linux-toradex.git/drivers/media/usb, branch v5.11

media: gspca: Fix memory leak in probe

2020-12-07T14:00:15+00:00

The gspca driver leaks memory when a probe fails.  gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface).  But the
failure pathway neglects to call v4l2_device_unregister(), the routine
responsible for dropping this reference.  Consequently the memory for
the USB interface and its device never gets released.

This patch adds the missing function call.

Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com

Signed-off-by: Alan Stern 
CC: 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: uvcvideo: Use DIV_ROUND_CLOSEST directly to make it readable

2020-11-27T09:19:29+00:00

The kernel.h macro DIV_ROUND_CLOSEST performs the computation (x + d/2)/d
but is perhaps more readable.

Signed-off-by: zhong jiang 
Signed-off-by: Mauro Carvalho Chehab

media: msi2500: assign SPI bus number dynamically

2020-11-27T07:12:11+00:00

SPI bus number must be assigned dynamically for each device, otherwise it
will crash when multiple devices are plugged to system.

Reported-and-tested-by: syzbot+c60ddb60b685777d9d59@syzkaller.appspotmail.com

Cc: stable@vger.kernel.org
Signed-off-by: Antti Palosaari 
Signed-off-by: Mauro Carvalho Chehab

media: usb: msi2500: Fix a possible null-pointer dereference in msi2500_stop_streaming()

2020-11-27T07:02:13+00:00

In msi2500_stop_streaming(), there is an if statement on line 870 to
check whether dev->udev is NULL:
    if (dev->udev)

When dev->udev is NULL, it is used on line 877:
    msi2500_ctrl_msg(dev, CMD_STOP_STREAMING, 0)
        usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), ...)

Thus, a possible null-pointer dereference may occur.

To fix this bug, dev->udev is checked before calling msi2500_ctrl_msg().

This bug is found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai 
Signed-off-by: Mauro Carvalho Chehab

media: gp8psk: initialize stats at power control logic

2020-11-27T06:40:21+00:00

As reported on:
	https://lore.kernel.org/linux-media/20190627222020.45909-1-willemdebruijn.kernel@gmail.com/

if gp8psk_usb_in_op() returns an error, the status var is not
initialized. Yet, this var is used later on, in order to
identify:
	- if the device was already started;
	- if firmware has loaded;
	- if the LNBf was powered on.

Using status = 0 seems to ensure that everything will be
properly powered up.

So, instead of the proposed solution, let's just set
status = 0.

Reported-by: syzbot 
Reported-by: Willem de Bruijn 
Signed-off-by: Mauro Carvalho Chehab

media: dvb-usb: Add Hauppauge MAX S2's USB-IDs

2020-11-26T13:26:43+00:00

Hauppauge MAX S2 or WinTV NOVA HD USB2.0.

Signed-off-by: Kai Muenz 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab

media: cx231xx: Use snd_card_free_when_closed() instead of snd_card_free().

2020-11-17T06:12:45+00:00

cx231xx_close_extension and hence cx231xx_audio_fini() are called with the
cx231xx device lock held, but snd_cx231xx_pcm_close() also grabs that mutex
when closing the file on behalf of arecord. There seems to be no reason to
wait for sound card resources to be released, so let the release be
asynchronous.

Tested with a Hauppauge 955Q (2040:b123) and Linux 5.9.6; the hang
described in the bug no longer occurs and disconnecting the device
correctly terminates arecord with ENODEV.

Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=204087
Signed-off-by: Zebediah Figura 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: usb: dvb-usb-v2: zd1301: fix missing platform_device_unregister()

2020-11-17T05:57:29+00:00

Add the missing platform_device_unregister() before return
from zd1301_frontend_attach in the error handling case when
pdev->dev.driver is empty.

There's an error handling route named err_platform_device_unregister,
so just reuse it.

Signed-off-by: Qinglang Miao 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab

media: cx231xx: Consolidate dmesg output

2020-11-16T09:31:10+00:00

The memory allocations in cx231xx_init_*() happen all in task context with
GFP_KERNEL. Therefore a dev_err() trying to deduce whether this is called
from task or interrupt context is pretty useless.

Remove these historical leftovers.

Signed-off-by: Thomas Gleixner 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: au0828: Consolidate dmesg output

2020-11-16T09:31:10+00:00

The memory allocations in au0828_init_isoc() happen all in task context
with GFP_KERNEL. Therefore a printk() trying to deduce whether this is
called from task or interrupt context is pretty useless.

Convert it to au0828_isocdbg() as the other one in that function and for
completeness sake add one for the URB allocation as well.

Signed-off-by: Thomas Gleixner 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab