summaryrefslogtreecommitdiff
path: root/drivers/media/dvb-core/dvb_ca_en50221.c
AgeCommit message (Collapse)Author
2023-05-14media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221Hyunwoo Kim
If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2023-05-14media: dvb_ca_en50221: fix a size write bugYongSu Yoo
The function of "dvb_ca_en50221_write_data" at source/drivers/media /dvb-core/dvb_ca_en50221.c is used for two cases. The first case is for writing APDU data in the function of "dvb_ca_en50221_io_write" at source/drivers/media/dvb-core/ dvb_ca_en50221.c. The second case is for writing the host link buf size on the Command Register in the function of "dvb_ca_en50221_link_init" at source/drivers/media/dvb-core/dvb_ca_en50221.c. In the second case, there exists a bug like following. In the function of the "dvb_ca_en50221_link_init", after a TV host calculates the host link buf_size, the TV host writes the calculated host link buf_size on the Size Register. Accroding to the en50221 Spec (the page 60 of https://dvb.org/wp-content/uploads/2020/02/En50221.V1.pdf), before this writing operation, the "SW(CMDREG_SW)" flag in the Command Register should be set. We can see this setting operation in the function of the "dvb_ca_en50221_link_init" like below. ... if ((ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_SW)) != 0) return ret; ... But, after that, the real writing operation is implemented using the function of the "dvb_ca_en50221_write_data" in the function of "dvb_ca_en50221_link_init", and the "dvb_ca_en50221_write_data" includes the function of "ca->pub->write_cam_control", and the function of the "ca->pub->write_cam_control" in the function of the "dvb_ca_en50221_wrte_data" does not include "CMDREG_SW" flag like below. ... if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_HC)) != 0) ... In the above source code, we can see only the "IRQEN | CMDREG_HC", but we cannot see the "CMDREG_SW". The "CMDREG_SW" flag which was set in the function of the "dvb_ca_en50221_link_init" was rollbacked by the follwoing function of the "dvb_ca_en50221_write_data". This is a bug. and this bug causes that the calculated host link buf_size is not properly written in the CI module. Through this patch, we fix this bug. Link: https://lore.kernel.org/linux-media/20220818125027.1131-1-yongsuyoo0215@gmail.com Signed-off-by: YongSu Yoo <yongsuyoo0215@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvbdev: adopts refcnt to avoid UAFLin Ma
dvb_unregister_device() is known that prone to use-after-free. That is, the cleanup from dvb_unregister_device() releases the dvb_device even if there are pointers stored in file->private_data still refer to it. This patch adds a reference counter into struct dvb_device and delays its deallocation until no pointer refers to the object. Link: https://lore.kernel.org/linux-media/20220807145952.10368-1-linma@zju.edu.cn Signed-off-by: Lin Ma <linma@zju.edu.cn> Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2021-06-17media: dvb_ca_en50221: avoid speculation from CA slotMauro Carvalho Chehab
As warned by smatch: drivers/media/dvb-core/dvb_ca_en50221.c:1392 dvb_ca_en50221_io_do_ioctl() warn: potential spectre issue 'ca->slot_info' [r] (local cap) There's a potential of using a CAM ioctl for speculation. The risk here is minimum, as only a small subset of DVB boards have CI, with a CAM module installed. Also, exploiting it would require a user capable of starting a DVB application. There are probably a lot of easier ways to try to exploit. Yet, it doesn't harm addressing it. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: fix incorrect kernel doc usagesHans Verkuil
This patch fixes the following trivial warnings w.r.t. kernel-doc usage: drivers/media/common/videobuf2/frame_vector.c:38: warning: Excess function parameter 'gup_flags' description in 'get_vaddr_frames' drivers/media/dvb-core/dvb_ca_en50221.c:193: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1014: warning: expecting prototype for Wake up the DVB CA thread(). Prototype was for dvb_ca_en50221_thread_wakeup() instead drivers/media/dvb-core/dvb_ca_en50221.c:1023: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1081: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1112: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1327: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1411: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1426: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1582: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1693: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1743: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1772: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1830: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1922: warning: wrong kernel-doc identifier on line: drivers/media/rc/img-ir/img-ir-hw.c:628: warning: expecting prototype for img_ir_decoder_compatable(). Prototype was for img_ir_decoder_compatible() instead drivers/media/v4l2-core/v4l2-jpeg.c:461: warning: expecting prototype for jpeg_parse_header(). Prototype was for v4l2_jpeg_parse_header() instead drivers/media/platform/vsp1/vsp1_dl.c:166: warning: expecting prototype for struct vsp1_cmd_pool. Prototype was for struct vsp1_dl_cmd_pool instead drivers/media/platform/mtk-vpu/mtk_vpu.c:28: warning: expecting prototype for is a tiny processor controlling video hardware(). Prototype was for INIT_TIMEOUT_MS() instead drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:73: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct vp9_ref_buf instead drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:85: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct vp9_sf_ref_fb instead drivers/media/tuners/mt2063.c:1404: warning: expecting prototype for fLO_FractionalTerm(). Prototype was for MT2063_fLO_FractionalTerm() instead drivers/media/tuners/mt2063.c:1465: warning: expecting prototype for CalcLO2Mult(). Prototype was for MT2063_CalcLO2Mult() instead drivers/media/usb/pwc/pwc-dec23.c:640: warning: wrong kernel-doc identifier on line: drivers/media/platform/exynos4-is/media-dev.c:820: warning: expecting prototype for __fimc_md_create_fimc_links(). Prototype was for __fimc_md_create_fimc_sink_links() instead drivers/media/i2c/s5k6aa.c:426: warning: expecting prototype for s5k6aa_configure_pixel_clock(). Prototype was for s5k6aa_configure_pixel_clocks() instead drivers/media/i2c/imx274.c:700: warning: wrong kernel-doc identifier on line: drivers/media/i2c/imx274.c:735: warning: wrong kernel-doc identifier on line: drivers/media/i2c/imx274.c:983: warning: wrong kernel-doc identifier on line: Most are missing or mistyped function names. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2019-05-24treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 113Thomas Gleixner
Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details to obtain the license point your browser to http www gnu org copyleft gpl html extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 26 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Richard Fontana <rfontana@redhat.com> Reviewed-by: Allison Randal <allison@lohutok.net> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190523091650.572604764@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-18media: dvb-core: fix epoll() by calling poll_wait firstHans Verkuil
The epoll function expects that whenever the poll file op is called, the poll_wait function is also called. That didn't always happen in dvb_demux_poll(), dvb_dvr_poll() and dvb_ca_en50221_io_poll(). Fix this, otherwise epoll() can timeout when it shouldn't. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-08-02media: dvb_ca_en50221: off by one in dvb_ca_en50221_io_do_ioctl()Dan Carpenter
The > should be >= so we don't read one element beyond the end of the ca->slot_info[] array. The array is allocated in dvb_ca_en50221_init(). Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-05-16media: dvb_ca_en50221: prevent using slot_info for Spectre attacsMauro Carvalho Chehab
slot can be controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability, as warned by smatch: drivers/media/dvb-core/dvb_ca_en50221.c:1479 dvb_ca_en50221_io_write() warn: potential spectre issue 'ca->slot_info' (local cap) Acked-by: "Jasmin J." <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-03-06media: dvb_ca_en50221: fix severity of successful CAM init log messageDaniel Scheller
A successful CA module initialisation isn't an error. Change the log print to info severity accordingly. Cc: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Daniel Scheller <d.scheller@gmx.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-02-11vfs: do bulk POLL* -> EPOLL* replacementLinus Torvalds
This is the mindless scripted replacement of kernel use of POLL* variables as described by Al, done by this script: for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'` for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done done with de-mangling cleanups yet to come. NOTE! On almost all architectures, the EPOLL* constants have the same values as the POLL* constants do. But they keyword here is "almost". For various bad reasons they aren't the same, and epoll() doesn't actually work quite correctly in some cases due to this on Sparc et al. The next patch from Al will sort out the final differences, and we should be all done. Scripted-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-02-06Merge tag 'media/v4.16-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - videobuf2 was moved to a media/common dir, as it is now used by the DVB subsystem too - Digital TV core memory mapped support interface - new sensor driver: ov7740 - several improvements at ddbridge driver - new V4L2 driver: IPU3 CIO2 CSI-2 receiver unit, found on some Intel SoCs - new tuner driver: tda18250 - finally got rid of all LIRC staging drivers - as we don't have old lirc drivers anymore, restruct the lirc device code - add support for UVC metadata - add a new staging driver for NVIDIA Tegra Video Decoder Engine - DVB kAPI headers moved to include/media - synchronize the kAPI and uAPI for the DVB subsystem, removing the gap for non-legacy APIs - reduce the kAPI gap for V4L2 - lots of other driver enhancements, cleanups, etc. * tag 'media/v4.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (407 commits) media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32 media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32 media: v4l2-compat-ioctl32.c: avoid sizeof(type) media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32 media: v4l2-compat-ioctl32.c: fix the indentation media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF media: v4l2-ioctl.c: don't copy back the result for -ENOTTY media: v4l2-ioctl.c: use check_fmt for enum/g/s/try_fmt media: vivid: fix module load error when enabling fb and no_error_inj=1 media: dvb_demux: improve debug messages media: dvb_demux: Better handle discontinuity errors media: cxusb, dib0700: ignore XC2028_I2C_FLUSH media: ts2020: avoid integer overflows on 32 bit machines media: i2c: ov7740: use gpio/consumer.h instead of gpio.h media: entity: Add a nop variant of media_entity_cleanup ...
2018-01-30Merge branch 'misc.poll' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull poll annotations from Al Viro: "This introduces a __bitwise type for POLL### bitmap, and propagates the annotations through the tree. Most of that stuff is as simple as 'make ->poll() instances return __poll_t and do the same to local variables used to hold the future return value'. Some of the obvious brainos found in process are fixed (e.g. POLLIN misspelled as POLL_IN). At that point the amount of sparse warnings is low and most of them are for genuine bugs - e.g. ->poll() instance deciding to return -EINVAL instead of a bitmap. I hadn't touched those in this series - it's large enough as it is. Another problem it has caught was eventpoll() ABI mess; select.c and eventpoll.c assumed that corresponding POLL### and EPOLL### were equal. That's true for some, but not all of them - EPOLL### are arch-independent, but POLL### are not. The last commit in this series separates userland POLL### values from the (now arch-independent) kernel-side ones, converting between them in the few places where they are copied to/from userland. AFAICS, this is the least disruptive fix preserving poll(2) ABI and making epoll() work on all architectures. As it is, it's simply broken on sparc - try to give it EPOLLWRNORM and it will trigger only on what would've triggered EPOLLWRBAND on other architectures. EPOLLWRBAND and EPOLLRDHUP, OTOH, are never triggered at all on sparc. With this patch they should work consistently on all architectures" * 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (37 commits) make kernel-side POLL... arch-independent eventpoll: no need to mask the result of epi_item_poll() again eventpoll: constify struct epoll_event pointers debugging printk in sg_poll() uses %x to print POLL... bitmap annotate poll(2) guts 9p: untangle ->poll() mess ->si_band gets POLL... bitmap stored into a user-visible long field ring_buffer_poll_wait() return value used as return value of ->poll() the rest of drivers/*: annotate ->poll() instances media: annotate ->poll() instances fs: annotate ->poll() instances ipc, kernel, mm: annotate ->poll() instances net: annotate ->poll() instances apparmor: annotate ->poll() instances tomoyo: annotate ->poll() instances sound: annotate ->poll() instances acpi: annotate ->poll() instances crypto: annotate ->poll() instances block: annotate ->poll() instances x86: annotate ->poll() instances ...
2018-01-04media: fix usage of whitespaces and on indentationMauro Carvalho Chehab
On several places, whitespaces are being used for indentation, or even at the end of the line. Fix them. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-28media: move dvb kAPI headers to include/mediaMauro Carvalho Chehab
Except for DVB, all media kAPI headers are at include/media. Move the headers to it. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-12-14media: dvb_ca_en50221: sanity check slot number from userspaceColin Ian King
Currently a user can pass in an unsanitized slot number which will lead to and out of range index into ca->slot_info. Fix this by checking that the slot number is no more than the allowed maximum number of slots. Seems that this bug has been in the driver forever. Detected by CoverityScan, CID#139381 ("Untrusted pointer read") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-11-27media: annotate ->poll() instancesAl Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-11-27media: dvb_ca_en50221: fix lots of documentation warningsMauro Carvalho Chehab
Building the driver with gcc 7.2.1 and: make ARCH=i386 CF=-D__CHECK_ENDIAN__ CONFIG_DEBUG_SECTION_MISMATCH=y W=1 CHECK='' M=drivers/media now produces a lot of warnings: drivers/media/dvb-core/dvb_ca_en50221.c:233: warning: No description found for parameter 'ca' drivers/media/dvb-core/dvb_ca_en50221.c:233: warning: No description found for parameter 'slot' drivers/media/dvb-core/dvb_ca_en50221.c:284: warning: No description found for parameter 'timeout_hz' drivers/media/dvb-core/dvb_ca_en50221.c:284: warning: Excess function parameter 'timeout_ms' description in 'dvb_ca_en50221_wait_if_status' drivers/media/dvb-core/dvb_ca_en50221.c:409: warning: No description found for parameter 'tuple_type' drivers/media/dvb-core/dvb_ca_en50221.c:409: warning: No description found for parameter 'tuple_length' drivers/media/dvb-core/dvb_ca_en50221.c:409: warning: Excess function parameter 'tupleType' description in 'dvb_ca_en50221_read_tuple' drivers/media/dvb-core/dvb_ca_en50221.c:409: warning: Excess function parameter 'tupleLength' description in 'dvb_ca_en50221_read_tuple' drivers/media/dvb-core/dvb_ca_en50221.c:795: warning: No description found for parameter 'buf' drivers/media/dvb-core/dvb_ca_en50221.c:795: warning: No description found for parameter 'bytes_write' drivers/media/dvb-core/dvb_ca_en50221.c:795: warning: Excess function parameter 'ebuf' description in 'dvb_ca_en50221_write_data' drivers/media/dvb-core/dvb_ca_en50221.c:795: warning: Excess function parameter 'count' description in 'dvb_ca_en50221_write_data' drivers/media/dvb-core/dvb_ca_en50221.c:942: warning: No description found for parameter 'pubca' drivers/media/dvb-core/dvb_ca_en50221.c:942: warning: Excess function parameter 'ca' description in 'dvb_ca_en50221_camchange_irq' drivers/media/dvb-core/dvb_ca_en50221.c:970: warning: No description found for parameter 'pubca' drivers/media/dvb-core/dvb_ca_en50221.c:970: warning: Excess function parameter 'ca' description in 'dvb_ca_en50221_camready_irq' drivers/media/dvb-core/dvb_ca_en50221.c:990: warning: No description found for parameter 'pubca' drivers/media/dvb-core/dvb_ca_en50221.c:990: warning: Excess function parameter 'ca' description in 'dvb_ca_en50221_frda_irq' drivers/media/dvb-core/dvb_ca_en50221.c:1304: warning: No description found for parameter 'data' drivers/media/dvb-core/dvb_ca_en50221.c:1348: warning: No description found for parameter 'parg' drivers/media/dvb-core/dvb_ca_en50221.c:1348: warning: Excess function parameter 'inode' description in 'dvb_ca_en50221_io_do_ioctl' drivers/media/dvb-core/dvb_ca_en50221.c:1348: warning: Excess function parameter 'arg' description in 'dvb_ca_en50221_io_do_ioctl' drivers/media/dvb-core/dvb_ca_en50221.c:1432: warning: Excess function parameter 'inode' description in 'dvb_ca_en50221_io_ioctl' drivers/media/dvb-core/dvb_ca_en50221.c:1544: warning: No description found for parameter 'ca' drivers/media/dvb-core/dvb_ca_en50221.c:1544: warning: No description found for parameter 'result' drivers/media/dvb-core/dvb_ca_en50221.c:1544: warning: No description found for parameter '_slot' drivers/media/dvb-core/dvb_ca_en50221.c:1849: warning: No description found for parameter 'pubca' drivers/media/dvb-core/dvb_ca_en50221.c:1849: warning: Excess function parameter 'ca' description in 'dvb_ca_en50221_init' drivers/media/dvb-core/dvb_ca_en50221.c:1936: warning: No description found for parameter 'pubca' drivers/media/dvb-core/dvb_ca_en50221.c:1936: warning: Excess function parameter 'ca_dev' description in 'dvb_ca_en50221_release' drivers/media/dvb-core/dvb_ca_en50221.c:1936: warning: Excess function parameter 'ca' description in 'dvb_ca_en50221_release' Trivially fix them. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Fixed multiple blank linesJasmin Jessich
- Running "checkpatch.pl -strict -f ..." complained * Please don't use multiple blank lines Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Fixed style issues on the whole fileJasmin Jessich
- Running "checkpatch.pl -strict -f ..." gave more checks to fix. * Blank lines aren't necessary after an open brace '{' * Comparison to NULL written as "!<var>" * CHECK: Blank lines aren't necessary before a close brace '}' Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Fixed remaining block commentsJasmin Jessich
- Added the missing opening empty comment line. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Fix again wrong EXPORT_SYMBOL orderJasmin Jessich
Some EXPORT_SYMBOL() on this file don't match the name of functions that precedes them. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Fixed typoJasmin Jessich
- "dont" -> "don't" Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Fixed 80 char limitJasmin Jessich
Fixed most of: WARNING: line over 80 characters The remaining lines are printk strings, which should not be split and lines where I thing they should stay as they are. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Fixed C++ commentsJasmin Jessich
- Changed all C++ style comments ("// ..") to C style ones ("/* .. */"). Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Removed unused symbolJasmin Jessich
- The STATUSREG_TXERR definition is not used and it has style problems, too. Removing it seems to solve both issues. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Removed useless bracesJasmin Jessich
Fixed all: WARNING: braces {} are not necessary for single statement blocks Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Added line breaksJasmin Jessich
Fixed all: WARNING: Missing a blank line after declarations Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Used a helper variableJasmin Jessich
Used a helper variable "struct dvb_ca_slot *sl" instead of "ca->slot_info[slot]". This reduces the line length and simplifies code reading. Fixed also "-strict" checks in this patch: - Comparison to NULL written as "!<var>". Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Avoid assignments in ifsJasmin Jessich
Fixed all: ERROR: do not use assignment in if condition Fixed also "-strict" checks in this patch: - Changed "if (ret != 0)" to "if (ret)". - Camel case variables have been converted to kernel_case. - Comparison to NULL written as "!<var>". - No space is necessary after a cast. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Fixed block commentsJasmin Jessich
Fixed all: WARNING: Block comments use * on subsequent lines Added also the missing opening empty comment line. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: use usleep_rangeJasmin Jessich
Fixed all: WARNING: msleep < 20ms can sleep for up to 20ms by using usleep_range. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: New function dvb_ca_en50221_poll_cam_goneJasmin Jessich
The CAM poll code for the budget-av is exactly the same on several places. Extracting the code to a new function improves maintainability. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20media: dvb_ca_en50221: Refactored dvb_ca_en50221_threadJasmin Jessich
Refactored "dvb_ca_en50221_thread" by moving the state machine into the new function "dvb_ca_en50221_thread_state_machine". This reduces the thread function size and reduces the structural complexity and of course gives us more space to meet the line length goal in the new function. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-26media: dvb_ca_en50221: Add block read/write functionsRalph Metzler
Some lower level drivers may work better when sending blocks of data instead byte per byte. For this we need new function pointers in the dvb_ca_en50221 protocol structure (read_data, write_data) and the protocol needs to execute them, if they are defined. Block data transmission is done in all states except LINKINIT. Original code change by Ralph Metzler, modified by Jasmin Jessich and Daniel Scheller to match Kernel code style. Signed-off-by: Ralph Metzler <rjkm@metzlerbros.de> Signed-off-by: Daniel Scheller <d.scheller@gmx.net> Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-26media: dvb_ca_en50221: Increase timeout for link initRalph Metzler
Some CAMs do a really slow initialization, which requires a longer timeout for the first response. Original code change by Ralph Metzler, modified by Jasmin Jessich to match Kernel code style. Signed-off-by: Ralph Metzler <rjkm@metzlerbros.de> Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-26media: dvb_ca_en50221: State UNINITIALISED instead of INVALIDRalph Metzler
In case of a linkinit failure change to state UNINITIALISED to re-init the CAM. Original code change by Ralph Metzler, modified by Jasmin Jessich to match Kernel code style. Signed-off-by: Ralph Metzler <rjkm@metzlerbros.de> Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-07[media] dvb_ca_en50221: Fix wrong EXPORT_SYMBOL orderJasmin Jessich
Some EXPORT_SYMBOL() on this file don't match the name of functions that preceeds them. Also, some kernel-doc markups also have a wrong name. Fix it. Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-07[media] dvb_ca_en50221: use foo *bar, instead of foo * barJasmin Jessich
Make checkpatch happier by fixing this warning: ERROR: "foo * bar" should be "foo *bar" Signed-off-by: Jasmin Jessich <jasmin@anw.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-04-17[media] media/dvb-core: Race condition when writing to CAMJasmin J
It started with a sporadic message in syslog: "CAM tried to send a buffer larger than the ecount size" This message is not the fault itself, but a consecutive fault, after a read error from the CAM. This happens only on several CAMs, several hardware, and of course sporadic. It is a consecutive fault, if the last read from the CAM did fail. I guess this will not happen on all CAMs, but at least it did on mine. There was a write error to the CAM and during the re-initialization procedure, the CAM finished the last read, although it got a RS. The write error to the CAM happened because a race condition between HC write, checking DA and FR. This patch added an additional check for DA(RE), just after checking FR. It is important to read the CAMs status register again, to give the CAM the necessary time for a proper reaction to HC. Please note the description within the source code (patch below). [mchehab@s-opensource.com: make checkpatch happy] Signed-off-by: Jasmin jessich <jasmin@anw.at> Tested-by: Ralph Metzler <rjkm@metzlerbros.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-03-02sched/headers: Prepare to move signal wakeup & sigpending methods from ↵Ingo Molnar
<linux/sched.h> into <linux/sched/signal.h> Fix up affected files that include this signal functionality via sched.h. Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mike Galbraith <efault@gmx.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-01-27[media] media: Drop FSF's postal address from the source code filesSakari Ailus
Drop the FSF's postal address from the source code files that typically contain mostly the license text. Of the 628 removed instances, 578 are outdated. The patch has been created with the following command without manual edits: git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \ drivers/media/ include/media|while read i; do i=$i perl -e ' open(F,"< $ENV{i}"); $a=join("", <F>); $a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m && $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m; close(F); open(F, "> $ENV{i}"); print F $a; close(F);'; done Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2016-11-18[media] dvb-core/en50221: use dvb_remove_device()Max Kellermann
Commit da677fe14364 ("[media] dvb-core/en50221: use kref to manage struct dvb_ca_private") moved the dvb_unregister_device() call to the kref callback, but that left lots of stale device state visible to userspace (e.g. in sysfs). By using dvb_remove_device() and dvb_free_device() instead of dvb_unregister_device(), we can avoid that. Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-21[media] dvb-core: use pr_foo() instead of printk()Mauro Carvalho Chehab
The dvb-core directly calls printk() without using the modern printk macros, or using the proper printk levels. Change it to use pr_foo(). Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-13[media] dvb-core/en50221: use kref to manage struct dvb_ca_privateMax Kellermann
Don't free the object until the file handle has been closed. Fixes use-after-free bug which occurs when I disconnect my DVB-S received while VDR is running. This is a crash dump of such a use-after-free: general protection fault: 0000 [#1] SMP CPU: 0 PID: 2541 Comm: CI adapter on d Not tainted 4.7.0-rc1-hosting+ #49 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff880027d7ce00 ti: ffff88003d8f8000 task.ti: ffff88003d8f8000 RIP: 0010:[<ffffffff812f3d1f>] [<ffffffff812f3d1f>] dvb_ca_en50221_io_read_condition.isra.7+0x6f/0x150 RSP: 0018:ffff88003d8fba98 EFLAGS: 00010206 RAX: 0000000059534255 RBX: 000000753d470f90 RCX: ffff88003c74d181 RDX: 00000001bea04ba9 RSI: ffff88003d8fbaf4 RDI: 3a3030a56d763fc0 RBP: ffff88003d8fbae0 R08: ffff88003c74d180 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88003c480e00 R13: 00000000ffffffff R14: 0000000059534255 R15: 0000000000000000 FS: 00007fb4209b4700(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f06445f4078 CR3: 000000003c55b000 CR4: 00000000000006b0 Stack: ffff88003d8fbaf4 000000003c2170c0 0000000000004000 0000000000000000 ffff88003c480e00 ffff88003d8fbc80 ffff88003c74d180 ffff88003d8fbb8c 0000000000000000 ffff88003d8fbb10 ffffffff812f3e37 ffff88003d8fbb00 Call Trace: [<ffffffff812f3e37>] dvb_ca_en50221_io_poll+0x37/0xa0 [<ffffffff8113109b>] do_sys_poll+0x2db/0x520 This is a backtrace of the kernel attempting to lock a freed mutex: #0 0xffffffff81083d40 in rep_nop () at ./arch/x86/include/asm/processor.h:569 #1 cpu_relax () at ./arch/x86/include/asm/processor.h:574 #2 virt_spin_lock (lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:57 #3 native_queued_spin_lock_slowpath (lock=0xffff88003c480e90, val=761492029) at kernel/locking/qspinlock.c:304 #4 0xffffffff810d1a06 in pv_queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/paravirt.h:669 #5 queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:28 #6 queued_spin_lock (lock=<optimized out>) at include/asm-generic/qspinlock.h:107 #7 __mutex_lock_common (use_ww_ctx=<optimized out>, ww_ctx=<optimized out>, ip=<optimized out>, nest_lock=<optimized out>, subclass=<optimized out>, state=<optimized out>, lock=<optimized out>) at kernel/locking/mutex.c:526 #8 mutex_lock_interruptible_nested (lock=0xffff88003c480e88, subclass=<optimized out>) at kernel/locking/mutex.c:647 #9 0xffffffff812f49fe in dvb_ca_en50221_io_do_ioctl (file=<optimized out>, cmd=761492029, parg=0x1 <irq_stack_union+1>) at drivers/media/dvb-core/dvb_ca_en50221.c:1210 #10 0xffffffff812ee660 in dvb_usercopy (file=<optimized out>, cmd=761492029, arg=<optimized out>, func=<optimized out>) at drivers/media/dvb-core/dvbdev.c:883 #11 0xffffffff812f3410 in dvb_ca_en50221_io_ioctl (file=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at drivers/media/dvb-core/dvb_ca_en50221.c:1284 #12 0xffffffff8112eddd in vfs_ioctl (arg=<optimized out>, cmd=<optimized out>, filp=<optimized out>) at fs/ioctl.c:43 #13 do_vfs_ioctl (filp=0xffff88003c480e90, fd=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at fs/ioctl.c:674 #14 0xffffffff8112f30c in SYSC_ioctl (arg=<optimized out>, cmd=<optimized out>, fd=<optimized out>) at fs/ioctl.c:689 #15 SyS_ioctl (fd=6, cmd=2148298626, arg=140734533693696) at fs/ioctl.c:680 #16 0xffffffff8103feb2 in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:207 Signed-off-by: Max Kellermann <max@duempel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-07[media] drivers/media/dvb-core/en50221: move code to dvb_ca_private_free()Max Kellermann
Prepare for postponing the call until all file handles have been closed. [mchehab@osg.samsung.com: make checkpatch happy] Signed-off-by: Max Kellermann <max@duempel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-01-11[media] dvb: modify core to implement interfaces/entities at MC new genMauro Carvalho Chehab
The Media Controller New Generation redefines the types for both interfaces and entities to be used on DVB. Make the needed changes at the DVB core for all interfaces, entities and data and interface links to appear in the graph. Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-08-22[media] DocBook: add dvb_ca_en50221.h to documentationMauro Carvalho Chehab
There are already some tags at dvb_ca_en50221.h, but using a different format. Convert them, fix a few entries and add to the device-drivers DocBook. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Acked-by: Jonathan Corbet <corbet@lwn.net>
2015-04-08[media] DVB: Less function calls in dvb_ca_en50221_init() after error detectionMarkus Elfring
The functions "dvb_unregister_device" and "kfree" could still be called by the dvb_ca_en50221_init() function in the case that a previous resource allocation failed. * Corresponding details could be improved by adjustments for jump targets. * Let us delete also an unnecessary check for the variable "ca" there. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-04-08[media] DVB: Delete an unnecessary check before the function call ↵Markus Elfring
"dvb_unregister_device" The dvb_unregister_device() function tests whether its argument is NULL and then returns immediately. Thus the test around the call is not needed. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
generated by cgit (git 2.34.1) at 2024-05-09 17:20:16 +0000