linux-toradex.git/drivers/media/usb, branch v4.1.26

[media] au0828: Fix dev_state handling

2016-04-20T05:03:43+00:00

[ Upstream commit e8e3039f5b941f7825d335f8ca11c12a8104db11 ]

The au0828 dev_state is actually a bit mask. It should not be
checking with "==" but, instead, with a logic and. There are some
places where it was doing it wrong.

Fix that by replacing the dev_state set/clear/test with the
bitops.

As reviewed by Shuah:
	"Looks good. Tested running bind/unbind au0828 loop for 1000 times.
	Didn't see any problems and the v4l2_querycap() problem has been
	fixed with this patch.

	After the above test, ran bind/unbind snd_usb_audio 1000 times.
	Didn't see any problems. Generated media graph and the graph
	looks good."

Cc: stable@vger.kernel.org
Reviewed-by: Shuah Khan 
Tested-by: Shuah Khan 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] au0828: fix au0828_v4l2_close() dev_state race condition

2016-04-20T05:03:43+00:00

[ Upstream commit ed940cd27416f9887864b95e1f8f8845aa9d6391 ]

au0828_v4l2_close() check for dev_state == DEV_DISCONNECTED will fail to
detect the device disconnected state correctly, if au0828_v4l2_open() runs
to set the DEV_INITIALIZED bit. A loop test of bind/unbind found this bug
by increasing the likelihood of au0828_v4l2_open() occurring while unbind
is in progress. When au0828_v4l2_close() fails to detect that the device
is in disconnect state, it attempts to power down the device and fails with
the following general protection fault:

[  260.992962] Call Trace:
[  260.993008]  [] ? xc5000_sleep+0x8f/0xd0 [xc5000]
[  260.993095]  [] ? fe_standby+0x3c/0x50 [tuner]
[  260.993186]  [] au0828_v4l2_close+0x53c/0x620 [au0828]
[  260.993298]  [] v4l2_release+0xf0/0x210 [videodev]
[  260.993382]  [] __fput+0x1fc/0x6c0
[  260.993449]  [] ____fput+0xe/0x10
[  260.993519]  [] task_work_run+0x133/0x1f0
[  260.993602]  [] exit_to_usermode_loop+0x140/0x170
[  260.993681]  [] syscall_return_slowpath+0x16a/0x1a0
[  260.993754]  [] entry_SYSCALL_64_fastpath+0xa6/0xa8

Cc: stable@vger.kernel.org
Signed-off-by: Shuah Khan 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] pwc: Add USB id for Philips Spc880nc webcam

2016-04-18T12:50:34+00:00

[ Upstream commit 7445e45d19a09e5269dc85f17f9635be29d2f76c ]

SPC 880NC PC camera discussions:
	http://www.pclinuxos.com/forum/index.php/topic,135688.0.html

Cc: stable@vger.kernel.org
Reported-by: Kikim 
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] usbvision: fix crash on detecting device with invalid configuration

2016-04-18T12:50:31+00:00

[ Upstream commit fa52bd506f274b7619955917abfde355e3d19ffe ]

The usbvision driver crashes when a specially crafted usb device with invalid
number of interfaces or endpoints is detected. This fix adds checks that the
device has proper configuration expected by the driver.

Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] gspca: ov534/topro: prevent a division by 0

2016-02-01T16:27:34+00:00

[ Upstream commit dcc7fdbec53a960588f2c40232db2c6466c09917 ]

v4l2-compliance sends a zeroed struct v4l2_streamparm in
v4l2-test-formats.cpp::testParmType(), and this results in a division by
0 in some gspca subdrivers:

  divide error: 0000 [#1] SMP
  Modules linked in: gspca_ov534 gspca_main ...
  CPU: 0 PID: 17201 Comm: v4l2-compliance Not tainted 4.3.0-rc2-ao2 #1
  Hardware name: System manufacturer System Product Name/M2N-E SLI, BIOS
    ASUS M2N-E SLI ACPI BIOS Revision 1301 09/16/2010
  task: ffff8800818306c0 ti: ffff880095c4c000 task.ti: ffff880095c4c000
  RIP: 0010:[]  [] sd_set_streamparm+0x12/0x60 [gspca_ov534]
  RSP: 0018:ffff880095c4fce8  EFLAGS: 00010296
  RAX: 0000000000000000 RBX: ffff8800c9522000 RCX: ffffffffa077a140
  RDX: 0000000000000000 RSI: ffff880095e0c100 RDI: ffff8800c9522000
  RBP: ffff880095e0c100 R08: ffffffffa077a100 R09: 00000000000000cc
  R10: ffff880067ec7740 R11: 0000000000000016 R12: ffffffffa07bb400
  R13: 0000000000000000 R14: ffff880081b6a800 R15: 0000000000000000
  FS:  00007fda0de78740(0000) GS:ffff88012fc00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00000000014630f8 CR3: 00000000cf349000 CR4: 00000000000006f0
  Stack:
   ffffffffa07a6431 ffff8800c9522000 ffffffffa077656e 00000000c0cc5616
   ffff8800c9522000 ffffffffa07a5e20 ffff880095e0c100 0000000000000000
   ffff880067ec7740 ffffffffa077a140 ffff880067ec7740 0000000000000016
  Call Trace:
   [] ? v4l_s_parm+0x21/0x50 [videodev]
   [] ? vidioc_s_parm+0x4e/0x60 [gspca_main]
   [] ? __video_do_ioctl+0x280/0x2f0 [videodev]
   [] ? video_ioctl2+0x20/0x20 [videodev]
   [] ? video_usercopy+0x319/0x4e0 [videodev]
   [] ? page_add_new_anon_rmap+0x71/0xa0
   [] ? mem_cgroup_commit_charge+0x52/0x90
   [] ? handle_mm_fault+0xc18/0x1680
   [] ? v4l2_ioctl+0xac/0xd0 [videodev]
   [] ? do_vfs_ioctl+0x28f/0x480
   [] ? SyS_ioctl+0x74/0x80
   [] ? entry_SYSCALL_64_fastpath+0x16/0x75
  Code: c7 93 d9 79 a0 5b 5d e9 f1 f3 9a e0 0f 1f 00 66 2e 0f 1f 84 00
    00 00 00 00 66 66 66 66 90 53 31 d2 48 89 fb 48 83 ec 08 8b 46 10 
    76 0c 80 bf ac 0c 00 00 00 88 87 4e 0e 00 00 74 09 80 bf 4f
  RIP  [] sd_set_streamparm+0x12/0x60 [gspca_ov534]
   RSP 
  ---[ end trace 279710c2c6c72080 ]---

Following what the doc says about a zeroed timeperframe (see
http://www.linuxtv.org/downloads/v4l-dvb-apis/vidioc-g-parm.html):

  ...
  To reset manually applications can just set this field to zero.

fix the issue by resetting the frame rate to a default value in case of
an unusable timeperframe.

The fix is done in the subdrivers instead of gspca.c because only the
subdrivers have notion of a default frame rate to reset the camera to.

Signed-off-by: Antonio Ospite 
Cc: stable@vger.kernel.org
Reviewed-by: Hans de Goede 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

airspy: increase USB control message buffer size

2016-01-31T19:23:35+00:00

commit aa0850e1d56623845b46350ffd971afa9241886d upstream.

Driver requested device firmware version string during probe using
only 24 byte long buffer. That buffer is too small for newer firmware
versions, which causes device firmware hang - device stops responding
to any commands after that. Increase buffer size to 128 which should
be enough for any current and future version strings.

Link: https://github.com/airspy/host/issues/27

Reported-by: Benjamin Vernoux 
Signed-off-by: Antti Palosaari 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

rtl28xxu: fix control message flaws

2015-11-09T22:33:34+00:00

commit d18ca5b7ceca0e9674cb4bb2ed476b0fcbb23ba2 upstream.

Add lock to prevent concurrent access for control message as control
message function uses shared buffer. Without the lock there may be
remote control polling which messes the buffer causing IO errors.
Increase buffer size and add check for maximum supported message
length.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=103391
Fixes: c56222a6b25c ("[media] rtl28xxu: move usb buffers to state")

Signed-off-by: Antti Palosaari 
Signed-off-by: Greg Kroah-Hartman

rc-core: fix dib0700 scancode generation for RC5

2015-08-03T16:29:02+00:00

commit 4d298b8539ed59f1d69d3aa6e41a2c4908137612 upstream.

commit af3a4a9bbeb0 ("[media] dib0700: NEC scancode cleanup") cleaned
up the NEC scancode logic but overlooked the RC5 case.

This patch brings the RC5 case in line with the NEC code and makes
the struct self-documenting.

Signed-off-by: David Härdeman 
Reported-by: David Cimbůrek 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: Fix regression in some more dib0700 based devices

2015-08-03T16:29:02+00:00

commit e989a73ebd09d22c22ead51fa363a2f56f70f28a upstream.

Fix an oops during device initialization by correctly setting size_of_priv
instead of leaving it 0.
The regression was introduced by 8abe4a0a3f6d4217b16a ("[media] dib7000:
export just one symbol") and only fixed for one type of dib0700 based
devices in 9e334c75642b6e5bfb95 ("[media] Fix regression in some dib0700
based devices").

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=92301

Fixes: 8abe4a0a3f6d4217b16a ("[media] dib7000: export just one symbol")

Signed-off-by: Thomas Reitmayr 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'patchwork' into v4l_for_linus

2015-04-21T09:12:35+00:00

* patchwork: (404 commits)
  [media] uvcvideo: add support for VIDIOC_QUERY_EXT_CTRL
  [media] uvcvideo: fix cropcap v4l2-compliance failure
  [media] media: omap3isp: remove unused clkdev
  [media] coda: Add tracing support
  [media] coda: drop dma_sync_single_for_device in coda_bitstream_queue
  [media] coda: fix fill bitstream errors in nonstreaming case
  [media] coda: call SEQ_END when the first queue is stopped
  [media] coda: fail to start streaming if userspace set invalid formats
  [media] coda: remove duplicate error messages for buffer allocations
  [media] coda: move parameter buffer in together with context buffer allocation
  [media] coda: allocate bitstream buffer from REQBUFS, size depends on the format
  [media] coda: allocate per-context buffers from REQBUFS
  [media] coda: use strlcpy instead of snprintf
  [media] coda: bitstream payload is unsigned
  [media] coda: fix double call to debugfs_remove
  [media] coda: check kasprintf return value in coda_open
  [media] coda: bitrate can only be set in kbps steps
  [media] v4l2-mem2mem: no need to initialize b in v4l2_m2m_next_buf and v4l2_m2m_buf_remove
  [media] s5p-mfc: set allow_zero_bytesused flag for vb2_queue_init
  [media] coda: set allow_zero_bytesused flag for vb2_queue_init
  ...