linux-toradex.git/drivers/media, branch v2.6.27.20

V4L: ivtv: fix decoder crash regression

2009-03-17T00:53:02+00:00

(cherry picked from commit ac9575f75c52bcb455120f8c43376b556acba048)

The video_ioctl2 conversion of ivtv in kernel 2.6.27 introduced a bug
causing decoder commands to crash. The decoder commands should have been
handled from the video_ioctl2 default handler, ensuring correct mapping
of the argument between user and kernel space. Unfortunately they ended
up before the video_ioctl2 call, causing random crashes.

Thanks to hannes@linus.priv.at for testing and helping me track down the
cause!

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman

V4L: tda8290: fix TDA8290 + TDA18271 initialization

2009-03-17T00:53:02+00:00

(cherry picked from commit 439b72b69e4992e9ec34b74304f0fa95623934eb)

Don't call tda8290_init_tuner unless we have either a TDA8275 or TDA8275A
present. Calling this function will cause a TDA18271 to get sick, so we
should only call it when needed.

Signed-off-by: Michael Krufky 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

DVB: s5h1409: Perform s5h1409 soft reset after tuning

2009-03-17T00:53:02+00:00

(cherry picked from commit 67e70baf043cfdcdaf5972bc94be82632071536b)

Just like with the s5h1411, the s5h1409 needs a soft-reset in order for it
to know that the tuner has been told to change frequencies.  This change
changes the behavior from "random tuning times between 500ms to complete
tuning lock failures" to "tuning lock consistently within 700ms".

Thanks to Robert Krakora  for doing
initial testing of the patch on the KWorld 330U.

Thanks to Andy Walls  for doing testing of the patch on
the HVR-1600.

Thanks to Michael Krufky  for doing additional testing.

Signed-off-by: Devin Heitmueller 
Signed-off-by: Michael Krufky 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

V4L/DVB (9621): Avoid writing outside shadow.bytes[] array

2008-12-18T17:13:41+00:00

commit 494264379d186bf806613d27aafb7d88d42f4212 upstream.

There were no check about the limits of shadow.bytes array. This offers
a risk of writing values outside the limits, overriding other data
areas.

Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

V4L/DVB (9352): Add some missing compat32 ioctls

2008-12-05T18:55:12+00:00

commit c7f09db6852d85e7f76322815051aad1c88d08cf upstream.

This patch adds the missing compat ioctls that are needed to
operate Skype in combination with libv4l and a MJPEG only camera.

If you think it's trivial enough please submit it to -stable, too.

Signed-off-by: Gregor Jasny 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

V4L/DVB (9624): CVE-2008-5033: fix OOPS on tvaudio when controlling bass/treble

2008-11-20T22:54:48+00:00

commit 01a1a3cc1e3fbe718bd06a2a5d4d1a2d0fb4d7d9 upstream.

This bug were supposed to be fixed by 5ba2f67afb02c5302b2898949ed6fc3b3d37dcf1,
where a call to NULL happens.

Not all tvaudio chips allow controlling bass/treble. So, the driver
has a table with a flag to indicate if the chip does support it.

Unfortunately, the handling of this logic were broken for a very long
time (probably since the first module version). Due to that, an OOPS
were generated for devices that don't support bass/treble.

This were the resulting OOPS message before the patch, with debug messages
enabled:

tvaudio' 1-005b: VIDIOC_S_CTRL
BUG: unable to handle kernel NULL pointer dereference at 00000000
IP: [<00000000>]
*pde = 22fda067 *pte = 00000000
Oops: 0000 [#1] SMP
Modules linked in: snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_hwdep snd soundcore tuner_simple tuner_types tea5767 tuner
tvaudio bttv bridgebnep rfcomm l2cap bluetooth it87 hwmon_vid hwmon fuse sunrpc ipt_REJECT
nf_conntrack_ipv4 iptable_filter ip_tables ip6t_REJECT xt_tcpudp nf_conntrack_ipv6 xt_state nf_conntrack
ip6table_filter ip6_tables x_tables ipv6 dm_mirrordm_multipath dm_mod configfs videodev v4l1_compat
ir_common 8139cp compat_ioctl32 v4l2_common 8139too videobuf_dma_sg videobuf_core mii btcx_risc tveeprom
i915 button snd_page_alloc serio_raw drm pcspkr i2c_algo_bit i2c_i801 i2c_core iTCO_wdt
iTCO_vendor_support sr_mod cdrom sg ata_generic pata_acpi ata_piix libata sd_mod scsi_mod ext3 jbdmbcache
uhci_hcd ohci_hcd ehci_hcd [last unloaded: soundcore]

Pid: 15413, comm: qv4l2 Not tainted (2.6.25.14-108.fc9.i686 #1)
EIP: 0060:[<00000000>] EFLAGS: 00210246 CPU: 0
EIP is at 0x0
EAX: 00008000 EBX: ebd21600 ECX: e2fd9ec4 EDX: 00200046
ESI: f8c0f0c4 EDI: f8c0f0c4 EBP: e2fd9d50 ESP: e2fd9d2c
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process qv4l2 (pid: 15413, ti=e2fd9000 task=ebe44000 task.ti=e2fd9000)
Stack: f8c0c6ae e2ff2a00 00000d00 e2fd9ec4 ebc4e000 e2fd9d5c f8c0c448 00000000
       f899c12a e2fd9d5c f899c154 e2fd9d68 e2fd9d80 c0560185 e2fd9d88 f8f3e1d8
       f8f3e1dc ebc4e034 f8f3e18c e2fd9ec4 00000000 e2fd9d90 f899c286 c008561c
Call Trace:
 [] ? chip_command+0x266/0x4b6 [tvaudio]
 [] ? chip_command+0x0/0x4b6 [tvaudio]
 [] ? i2c_cmd+0x0/0x2f [i2c_core]
 [] ? i2c_cmd+0x2a/0x2f [i2c_core]
 [] ? device_for_each_child+0x21/0x49
 [] ? i2c_clients_command+0x1c/0x1e [i2c_core]
 [] ? bttv_call_i2c_clients+0x14/0x16 [bttv]
 [] ? bttv_s_ctrl+0x1bc/0x313 [bttv]
 [] ? bttv_s_ctrl+0x0/0x313 [bttv]
 [] ? __video_do_ioctl+0x1f84/0x3726 [videodev]
 [] ? sock_aio_write+0x100/0x10d
 [] ? kmap_atomic_prot+0x1dd/0x1df
 [] ? enqueue_hrtimer+0xc2/0xcd
 [] ? copy_from_user+0x39/0x121
 [] ? __video_ioctl2+0x1aa/0x24a [videodev]
 [] ? do_notify_resume+0x768/0x795
 [] ? getnstimeofday+0x34/0xd1
 [] ? autoremove_wake_function+0x0/0x33
 [] ? video_ioctl2+0xf/0x13 [videodev]
 [] ? vfs_ioctl+0x50/0x69
 [] ? do_vfs_ioctl+0x239/0x24c
 [] ? sys_ioctl+0x40/0x5b
 [] ? syscall_call+0x7/0xb
 [] ? cpuid4_cache_sysfs_exit+0x3d/0x69
 =======================
Code:  Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:e2fd9d2c

Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

DVB: s5h1411: Power down s5h1411 when not in use

2008-11-07T03:05:49+00:00

cherry picked from commit 11fc9a4a440112b5afc1a99d86ba92d70205a688

DVB: s5h1411: Power down s5h1411 when not in use

Power down the s5h1411 demodulator when not in use
(on the Pinnacle 801e, this brings idle power from
123ma down to 84ma).

Signed-off-by: Devin Heitmueller 
Acked-by: Steven Toth 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman

DVB: s5h1411: Perform s5h1411 soft reset after tuning

2008-11-07T03:05:49+00:00

cherry picked from commit f0d041e50bc6c8a677922d72b010f80af9b23b18

DVB: s5h1411: Perform s5h1411 soft reset after tuning

If you instruct the tuner to change frequencies, it can take up to 2500ms to
get a demod lock.  By performing a soft reset after the tuning call (which
is consistent with how the Pinnacle 801e Windows driver behaves), you get
a demod lock inside of 300ms

Signed-off-by: Devin Heitmueller 
Signed-off-by: Michael Krufky 
Acked-by: Steven Toth 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits

2008-11-07T03:05:49+00:00

cherry picked from commit 1af46b450fa49c57d73764d66f267335ccd807e2

DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits

Adding a serialmode function to read/and/or/write the register for safety.

Signed-off-by: Steven Toth 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman

V4L: pvrusb2: Keep MPEG PTSs from drifting away

2008-11-07T03:05:47+00:00

cherry picked from commit 3f93d1adca658201c64251c43a147cc79d468c3f

V4L: pvrusb2: Keep MPEG PTSs from drifting away

This change was empirically figured out by Boris Dores after
empirically comparing against behavior in the Windows driver.

Signed-off-by: Mike Isely 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Michael Krufky 
Signed-off-by: Greg Kroah-Hartman