linux-stable.git/drivers/media, branch v4.1.38

[media] media: usbtv: prevent access to free'd resources

2016-08-17T16:58:31+00:00

[ Upstream commit 2a00932f082aff93c3a55426e0c7af6d0ec03997 ]

When disconnecting the usbtv device, the sound card is unregistered
from ALSA and the snd member of the usbtv struct is set to NULL.  If
the usbtv snd_trigger work is running, this can cause a race condition
where the kernel will attempt to access free'd resources, shown in
[1].

This patch fixes the disconnection code by cancelling any snd_trigger
work before unregistering the sound card from ALSA and checking that
the snd member still exists in the work function.

[1]:
 usb 3-1.2: USB disconnect, device number 6
 BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
 IP: [] process_one_work+0x30/0x480
 PGD 405bbf067 PUD 405bbe067 PMD 0
 Call Trace:
  [] worker_thread+0x48/0x4e0
  [] ? process_one_work+0x480/0x480
  [] ? process_one_work+0x480/0x480
  [] kthread+0xd8/0xf0
  [] ret_from_fork+0x22/0x40
  [] ? kthread_worker_fn+0x170/0x170
 ---[ end trace 0f3dac5c1a38e610 ]---

Signed-off-by: Matthew Leach 
Tested-by: Peter Sutton 
Cc: stable@vger.kernel.org
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] Fix RC5 decoding with Fintek CIR chipset

2016-08-17T16:58:31+00:00

[ Upstream commit bbdb34c90aeb8b2253eae88029788ebe1d7f2fd4 ]

Fix RC5 decoding with Fintek CIR chipset

Commit e87b540be2dd02552fb9244d50ae8b4e4619a34b tightened up the RC5
decoding by adding a check for trailing silence to ensure a valid RC5
command had been received. Unfortunately the trailer length checked was
10 units and the Fintek CIR device does not want to provide details of a
space longer than 6350us. This meant that RC5 remotes working on a
Fintek setup on 3.16 failed on 3.17 and later. Fix this by shortening
the trailer check to 6 units (allowing for a previous space in the
received remote command).

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=117221

Signed-off-by: Jonathan McDowell 
Cc: stable@vger.kernel.org
Signed-off-by: David Härdeman 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] media: dvb_ringbuffer: Add memory barriers

2016-08-17T16:58:31+00:00

[ Upstream commit ca6e6126db5494f18c6c6615060d4d803b528bff ]

Implement memory barriers according to Documentation/circular-buffers.txt:
- use smp_store_release() to update ringbuffer read/write pointers
- use smp_load_acquire() to load write pointer on reader side
- use ACCESS_ONCE() to load read pointer on writer side

This fixes data stream corruptions observed e.g. on an ARM Cortex-A9
quad core system with different types (PCI, USB) of DVB tuners.

Signed-off-by: Soeren Moch 
Cc: stable@vger.kernel.org # 3.14+
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

s5p-mfc: Add release callback for memory region devs

2016-08-14T21:22:55+00:00

[ Upstream commit 6311f1261f59ce5e51fbe5cc3b5e7737197316ac ]

When s5p_mfc_remove() calls put_device() for the reserved memory region
devs, the driver core warns that the dev doesn't have a release callback:

WARNING: CPU: 0 PID: 591 at drivers/base/core.c:251 device_release+0x8c/0x90
Device 's5p-mfc-l' does not have a release() function, it is broken and must be fixed.

Also, the declared DMA memory using dma_declare_coherent_memory() isn't
relased so add a dev .release that calls dma_release_declared_memory().

Cc: 
Fixes: 6e83e6e25eb4 ("[media] s5p-mfc: Fix kernel warning on memory init")
Signed-off-by: Javier Martinez Canillas 
Tested-by: Marek Szyprowski 
Signed-off-by: Sylwester Nawrocki 
Signed-off-by: Sasha Levin

s5p-mfc: Set device name for reserved memory region devs

2016-08-14T21:22:48+00:00

[ Upstream commit 29debab0a94035a390801d1f177d171d014b7765 ]

The devices don't have a name set, so makes dev_name() returns NULL which
makes harder to identify the devices that are causing issues, for example:

WARNING: CPU: 2 PID: 616 at drivers/base/core.c:251 device_release+0x8c/0x90
Device '(null)' does not have a release() function, it is broken and must be fixed.

And after setting the device name:

WARNING: CPU: 0 PID: 591 at drivers/base/core.c:251 device_release+0x8c/0x90
Device 's5p-mfc-l' does not have a release() function, it is broken and must be fixed.

Cc: 
Fixes: 6e83e6e25eb4 ("[media] s5p-mfc: Fix kernel warning on memory init")
Signed-off-by: Javier Martinez Canillas 
Tested-by: Marek Szyprowski 
Signed-off-by: Sylwester Nawrocki 
Signed-off-by: Sasha Levin

media: fix airspy usb probe error path

2016-08-06T16:59:20+00:00

[ Upstream commit aa93d1fee85c890a34f2510a310e55ee76a27848 ]

Fix a memory leak on probe error of the airspy usb device driver.

The problem is triggered when more than 64 usb devices register with
v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.

The memory leak is caused by the probe function of the airspy driver
mishandeling errors and not freeing the corresponding control structures
when an error occours registering the device to v4l2 core.

A badusb device can emulate 64 of these devices, and then through
continual emulated connect/disconnect of the 65th device, cause the
kernel to run out of RAM and crash the kernel, thus causing a local DOS
vulnerability.

Fixes CVE-2016-5400

Signed-off-by: James Patrick-Evans 
Reviewed-by: Kees Cook 
Cc: stable@vger.kernel.org # 3.17+
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

[media] v4l: vsp1: Set the SRU CTRL0 register when starting the stream

2016-07-11T03:07:08+00:00

[ Upstream commit f6acfcdc5b8cdc9ddd53a459361820b9efe958c4 ]

Commit 58f896d859ce ("[media] v4l: vsp1: sru: Make the intensity
controllable during streaming") refactored the stream start code and
removed the SRU CTRL0 register write by mistake. Add it back.

Fixes: 58f896d859ce ("[media] v4l: vsp1: sru: Make the intensity controllable during streaming")

Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] coda: fix error path in case of missing pdata on non-DT platform

2016-07-11T03:07:07+00:00

[ Upstream commit bc717d5e92c8c079280eb4acbe335c6f25041aa2 ]

If we bail out this early, v4l2_device_register() has not been called
yet, so no need to call v4l2_device_unregister().

Fixes: b7bd660a51f0 ("[media] coda: Call v4l2_device_unregister() from a single location")

Reported-by: Michael Olbrich 
Signed-off-by: Philipp Zabel 
Reviewed-by: Fabio Estevam 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

uvc: Forward compat ioctls to their handlers directly

2016-06-18T20:47:33+00:00

[ Upstream commit a44323e2a8f342848bb77e8e04fcd85fcb91b3b4 ]

The current code goes through a lot of indirection just to call a
known handler.  Simplify it: just call the handlers directly.

Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski 
Signed-off-by: Sasha Levin

[media] media: v4l2-compat-ioctl32: fix missing reserved field copy in put_v4l2_create32

2016-06-03T23:15:26+00:00

[ Upstream commit baf43c6eace43868e490f18560287fa3481b2159 ]

In v4l2-compliance utility, test VIDIOC_CREATE_BUFS will check whether reserved
filed of v4l2_create_buffers filled with zero
Reserved field is filled with zero in v4l_create_bufs.
This patch copy reserved field of v4l2_create_buffer from kernel space to user
space

Signed-off-by: Tiffany Lin 
Signed-off-by: Hans Verkuil 
Cc:       # for v3.19 and up
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin