linux-toradex.git/drivers/media, branch v4.2.6

rtl28xxu: fix control message flaws

2015-11-09T22:37:32+00:00

commit d18ca5b7ceca0e9674cb4bb2ed476b0fcbb23ba2 upstream.

Add lock to prevent concurrent access for control message as control
message function uses shared buffer. Without the lock there may be
remote control polling which messes the buffer causing IO errors.
Increase buffer size and add check for maximum supported message
length.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=103391
Fixes: c56222a6b25c ("[media] rtl28xxu: move usb buffers to state")

Signed-off-by: Antti Palosaari 
Signed-off-by: Greg Kroah-Hartman

si2168: Bounds check firmware

2015-11-09T22:37:32+00:00

commit 47810b4341ac9d2f558894bc5995e6fa2a1298f9 upstream.

When reading the firmware and sending commands, the length must
be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the expected
format:

si2168 11-0064: found a 'Silicon Labs Si2168-B40'
si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
si2168 11-0064: firmware download failed -95
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f

Add the proper check.

Reported-by: Stuart Auchterlonie 
Reviewed-by: Antti Palosaari 
Signed-off-by: Laura Abbott 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

si2157: Bounds check firmware

2015-11-09T22:37:31+00:00

commit a828d72df216c36e9c40b6c24dc4b17b6f7b5a76 upstream.

When reading the firmware and sending commands, the length
must be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the
expected format. Add the proper check.

Signed-off-by: Laura Abbott 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

m88ds3103: use own reg update_bits() implementation

2015-11-09T22:37:31+00:00

commit 56ea37da3b93dfe46cb5c3ee0ee4cc44229ece47 upstream.

Device stopped to tuning some channels after regmap conversion.
Reason is that regmap_update_bits() works a bit differently for
partially volatile registers than old homemade routine. Return
back to old routine in order to fix issue.

Fixes: 478932b16052f5ded74685d096ae920cd17d6424

Reported-by: Mark Clarkstone 
Tested-by: Mark Clarkstone 
Signed-off-by: Antti Palosaari 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

v4l: omap3isp: Fix async notifier registration order

2015-09-29T17:33:28+00:00

commit 5d479386983c5f1bb1aff4f88a027b6143f88a39 upstream.

The async notifier was registered before the v4l2_device was registered and
before the notifier callbacks were set. This could lead to missing the
bound() and complete() callbacks and to attempting to spin_lock() and
uninitialised spin lock.

Also fix unregistering the async notifier in the case of an error --- the
function may not fail anymore after the notifier is registered.

Fixes: da7f3843d2c7 ("[media] omap3isp: Add support for the Device Tree")

Signed-off-by: Sakari Ailus 
Reviewed-by: Sebastian Reichel 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

v4l: xilinx: missing error code

2015-09-29T17:33:27+00:00

commit e31f8f00bfc081ec1881d92a2dd192aeddf1d9d7 upstream.

We should set "ret" on this error path instead of returning success.

Fixes: df3305156f98 ('[media] v4l: xilinx: Add Xilinx Video IP core')

Signed-off-by: Dan Carpenter 
Acked-by: Hyun Kwon 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: am437x-vpfe: Fix a race condition during release

2015-09-29T17:33:27+00:00

commit c99235fa3ef833c3c23926085f2bb68851c8460a upstream.

There was a race condition where during cleanup/release operation
on-going streaming would cause a kernel panic because the hardware
module was disabled prematurely with IRQ still pending.

Fixes: 417d2e507edc ("[media] media: platform: add VPFE capture driver support for AM437X")

Signed-off-by: Benoit Parrot 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: am437x-vpfe: Requested frame size and fmt overwritten by current sensor setting

2015-09-29T17:33:27+00:00

commit f47c9045643f91e76d8a9030828b9fe1cf4a6bcf upstream.

Upon a S_FMT the input/requested frame size and pixel format is
overwritten by the current sub-device settings.
Fix this so application can actually set the frame size and format.

Fixes: 417d2e507edc ("[media] media: platform: add VPFE capture driver support for AM437X")

Signed-off-by: Benoit Parrot 
Acked-by: Lad, Prabhakar 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

v4l: omap3isp: Fix sub-device power management code

2015-09-29T17:33:27+00:00

commit 9d39f05490115bf145e5ea03c0b7ec9d3d015b01 upstream.

Commit 813f5c0ac5cc ("media: Change media device link_notify behaviour")
modified the media controller link setup notification API and updated the
OMAP3 ISP driver accordingly. As a side effect it introduced a bug by
turning power on after setting the link instead of before. This results in
sub-devices not being powered down in some cases when they should be. Fix
it.

Fixes: 813f5c0ac5cc [media] media: Change media device link_notify behaviour

Signed-off-by: Sakari Ailus 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

rc-core: fix remove uevent generation

2015-09-29T17:33:27+00:00

commit a66b0c41ad277ae62a3ae6ac430a71882f899557 upstream.

The input_dev is already gone when the rc device is being unregistered
so checking for its presence only means that no remove uevent will be
generated.

Signed-off-by: David Härdeman 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman