linux-toradex.git/drivers/media/tuners, branch v6.10

media: tunner: xc5000: Refactor firmware load

2024-04-15T11:42:38+00:00

Make sure the firmware is released when we leave
xc_load_fw_and_init_tuner()

This change makes smatch happy:
drivers/media/tuners/xc5000.c:1213 xc_load_fw_and_init_tuner() warn: 'fw' from request_firmware() not released on lines: 1213.

Cc: Shuah Khan 
Signed-off-by: Ricardo Ribalda 
Signed-off-by: Hans Verkuil

media: tda18271: remove redundant assignment to variable bcal

2024-02-16T10:46:32+00:00

The variable bcal is being initialized with a value that is never
read, it is being re-assigned in both paths of an if statement near
the end of the function. The initialization is redundant and can
be removed.

Cleans up clang scan build warning:
drivers/media/tuners/tda18271-fe.c:473:2: warning: Value stored
to 'bcal' is never read [deadcode.DeadStores]

Signed-off-by: Colin Ian King 
Signed-off-by: Hans Verkuil

media: xc4000: Fix atomicity violation in xc4000_get_frequency

2024-02-05T11:57:44+00:00

In xc4000_get_frequency():
	*freq = priv->freq_hz + priv->freq_offset;
The code accesses priv->freq_hz and priv->freq_offset without holding any
lock.

In xc4000_set_params():
	// Code that updates priv->freq_hz and priv->freq_offset
	...

xc4000_get_frequency() and xc4000_set_params() may execute concurrently,
risking inconsistent reads of priv->freq_hz and priv->freq_offset. Since
these related data may update during reading, it can result in incorrect
frequency calculation, leading to atomicity violations.

This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 6.2.

To address this issue, it is proposed to add a mutex lock pair in
xc4000_get_frequency() to ensure atomicity. With this patch applied, our
tool no longer reports the possible bug, with the kernel configuration
allyesconfig for x86_64. Due to the lack of associated hardware, we cannot
test the patch in runtime testing, and just verify it according to the
code logic.

[1] https://sites.google.com/view/basscheck/

Fixes: 4c07e32884ab ("[media] xc4000: Fix get_frequency()")
Cc: stable@vger.kernel.org
Reported-by: BassCheck 
Signed-off-by: Gui-Dong Han <2045gemini@gmail.com>
Signed-off-by: Hans Verkuil

media: dvb: symbol fixup for dvb_attach()

2023-09-09T07:15:11+00:00

In commit 9011e49d54dc ("modules: only allow symbol_get of
EXPORT_SYMBOL_GPL modules") the use of symbol_get is properly restricted
to GPL-only marked symbols.  This interacts oddly with the DVB logic
which only uses dvb_attach() to load the dvb driver which then uses
symbol_get().

Fix this up by properly marking all of the dvb_attach attach symbols as
EXPORT_SYMBOL_GPL().

Fixes: 9011e49d54dc ("modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules")
Cc: stable 
Reported-by: Stefan Lippers-Hollmann 
Cc: Mauro Carvalho Chehab 
Cc: Christoph Hellwig 
Cc: linux-media@vger.kernel.org
Cc: linux-modules@vger.kernel.org
Acked-by: Luis Chamberlain 
Acked-by: Hans Verkuil 
Link: https://lore.kernel.org/r/20230908092035.3815268-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

media: tuners: qt1010: replace BUG_ON with a regular error

2023-07-25T07:24:30+00:00

BUG_ON is unnecessary here, and in addition it confuses smatch.
Replacing this with an error return help resolve this smatch
warning:

drivers/media/tuners/qt1010.c:350 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34

Signed-off-by: Hans Verkuil

media: Switch i2c drivers back to use .probe()

2023-05-25T14:21:21+00:00

After commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new()
call-back type"), all drivers being converted to .probe_new() and then
commit 03c835f498b5 ("i2c: Switch .probe() to not take an id parameter")
convert back to (the new) .probe() to be able to eventually drop
.probe_new() from struct i2c_driver.

Signed-off-by: Uwe Kleine-König 
Signed-off-by: Hans Verkuil

media: it913x: Convert to platform remove callback returning void

2023-04-11T14:59:21+00:00

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is (mostly) ignored
and this typically results in resource leaks. To improve here there is a
quest to make the remove callback return void. In the first step of this
quest all drivers are converted to .remove_new() which already returns
void.

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.

Signed-off-by: Uwe Kleine-König 
Signed-off-by: Hans Verkuil

media: mxl5005s: Bounds check size used for max array index

2023-03-19T21:50:49+00:00

The use of state->CH_Ctrl[i].size in a shift operation implies that its
value can be as much as 32, but the state->CH_Ctrl[i].val array is only
25 in size. Bounds check the size before shifting and looping. Fixes
warnings seen with GCC 13:

../drivers/media/tuners/mxl5005s.c: In function 'MXL_ControlWrite_Group.isra':
../drivers/media/tuners/mxl5005s.c:3450:70: warning: array subscript 32 is above array bounds of 'u16[25]' {aka 'short unsigned int[25]'} [-Warray-bounds=]
 3450 | state->CH_Ctrl[i].val[j] = (u8)((value >> j) & 0x01);
      |  ~~~~~~~~~~~~~~~~~~~~~^~~
../drivers/media/tuners/mxl5005s.c:238:13: note: while referencing 'val'
  238 |         u16 val[25];    /* Binary representation of Value */
      |             ^~~

Cc: Colin Ian King 
Signed-off-by: Kees Cook 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: tuners/si2157: Convert to i2c's .probe_new()

2023-01-22T07:33:25+00:00

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.

Signed-off-by: Uwe Kleine-König 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

Merge tag 'br-v6.2g' of git://linuxtv.org/hverkuil/media_tree into media_stage

2022-11-25T07:55:21+00:00

Despite being big, the changes here are trivial: they just change the
probing method for I2C. So, apply it as a merge.

Tag branch

* tag 'br-v6.2g' of git://linuxtv.org/hverkuil/media_tree: (96 commits)
  media: v4l2-core/tuner-core: Convert to i2c's .probe_new()
  media: usb: go7007: s2250-board: Convert to i2c's .probe_new()
  media: tuners/tua9001: Convert to i2c's .probe_new()
  media: tuners/tda18250: Convert to i2c's .probe_new()
  media: tuners/tda18212: Convert to i2c's .probe_new()
  media: tuners/qm1d1c0042: Convert to i2c's .probe_new()
  media: tuners/qm1d1b0004: Convert to i2c's .probe_new()
  media: tuners/mxl301rf: Convert to i2c's .probe_new()
  media: tuners/mt2060: Convert to i2c's .probe_new()
  media: tuners/m88rs6000t: Convert to i2c's .probe_new()
  media: tuners/fc2580: Convert to i2c's .probe_new()
  media: tuners/e4000: Convert to i2c's .probe_new()
  media: vidtv: Convert to i2c's .probe_new()
  media: radio/tef6862: Convert to i2c's .probe_new()
  media: radio/saa7706h: Convert to i2c's .probe_new()
  media: radio/radio-tea5764: Convert to i2c's .probe_new()
  media: i2c/wm8775: Convert to i2c's .probe_new()
  media: i2c/wm8739: Convert to i2c's .probe_new()
  media: i2c/vs6624: Convert to i2c's .probe_new()
  media: i2c/vpx3220: Convert to i2c's .probe_new()
  ...

Signed-off-by: Mauro Carvalho Chehab