If userspace sends an invalid bandwidth, it should either return
EINVAL or switch to auto mode.
This driver will go past an array and program the hardware on a
wrong way if this happens.
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up to 7 values:
drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/dvb-frontends/dib3000mc.c:134 dib3000mc_setup_pwm_state() warn: inconsistent indenting
drivers/media/dvb-frontends/dib3000mc.c:144 dib3000mc_setup_pwm_state() warn: inconsistent indenting
drivers/media/dvb-frontends/dib3000mc.c:420 dib3000mc_sleep() warn: inconsistent indenting
drivers/media/dvb-frontends/dib3000mc.c:453 dib3000mc_set_channel_cfg() warn: inconsistent indenting
The last one is actually due to a commented code. Let's rework
it, in order to remove the sparse warning without removing the
dead code, as it may be useful in the future.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/usb/go7007/go7007-driver.c:452 frame_boundary() warn: variable dereferenced before check 'vb' (see line 449)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Using static const allows the compiler to optimize the code.
Before static const:
text data bss dec hex filename
4982 524 1568 7074 1ba2 drivers/media/tuners/qt1010.o
After static const:
text data bss dec hex filename
4714 524 1568 6806 1a96 drivers/media/tuners/qt1010.o
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The streg_cbdata can have a negative error value. So, it should be
an integer, and not u8, as reported by smatch:
drivers/media/radio/wl128x/fmdrv_common.c:1517 fmc_prepare() warn: assigning (-115) to unsigned variable 'fmdev->streg_cbdata'
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
There are some false-positive warnings produced by smatch:
drivers/media/rc/ir-sony-decoder.c:129 ir_sony_decode() warn: missing break? reassigning 'data->state'
drivers/media/rc/ir-sony-decoder.c:137 ir_sony_decode() warn: missing break? reassigning 'data->state'
drivers/media/rc/ir-sony-decoder.c:165 ir_sony_decode() warn: missing break? reassigning 'data->state'
This is due to the logic used there to detect the need of a break.
While those are false positives, it is easy to get rid of them without
any drawbacks. The side effect is a cleaner function, with is good.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/platform/s5p-mfc/s5p_mfc.c:1340 s5p_mfc_runtime_resume() warn: this array is probably non-NULL. 'm_dev->alloc_ctx'
alloc_ctx can never be NULL, as it is embeeded inside the struct
s5p_mfc_dev.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/zoran/zoran_device.c:1594 zoran_init_hardware() warn: inconsistent indenting
Fix indent. While here, fix CodingStyle and remove dead code, as it
can always be recovered from git logs.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/ivtv/ivtv-driver.c:832 ivtv_init_struct2() error: buffer overflow 'itv->card->video_inputs' 6 <= 6
That happens because nof_inputs and nof_audio_inputs can be initialized
as IVTV_CARD_MAX_VIDEO_INPUTS, instead of IVTV_CARD_MAX_VIDEO_INPUTS - 1.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/i2c/saa717x.c:155 saa717x_read() warn: mask and shift to zero
drivers/media/i2c/saa717x.c:155 saa717x_read() warn: mask and shift to zero
This is done right at saa717x_write(), but the read function is
broken. Thankfully, there's just one place at saa717x driver that
uses multibyte read (for status report, via printk).
Yet, let's fix it. From saa717x_write(), it is clear that the
bytes are in little endian:
mm1[4] = (value >> 16) & 0xff;
mm1[3] = (value >> 8) & 0xff;
mm1[2] = value & 0xff;
So, the same order should be valid for read too.
Compile-tested only.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/saa7164/saa7164-core.c:631 saa7164_irq() warn: variable dereferenced before check 'dev' (see line 621)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/ngene/ngene-core.c:1529 init_channel() error: we previously assumed 'chan->fe' could be null (see line 1521)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/cx18/cx18-driver.c:807 cx18_init_struct2() error: buffer overflow 'cx->card->video_inputs' 6 <= 6
That happens because nof_inputs and nof_audio_inputs can be initialized
as CX18_CARD_MAX_VIDEO_INPUTS, instead of CX18_CARD_MAX_VIDEO_INPUTS - 1.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Andy Walls <awalls@md.metrocast.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/rc/rc-main.c:749 rc_close() warn: inconsistent indenting
There's an extra space there.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/platform/am437x/am437x-vpfe.c: In function 'vpfe_ccdc_update_raw_params':
drivers/media/platform/am437x/am437x-vpfe.c:430:38: warning: variable 'config_params' set but not used [-Wunused-but-set-variable]
struct vpfe_ccdc_config_params_raw *config_params =
^
vpfe_ccdc_update_raw_params() is supposed to update the raw
params at ccdc. However, it is just creating a local var and changing
it.
Compile-tested only.
Cc: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
radio-bcm2048.c: In function 'bcm2048_i2c_driver_probe':
radio-bcm2048.c:2597:11: warning: variable 'skip_release' set but not used [-Wunused-but-set-variable]
int err, skip_release = 0;
^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In file included from include/uapi/linux/posix_types.h:4:0,
from include/uapi/linux/types.h:13,
from include/linux/types.h:5,
from include/uapi/linux/sysinfo.h:4,
from include/uapi/linux/kernel.h:4,
from include/linux/cache.h:4,
from include/linux/time.h:4,
from include/linux/input.h:11,
from drivers/media/usb/dvb-usb/dvb-usb.h:13,
from drivers/media/usb/dvb-usb/dib0700.h:13,
from drivers/media/usb/dvb-usb/dib0700_devices.c:9:
drivers/media/dvb-frontends/dib8000.h: In function 'dib8000_attach':
include/linux/stddef.h:8:14: warning: return makes integer from pointer without a cast [-Wint-conversion]
#define NULL ((void *)0)
^
drivers/media/dvb-frontends/dib8000.h:72:9: note: in expansion of macro 'NULL'
return NULL;
^
Reported-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In file included from drivers/media/common/b2c2/flexcop-fe-tuner.c:13:0:
drivers/media/dvb-frontends/cx24123.h:54:2: warning: 'cx24123_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
cx24123_get_tuner_i2c_adapter(struct dvb_frontend *fe)
^
In file included from drivers/media/usb/em28xx/em28xx-dvb.c:46:0:
drivers/media/dvb-frontends/s921.h:40:2: warning: 's921_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
s921_get_tuner_i2c_adapter(struct dvb_frontend *fe)
^
In file included from drivers/media/usb/em28xx/em28xx-dvb.c:55:0:
drivers/media/dvb-frontends/mb86a20s.h:49:2: warning: 'mb86a20s_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
mb86a20s_get_tuner_i2c_adapter(struct dvb_frontend *fe)
^
In file included from drivers/media/usb/cx231xx/cx231xx-dvb.c:35:0:
drivers/media/dvb-frontends/mb86a20s.h:49:2: warning: 'mb86a20s_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
mb86a20s_get_tuner_i2c_adapter(struct dvb_frontend *fe)
^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Fix these compiler warnings that appeared after switching to gcc-5.1.0:
drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_power':
drivers/media/platform/s3c-camif/camif-capture.c:118:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
if (!on == camif->sensor.power_count)
^
drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_streaming':
drivers/media/platform/s3c-camif/camif-capture.c:134:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
if (!on == camif->sensor.stream_count)
^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Fix these compiler warnings that appeared after switching to gcc-5.1.0:
drivers/media/i2c/s5k5baf.c: In function 's5k5baf_set_power':
drivers/media/i2c/s5k5baf.c:1057:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
if (!on != state->power)
^
drivers/media/i2c/s5k6aa.c: In function 's5k6aa_set_power':
drivers/media/i2c/s5k6aa.c:878:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
if (!on == s5k6aa->power) {
^
drivers/media/i2c/s5c73m3/s5c73m3-core.c: In function 's5c73m3_oif_set_power':
drivers/media/i2c/s5c73m3/s5c73m3-core.c:1456:17: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
} else if (!on == state->power) {
^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
For these encodings the quantization range should be ignored, since
there is only one possible Y'CbCr encoding.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In order to be consistent with the other Y'CbCr encodings add
support for full range V4L2_YCBCR_ENC_BT2020_CONST_LUM.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In order to be consistent with the other Y'CbCr encodings add
support for full range V4L2_YCBCR_ENC_BT2020.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In order to be consistent with the other Y'CbCr encodings add
support for full range V4L2_YCBCR_ENC_SMPTE240M.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Add a log_status function to the test pattern generator and use that
in vivid. This simplifies debugging complex colorspace problems.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Use the VIVID_WEBCAM_SIZES constant where appropriate and add a
1920x1080 pixel frame size setting with frame rates of 2 fps and
5 fps.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
You must use static inline otherwise you get these errors if CONFIG_OF is not defined:
In file included from drivers/media/platform/soc_camera/soc_camera.c:39:0:
include/media/v4l2-of.h:112:13: warning: 'v4l2_of_free_endpoint' defined but not used [-Wunused-function]
static void v4l2_of_free_endpoint(struct v4l2_of_endpoint *endpoint)
^
In file included from drivers/media/platform/soc_camera/atmel-isi.c:28:0:
include/media/v4l2-of.h:112:13: warning: 'v4l2_of_free_endpoint' defined but not used [-Wunused-function]
static void v4l2_of_free_endpoint(struct v4l2_of_endpoint *endpoint)
^
In file included from drivers/media/platform/soc_camera/rcar_vin.c:36:0:
include/media/v4l2-of.h:112:13: warning: 'v4l2_of_free_endpoint' defined but not used [-Wunused-function]
static void v4l2_of_free_endpoint(struct v4l2_of_endpoint *endpoint)
^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Add device tree support for adp1653 flash LED driver.
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Instead of parsing the link-frequencies property in the driver, let
v4l2_of_alloc_parse_endpoint() do it.
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Reviewed-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The link-frequencies property is a variable length array of link frequencies
in an endpoint. The array is needed by an increasing number of drivers, so
it makes sense to add it to struct v4l2_of_endpoint.
However, the length of the array is variable and the size of struct
v4l2_of_endpoint is fixed since it is allocated by the caller. The options
here are
1. to define a fixed maximum limit of link frequencies that has to be the
global maximum of all boards. This is seen as problematic since the maximum
could be largish, and everyone hitting the problem would need to submit a
patch to fix it, or
2. parse the property in every driver. This doesn't sound appealing as two
of the three implementations submitted to linux-media were wrong, and one of
them was even merged before this was noticed, or
3. change the interface so that allocating and releasing memory according to
the size of the array is possible. This is what the patch does.
v4l2_of_alloc_parse_endpoint() is just like v4l2_of_parse_endpoint(), but it
will allocate the memory resources needed to store struct v4l2_of_endpoint
and the additional arrays pointed to by this struct. A corresponding release
function v4l2_of_free_endpoint() is provided to release the memory allocated
by v4l2_of_alloc_parse_endpoint().
In addition to this, the link-frequencies property is parsed as well, and
the result is stored to struct v4l2_of_endpoint field link_frequencies.
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Tested-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Zero the entire struct starting from bus_type. As more fields are added, no
changes will be needed in the function to reset their value explicitly.
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The field is unused. Remove it.
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJVPYnpAAoJEHm+PkMAQRiGVucH/2AIvaMTlYYvD62Ayk0BBKi1
WYnePuy9+t05pNyG103Xvaqsuuw3JZA+5BL1ezbxXcSdvdroDVbFdRgF0D23O6U0
rm/jec6Cd/Wf8bPvo8weka0IjBSIYXCrnatJPlc4W3jOxin4a9y6XeF3rUTXAsF+
AxnImYrFKNy4ZAZ7tLGA4I5ZHolYtO5RrbZmgAtSybobppcmkwTErAbRCk1GHLTg
Mf+3UTU/4aFM1Ui32MYioESTrhURBQ5gZ5nAU+48hSgW3FEqK40tniuzjrNA+oBT
KOs59yjNzWnwJ8wfETLT6CUrOZJwks3WyGbGXVfDoG3ThHl6NgtqpjR4S6qSHs4=
=qIAb
-----END PGP SIGNATURE-----
Merge tag 'v4.1-rc1' into patchwork
Linux 4.1-rc1
* tag 'v4.1-rc1': (11651 commits)
Linux 4.1-rc1
x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue
v4l: xilinx: fix for include file movement
platform/chrome: chromeos_laptop - instantiate Atmel at primary address
RCU pathwalk breakage when running into a symlink overmounting something
fix I_DIO_WAKEUP definition
direct-io: only inc/dec inode->i_dio_count for file systems
fs/9p: fix readdir()
Btrfs: prevent list corruption during free space cache processing
toshiba_acpi: Do not register vendor backlight when acpi_video bl is available
x86: fix special __probe_kernel_write() tail zeroing case
crypto: img-hash - CRYPTO_DEV_IMGTEC_HASH should depend on HAS_DMA
crypto: x86/sha512_ssse3 - fixup for asm function prototype change
nios2: rework cache
nios2: Add types.h header required for __u32 type
ALSA: hda - fix headset mic detection problem for one more machine
eth: bf609 eth clock: add pclk clock for stmmac driver probe
blackfin: Wire up missing syscalls
Btrfs: fix inode cache writeout
ACPI / scan: Add a scan handler for PRP0001
...
AMD CPUs don't reinitialize the SS descriptor on SYSRET, so SYSRET with
SS == 0 results in an invalid usermode state in which SS is apparently
equal to __USER_DS but causes #SS if used.
Work around the issue by setting SS to __KERNEL_DS __switch_to, thus
ensuring that SYSRET never happens with SS set to NULL.
This was exposed by a recent vDSO cleanup.
Fixes: e7d6eefaaa x86/vdso32/syscall.S: Do not load __USER32_DS to %ss
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Peter Anvin <hpa@zytor.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Denys Vlasenko <vda.linux@googlemail.com>
Cc: Brian Gerst <brgerst@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Pull intel drm fixes from Dave Airlie.
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/i915: vlv: fix save/restore of GFX_MAX_REQ_COUNT reg
drm/i915: Workaround to avoid lite restore with HEAD==TAIL
drm/i915: cope with large i2c transfers
Pull intel iommu updates from David Woodhouse:
"This lays a little of the groundwork for upcoming Shared Virtual
Memory support — fixing some bogus #defines for capability bits and
adding the new ones, and starting to use the new wider page tables
where we can, in anticipation of actually filling in the new fields
therein.
It also allows graphics devices to be assigned to VM guests again.
This got broken in 3.17 by disallowing assignment of RMRR-afflicted
devices. Like USB, we do understand why there's an RMRR for graphics
devices — and unlike USB, it's actually sane. So we can make an
exception for graphics devices, just as we do USB controllers.
Finally, tone down the warning about the X2APIC_OPT_OUT bit, due to
persistent requests. X2APIC_OPT_OUT was added to the spec as a nasty
hack to allow broken BIOSes to forbid us from using X2APIC when they
do stupid and invasive things and would break if we did.
Someone noticed that since Windows doesn't have full IOMMU support for
DMA protection, setting the X2APIC_OPT_OUT bit made Windows avoid
initialising the IOMMU on the graphics unit altogether.
This means that it would be available for use in "driver mode", where
the IOMMU registers are made available through a BAR of the graphics
device and the graphics driver can do SVM all for itself.
So they started setting the X2APIC_OPT_OUT bit on *all* platforms with
SVM capabilities. And even the platforms which *might*, if the
planets had been aligned correctly, possibly have had SVM capability
but which in practice actually don't"
* git://git.infradead.org/intel-iommu:
iommu/vt-d: support extended root and context entries
iommu/vt-d: Add new extended capabilities from v2.3 VT-d specification
iommu/vt-d: Allow RMRR on graphics devices too
iommu/vt-d: Print x2apic opt out info instead of printing a warning
iommu/vt-d: kill bogus ecap_niotlb_iunits()
