BMC/Intel-BMC/linux.git/drivers/media/rc/lirc_dev.c, branch dev-4.10

lirc_dev: LIRC_{G,S}ET_REC_MODE do not work

2017-03-12T05:44:07+00:00

commit bd291208d7f5d6b2d6a033fee449a429230b06df upstream. Since "273b902 [media] lirc_dev: use LIRC_CAN_REC() define" these ioctls no longer work. Signed-off-by: Sean Young Reviewed-by: Andi Shyti Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

[media] lirc: fix error paths in lirc_cdev_add()

2016-12-01T14:46:00+00:00

"c77d17c0 [media] lirc: use-after free" introduces two problems: cdev_del() can be called with a NULL argument, and the kobject_put() path will cause a double free. Reported-by: Dan Carpenter Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc: use-after free while reading from device and unplugging

2016-11-21T15:28:11+00:00

Many lirc drivers have their own receive buffers which are freed on unplug (e.g. ir_lirc_unregister). This means that ir->buf->wait_poll will be freed directly after unplug so do not remove yourself from the wait queue. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc: prevent use-after free

2016-11-21T15:19:56+00:00

If you unplug an lirc device while reading from it, you will get an use after free as the cdev is freed while still in use. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc: might sleep error in lirc_dev_fop_read

2016-11-21T15:19:08+00:00

[ 101.457944] ------------[ cut here ]------------ [ 101.457954] WARNING: CPU: 3 PID: 1819 at kernel/sched/core.c:7708 __might_sleep+0x7e/0x80 [ 101.457960] do not call blocking ops when !TASK_RUNNING; state=1 set at [] lirc_dev_fop_read+0x292/0x4e0 [lirc_dev] Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: remove compat_ioctl assignment

2016-11-18T16:16:09+00:00

There is no need to check for CONFIG_COMPAT and consequently assign the compat_ioctl. Signed-off-by: Andi Shyti Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: use LIRC_CAN_REC() define to check if the device can receive

2016-07-13T18:29:03+00:00

The LIRC_CAN_REC() returns a boolean "flag & LIRC_CAN_REC_MASK" to check whether the device can receive data. Signed-off-by: Andi Shyti Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: fix potential segfault

2016-07-13T18:28:25+00:00

When opening or closing a lirc character device, the framework provides to the user the possibility to keep track of opening or closing of the device by calling two functions: - set_use_inc() when opening the device - set_use_dec() when closing the device if those are not set by the lirc user, the system segfaults. Check the pointer value before calling the above functions. Signed-off-by: Andi Shyti Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: extremely trivial comment style fix

2016-07-13T18:27:16+00:00

Signed-off-by: Andi Shyti Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: fix error return value

2016-07-13T18:26:52+00:00

If ioctl is called, it cannot be a case of invalid system call number (ENOSYS), that is a ENOTTY case which means that the device doesn't support that specific ioctl command. So, replace ENOSYS with ENOTTY. Signed-off-by: Andi Shyti Signed-off-by: Mauro Carvalho Chehab