linux-stable.git/drivers/media, branch v3.2.99

cx231xx: Fix the max number of interfaces

2018-02-13T18:32:24+00:00

commit 139d28826b8e2bc7a9232fde0d2f14812914f501 upstream.

The max number of interfaces was read from the wrong descriptor.

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

media: omap_vout: Fix a possible null pointer dereference in omap_vout_open()

2018-02-13T18:32:12+00:00

commit bfba2b3e21b9426c0f9aca00f3cad8631b2da170 upstream.

Move a debug message so that a null pointer access can not happen
for the variable "vout" in this function.

Fixes: 5c7ab6348e7b3fcca2b8ee548306c774472971e2 ("V4L/DVB: V4L2: Add support for OMAP2/3 V4L2 display driver on top of DSS2")

Signed-off-by: Markus Elfring 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

media: rc: check for integer overflow

2018-02-13T18:32:09+00:00

commit 3e45067f94bbd61dec0619b1c32744eb0de480c8 upstream.

The ioctl LIRC_SET_REC_TIMEOUT would set a timeout of 704ns if called
with a timeout of 4294968us.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: open-code U32_MAX]
Signed-off-by: Ben Hutchings

media: imon: Fix null-ptr-deref in imon_probe

2017-11-26T13:51:11+00:00

commit 58fd55e838276a0c13d1dc7c387f90f25063cbf3 upstream.

It seems that the return value of usb_ifnum_to_if() can be NULL and
needs to be checked.

Signed-off-by: Arvind Yadav 
Tested-by: Andrey Konovalov 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

cx231xx-cards: fix NULL-deref on missing association descriptor

2017-11-26T13:51:10+00:00

commit 6c3b047fa2d2286d5e438bcb470c7b1a49f415f6 upstream.

Make sure to check that we actually have an Interface Association
Descriptor before dereferencing it during probe to avoid dereferencing a
NULL-pointer.

Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")

Reported-by: Andrey Konovalov 
Signed-off-by: Johan Hovold 
Tested-by: Andrey Konovalov 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

media: em28xx: calculate left volume level correctly

2017-11-26T13:51:04+00:00

commit 801e3659bf2c87c31b7024087d61e89e172b5651 upstream.

The calculation of the left volume looks suspect, the value of
0x1f - ((val << 8) & 0x1f) is always 0x1f. The debug prior to the
assignment of value[1] prints the left volume setting using the
calculation 0x1f - (val >> 8) & 0x1f which looks correct to me.
Fix the left volume by using the correct expression as used in
the debug.

Detected by CoverityScan, CID#146140 ("Wrong operator used")

Fixes: 850d24a5a861 ("[media] em28xx-alsa: add mixer support for AC97 volume controls")

Signed-off-by: Colin Ian King 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

media: uvcvideo: Prevent heap overflow when accessing mapped controls

2017-11-26T13:51:04+00:00

commit 7e09f7d5c790278ab98e5f2c22307ebe8ad6e8ba upstream.

The size of uvc_control_mapping is user controlled leading to a
potential heap overflow in the uvc driver. This adds a check to verify
the user provided size fits within the bounds of the defined buffer
size.

Originally-from: Richard Simmons 

Signed-off-by: Guenter Roeck 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

rc: Fix input deadlock and transmit error in redrat3 driver

2017-11-11T13:34:50+00:00

commit dbea1880368071dfa97d5e6aa4a368e7d0146a85 upstream.

Fixed submit urb logic so hardware doesn't hang trying to transmit
signal data

Removed unneeded enable/disable detector commands in
redrat3_transmit_ir (the hardware does this anyway) and converted
arguments to unsigned as per 5588dc2

Signed-off-by: Andrew Vincer 
Cc: Jarod Wilson 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

mxl111sf: remove an unused variable

2017-11-11T13:34:49+00:00

commit 3fd7e4341e04f80e2605f56bbd8cb1e8b027901a upstream.

We don't use this any more after 3be5bb71fb "[media] mxl111sf: fix error
on stream stop in mxl111sf_ep6_streaming_ctrl()" and it makes GCC
complain.

Signed-off-by: Dan Carpenter 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

tda18212: silence compiler warning

2017-11-11T13:34:46+00:00

commit e666a44fa313cb9329c0381ad02fc6ee1e21cb31 upstream.

Trivial fix.

Signed-off-by: Antti Palosaari 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings