Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'media/v4.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab:
"Some regression fixes and potential security issues:
- netup_unidvb: fix potential crash when spi is NULL
- rtl28xxu: fix control message flaws
- m88ds3103: fix a regression on Kernel 4.2
- c8sectpfe: fix some issues on this new driver
- v4l2-flash-led-class: fix a Kbuild dependency
- si2157 and si2158: check for array boundary when uploading firmware
files
- horus3a and lnbh25: fix some building troubles when some options
aren't selected
- ir-hix5hd2: drop the use of IRQF_NO_SUSPEND"
* tag 'media/v4.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] m88ds3103: use own reg update_bits() implementation
[media] rtl28xxu: fix control message flaws
[media] v4l2-flash-led-class: Add missing VIDEO_V4L2 Kconfig dependency
[media] netup_unidvb: fix potential crash when spi is NULL
[media] si2168: Bounds check firmware
[media] si2157: Bounds check firmware
[media] ir-hix5hd2: drop the use of IRQF_NO_SUSPEND
[media] c8sectpfe: fix return of garbage
[media] c8sectpfe: fix ininitialized error return on firmware load failure
[media] lnbh25: Fix lnbh25_attach() function return type
[media] horus3a: Fix horus3a_attach() function parameters
+81
-46
+2
-2
drivers/media/dvb-frontends/horus3a.h
+2
-2
drivers/media/dvb-frontends/horus3a.h
···
46
46
const struct horus3a_config *config,
47
47
struct i2c_adapter *i2c);
48
48
#else
49
-
static inline struct dvb_frontend *horus3a_attach(
50
-
const struct cxd2820r_config *config,
49
+
static inline struct dvb_frontend *horus3a_attach(struct dvb_frontend *fe,
50
+
const struct horus3a_config *config,
51
51
struct i2c_adapter *i2c)
52
52
{
53
53
printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+1
-1
drivers/media/dvb-frontends/lnbh25.h
+1
-1
drivers/media/dvb-frontends/lnbh25.h
+47
-26
drivers/media/dvb-frontends/m88ds3103.c
+47
-26
drivers/media/dvb-frontends/m88ds3103.c
···
18
18
19
19
static struct dvb_frontend_ops m88ds3103_ops;
20
20
21
+
/* write single register with mask */
22
+
static int m88ds3103_update_bits(struct m88ds3103_dev *dev,
23
+
u8 reg, u8 mask, u8 val)
24
+
{
25
+
int ret;
26
+
u8 tmp;
27
+
28
+
/* no need for read if whole reg is written */
29
+
if (mask != 0xff) {
30
+
ret = regmap_bulk_read(dev->regmap, reg, &tmp, 1);
31
+
if (ret)
32
+
return ret;
33
+
34
+
val &= mask;
35
+
tmp &= ~mask;
36
+
val |= tmp;
37
+
}
38
+
39
+
return regmap_bulk_write(dev->regmap, reg, &val, 1);
40
+
}
41
+
21
42
/* write reg val table using reg addr auto increment */
22
43
static int m88ds3103_wr_reg_val_tab(struct m88ds3103_dev *dev,
23
44
const struct m88ds3103_reg_val *tab, int tab_len)
···
415
394
u8tmp2 = 0x00; /* 0b00 */
416
395
break;
417
396
}
418
-
ret = regmap_update_bits(dev->regmap, 0x22, 0xc0, u8tmp1 << 6);
397
+
ret = m88ds3103_update_bits(dev, 0x22, 0xc0, u8tmp1 << 6);
419
398
if (ret)
420
399
goto err;
421
-
ret = regmap_update_bits(dev->regmap, 0x24, 0xc0, u8tmp2 << 6);
400
+
ret = m88ds3103_update_bits(dev, 0x24, 0xc0, u8tmp2 << 6);
422
401
if (ret)
423
402
goto err;
424
403
}
···
476
455
if (ret)
477
456
goto err;
478
457
}
479
-
ret = regmap_update_bits(dev->regmap, 0x9d, 0x08, 0x08);
458
+
ret = m88ds3103_update_bits(dev, 0x9d, 0x08, 0x08);
480
459
if (ret)
481
460
goto err;
482
461
ret = regmap_write(dev->regmap, 0xf1, 0x01);
483
462
if (ret)
484
463
goto err;
485
-
ret = regmap_update_bits(dev->regmap, 0x30, 0x80, 0x80);
464
+
ret = m88ds3103_update_bits(dev, 0x30, 0x80, 0x80);
486
465
if (ret)
487
466
goto err;
488
467
}
···
519
498
switch (dev->cfg->ts_mode) {
520
499
case M88DS3103_TS_SERIAL:
521
500
case M88DS3103_TS_SERIAL_D7:
522
-
ret = regmap_update_bits(dev->regmap, 0x29, 0x20, u8tmp1);
501
+
ret = m88ds3103_update_bits(dev, 0x29, 0x20, u8tmp1);
523
502
if (ret)
524
503
goto err;
525
504
u8tmp1 = 0;
···
588
567
if (ret)
589
568
goto err;
590
569
591
-
ret = regmap_update_bits(dev->regmap, 0x4d, 0x02, dev->cfg->spec_inv << 1);
570
+
ret = m88ds3103_update_bits(dev, 0x4d, 0x02, dev->cfg->spec_inv << 1);
592
571
if (ret)
593
572
goto err;
594
573
595
-
ret = regmap_update_bits(dev->regmap, 0x30, 0x10, dev->cfg->agc_inv << 4);
574
+
ret = m88ds3103_update_bits(dev, 0x30, 0x10, dev->cfg->agc_inv << 4);
596
575
if (ret)
597
576
goto err;
598
577
···
646
625
dev->warm = false;
647
626
648
627
/* wake up device from sleep */
649
-
ret = regmap_update_bits(dev->regmap, 0x08, 0x01, 0x01);
628
+
ret = m88ds3103_update_bits(dev, 0x08, 0x01, 0x01);
650
629
if (ret)
651
630
goto err;
652
-
ret = regmap_update_bits(dev->regmap, 0x04, 0x01, 0x00);
631
+
ret = m88ds3103_update_bits(dev, 0x04, 0x01, 0x00);
653
632
if (ret)
654
633
goto err;
655
-
ret = regmap_update_bits(dev->regmap, 0x23, 0x10, 0x00);
634
+
ret = m88ds3103_update_bits(dev, 0x23, 0x10, 0x00);
656
635
if (ret)
657
636
goto err;
658
637
···
770
749
utmp = 0x29;
771
750
else
772
751
utmp = 0x27;
773
-
ret = regmap_update_bits(dev->regmap, utmp, 0x01, 0x00);
752
+
ret = m88ds3103_update_bits(dev, utmp, 0x01, 0x00);
774
753
if (ret)
775
754
goto err;
776
755
777
756
/* sleep */
778
-
ret = regmap_update_bits(dev->regmap, 0x08, 0x01, 0x00);
757
+
ret = m88ds3103_update_bits(dev, 0x08, 0x01, 0x00);
779
758
if (ret)
780
759
goto err;
781
-
ret = regmap_update_bits(dev->regmap, 0x04, 0x01, 0x01);
760
+
ret = m88ds3103_update_bits(dev, 0x04, 0x01, 0x01);
782
761
if (ret)
783
762
goto err;
784
-
ret = regmap_update_bits(dev->regmap, 0x23, 0x10, 0x10);
763
+
ret = m88ds3103_update_bits(dev, 0x23, 0x10, 0x10);
785
764
if (ret)
786
765
goto err;
787
766
···
1013
992
}
1014
993
1015
994
utmp = tone << 7 | dev->cfg->envelope_mode << 5;
1016
-
ret = regmap_update_bits(dev->regmap, 0xa2, 0xe0, utmp);
995
+
ret = m88ds3103_update_bits(dev, 0xa2, 0xe0, utmp);
1017
996
if (ret)
1018
997
goto err;
1019
998
1020
999
utmp = 1 << 2;
1021
-
ret = regmap_update_bits(dev->regmap, 0xa1, reg_a1_mask, utmp);
1000
+
ret = m88ds3103_update_bits(dev, 0xa1, reg_a1_mask, utmp);
1022
1001
if (ret)
1023
1002
goto err;
1024
1003
···
1068
1047
voltage_dis ^= dev->cfg->lnb_en_pol;
1069
1048
1070
1049
utmp = voltage_dis << 1 | voltage_sel << 0;
1071
-
ret = regmap_update_bits(dev->regmap, 0xa2, 0x03, utmp);
1050
+
ret = m88ds3103_update_bits(dev, 0xa2, 0x03, utmp);
1072
1051
if (ret)
1073
1052
goto err;
1074
1053
···
1101
1080
}
1102
1081
1103
1082
utmp = dev->cfg->envelope_mode << 5;
1104
-
ret = regmap_update_bits(dev->regmap, 0xa2, 0xe0, utmp);
1083
+
ret = m88ds3103_update_bits(dev, 0xa2, 0xe0, utmp);
1105
1084
if (ret)
1106
1085
goto err;
1107
1086
···
1136
1115
} else {
1137
1116
dev_dbg(&client->dev, "diseqc tx timeout\n");
1138
1117
1139
-
ret = regmap_update_bits(dev->regmap, 0xa1, 0xc0, 0x40);
1118
+
ret = m88ds3103_update_bits(dev, 0xa1, 0xc0, 0x40);
1140
1119
if (ret)
1141
1120
goto err;
1142
1121
}
1143
1122
1144
-
ret = regmap_update_bits(dev->regmap, 0xa2, 0xc0, 0x80);
1123
+
ret = m88ds3103_update_bits(dev, 0xa2, 0xc0, 0x80);
1145
1124
if (ret)
1146
1125
goto err;
1147
1126
···
1173
1152
}
1174
1153
1175
1154
utmp = dev->cfg->envelope_mode << 5;
1176
-
ret = regmap_update_bits(dev->regmap, 0xa2, 0xe0, utmp);
1155
+
ret = m88ds3103_update_bits(dev, 0xa2, 0xe0, utmp);
1177
1156
if (ret)
1178
1157
goto err;
1179
1158
···
1215
1194
} else {
1216
1195
dev_dbg(&client->dev, "diseqc tx timeout\n");
1217
1196
1218
-
ret = regmap_update_bits(dev->regmap, 0xa1, 0xc0, 0x40);
1197
+
ret = m88ds3103_update_bits(dev, 0xa1, 0xc0, 0x40);
1219
1198
if (ret)
1220
1199
goto err;
1221
1200
}
1222
1201
1223
-
ret = regmap_update_bits(dev->regmap, 0xa2, 0xc0, 0x80);
1202
+
ret = m88ds3103_update_bits(dev, 0xa2, 0xc0, 0x80);
1224
1203
if (ret)
1225
1204
goto err;
1226
1205
···
1456
1435
goto err_kfree;
1457
1436
1458
1437
/* sleep */
1459
-
ret = regmap_update_bits(dev->regmap, 0x08, 0x01, 0x00);
1438
+
ret = m88ds3103_update_bits(dev, 0x08, 0x01, 0x00);
1460
1439
if (ret)
1461
1440
goto err_kfree;
1462
-
ret = regmap_update_bits(dev->regmap, 0x04, 0x01, 0x01);
1441
+
ret = m88ds3103_update_bits(dev, 0x04, 0x01, 0x01);
1463
1442
if (ret)
1464
1443
goto err_kfree;
1465
-
ret = regmap_update_bits(dev->regmap, 0x23, 0x10, 0x10);
1444
+
ret = m88ds3103_update_bits(dev, 0x23, 0x10, 0x10);
1466
1445
if (ret)
1467
1446
goto err_kfree;
1468
1447
+4
drivers/media/dvb-frontends/si2168.c
+4
drivers/media/dvb-frontends/si2168.c
···
502
502
/* firmware is in the new format */
503
503
for (remaining = fw->size; remaining > 0; remaining -= 17) {
504
504
len = fw->data[fw->size - remaining];
505
+
if (len > SI2168_ARGLEN) {
506
+
ret = -EINVAL;
507
+
break;
508
+
}
505
509
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
506
510
cmd.wlen = len;
507
511
cmd.rlen = 1;
+4
-8
drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
+4
-8
drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
···
80
80
u16 reg;
81
81
unsigned long flags;
82
82
83
-
if (!spi) {
84
-
dev_dbg(&spi->master->dev,
85
-
"%s(): SPI not initialized\n", __func__);
83
+
if (!spi)
86
84
return IRQ_NONE;
87
-
}
85
+
88
86
spin_lock_irqsave(&spi->lock, flags);
89
87
reg = readw(&spi->regs->control_stat);
90
88
if (!(reg & NETUP_SPI_CTRL_IRQ)) {
···
232
234
unsigned long flags;
233
235
struct netup_spi *spi = ndev->spi;
234
236
235
-
if (!spi) {
236
-
dev_dbg(&spi->master->dev,
237
-
"%s(): SPI not initialized\n", __func__);
237
+
if (!spi)
238
238
return;
239
-
}
239
+
240
240
spin_lock_irqsave(&spi->lock, flags);
241
241
reg = readw(&spi->regs->control_stat);
242
242
writew(reg | NETUP_SPI_CTRL_IRQ, &spi->regs->control_stat);
+3
-4
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+3
-4
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
···
1097
1097
Elf32_Ehdr *ehdr;
1098
1098
Elf32_Phdr *phdr;
1099
1099
u8 __iomem *dst;
1100
-
int err, i;
1100
+
int err = 0, i;
1101
1101
1102
1102
if (!fw || !context)
1103
1103
return -EINVAL;
···
1106
1106
phdr = (Elf32_Phdr *)(fw->data + ehdr->e_phoff);
1107
1107
1108
1108
/* go through the available ELF segments */
1109
-
for (i = 0; i < ehdr->e_phnum && !err; i++, phdr++) {
1109
+
for (i = 0; i < ehdr->e_phnum; i++, phdr++) {
1110
1110
1111
1111
/* Only consider LOAD segments */
1112
1112
if (phdr->p_type != PT_LOAD)
···
1192
1192
1193
1193
static int load_c8sectpfe_fw_step1(struct c8sectpfei *fei)
1194
1194
{
1195
-
int ret;
1196
1195
int err;
1197
1196
1198
1197
dev_info(fei->dev, "Loading firmware: %s\n", FIRMWARE_MEMDMA);
···
1206
1207
if (err) {
1207
1208
dev_err(fei->dev, "request_firmware_nowait err: %d.\n", err);
1208
1209
complete_all(&fei->fw_ack);
1209
-
return ret;
1210
+
return err;
1210
1211
}
1211
1212
1212
1213
return 0;
+1
-1
drivers/media/rc/ir-hix5hd2.c
+1
-1
drivers/media/rc/ir-hix5hd2.c
+4
drivers/media/tuners/si2157.c
+4
drivers/media/tuners/si2157.c
···
166
166
167
167
for (remaining = fw->size; remaining > 0; remaining -= 17) {
168
168
len = fw->data[fw->size - remaining];
169
+
if (len > SI2157_ARGLEN) {
170
+
dev_err(&client->dev, "Bad firmware length\n");
171
+
goto err_release_firmware;
172
+
}
169
173
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
170
174
cmd.wlen = len;
171
175
cmd.rlen = 1;
+13
-2
drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+13
-2
drivers/media/usb/dvb-usb-v2/rtl28xxu.c
···
34
34
unsigned int pipe;
35
35
u8 requesttype;
36
36
37
+
mutex_lock(&d->usb_mutex);
38
+
39
+
if (req->size > sizeof(dev->buf)) {
40
+
dev_err(&d->intf->dev, "too large message %u\n", req->size);
41
+
ret = -EINVAL;
42
+
goto err_mutex_unlock;
43
+
}
44
+
37
45
if (req->index & CMD_WR_FLAG) {
38
46
/* write */
39
47
memcpy(dev->buf, req->data, req->size);
···
58
50
dvb_usb_dbg_usb_control_msg(d->udev, 0, requesttype, req->value,
59
51
req->index, dev->buf, req->size);
60
52
if (ret < 0)
61
-
goto err;
53
+
goto err_mutex_unlock;
62
54
63
55
/* read request, copy returned data to return buf */
64
56
if (requesttype == (USB_TYPE_VENDOR | USB_DIR_IN))
65
57
memcpy(req->data, dev->buf, req->size);
66
58
59
+
mutex_unlock(&d->usb_mutex);
60
+
67
61
return 0;
68
-
err:
62
+
err_mutex_unlock:
63
+
mutex_unlock(&d->usb_mutex);
69
64
dev_dbg(&d->intf->dev, "failed=%d\n", ret);
70
65
return ret;
71
66
}
+1
-1
drivers/media/usb/dvb-usb-v2/rtl28xxu.h
+1
-1
drivers/media/usb/dvb-usb-v2/rtl28xxu.h
+1
-1
drivers/media/v4l2-core/Kconfig
+1
-1
drivers/media/v4l2-core/Kconfig
···
47
47
# Used by LED subsystem flash drivers
48
48
config V4L2_FLASH_LED_CLASS
49
49
tristate "V4L2 flash API for LED flash class devices"
50
-
depends on VIDEO_V4L2_SUBDEV_API
50
+
depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
51
51
depends on LEDS_CLASS_FLASH
52
52
---help---
53
53
Say Y here to enable V4L2 flash API support for LED flash