The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16
bytes of uninitialized stack memory, because the "reserved" member of
the fb_vblank struct declared on the stack is not altered or zeroed
before being copied back to the user. This patch takes care of it.
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Signed-off-by: Andy Walls <awalls@md.metrocast.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The wrong value for the volume control limit, 65335 vs. 65535,
prevents proper cx25840 v4l2_subdevice initialization.
Reported-by: Igor M. liplianin <liplianin@me.by>
Signed-off-by: Andy Walls <awalls@md.metrocast.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Video device was not being released on driver remove.
Signed-off-by: Pawel Osciak <p.osciak@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Output buffer has to be at least the size of input buffer, not the other
way around.
Signed-off-by: Pawel Osciak <p.osciak@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The drivers/media/video/mt9v022.c file, on line 405, tries a "case 0" o a
v4l2_mbus_pixelcode enum which don't have an 0 value element, so I got a compile
warning. That "case" is useless so it can be removed.
Signed-off-by: Ionut Gabriel Popescu <poyo_vl@yahoo.com>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The mx25_camera_irq irq handler may get called after the camera has been
deactivated (from mx2_camera_deactivate). Detect this situation, and bail out.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
As the end of frame marker does not contain any pixel, it must not be
transferred.
Reported-by: Ivo Jager <ivo.jager@siliconfields.net>
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This fixes a nasty memory corruption bug when using userptr I/O.
The function videobuf_pages_to_sg() sets up the scatter-gather list for the
DMA transfer to the userspace pages. The first transfer is setup correctly
(the size is set to PAGE_SIZE - offset), but all other transfers have size
PAGE_SIZE. This is wrong for the last transfer which may be less than PAGE_SIZE.
Most, if not all, drivers will program the boards DMA engine correctly, i.e.
even though the size in the last sg element is wrong, they will do their
own size calculations and make sure the right amount is DMA-ed, and so seemingly
prevent memory corruption.
However, behind the scenes the dynamic DMA mapping support (in lib/swiotlb.c)
may create bounce buffers if the memory pages are not in DMA-able memory.
This happens for example on a 64-bit linux with a board that only supports
32-bit DMA.
These bounce buffers DO use the information in the sg list to determine the
size. So while the DMA engine transfers the correct amount of data, when the
data is 'bounced' back too much is copied, causing buffer overwrites.
The fix is simple: calculate and set the correct size for the last sg list
element.
Signed-off-by: Hans Verkuil <hans.verkuil@tandberg.com>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Drivers shouldn't sleep while holding a spinlock. A previous workaround
were to release the spinlock before callinc schedule().
This patch uses a different approach: it just waits for the
siano hardware to answer.
Signed-off-by: Richard Zidlicky <rz@linux-m68k.org>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
To improve performance on DiB7770-devices enabling the current mirror
is needed.
This patch adds an option to the dib7000p-driver to do that and it
creates a separate device-entry in dib0700-device to use those changes
on hardware which is using the DiB7770.
Signed-off-by: Olivier Grenie <olivier.grenie@dibcom.fr>
Signed-off-by: Patrick Boettcher <patrick.boettcher@dibcom.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
These keys are found on remote bundled with
Toshiba Qosmio F50-10q.
Found and tested by, Sami R <maesesami@gmail.com>
Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Acked-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The logic in ir_timer_keyup was inverted.
In case that values aren't equal,
the meaning of the time_is_after_eq_jiffies(ir->keyup_jiffies) is that
ir->keyup_jiffies is after the the jiffies or equally that
that jiffies are before the the ir->keyup_jiffies which is
exactly the situation we want to avoid (that the timeout is in the future)
Confusing Eh?
Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Acked-by: Jarod Wilson <jarod@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
As reported by Anton Blanchard <anton@samba.org>, double IR events on
2.6.36-rc2 and a DViCO FusionHDTV DVB-T Dual Express are happening:
[ 1351.032084] ir_keydown: i2c IR (FusionHDTV): key down event, key 0x0067, scancode 0x0051
[ 1351.281284] ir_keyup: keyup key 0x0067
ie one key down event and one key up event 250ms later.
So, we need to increase the repeat timeout, to avoid this bug to hit.
As we're doing it at core, this fix is not needed anymore at dib0700 driver.
Thanks-to: Anton Blanchard <anton@samba.org>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
As reported by Carlos, Prolink Pixelview SBTVD Hybrid is based on
Conexant cx231xx + Fujitsu 86A20S demodulator. However, both shares
the same USB ID. So, we need to use USB bcdDevice, in order to
properly discover what's the board.
We know for sure that bcd 0x100 is used for a dib0700 device, while
bcd 0x4001 is used for a cx23102 device. This patch reserves two ranges,
the first one from 0x0000-0x3f00 for dib0700, and the second from
0x4000-0x4fff for cx231xx devices.
This may need fixes in the future, as we get access to other devices.
Thanks-to: Carlos Americo Domiciano <c_domiciano@yahoo.com.br>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Reported in lirc sf.net tracker and on lirc mailing list
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
When plugging some webcams on ARM, the system crashes.
This is because we alloc buffer for an urb through usb_buffer_alloc,
the alloced buffer is already in DMA coherent region, so we should
set the flag of this urb to URB_NO_TRANSFER_DMA_MAP, otherwise when
we submit this urb, the hcd core will handle this address as an
non-DMA address and call dma_map_single/sg to map it. On arm
architecture, dma_map_single a DMA coherent address will be catched
by a BUG_ON().
Signed-off-by: Jason Wang <jason77.wang@gmail.com>
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Some time a go our customers wrote me about problem with our TV card
BeholdTV Columbus. It's PCMCIA TV card for notebook.
As I understand v4l has some regression with autodetect address of tuners.
I can set incorrect I2C address and had report about detect tuner. No any TV of course.
When I set correct tuner type and I2C address of the tuners all works well.
Signed-off-by: Beholder Intl. Ltd. Dmitry Belimov <d.belimov@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The original code dereferenced "port" before checking it for NULL. I
moved the test down below the check. Also I changed the comparisons a
little so people wouldn't get confused and think "port" and "buf" were
ints instead of pointers. (Probably that's what lead to this issue in
the first place.)
There is only one caller for this function and it passes non-NULL
pointers, so this is essentially a cleanup rather than a bugfix.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
We dereference "maskptr" unconditionally at the start of the function
and also inside the call to parse_tlist() towards the end of the
function. This function is called from store_val_any() and it always
passes a non-NULL pointer.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Mike Isely <isely@pobox.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
"fw" is always a non-NULL pointer at this point, and anyway
release_firmware() accepts NULL pointers.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The original code dereferenced ir->raw after freeing it and setting it
to NULL.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
If we return directly here then we miss out on some mutex_unlock()s
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The cx88-alsa module has been around since January 2006 and has seen no
significant changes since September 2007. It is stable in operation
and so I believe that the 'experimental' tag is no longer warranted.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This build bug triggers:
drivers/built-in.o: In function `mantis_exit':
(.text+0x377413): undefined reference to `ir_input_unregister'
drivers/built-in.o: In function `mantis_input_init':
(.text+0x3774ff): undefined reference to `__ir_input_register'
If MANTIS_CORE is enabled but IR_CORE is not. Add the correct
dependency.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
There are no more users of struct file_operations:ioctl. These
can be safely removed.
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: John Kacur <jkacur@redhat.com>
Cc: Hans Verkuil <hverkuil@xs4all.nl>
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6:
V4L/DVB: v4l2-ctrls.c: needs to include slab.h
V4L/DVB: fix Kconfig to depends on VIDEO_IR
V4L/DVB: Fix IR_CORE dependencies
v4l2-ctrls.c needs to include slab.h to prevent build errors:
drivers/media/video/v4l2-ctrls.c:766: error: implicit declaration of function 'kzalloc'
drivers/media/video/v4l2-ctrls.c:786: error: implicit declaration of function 'kfree'
drivers/media/video/v4l2-ctrls.c:1528: error: implicit declaration of function 'kmalloc'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
i2c: I2C bus multiplexer driver pca954x
i2c: Multiplexed I2C bus core support
i2c: Use a separate mutex for userspace client lists
i2c: Make i2c_default_probe self-sufficient
i2c: Drop dummy variable
i2c: Move adapter locking helpers to i2c-core
V4L/DVB: Use custom I2C probing function mechanism
i2c: Add support for custom probe function
i2c-dev: Use memdup_user
i2c-dev: Remove unnecessary kmalloc casts
Now that i2c-core offers the possibility to provide custom probing
function for I2C devices, let's make use of it.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The probe method used by i2c_new_probed_device() may not be suitable
for all cases. Let the caller provide its own, optional probe
function.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (94 commits)
V4L/DVB: tvp7002: fix write to H-PLL Feedback Divider LSB register
V4L/DVB: dvb: siano: free spinlock before schedule()
V4L/DVB: media: video: pvrusb2: remove custom hex_to_bin()
V4L/DVB: drivers: usbvideo: remove custom implementation of hex_to_bin()
V4L/DVB: Report supported QAM modes on bt8xx
V4L/DVB: media: ir-keytable: null dereference in debug code
V4L/DVB: ivtv: convert to the new control framework
V4L/DVB: ivtv: convert gpio subdev to new control framework
V4L/DVB: wm8739: convert to the new control framework
V4L/DVB: cs53l32a: convert to new control framework
V4L/DVB: wm8775: convert to the new control framework
V4L/DVB: cx2341x: convert to the control framework
V4L/DVB: cx25840: convert to the new control framework
V4L/DVB: cx25840/ivtv: replace ugly priv control with s_config
V4L/DVB: saa717x: convert to the new control framework
V4L/DVB: msp3400: convert to the new control framework
V4L/DVB: saa7115: convert to the new control framework
V4L/DVB: v4l2: hook up the new control framework into the core framework
V4L/DVB: Documentation: add v4l2-controls.txt documenting the new controls API
V4L/DVB: v4l2-ctrls: Whitespace cleanups
...
H-PLL Feedback Divider LSB register is an 8 bit register out
of which the first 4 bits are reserved. Current code is
writing to these reserved location. This patch corrects
this issue by left shifting the values being written to the
register by 4.
This patch has been tested on DM6467 EVM with 720P-60 and
1080I-60 inputs.
Signed-off-by: Sudhakar Rajashekhara <sudhakar.raj@ti.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Calling schedule() holding spinlock with disables irqs is improper. As
spinlock protects list coredev->buffers, it can be unlocked untill wakeup.
This bug was introduced in a9349315f6.
Signed-off-by: Kulikov Vasiliy <segooon@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Here a small patch to get a TwinHan VT DST DVB-T card working with
kernels >= 2.6.32. Analogously to
http://linuxtv.org/hg/v4l-dvb/rev/0e735b509163 I had to:
"Fill in the .caps field in struct dst_dvbt_ops (around line 1763) with
all the supported QAM modulation methods to match the capabilities of
the card as implemented in function dst_set_modulation (around line
502). Note that beginning with linux kernel version 2.6.32 the
modulation method is checked (by function dvb_frontend_check_parameters
in file drivers/media/dvb/dvb-core/dvb_frontend.c) and thus tuning fails
if you use a modulation method that is not present in the .caps field."
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
"ir_dev->props" can be NULL. We only use raw mode if "ir_dev->props" is
non-NULL and "ir_dev->props->driver_type == RC_DRIVER_IR_RAW".
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
