57a7)

Signed-off-by: Henrik Ingo 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

dvb-usb-firmware: don't do DMA on stack

2017-04-22T05:15:02+00:00

commit 67b0503db9c29b04eadfeede6bebbfe5ddad94ef upstream.

The buffer allocation for the firmware data was changed in
commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
but the same applies for the reset value.

Fixes: 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
Signed-off-by: Stefan Brüns 
Signed-off-by: Mauro Carvalho Chehab 
Cc: Ben Hutchings 
Cc: Brad Spengler 
Signed-off-by: Greg Kroah-Hartman

dvb-usb: don't use stack for firmware load

2017-04-22T05:15:02+00:00

commit 43fab9793c1f44e665b4f98035a14942edf03ddc upstream.

As reported by Marc Duponcheel , firmware load on
dvb-usb is using the stack, with is not allowed anymore on default
Kernel configurations:

[ 1025.958836] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in cold state, will try to load a firmware
[ 1025.958853] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[ 1025.958855] dvb-usb: could not stop the USB controller CPU.
[ 1025.958856] dvb-usb: error while transferring firmware (transferred size: -11, block size: 3)
[ 1025.958856] dvb-usb: firmware download failed at 8 with -22
[ 1025.958867] usbcore: registered new interface driver dvb_usb_dtt200u

[    2.789902] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[    2.789905] ------------[ cut here ]------------
[    2.789911] WARNING: CPU: 3 PID: 2196 at drivers/usb/core/hcd.c:1584 usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789912] transfer buffer not dma capable
[    2.789912] Modules linked in: btusb dvb_usb_dtt200u(+) dvb_usb_af9035(+) btrtl btbcm dvb_usb dvb_usb_v2 btintel dvb_core bluetooth rc_core rfkill x86_pkg_temp_thermal intel_powerclamp coretemp crc32_pclmul aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd drm_kms_helper syscopyarea sysfillrect pcspkr i2c_i801 sysimgblt fb_sys_fops drm i2c_smbus i2c_core r8169 lpc_ich mfd_core mii thermal fan rtc_cmos video button acpi_cpufreq processor snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd crc32c_intel ahci libahci libata xhci_pci ehci_pci xhci_hcd ehci_hcd usbcore usb_common dm_mirror dm_region_hash dm_log dm_mod
[    2.789936] CPU: 3 PID: 2196 Comm: systemd-udevd Not tainted 4.9.0-gentoo #1
[    2.789937] Hardware name: ASUS All Series/H81I-PLUS, BIOS 0401 07/23/2013
[    2.789938]  ffffc9000339b690 ffffffff812bd397 ffffc9000339b6e0 0000000000000000
[    2.789939]  ffffc9000339b6d0 ffffffff81055c86 000006300339b6a0 ffff880116c0c000
[    2.789941]  0000000000000000 0000000000000000 0000000000000001 ffff880116c08000
[    2.789942] Call Trace:
[    2.789945]  [] dump_stack+0x4d/0x66
[    2.789947]  [] __warn+0xc6/0xe0
[    2.789948]  [] warn_slowpath_fmt+0x4a/0x50
[    2.789952]  [] usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789954]  [] ? io_schedule_timeout+0xd8/0x110
[    2.789956]  [] usb_hcd_submit_urb+0x9c/0x980 [usbcore]
[    2.789958]  [] ? copy_page_to_iter+0x14f/0x2b0
[    2.789960]  [] ? pagecache_get_page+0x28/0x240
[    2.789962]  [] ? touch_atime+0x20/0xa0
[    2.789964]  [] usb_submit_urb+0x2c4/0x520 [usbcore]
[    2.789967]  [] usb_start_wait_urb+0x5a/0xe0 [usbcore]
[    2.789969]  [] usb_control_msg+0xbc/0xf0 [usbcore]
[    2.789970]  [] usb_cypress_writemem+0x3d/0x40 [dvb_usb]
[    2.789972]  [] usb_cypress_load_firmware+0x4f/0x130 [dvb_usb]
[    2.789973]  [] ? console_unlock+0x2fe/0x5d0
[    2.789974]  [] ? vprintk_emit+0x27c/0x410
[    2.789975]  [] ? vprintk_default+0x1a/0x20
[    2.789976]  [] ? printk+0x43/0x4b
[    2.789977]  [] dvb_usb_download_firmware+0x60/0xd0 [dvb_usb]
[    2.789979]  [] dvb_usb_device_init+0x3d8/0x610 [dvb_usb]
[    2.789981]  [] dtt200u_usb_probe+0x92/0xd0 [dvb_usb_dtt200u]
[    2.789984]  [] usb_probe_interface+0xfc/0x270 [usbcore]
[    2.789985]  [] driver_probe_device+0x215/0x2d0
[    2.789986]  [] __driver_attach+0x96/0xa0
[    2.789987]  [] ? driver_probe_device+0x2d0/0x2d0
[    2.789988]  [] bus_for_each_dev+0x5b/0x90
[    2.789989]  [] driver_attach+0x19/0x20
[    2.789990]  [] bus_add_driver+0x11c/0x220
[    2.789991]  [] driver_register+0x5b/0xd0
[    2.789994]  [] usb_register_driver+0x7c/0x130 [usbcore]
[    2.789994]  [] ? 0xffffffffa06a5000
[    2.789996]  [] dtt200u_usb_driver_init+0x1e/0x20 [dvb_usb_dtt200u]
[    2.789997]  [] do_one_initcall+0x38/0x140
[    2.789998]  [] ? __vunmap+0x7c/0xc0
[    2.789999]  [] ? do_init_module+0x22/0x1d2
[    2.790000]  [] do_init_module+0x5a/0x1d2
[    2.790002]  [] load_module+0x1e11/0x2580
[    2.790003]  [] ? show_taint+0x30/0x30
[    2.790004]  [] ? kernel_read_file+0x100/0x190
[    2.790005]  [] SyS_finit_module+0xba/0xc0
[    2.790007]  [] entry_SYSCALL_64_fastpath+0x13/0x94
[    2.790008] ---[ end trace c78a74e78baec6fc ]---

So, allocate the structure dynamically.

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 4.9: adjust context]
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

dvb-usb-v2: avoid use-after-free

2017-04-22T05:15:01+00:00

commit 005145378c9ad7575a01b6ce1ba118fb427f583a upstream.

I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:

drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.

This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

dib0700: fix nec repeat handling

2017-04-18T05:55:47+00:00

commit ba13e98f2cebd55a3744c5ffaa08f9dca73bf521 upstream.

When receiving a nec repeat, ensure the correct scancode is repeated
rather than a random value from the stack.  This removes the need for
the bogus uninitialized_var() and also fixes the warnings:

    drivers/media/usb/dvb-usb/dib0700_core.c: In function ‘dib0700_rc_urb_completion’:
    drivers/media/usb/dvb-usb/dib0700_core.c:679: warning: ‘protocol’ may be used uninitialized in this function

[sean addon: So after writing the patch and submitting it, I've bought the
             hardware on ebay. Without this patch you get random scancodes
             on nec repeats, which the patch indeed fixes.]

Signed-off-by: Sean Young 
Tested-by: Sean Young 
Signed-off-by: Arnd Bergmann 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

media: remove unused variable that causes a warning

2017-02-08T08:43:04+00:00

commit 1d11437f4fd02f9b5d3749675a1232216787dcc6 upstream.

My 'allmodconfig' build is _almost_ free of warnings, and most of the
remaining ones are for legacy drivers that just do bad things that I
can't find it in my black heart to care too much about.  But this one
was just annoying me:

   drivers/media/v4l2-core/videobuf2-core.c:3256:26: warning: unused variable ‘fileio’ [-Wunused-variable]

because commit 0e661006370b ("[media] vb2: fix 'UNBALANCED' warnings
when calling vb2_thread_stop()") removed all users of 'fileio' and
instead calls "__vb2_cleanup_fileio(q)" to clean up q->fileio.  But the
now unused 'fileio' variable was left around.

Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

s3c-camif: fix compiler warnings

2017-02-08T08:43:04+00:00

commit 7e0d4e92269e574e50a58041fac4cc75a149828c upstream.

Fix these compiler warnings that appeared after switching to gcc-5.1.0:

drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_power':
drivers/media/platform/s3c-camif/camif-capture.c:118:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  if (!on == camif->sensor.power_count)
          ^
drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_streaming':
drivers/media/platform/s3c-camif/camif-capture.c:134:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  if (!on == camif->sensor.stream_count)
          ^

Signed-off-by: Hans Verkuil 
Cc: Kamil Debski 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

[media] media: usbtv: prevent access to free'd resources

2016-08-22T16:23:07+00:00

[ Upstream commit 2a00932f082aff93c3a55426e0c7af6d0ec03997 ]

When disconnecting the usbtv device, the sound card is unregistered
from ALSA and the snd member of the usbtv struct is set to NULL.  If
the usbtv snd_trigger work is running, this can cause a race condition
where the kernel will attempt to access free'd resources, shown in
[1].

This patch fixes the disconnection code by cancelling any snd_trigger
work before unregistering the sound card from ALSA and checking that
the snd member still exists in the work function.

[1]:
 usb 3-1.2: USB disconnect, device number 6
 BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
 IP: [] process_one_work+0x30/0x480
 PGD 405bbf067 PUD 405bbe067 PMD 0
 Call Trace:
  [] worker_thread+0x48/0x4e0
  [] ? process_one_work+0x480/0x480
  [] ? process_one_work+0x480/0x480
  [] kthread+0xd8/0xf0
  [] ret_from_fork+0x22/0x40
  [] ? kthread_worker_fn+0x170/0x170
 ---[ end trace 0f3dac5c1a38e610 ]---

Signed-off-by: Matthew Leach 
Tested-by: Peter Sutton 
Cc: stable@vger.kernel.org
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin