summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-12-14xfs: avoid infinite loop when cancelling CoW blocks after writeback failureDarrick J. Wong
When we're cancelling a cow range, we don't always delete each extent that we iterate, so we have to move icur backwards in the list to avoid an infinite loop. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de>
2017-12-14xfs: relax is_reflink_inode assert in xfs_reflink_find_cow_mappingDarrick J. Wong
We don't hold the ilock through the entire sequence of xfs_writepage_map -> xfs_map_cow -> xfs_reflink_find_cow_mapping. This means that we can race with another thread that is trying to clear the inode reflink flag, with the result that the flag is set for the xfs_map_cow check but cleared before we get to the assert in find_cow_mapping. When this happens, we blow the assert even though everything is fine. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de>
2017-12-14xfs: remove dest file's post-eof preallocations before reflinkingDarrick J. Wong
If we try to reflink into a file with post-eof preallocations at an offset well past the preallocations, we increase i_size as one would expect. However, those allocations do not have page cache backing them, so they won't get cleaned out on their own. This leads to asserts in the collapse/insert range code and xfs_destroy_inode when they encounter delalloc extents they weren't expecting to find. Since there are plenty of other places where we dump those post-eof blocks, do the same to the reflink destination file before we start remapping extents. This was found by adding clonerange support to fsstress and running it in write-only mode. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de>
2017-12-14xfs: move xfs_iext_insert tracepoint to report useful informationDarrick J. Wong
Move the tracepoint in xfs_iext_insert to after the point where we've inserted the extent because otherwise we report stale extent data in the ftrace output. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de>
2017-12-14xfs: account for null transactions in bunmapiDarrick J. Wong
In e1a4e37cc7b665 ("xfs: try to avoid blowing out the transaction reservation when bunmaping a shared extent"), we try to constrain the amount of real extents we unmap from the data fork in a given call so that we don't blow out transaction reservations. However, not all bunmapi operations require a transaction -- if we're only removing a delalloc extent, no transaction is needed, so we have to code against that. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de>
2017-12-14media: ddbridge: stv09xx: detach frontends on lnb failureDaniel Scheller
While the failure handling in dvb_input_attach() has been improved lately so any tuner failure won't result in demod driver modules with a usecount > 0 anymore (thus requiring rmmod -f), there's still an issue with stv090x and stv0910 based tuner modules, in that LNB driver attach failures leave an attached demod frontend driver behind which have a usecount of > 0 in this failure case, due to them not being detached/ released. Fix this by detaching the demod frontends if the LNB driver fails. Richard tested and verified the changes with STV0910 hardware, thus adding his Tested-by. Signed-off-by: Daniel Scheller <d.scheller@gmx.net> Tested-by: Richard Scobie <rascobie@slingshot.co.nz> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14xfs: hold xfs_buf locked between shortform->leaf conversion and the addition ↵Darrick J. Wong
of an attribute The new attribute leaf buffer is not held locked across the transaction roll between the shortform->leaf modification and the addition of the new entry. As a result, the attribute buffer modification being made is not atomic from an operational perspective. Hence the AIL push can grab it in the transient state of "just created" after the initial transaction is rolled, because the buffer has been released. This leads to xfs_attr3_leaf_verify() asserting that hdr.count is zero, treating this as in-memory corruption, and shutting down the filesystem. Darrick ported the original patch to 4.15 and reworked it use the xfs_defer_bjoin helper and hold/join the buffer correctly across the second transaction roll. Signed-off-by: Alex Lyakas <alex@zadarastorage.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de>
2017-12-14xfs: add the ability to join a held buffer to a defer_opsDarrick J. Wong
In certain cases, defer_ops callers will lock a buffer and want to hold the lock across transaction rolls. Similar to ijoined inodes, we want to dirty & join the buffer with each transaction roll in defer_finish so that afterwards the caller still owns the buffer lock and we haven't inadvertently pinned the log. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de>
2017-12-14media: tuners: tda8290: reduce stack usage with kasanArnd Bergmann
With CONFIG_KASAN enabled, we get a relatively large stack frame in one function drivers/media/tuners/tda8290.c: In function 'tda8290_set_params': drivers/media/tuners/tda8290.c:310:1: warning: the frame size of 1520 bytes is larger than 1024 bytes [-Wframe-larger-than=] With CONFIG_KASAN_EXTRA this goes up to drivers/media/tuners/tda8290.c: In function 'tda8290_set_params': drivers/media/tuners/tda8290.c:310:1: error: the frame size of 3200 bytes is larger than 3072 bytes [-Werror=frame-larger-than=] We can significantly reduce this by marking local arrays as 'static const', and this should result in better compiled code for everyone. [mchehab@s-opensource.com: fix a trivial merge conflict] Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Michael Ira Krufky <mkrufky@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14ALSA: rawmidi: Avoid racy info ioctl via ctl deviceTakashi Iwai
The rawmidi also allows to obtaining the information via ioctl of ctl API. It means that user can issue an ioctl to the rawmidi device even when it's being removed as long as the control device is present. Although the code has some protection via the global register_mutex, its range is limited to the search of the corresponding rawmidi object, and the mutex is already unlocked at accessing the rawmidi object. This may lead to a use-after-free. For avoiding it, this patch widens the application of register_mutex to the whole snd_rawmidi_info_select() function. We have another mutex per rawmidi object, but this operation isn't very hot path, so it shouldn't matter from the performance POV. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-12-14media: RC docs: add enum rc_proto description at the docsMauro Carvalho Chehab
This is part of the uAPI. Add it to the documentation again, and fix cross-references. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Acked-by: Sean Young <sean@mess.org>
2017-12-14media: cec: move cec autorepeat handling to rc-coreSean Young
CEC autorepeat is different than other protocols. Autorepeat is triggered by the first repeated user control pressed CEC message, rather than a fixed REP_DELAY. This change also does away with the KEY_UP event directly after the first KEY_DOWN event, which was used to stop autorepeat from starting. See commit a9a249a2c997 ("media: cec: fix remote control passthrough") for the original change. Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: imon: auto-config ffdc 30 deviceSean Young
Another device with the 0xffdc device id, this one with 0x30 in the config byte. Its an iMON VFD + iMON IR (it does not understand rc6). Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: winbond-cir: Fix pnp_irq's error checking for wbcir_probeArvind Yadav
The pnp_irq() function returns -1 if an error occurs. pnp_irq() error checking for zero is not correct. Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: rc: Replace timeval with ktime_t in imon.cChunyan Zhang
This patch changes the 32-bit time type (timeval) to the 64-bit one (ktime_t), since 32-bit time types will break in the year 2038. I use ktime_t instead of all uses of timeval in imon.c This patch also changes do_gettimeofday() to ktime_get() accordingly, since ktime_get returns a ktime_t, but do_gettimeofday returns a struct timeval, and the other reason is that ktime_get() uses the monotonic clock. Signed-off-by: Chunyan Zhang <zhang.chunyan@linaro.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: improve lockingSean Young
Once rc_unregister_device() has been called, no driver function should be called. This prevents some nasty race conditions with an ioctl calls driver functions when the driver specific data has been freed. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: allow lirc device to be opened more than onceSean Young
This makes it possible for lircd to read from a lirc chardev, and not keep it busy. Note that this changes the default for timeout reports to on. lircd already enables timeout reports when it opens a lirc device, leaving them on until the next reboot. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: rc: include <uapi/linux/lirc.h> rather than <media/lirc.h>Sean Young
This removes the need for include/media/lirc.h, which just includes the uapi file. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: rc: move ir-lirc-codec.c contents into lirc_dev.cSean Young
Since removing the lirc kapi, ir-lirc-codec.c only contains lirc fops so the file name is no longer correct. By moving its content into lirc_dev.c the ugly extern struct lirc_fops is not longer needed, and everything lirc related is in one file. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14kfifo: DECLARE_KIFO_PTR(fifo, u64) does not work on arm 32 bitSean Young
If you try to store u64 in a kfifo (or a struct with u64 members), then the buf member of __STRUCT_KFIFO_PTR will cause 4 bytes padding due to alignment (note that struct __kfifo is 20 bytes on 32 bit). That in turn causes the __is_kfifo_ptr() to fail, which is caught by kfifo_alloc(), which now returns EINVAL. So, ensure that __is_kfifo_ptr() compares to the right structure. Signed-off-by: Sean Young <sean@mess.org> Acked-by: Stefani Seibold <stefani@seibold.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: scancode rc devices should have a lirc device tooSean Young
Now that the lirc interface supports scancodes, RC scancode devices can also have a lirc device. The only receiving feature they will have enabled is LIRC_CAN_REC_SCANCODE. Note that CEC devices have no lirc device, since they can be controlled from their /dev/cecN chardev. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: document LIRC_MODE_SCANCODESean Young
Lirc supports a new mode which requires documentation. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: ensure lirc device receives nec repeatsSean Young
The lirc device should get lirc repeats whether there is a keymap match or not. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: implement reading scancodeSean Young
This implements LIRC_MODE_SCANCODE reading from the lirc device. The scancode can be read from the input device too, but with this interface you get the rc protocol, keycode, toggle and repeat status in addition to just the scancode. int main() { int fd, mode, rc; fd = open("/dev/lirc0", O_RDWR); mode = LIRC_MODE_SCANCODE; if (ioctl(fd, LIRC_SET_REC_MODE, &mode)) { // kernel too old or lirc does not support transmit } struct lirc_scancode scancode; while (read(fd, &scancode, sizeof(scancode)) == sizeof(scancode)) { printf("protocol:%d scancode:0x%x toggle:%d repeat:%d\n", scancode.rc_proto, scancode.scancode, !!(scancode.flags & LIRC_SCANCODE_FLAG_TOGGLE), !!(scancode.flags & LIRC_SCANCODE_FLAG_REPEAT)); } close(fd); } Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: remove last remnants of lirc kapiSean Young
rc-core has replaced the lirc kapi many years ago, and now with the last driver ported to rc-core, we can finally remove it. Note this has no effect on userspace. All future IR drivers should use the rc-core api. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: remove name from lirc_devSean Young
This is a duplicate of rcdev->driver_name. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: create rc-core open and close lirc functionsSean Young
Replace the generic kernel lirc api with ones which use rc-core, further reducing the lirc_dev members. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: do not call close() or open() on unregistered devicesSean Young
If a lirc chardev is held open after a device is unplugged, rc_close() will be called after rc_unregister_device(). The driver is not expecting any calls at this point, and the iguanair driver causes an oops in this scenario. rc_open() can be called when the device is removed too, by calling open on the chardev whilst the device is being removed. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: move lirc_dev->attached to rc_dev->registeredSean Young
This is done to further remove the lirc kernel api. Ensure that every fops checks for this. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: use kfifo rather than lirc_buffer for raw IRSean Young
Since the only mode lirc devices can handle is raw IR, handle this in a plain kfifo. Remove lirc_buffer since this is no longer needed. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: merge lirc_dev_fop_ioctl and ir_lirc_ioctlSean Young
Calculate lirc features when necessary, and add LIRC_{S,G}ET_REC_MODE cases to ir_lirc_ioctl. This makes lirc_dev_fop_ioctl() unnecessary since all cases are already handled by ir_lirc_ioctl(). Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: rc: document and fix rc_validate_scancode()Sean Young
For some IR protocols, some scancode values not valid, i.e. they're part of a different protocol variant. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: validate scancode for transmitSean Young
Ensure we reject an attempt to transmit invalid scancodes. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: lirc interface should not be a raw decoderSean Young
The lirc user interface exists as a raw decoder, which does not make much sense for transmit-only devices. In addition, we want to have lirc char devices for devices which do not use raw IR, i.e. scancode only devices. Note that rc-code, lirc_dev, ir-lirc-codec are now calling functions of each other, so they've been merged into one module rc-core to avoid circular dependencies. Since ir-lirc-codec no longer exists as separate codec module, there is no need for RC_DRIVER_IR_RAW_TX type drivers to call ir_raw_event_register(). Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: rc: auto load encoder if necessarySean Young
When sending scancodes, load the encoder if we need it. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: use the correct carrier for scancode transmitSean Young
If the lirc device supports it, set the carrier for the protocol. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: implement scancode sendingSean Young
This introduces a new lirc mode: scancode. Any device which can send raw IR can now also send scancodes. int main() { int mode, fd = open("/dev/lirc0", O_RDWR); mode = LIRC_MODE_SCANCODE; if (ioctl(fd, LIRC_SET_SEND_MODE, &mode)) { // kernel too old or lirc does not support transmit } struct lirc_scancode scancode = { .scancode = 0x1e3d, .rc_proto = RC_PROTO_RC5, }; write(fd, &scancode, sizeof(scancode)); close(fd); } The other fields of lirc_scancode must be set to 0. Note that toggle (rc5, rc6) and repeats (nec) are not implemented. Nor is there a method for holding down a key for a period. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: lirc: remove LIRCCODE and LIRC_GET_LENGTHSean Young
LIRCCODE is a lirc mode where a driver produces driver-dependent codes for receive and transmit. No driver uses this any more. The LIRC_GET_LENGTH ioctl was used for this mode only. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: MAINTAINERS: remove lirc staging areaSean Young
Now that lirc is no longer in the staging area, remove the entry. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: staging: remove lirc_zilog driverSean Young
The ir-kbd-i2c driver behaves like the lirc_zilog driver, except it can send raw IR and receives scancodes rather than lirccodes. The lirc_zilog driver only polls if the lirc chardev is opened; similarly the ir-kbd-i2c driver only polls if the corresponding input device is opened, or the lirc device. Polling is disabled during IR transmission through the mutex. The polling period is 402ms in the ir-kdb-i2c driver, and 260ms in the lirc_zilog driver. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14arm64/sve: Report SVE to userspace via CPUID only if supportedDave Martin
Currently, the SVE field in ID_AA64PFR0_EL1 is visible unconditionally to userspace via the CPU ID register emulation, irrespective of the kernel config. This means that if a kernel configured with CONFIG_ARM64_SVE=n is run on SVE-capable hardware, userspace will see SVE reported as present in the ID regs even though the kernel forbids execution of SVE instructions. This patch makes the exposure of the SVE field in ID_AA64PFR0_EL1 conditional on CONFIG_ARM64_SVE=y. Since future architecture features are likely to encounter a similar requirement, this patch adds a suitable helper macros for use when declaring config-conditional ID register fields. Fixes: 43994d824e84 ("arm64/sve: Detect SVE and activate runtime support") Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Reported-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Dave Martin <Dave.Martin@arm.com> Cc: Suzuki Poulose <suzuki.poulose@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com>
2017-12-14media: i2c: enable i2c IR for hardware which isn't HD-PVRSean Young
This is a fix for commit 329d88da4df9 ("[media] media: i2c: Don't export ir-kbd-i2c module alias") that stopped the module from being loaded automagically. The problems described only affect the HD-PVR, so it should not affect other hardware; also if the module happens to be loaded, the i2c IR part of the HD-PVR will be enabled anyway. Fixes: 329d88da4df9 ("[media] media: i2c: Don't export ir-kbd-i2c module alias") Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: rc: implement zilog transmitterSean Young
This code implements the transmitter which is currently implemented in the staging lirc_zilog driver. The new code does not need a signal database, iow. the haup-ir-blaster.bin firmware file is no longer needed, and the driver does not know anything about the keycodes in that file. Instead, the new driver can send raw IR, but the hardware is limited to few different lengths of pulse and spaces, so it is best to use generated IR rather than recorded IR. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: merge ir_tx_z8f0811_haup and ir_rx_z8f0811_haup i2c devicesSean Young
These two devices ids are really just one device with multiple addresses. Probing becomes much simpler if we simply fold this into one i2c device with two address. Note that this breaks the lirc_zilog driver, however we will teach ir-kbd-i2c to do what lirc_zilog does in a later commit. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: rc: i2c: only poll if the rc device is openedSean Young
The lirc_zilog driver only polls the device if the lirc chardev is opened; do the same with the rc-core driver. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: rc: i2c: use dev_dbg rather hand-rolled debugSean Young
Use the dev_dbg dynamic infrastructure instead of rolling our own custom debug logic. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: rc: i2c: set parent of rc device and improve nameSean Young
With the parent set for the rc device, the messages clearly state that it is attached via i2c. The additional printk is unnecessary. These are the old messages: rc rc1: i2c IR (Hauppauge WinTV PVR-150 as /devices/virtual/rc/rc1 ir-kbd-i2c: i2c IR (Hauppauge WinTV PVR-150 detected at i2c-10/10-0071/ir0 [ivtv i2c driver #0] Now we simply get: rc rc1: Hauppauge WinTV PVR-150 as /devices/pci0000:00/0000:00:1e.0/0000:02:00.0/i2c-10/10-0071/rc/rc1 Note that we no longer copy the name. I've checked all call sites to verfiy this is not a problem. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: xilinx-video: fix bad of_node_put() on endpoint errorAkinobu Mita
When iterating through all endpoints using of_graph_get_next_endpoint(), the refcount of the returned endpoint node is incremented and the refcount of the node which is passed as previous endpoint is decremented. So the caller doesn't need to call of_node_put() for each iterated node except for error exit paths. Otherwise we get "OF: ERROR: Bad of_node_put() on ..." messages. Cc: Hyun Kwon <hyun.kwon@xilinx.com> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: bt8xx: Fix err 'bt878_probe()'Christophe JAILLET
This is odd to call 'pci_disable_device()' in an error path before a coresponding successful 'pci_enable_device()'. Return directly instead. Fixes: 77e0be12100a ("V4L/DVB (4176): Bug-fix: Fix memory overflow") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: dvb_ca_en50221: sanity check slot number from userspaceColin Ian King
Currently a user can pass in an unsanitized slot number which will lead to and out of range index into ca->slot_info. Fix this by checking that the slot number is no more than the allowed maximum number of slots. Seems that this bug has been in the driver forever. Detected by CoverityScan, CID#139381 ("Untrusted pointer read") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>