kernel/linux.git/drivers/media/usb, branch v4.8.16

dib0700: fix nec repeat handling

2016-11-18T09:51:44+00:00

commit ba13e98f2cebd55a3744c5ffaa08f9dca73bf521 upstream. When receiving a nec repeat, ensure the correct scancode is repeated rather than a random value from the stack. This removes the need for the bogus uninitialized_var() and also fixes the warnings: drivers/media/usb/dvb-usb/dib0700_core.c: In function ‘dib0700_rc_urb_completion’: drivers/media/usb/dvb-usb/dib0700_core.c:679: warning: ‘protocol’ may be used uninitialized in this function [sean addon: So after writing the patch and submitting it, I've bought the hardware on ebay. Without this patch you get random scancodes on nec repeats, which the patch indeed fixes.] Signed-off-by: Sean Young Tested-by: Sean Young Signed-off-by: Arnd Bergmann Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

cx231xx: can't proceed if I2C bus register fails

2016-10-28T07:45:24+00:00

commit 461af077d349b11106ca084e9ef2973a753d33ff upstream. The driver should not ignore errors while registering the I2C bus, as this device can't even minimally work without the buses, as it uses those buses internally to talk with the several IP blocks inside the chip. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

cx231xx: fix GPIOs for Pixelview SBTVD hybrid

2016-10-28T07:45:24+00:00

commit 24b923f073ac37eb744f56a2c7f77107b8219ab2 upstream. This device uses GPIOs: 28 to switch between analog and digital modes: on digital mode, it should be set to 1. The code that sets it on analog mode is OK, but it misses the logic that sets it on digital mode. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

cx231xx: don't return error on success

2016-10-28T07:45:24+00:00

commit 1871d718a9db649b70f0929d2778dc01bc49b286 upstream. The cx231xx_set_agc_analog_digital_mux_select() callers expect it to return 0 or an error. Returning a positive value makes the first attempt to switch between analog/digital to fail. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

Merge tag 'media/v4.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2016-07-27T01:59:59+00:00

Pull media updates from Mauro Carvalho Chehab: - new framework support for HDMI CEC and remote control support - new encoding codec driver for Mediatek SoC - new frontend driver: helene tuner - added support for NetUp almost universal devices, with supports DVB-C/S/S2/T/T2 and ISDB-T - the mn88472 frontend driver got promoted from staging - a new driver for RCar video input - some soc_camera legacy drivers got removed: timb, omap1, mx2, mx3 - lots of driver cleanups, improvements and fixups * tag 'media/v4.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (377 commits) [media] cec: always check all_device_types and features [media] cec: poll should check if there is room in the tx queue [media] vivid: support monitor all mode [media] cec: fix test for unconfigured adapter in main message loop [media] cec: limit the size of the transmit queue [media] cec: zero unused msg part after msg->len [media] cec: don't set fh to NULL in CEC_TRANSMIT [media] cec: clear all status fields before transmit and always fill in sequence [media] cec: CEC_RECEIVE overwrote the timeout field [media] cxd2841er: Reading SNR for DVB-C added [media] cxd2841er: Reading BER and UCB for DVB-C added [media] cxd2841er: fix switch-case for DVB-C [media] cxd2841er: fix signal strength scale for ISDB-T [media] cxd2841er: adjust the dB scale for DVB-C [media] cxd2841er: provide signal strength for DVB-C [media] cxd2841er: fix BER report via DVBv5 stats API [media] mb86a20s: apply mask to val after checking for read failure [media] airspy: fix error logic during device register [media] s5p-cec/TODO: add TODO item [media] cec/TODO: drop comment about sphinx documentation ...

media: fix airspy usb probe error path

2016-07-15T21:15:40+00:00

Fix a memory leak on probe error of the airspy usb device driver. The problem is triggered when more than 64 usb devices register with v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV. The memory leak is caused by the probe function of the airspy driver mishandeling errors and not freeing the corresponding control structures when an error occours registering the device to v4l2 core. A badusb device can emulate 64 of these devices, and then through continual emulated connect/disconnect of the 65th device, cause the kernel to run out of RAM and crash the kernel, thus causing a local DOS vulnerability. Fixes CVE-2016-5400 Signed-off-by: James Patrick-Evans Reviewed-by: Kees Cook Cc: stable@vger.kernel.org # 3.17+ Signed-off-by: Linus Torvalds

[media] airspy: fix error logic during device register

2016-07-15T16:32:21+00:00

This patch addresses CVE-2016-5400, a local DOS vulnerability caused by a memory leak in the airspy usb device driver. The vulnerability is triggered when more than 64 usb devices register with v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.A badusb device can emulate 64 of these devices then through continual emulated connect/disconnect of the 65th device, cause the kernel to run out of RAM and crash the kernel. The vulnerability exists in kernel versions from 3.17 to current 4.7. The memory leak is caused by the probe function of the airspy driver mishandeling errors and not freeing the corresponding control structures when an error occours registering the device to v4l2 core. Signed-off-by: James Patrick-Evans Cc: stable@vger.kernel.org # Up to Kernel 3.17 Signed-off-by: Mauro Carvalho Chehab

[media] af9035: fix dual tuner detection with PCTV 79e

2016-07-15T14:44:10+00:00

The value 5 of the EEPROM_TS_MODE register (meaning dual tuner presence) is only valid for AF9035 devices. For IT9135 devices it is invalid and led to a false positive dual tuner mode detection with PCTV 79e. Therefore on non-AF9035 devices and with value 5 the driver now defaults to single tuner mode and outputs a regarding info message to log. This fixes Bugzilla bug #118561. Reported-by: Marc Duponcheel Signed-off-by: Stefan Pöschel Signed-off-by: Antti Palosaari Signed-off-by: Mauro Carvalho Chehab

[media] dvb-usb: silence an uninitialized variable warning

2016-07-13T16:13:22+00:00

My static checker complains that if adap->props.num_frontends is 0 then "ret" is uninitialized. I don't think that can happen. But "ret" is always zero here so we can just remove the condition. This extra check was added in commit 0d3ab8410dcb ('[media] dvb core: must check dvb_create_media_graph()'). Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab

[media] dw2102: add USB ID for Terratec Cinergy S2 Rev.3

2016-07-13T15:24:48+00:00

Add the USB ID for Terratec Cinergy S2 Rev.3 (0ccd:0102). Curiously dvb-usb-ids included already the USB ID for TERRATEC_CINERGY_S2_R3 even if the device was not supported. Reported-by: Christian Knippel Signed-off-by: Olli Salonen Signed-off-by: Mauro Carvalho Chehab