linux-stable.git/include/media/davinci, branch linux-3.16.y

media: davinci/vpbe: array underflow in vpbe_enum_outputs()

2019-09-23T20:12:02+00:00

commit b72845ee5577b227131b1fef23f9d9a296621d7b upstream.

In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
the problem is that "temp_index" can be negative.  This patch changes
the types to unsigned to address this array underflow bug.

Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")

Signed-off-by: Dan Carpenter 
Acked-by: "Lad, Prabhakar" 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Ben Hutchings

media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS

2018-11-20T18:04:46+00:00

commit d75cf0144f150272be806b69b4e62553ba07ea1b upstream.

drop VPFE_CMD_S_CCDC_RAW_PARAMS ioctl from dm355/dm644x following reasons:

- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t
  numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is
  described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user
  the user input over the kernel settings, and then compare them
  for inequality.
- We then go on to use an address provided by user space as both the
  __user pointer for input and pass it through phys_to_virt to come up
  with a kernel pointer to copy the data to. This looks like a trivially
  exploitable root hole.

Signed-off-by: Lad, Prabhakar 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.16: deleted code was slightly different]
Signed-off-by: Ben Hutchings

[media] media: davinci: vpfe: use v4l2_fh for priority handling

2014-04-16T21:24:15+00:00

This patch migrates the vpfe driver to use v4l2_fh for
priority handling.

Signed-off-by: Lad, Prabhakar 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

[media] media: davinci: vpbe: use v4l2_fh for priority handling

2014-04-16T21:23:45+00:00

This patch migrates the vpbe driver to use v4l2_fh for
priority handling. This also fixes v4l2-compliance test.

Signed-off-by: Lad, Prabhakar 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

[media] media: davinci: vpif: display: add V4L2-async support

2013-07-26T16:17:15+00:00

Add support for asynchronous subdevice probing, using the v4l2-async API.
The legacy synchronous mode is still supported too, which allows to
gradually update drivers and platforms.

Signed-off-by: Lad, Prabhakar 
Cc: Guennadi Liakhovetski 
Cc: Hans Verkuil 
Cc: Laurent Pinchart 
Cc: Sakari Ailus 
Cc: Mauro Carvalho Chehab 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

[media] media: davinci: vpif: capture: add V4L2-async support

2013-07-26T16:16:37+00:00

Add support for asynchronous subdevice probing, using the v4l2-async API.
The legacy synchronous mode is still supported too, which allows to
gradually update drivers and platforms.

Signed-off-by: Prabhakar Lad 
Cc: Guennadi Liakhovetski 
Cc: Hans Verkuil 
Cc: Laurent Pinchart 
Cc: Sakari Ailus 
Cc: Mauro Carvalho Chehab 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

[media] media: davinci: vpbe: fix checkpatch warning for CamelCase

2013-05-21T11:19:17+00:00

This patch fixes checkpatch warning to avoid CamelCase.

Signed-off-by: Lad, Prabhakar 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

[media] v4l2: pass std by value to the write-only s_std ioctl

2013-03-24T09:47:00+00:00

This ioctl is defined as IOW, so pass the argument by value instead of by
reference. I could have chosen to add const instead, but this is 1) easier
to handle in drivers and 2) consistent with the s_std subdev operation.

Signed-off-by: Hans Verkuil 
Acked-by: Laurent Pinchart 
Acked-by: Jonathan Corbet 
Acked-by: Guennadi Liakhovetski 
Acked-by: Lad, Prabhakar 
Signed-off-by: Mauro Carvalho Chehab

[media] davinci: more gama -> gamma typo fixes

2013-03-19T19:16:23+00:00

Signed-off-by: Hans Verkuil 
Acked-by: Lad, Prabhakar 
Signed-off-by: Mauro Carvalho Chehab

[media] davinci/dm644x_ccdc: fix compiler warning

2013-03-19T19:16:04+00:00

drivers/media/platform/davinci/dm644x_ccdc.c: In function ‘validate_ccdc_param’:
drivers/media/platform/davinci/dm644x_ccdc.c:233:32: warning: comparison between ‘enum ccdc_gama_width’ and ‘enum ccdc_data_size’ [-Wenum-compare]
It took a bit of work, see this thread of an earlier attempt to fix this:
https://patchwork.kernel.org/patch/1923091/
I've chosen not to follow the suggestions in that thread since gamma_width is
really a different property from data_size. What you really want is to know if
gamma_width fits inside data_size and for that you need to translate each
enum into a maximum bit number so you can safely compare the two.
So I put in two static inline translation functions instead, keeping the rest
of the code the same (except for fixing the 'gama' typo).

Signed-off-by: Hans Verkuil 
Acked-by: Lad, Prabhakar 
Signed-off-by: Mauro Carvalho Chehab