kernel/linux.git/drivers/media/rc/rc-loopback.c, branch linux-7.1.y

media: rc: fix race between unregister and urb/irq callbacks

2026-03-17T13:43:56+00:00

Some rc device drivers have a race condition between rc_unregister_device() and irq or urb callbacks. This is because rc_unregister_device() does two things, it marks the device as unregistered so no new commands can be issued and then it calls rc_free_device(). This means the driver has no chance to cancel any pending urb callbacks or interrupts after the device has been marked as unregistered. Those callbacks may access struct rc_dev or its members (e.g. struct ir_raw_event_ctrl), which have been freed by rc_free_device(). This change removes the implicit call to rc_free_device() from rc_unregister_device(). This means that device drivers can call rc_unregister_device() in their remove or disconnect function, then cancel all the urbs and interrupts before explicitly calling rc_free_device(). Note this is an alternative fix for an issue found by Haotian Zhang, see the Closes: tags. Reported-by: Haotian Zhang Closes: https://lore.kernel.org/linux-media/20251114101432.2566-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101418.2548-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101346.2530-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114090605.2413-1-vulab@iscas.ac.cn/ Reviewed-by: Patrice Chotard Signed-off-by: Sean Young Signed-off-by: Hans Verkuil

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

media: rc: remove unused tx_resolution field

2024-07-31T09:21:56+00:00

The tx_resolution field is never read. In theory you can imagine this field being useful for detecting whether the transmitter has the resolution for the message you are trying to send, but I am not aware of any hardware where this could be an issue. Just remove. Signed-off-by: Sean Young Signed-off-by: Hans Verkuil

media: lirc: report ir receiver overflow

2022-01-28T18:32:50+00:00

If the driver reports that the hardware had an overflow, report this to userspace. It would be nice to know when this happens, and not just get a long space. This change has been tested with lircd, ir-ctl, and ir-keytable. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: rc: rename s_learning_mode() to s_wideband_receiver()

2021-07-22T06:21:53+00:00

The s_learning_mode() function is called in response to the ioctl LIRC_SET_WIDEBAND_RECEIVER, so rename it to s_wideband_receiver(). Learning mode is when both the wideband receiver is turned on and carrier reports are enabled. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: rc-loopback: max_timeout of UINT_MAX does not work

2021-07-22T06:21:03+00:00

Any timeout larger than LIRC_VALUE_MASK cannot work for the lirc uapi. LIRC_VALUE_MASK is about 16 seconds which is more than enough. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: rc-loopback: send carrier reports

2021-07-22T06:20:33+00:00

When carrier reports are enabled, send them over loopback. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: rc-loopback: use dev_dbg() rather than handrolled debug

2021-07-22T06:19:56+00:00

Make use of dynamic debug. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: rc-loopback: return number of emitters rather than error

2021-07-22T06:19:17+00:00

The LIRC_SET_TRANSMITTER_MASK ioctl should return the number of emitters if an invalid list was set. Cc: stable@vger.kernel.org Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab