linux-stable.git/drivers/media, branch v4.1.8

cx24116: fix a buffer overflow when checking userspace params

2015-08-03T16:29:03+00:00

commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

s5h1420: fix a buffer overflow when checking userspace params

2015-08-03T16:29:03+00:00

commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up to 7 values:
	drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7

Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

saa7164: fix querycap warning

2015-08-03T16:29:02+00:00

commit 534bc3e2ee93835badca753bedce8073c67caa92 upstream.

Fix the VIDIOC_QUERYCAP warning due to the missing device_caps. Don't fill
in the version field, the V4L2 core will do that for you.

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

af9013: Don't accept invalid bandwidth

2015-08-03T16:29:02+00:00

commit d7b76c91f471413de9ded837bddeca2164786571 upstream.

If userspace sends an invalid bandwidth, it should either return
EINVAL or switch to auto mode.

This driver will go past an array and program the hardware on a
wrong way if this happens.

Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

cx24117: fix a buffer overflow when checking userspace params

2015-08-03T16:29:02+00:00

commit 82e3b88b679049f043fe9b03991d6d66fc0a43c8 upstream.

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

cx18: add missing caps for the PCM video device

2015-08-03T16:29:02+00:00

commit 2b4fd3ede3bab65ef5b97387b90899d11e4d3202 upstream.

The cx18 PCM video device didn't have any capabilities set, which caused a warnings
in the v4l2 core:

[    6.229393] ------------[ cut here ]------------
[    6.229414] WARNING: CPU: 1 PID: 593 at
drivers/media/v4l2-core/v4l2-ioctl.c:1025 v4l_querycap+0x41/0x70
[videodev]()
[    6.229415] Modules linked in: cx18_alsa mxl5005s s5h1409
tuner_simple tuner_types cs5345 tuner intel_rapl iosf_mbi
x86_pkg_temp_thermal coretemp raid1 snd_hda_codec_realtek kvm_intel
snd_hda_codec_generic snd_hda_codec_hdmi kvm snd_oxygen(+) snd_hda_intel
snd_oxygen_lib snd_hda_controller snd_hda_codec snd_mpu401_uart iTCO_wdt
snd_rawmidi iTCO_vendor_support snd_hwdep crct10dif_pclmul crc32_pclmul
crc32c_intel snd_seq cx18 snd_seq_device ghash_clmulni_intel
videobuf_vmalloc tveeprom cx2341x snd_pcm serio_raw videobuf_core vfat
dvb_core fat v4l2_common snd_timer videodev snd lpc_ich i2c_i801 joydev
mfd_core mei_me media soundcore tpm_infineon soc_button_array tpm_tis
mei shpchp tpm nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc
i915 nouveau mxm_wmi wmi e1000e ttm i2c_algo_bit drm_kms_helper
[    6.229444]  drm ptp pps_core video
[    6.229446] CPU: 1 PID: 593 Comm: v4l_id Not tainted
3.19.3-200.fc21.x86_64 #1
[    6.229447] Hardware name: Gigabyte Technology Co., Ltd.
Z87-D3HP/Z87-D3HP-CF, BIOS F6 01/20/2014
[    6.229448]  0000000000000000 00000000d12b1131 ffff88042dacfc28
ffffffff8176e215
[    6.229449]  0000000000000000 0000000000000000 ffff88042dacfc68
ffffffff8109bc1a
[    6.229451]  ffffffffa0594000 ffff88042dacfd90 0000000000000000
ffffffffa04e2140
[    6.229452] Call Trace:
[    6.229466]  [] dump_stack+0x45/0x57
[    6.229469]  [] warn_slowpath_common+0x8a/0xc0
[    6.229472]  [] warn_slowpath_null+0x1a/0x20
[    6.229474]  [] v4l_querycap+0x41/0x70 [videodev]
[    6.229477]  [] __video_do_ioctl+0x29c/0x320 [videodev]
[    6.229479]  [] ? do_last+0x2f1/0x1210
[    6.229491]  [] video_usercopy+0x366/0x5d0 [videodev]
[    6.229494]  [] ? v4l_querycap+0x70/0x70 [videodev]
[    6.229497]  [] video_ioctl2+0x15/0x20 [videodev]
[    6.229499]  [] v4l2_ioctl+0x164/0x180 [videodev]
[    6.229501]  [] do_vfs_ioctl+0x2f8/0x500
[    6.229502]  [] SyS_ioctl+0x81/0xa0
[    6.229505]  [] system_call_fastpath+0x12/0x17
[    6.229506] ---[ end trace dacd80d4b19277ea ]---

Added the necessary capabilities to stop this warning.

Signed-off-by: Hans Verkuil 
Reported-by: Laura Abbott 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

rc-core: fix dib0700 scancode generation for RC5

2015-08-03T16:29:02+00:00

commit 4d298b8539ed59f1d69d3aa6e41a2c4908137612 upstream.

commit af3a4a9bbeb0 ("[media] dib0700: NEC scancode cleanup") cleaned
up the NEC scancode logic but overlooked the RC5 case.

This patch brings the RC5 case in line with the NEC code and makes
the struct self-documenting.

Signed-off-by: David Härdeman 
Reported-by: David Cimbůrek 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: Fix regression in some more dib0700 based devices

2015-08-03T16:29:02+00:00

commit e989a73ebd09d22c22ead51fa363a2f56f70f28a upstream.

Fix an oops during device initialization by correctly setting size_of_priv
instead of leaving it 0.
The regression was introduced by 8abe4a0a3f6d4217b16a ("[media] dib7000:
export just one symbol") and only fixed for one type of dib0700 based
devices in 9e334c75642b6e5bfb95 ("[media] Fix regression in some dib0700
based devices").

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=92301

Fixes: 8abe4a0a3f6d4217b16a ("[media] dib7000: export just one symbol")

Signed-off-by: Thomas Reitmayr 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

vb2: Don't WARN when v4l2_buffer.bytesused is 0 for multiplanar buffers

2015-08-03T16:29:02+00:00

commit 77a3c6fd90c94f635edb00d4a65f485687538791 upstream.

Commit f61bf13b6a07 ("[media] vb2: add allow_zero_bytesused flag to the
vb2_queue struct") added a WARN_ONCE to catch usage of a deprecated API
using a zero value for v4l2_buffer.bytesused.

However, the condition is checked incorrectly, as the v4L2_buffer
bytesused field is supposed to be ignored for multiplanar buffers. This
results in spurious warnings when using the multiplanar API.

Fix it by checking v4l2_buffer.bytesused for uniplanar buffers and
v4l2_plane.bytesused for multiplanar buffers.

Fixes: f61bf13b6a07 ("[media] vb2: add allow_zero_bytesused flag to the vb2_queue struct")

Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

Kconfig: disable Media Controller for DVB

2015-06-18T06:53:36+00:00

Since when we start discussions about the usage Media Controller for
complex hardware, one thing become clear: the way it is, MC fails to
map anything different than capture/output/m2m video-only streaming.

The point is that MC has entities named as devnodes, but the only
devnode used (before the DVB patches) is MEDIA_ENT_T_DEVNODE_V4L.
Due to the way MC got implemented, however, this entity actually
doesn't represent the devnode, but the hardware I/O engine that
receives data via DMA.

By coincidence, such DMA is associated with the V4L device node
on webcam hardware, but this is not true even for other V4L2
devices. For example, on USB hardware, the DMA is done via the
USB controller. The data passes though a in-kernel filter that
strips off the URB headers. Other V4L2 devices like radio may not
even have DMA. When it have, the DMA is done via ALSA, and not
via the V4L devnode.

In other words, MC is broken as a whole, but tagging it as BROKEN
right now would do more harm than good.

So, instead, let's mark, for now, the DVB part as broken and
block all new changes to MC while we fix this mess, whith
we hopefully will do for the next Kernel version.

Requested-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil 
Acked-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Linus Torvalds