linux-stable.git/drivers/media, branch v4.4.63

dvb-usb-firmware: don't do DMA on stack

2017-04-21T07:30:07+00:00

commit 67b0503db9c29b04eadfeede6bebbfe5ddad94ef upstream.

The buffer allocation for the firmware data was changed in
commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
but the same applies for the reset value.

Fixes: 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
Signed-off-by: Stefan Brüns 
Signed-off-by: Mauro Carvalho Chehab 
Cc: Ben Hutchings 
Cc: Brad Spengler 
Signed-off-by: Greg Kroah-Hartman

dvb-usb: don't use stack for firmware load

2017-04-21T07:30:07+00:00

commit 43fab9793c1f44e665b4f98035a14942edf03ddc upstream.

As reported by Marc Duponcheel , firmware load on
dvb-usb is using the stack, with is not allowed anymore on default
Kernel configurations:

[ 1025.958836] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in cold state, will try to load a firmware
[ 1025.958853] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[ 1025.958855] dvb-usb: could not stop the USB controller CPU.
[ 1025.958856] dvb-usb: error while transferring firmware (transferred size: -11, block size: 3)
[ 1025.958856] dvb-usb: firmware download failed at 8 with -22
[ 1025.958867] usbcore: registered new interface driver dvb_usb_dtt200u

[    2.789902] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[    2.789905] ------------[ cut here ]------------
[    2.789911] WARNING: CPU: 3 PID: 2196 at drivers/usb/core/hcd.c:1584 usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789912] transfer buffer not dma capable
[    2.789912] Modules linked in: btusb dvb_usb_dtt200u(+) dvb_usb_af9035(+) btrtl btbcm dvb_usb dvb_usb_v2 btintel dvb_core bluetooth rc_core rfkill x86_pkg_temp_thermal intel_powerclamp coretemp crc32_pclmul aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd drm_kms_helper syscopyarea sysfillrect pcspkr i2c_i801 sysimgblt fb_sys_fops drm i2c_smbus i2c_core r8169 lpc_ich mfd_core mii thermal fan rtc_cmos video button acpi_cpufreq processor snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd crc32c_intel ahci libahci libata xhci_pci ehci_pci xhci_hcd ehci_hcd usbcore usb_common dm_mirror dm_region_hash dm_log dm_mod
[    2.789936] CPU: 3 PID: 2196 Comm: systemd-udevd Not tainted 4.9.0-gentoo #1
[    2.789937] Hardware name: ASUS All Series/H81I-PLUS, BIOS 0401 07/23/2013
[    2.789938]  ffffc9000339b690 ffffffff812bd397 ffffc9000339b6e0 0000000000000000
[    2.789939]  ffffc9000339b6d0 ffffffff81055c86 000006300339b6a0 ffff880116c0c000
[    2.789941]  0000000000000000 0000000000000000 0000000000000001 ffff880116c08000
[    2.789942] Call Trace:
[    2.789945]  [] dump_stack+0x4d/0x66
[    2.789947]  [] __warn+0xc6/0xe0
[    2.789948]  [] warn_slowpath_fmt+0x4a/0x50
[    2.789952]  [] usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789954]  [] ? io_schedule_timeout+0xd8/0x110
[    2.789956]  [] usb_hcd_submit_urb+0x9c/0x980 [usbcore]
[    2.789958]  [] ? copy_page_to_iter+0x14f/0x2b0
[    2.789960]  [] ? pagecache_get_page+0x28/0x240
[    2.789962]  [] ? touch_atime+0x20/0xa0
[    2.789964]  [] usb_submit_urb+0x2c4/0x520 [usbcore]
[    2.789967]  [] usb_start_wait_urb+0x5a/0xe0 [usbcore]
[    2.789969]  [] usb_control_msg+0xbc/0xf0 [usbcore]
[    2.789970]  [] usb_cypress_writemem+0x3d/0x40 [dvb_usb]
[    2.789972]  [] usb_cypress_load_firmware+0x4f/0x130 [dvb_usb]
[    2.789973]  [] ? console_unlock+0x2fe/0x5d0
[    2.789974]  [] ? vprintk_emit+0x27c/0x410
[    2.789975]  [] ? vprintk_default+0x1a/0x20
[    2.789976]  [] ? printk+0x43/0x4b
[    2.789977]  [] dvb_usb_download_firmware+0x60/0xd0 [dvb_usb]
[    2.789979]  [] dvb_usb_device_init+0x3d8/0x610 [dvb_usb]
[    2.789981]  [] dtt200u_usb_probe+0x92/0xd0 [dvb_usb_dtt200u]
[    2.789984]  [] usb_probe_interface+0xfc/0x270 [usbcore]
[    2.789985]  [] driver_probe_device+0x215/0x2d0
[    2.789986]  [] __driver_attach+0x96/0xa0
[    2.789987]  [] ? driver_probe_device+0x2d0/0x2d0
[    2.789988]  [] bus_for_each_dev+0x5b/0x90
[    2.789989]  [] driver_attach+0x19/0x20
[    2.789990]  [] bus_add_driver+0x11c/0x220
[    2.789991]  [] driver_register+0x5b/0xd0
[    2.789994]  [] usb_register_driver+0x7c/0x130 [usbcore]
[    2.789994]  [] ? 0xffffffffa06a5000
[    2.789996]  [] dtt200u_usb_driver_init+0x1e/0x20 [dvb_usb_dtt200u]
[    2.789997]  [] do_one_initcall+0x38/0x140
[    2.789998]  [] ? __vunmap+0x7c/0xc0
[    2.789999]  [] ? do_init_module+0x22/0x1d2
[    2.790000]  [] do_init_module+0x5a/0x1d2
[    2.790002]  [] load_module+0x1e11/0x2580
[    2.790003]  [] ? show_taint+0x30/0x30
[    2.790004]  [] ? kernel_read_file+0x100/0x190
[    2.790005]  [] SyS_finit_module+0xba/0xc0
[    2.790007]  [] entry_SYSCALL_64_fastpath+0x13/0x94
[    2.790008] ---[ end trace c78a74e78baec6fc ]---

So, allocate the structure dynamically.

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 4.9: adjust context]
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

dvb-usb-v2: avoid use-after-free

2017-04-21T07:30:07+00:00

commit 005145378c9ad7575a01b6ce1ba118fb427f583a upstream.

I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:

drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.

This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

uvcvideo: uvc_scan_fallback() for webcams with broken chain

2017-03-30T07:35:20+00:00

From: Henrik Ingo 

[ Upstream commit e950267ab802c8558f1100eafd4087fd039ad634 ]

Some devices have invalid baSourceID references, causing uvc_scan_chain()
to fail, but if we just take the entities we can find and put them
together in the most sensible chain we can think of, turns out they do
work anyway. Note: This heuristic assumes there is a single chain.

At the time of writing, devices known to have such a broken chain are
  - Acer Integrated Camera (5986:055a)
  - Realtek rtl157a7 (0bda:57a7)

Signed-off-by: Henrik Ingo 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sumit Semwal 
Signed-off-by: Greg Kroah-Hartman

media: fix dm1105.c build error

2017-03-12T05:37:24+00:00

commit e3bb3cddd177550d63a3e4909cf1a7782f13414d upstream.

Fix dm1105 build error when CONFIG_I2C_ALGOBIT=m and
CONFIG_DVB_DM1105=y.

drivers/built-in.o: In function `dm1105_probe':
dm1105.c:(.text+0x2836e7): undefined reference to `i2c_bit_add_bus'

Signed-off-by: Randy Dunlap 
Reported-by: kbuild test robot 
Cc: Javier Martinez Canillas 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

uvcvideo: Fix a wrong macro

2017-03-12T05:37:24+00:00

commit 17c341ec0115837a610b2da15e32546e26068234 upstream.

Don't mix up UVC_BUF_STATE_* and VB2_BUF_STATE_* codes.

Fixes: 6998b6fb4b1c ("[media] uvcvideo: Use videobuf2-vmalloc")

Signed-off-by: Guennadi Liakhovetski 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

am437x-vpfe: always assign bpp variable

2017-03-12T05:37:24+00:00

commit 6ebf75774f823ddbdbd10921006989d4df222f4a upstream.

In vpfe_s_fmt(), when the sensor format and the requested format were
the same, bpp was assigned to vpfe->bpp without being initialized first.

Grab the bpp value that is currently used by using __vpfe_get_format()
instead of its wrapper, vpfe_try_fmt().

This use of uninitialized variable has been found by compiling the
kernel with clang.

Fixes: 417d2e507edc ("[media] media: platform: add VPFE capture driver
support for AM437X")

Signed-off-by: Nicolas Iooss 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

siano: make it work again with CONFIG_VMAP_STACK

2017-02-23T16:43:09+00:00

commit f9c85ee67164b37f9296eab3b754e543e4e96a1c upstream.

Reported as a Kaffeine bug:
	https://bugs.kde.org/show_bug.cgi?id=375811

The USB control messages require DMA to work. We cannot pass
a stack-allocated buffer, as it is not warranted that the
stack would be into a DMA enabled area.

On Kernel 4.9, the default is to not accept DMA on stack anymore
on x86 architecture. On other architectures, this has been a
requirement since Kernel 2.2. So, after this patch, this driver
should likely work fine on all archs.

Tested with USB ID 2040:5510: Hauppauge Windham

Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

s5k4ecgx: select CRC32 helper

2017-02-01T07:30:53+00:00

commit c739c0a7c3c2472d7562b8f802cdce44d2597c8b upstream.

A rare randconfig build failure shows up in this driver when
the CRC32 helper is not there:

drivers/media/built-in.o: In function `s5k4ecgx_s_power':
s5k4ecgx.c:(.text+0x9eb4): undefined reference to `crc32_le'

This adds the 'select' that all other users of this function have.

Fixes: 8b99312b7214 ("[media] Add v4l2 subdev driver for S5K4ECGX sensor")

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

ite-cir: initialize use_demodulator before using it

2017-01-26T07:23:50+00:00

commit 7ec03e60ef81c19b5d3a46dd070ee966774b860f upstream.

Function ite_set_carrier_params() uses variable use_demodulator after
having initialized it to false in some if branches, but this variable is
never set to true otherwise.

This bug has been found using clang -Wsometimes-uninitialized warning
flag.

Fixes: 620a32bba4a2 ("[media] rc: New rc-based ite-cir driver for
several ITE CIRs")

Signed-off-by: Nicolas Iooss 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman