| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
When we moved to 3.0, we found that the cx18 driver was oopsing on close with:
NULL pointer deref at:
[ 2290.461009] Call Trace:
[ 2290.461009] [<c046007b>] ? pm_qos_add_request+0xc/0x6e
[ 2290.461009] [<c082631c>] __mutex_lock_common+0x87/0x125
[ 2290.461009] [<f8970e92>] ? cx18_queue_flush+0x31/0x87 [cx18]
[ 2290.461009] [<c0436b85>] ? __might_sleep+0x29/0xe4
[ 2290.461009] [<c0826515>] __mutex_lock_slowpath+0x25/0x27
[ 2290.461009] [<c08264b2>] ? mutex_lock+0x2e/0x3b
[ 2290.461009] [<c08264b2>] mutex_lock+0x2e/0x3b
[ 2290.461009] [<f88d3137>] videobuf_queue_lock+0x13/0x15 [videobuf_core]
[ 2290.461009] [<f88d3f86>] __videobuf_free+0xfc/0x112 [videobuf_core]
[ 2290.461009] [<f89741e6>] cx18_v4l2_close+0x158/0x172 [cx18]
[ 2290.461009] [<c0507522>] ? cpumask_next+0x1a/0x1d
[ 2290.461009] [<f88a319d>] v4l2_release+0x35/0x52 [videodev]
[ 2290.461009] [<c04f5717>] fput+0x100/0x1a5
[ 2290.461009] [<c04f2e09>] filp_close+0x5c/0x64
[ 2290.461009] [<c04f2e70>] sys_close+0x5f/0x93
[ 2290.461009] [<c082cd5f>] sysenter_do_call+0x12/0x28
Some digging showed that a merge at some previous point partially
added broken mmap() support, causing this trace. Remove the broken
code completely.
On top of that, the calculation in place for "buffer full" depended on
UYUV instead of HM12, while our GStreamer code was picking HM12 in
some circumstances.
Finally, the V4L2_CAP_STREAMING capability was never exposed. Patch it
into the YUV encoder node only.
Signed-off-by: Simon Farnsworth <simon.farnsworth@onelan.co.uk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Release the dev->alt_max_pkt_size buffer in all cases.
Signed-off-by: Chris Rankin <rankincj@yahoo.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
* tag 'v3.1-rc6': (1902 commits)
Linux 3.1-rc6
ioctl: register LTTng ioctl
fuse: fix memory leak
fuse: fix flock breakage
Btrfs: add dummy extent if dst offset excceeds file end in
Btrfs: calc file extent num_bytes correctly in file clone
btrfs: xattr: fix attribute removal
Btrfs: fix wrong nbytes information of the inode
Btrfs: fix the file extent gap when doing direct IO
Btrfs: fix unclosed transaction handle in btrfs_cont_expand
Btrfs: fix misuse of trans block rsv
Btrfs: reset to appropriate block rsv after orphan operations
Btrfs: skip locking if searching the commit root in csum lookup
btrfs: fix warning in iput for bad-inode
Btrfs: fix an oops when deleting snapshots
[media] vp7045: fix buffer setup
[media] nuvoton-cir: simplify raw IR sample handling
[media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL
[media] v4l2: Fix documentation of the codec device controls
[media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240
...
|
|
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm: Remove duplicate "return" statement
drm/nv04/crtc: Bail out if FB is not bound to crtc
drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs
drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
drm/nouveau: fix oops on pre-semaphore hardware
drm/nv50/crtc: Bail out if FB is not bound to crtc
drm/radeon/kms: fix DP detect and EDID fetch for DP bridges
|
|
* 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus:
[media] vp7045: fix buffer setup
[media] nuvoton-cir: simplify raw IR sample handling
[media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL
[media] v4l2: Fix documentation of the codec device controls
[media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240
[media] gspca - sonixj: Fix wrong register mask for sensor om6802
[media] gspca - ov519: Fix LED inversion of some ov519 webcams
[media] pwc: precedence bug in pwc_init_controls()
|
|
The MT9P031 is a parallel 12-bit 5MP sensor from Aptina (formerly
Micron) controlled through I2C.
The driver creates a V4L2 subdevice. It currently supports skipping,
cropping, automatic binning, and gain, exposure, h/v flip and test
pattern controls.
Signed-off-by: Javier Martin <javier.martin@vista-silicon.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
drivers/media/video/omap3isp/isp.h is not a proper location for a header
that needs to be included from board code. Move the platform data
definitions to media/omap3isp.h.
Board code still needs to include isp.h to get the struct isp_device
definition and access OMAP3 ISP platform callbacks. Those callbacks will
be replaced by more generic code.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Add buffer length check to sanity checks for USERPTR QBUF.
Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Make sure the pipeline has a valid video source (either a subdev with no
sink pad, or a non-subdev entity) at stream-on time and return -EPIPE if
no video source can be found.
Reported-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
dvb_usb_device_init calls the frontend_attach method of this driver which
uses vp7045_usb_ob. In order to have a buffer ready in vp7045_usb_op, it has to
be allocated before that happens.
Luckily we can use the whole private data as the buffer as it gets separately
allocated on the heap via kzalloc in dvb_usb_device_init and is thus apt for
use via usb_control_msg.
This fixes a
BUG: unable to handle kernel paging request at 0000000000001e78
reported by Tino Keitel and diagnosed by Dan Carpenter.
Cc: stable@kernel.org # For v3.0 and upper
Tested-by: Tino Keitel <tino.keitel@tikei.de>
Signed-off-by: Florian Mickler <florian@mickler.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The nuvoton-cir driver was storing up consecutive pulse-pulse and
space-space samples internally, for no good reason, since
ir_raw_event_store_with_filter() already merges back to back like
samples types for us. This should also fix a regression introduced late
in 3.0 that related to a timeout change, which actually becomes correct
when coupled with this change. Tested with RC6 and RC5 on my own
nuvoton-cir hardware atop vanilla 3.0.0, after verifying quirky
behavior in 3.0 due to the timeout change.
Reported-by: Stephan Raue <sraue@openelec.tv>
CC: Stephan Raue <sraue@openelec.tv>
CC: stable@vger.kernel.org
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
In the unlikely case that pci_find_bus() should return NULL
viacam_serial_is_enabled() is going to dereference a NULL pointer and
blow up. Better safe than sorry, so be defensive and check the
pointer.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The images are clearer with a lower bridge clock.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The bug was introduced by git commit 0e4d413af1a9d, giving very dark images.
Signed-off-by: Luiz Carlos Ramos <lramos.prof@yahoo.com.br>
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The list of the webcams which have LED inversion was rebuild scanning
ms-win .inf files.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
'!' has higher precedence than '&' so we need parenthesis here.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
In vidioc_enum_fmt_vid_cap, the 'compressed' flag was set from the
pixelformat, and all pixelformats were not treated.
Now, images are told as compressed when the image size is smaller than
its number of pixels.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
For USB speeds different of 'low', the bInterval value is logarithmic.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The webcam is build from an Omnivision test kit which contains a OV538 bridge
and a OV9712 sensor.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The variable gspca_debug is defined and settable in gspca main.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Lower exposure values give too dark images.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The contrast was too low. Higher values are better.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The images are clearer with a lower bridge clock.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The list of the webcams which have LED inversion was rebuild scanning
ms-win .inf files.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
When CONFIG_NET is disabled, SCSI_QLA_ISCSI selects SCSI_ISCSI_ATTRS,
which uses network interfaces, so the build fails with multiple errors:
warning: (ISCSI_TCP && SCSI_CXGB3_ISCSI && SCSI_CXGB4_ISCSI && SCSI_QLA_ISCSI && INFINIBAND_ISER) selects SCSI_ISCSI_ATTRS which has unmet direct dependencies (SCSI && NET)
ERROR: "skb_trim" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
ERROR: "netlink_kernel_create" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
ERROR: "netlink_kernel_release" [drivers/scsi/scsi_transport_iscsi.ko] undefined!
...
so make SCSI_QLA_ISCSI also depend on NET to prevent the build errors.
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Cc: Ravi Anand <ravi.anand@qlogic.com>
Cc: Vikas Chaudhary <vikas.chaudhary@qlogic.com>
Cc: iscsi-driver@qlogic.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm
* 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm:
ARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort
ARM: 7080/1: l2x0: make sure I&D are not locked down on init
ARM: 7081/1: mach-integrator: fix the clocksource
NET: am79c961: fix race in link status code
ARM: 7067/1: mm: keep significant bits in pfn_valid
|
|
Since backlight_types[] isn't modified, let's declare it const. That
was probably the intention of the author of commit bb7ca747f8d6
("backlight: add backlight type"), via which the "const char const *"
construct was introduced. The duplicate const was detected by sparse.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Cc: Matthew Garrett <mjg@redhat.com>
Cc: Richard Purdie <rpurdie@rpsys.net>
Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
* 'for-linus' of git://neil.brown.name/md:
md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
md/raid1,10: Remove use-after-free bug in make_request.
md/raid10: unify handling of write completion.
Avoid dereferencing a 'request_queue' after last close.
|
|
0.90 metadata uses an unsigned 32bit number to count the number of
kilobytes used from each device.
This should allow up to 4TB per device.
However we multiply this by 2 (to get sectors) before casting to a
larger type, so sizes above 2TB get truncated.
Also we allow rdev->sectors to be larger than 4TB, so it is possible
for the array to be resized larger than the metadata can handle.
So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in
used.
Also the sanity check at the end of super_90_load should include level
1 as it used ->size too. (RAID0 and Linear don't use ->size at all).
Reported-by: Pim Zandbergen <P.Zandbergen@macroscoop.nl>
Cc: stable@kernel.org
Signed-off-by: NeilBrown <neilb@suse.de>
|
|
A single request to RAID1 or RAID10 might result in multiple
requests if there are known bad blocks that need to be avoided.
To detect if we need to submit another write request we test:
if (sectors_handled < (bio->bi_size >> 9)) {
However this is after we call **_write_done() so the 'bio' no longer
belongs to us - the writes could have completed and the bio freed.
So move the **_write_done call until after the test against
bio->bi_size.
This addresses https://bugzilla.kernel.org/show_bug.cgi?id=41862
Reported-by: Bruno Wolff III <bruno@wolff.to>
Tested-by: Bruno Wolff III <bruno@wolff.to>
Signed-off-by: NeilBrown <neilb@suse.de>
|
|
A write can complete at two different places:
1/ when the last member-device write completes, through
raid10_end_write_request
2/ in make_request() when we remove the initial bias from ->remaining.
These two should do exactly the same thing and the comment says they
do, but they don't.
So factor the correct code out into a function and call it in both
places. This makes the code much more similar to RAID1.
The difference is only significant if there is an error, and they
usually take a while, so it is unlikely that there will be an error
already when make_request is completing, so this is unlikely to cause
real problems.
Signed-off-by: NeilBrown <neilb@suse.de>
|
|
Modifying the Maximum Read Request Size to 0 (value of 128Bytes) has
massive negative ramifications on some devices. Without knowing which
devices have this issue, do not modify from the default value when
walking the PCI-E bus in pcie_bus_safe mode. Also, make pcie_bus_safe
the default procedure.
Tested-by: Sven Schnelle <svens@stackframe.org>
Tested-by: Simon Kirby <sim@hostway.ca>
Tested-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Reported-and-tested-by: Eric Dumazet <eric.dumazet@gmail.com>
Reported-and-tested-by: Niels Ole Salscheider <niels_ole@salscheider-online.de>
References: https://bugzilla.kernel.org/show_bug.cgi?id=42162
Signed-off-by: Jon Mason <mason@myri.com>
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Commit b03e7495a862 ("PCI: Set PCI-E Max Payload Size on fabric")
introduced a potential NULL pointer dereference in calls to
pcie_bus_configure_settings due to attempts to access pci_bus self
variables when the self pointer is NULL.
To correct this, verify that the self pointer in pci_bus is non-NULL
before dereferencing it.
Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Shyam Iyer <shyam_iyer@dell.com>
Signed-off-by: Jon Mason <mason@myri.com>
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
* 'for-linus' of git://dev.laptop.org/users/cjb/mmc:
mmc: sdhci-s3c: Fix mmc card I/O problem
mmc: sd: UHS-I bus speed should be set last in UHS initialization
mmc: sdhi: initialise mmc_data->flags before use
mmc: core: use non-reentrant workqueue for clock gating
mmc: core: prevent aggressive clock gating racing with ios updates
mmc: rename mmc_host_clk_{ungate|gate} to mmc_host_clk_{hold|release}
mmc: sdhci-esdhc-imx: add missing inclusion of linux/module.h
|
|
The check for (adap->active_fe < 0) at the top of dvb_usb_ctrl_feed is a sanity
check to ensure that adap->active_fe is valid. Improve that sanity check
by also checking for (adap->active_fe >= adap->num_frontends_initialized)
Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
This fixes a bug introduced by a previous changeset entitled,
[media] dvb-usb: refactor MFE code for individual streaming config per frontend
As reported by Antti Palosaari, This error is shown by VLC when channel changed:
[0x7f1bbc000cd0] dvb access error: DMXSetFilter: failed with -1 (Invalid argument)
[0x7f1bbc000cd0] dvb access error: DMXSetFilter failed
[0x7f1bbc32f910] main stream error: cannot pre fill buffer
After my own investigations, I've determined that this error case occurs when
the application stops streaming but leaves the frontend and dvr devices open.
A typical example of this usage would be a channel change operation while
watching live television. The error occurs when the application attempts to
stream after tuning to the new channel.
To prevent this error, don't set adap->active_fe to -1 unless the application
closes the device.
Cc: Antti Palosaari <crope@iki.fi>
Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Remove the duplicate "return" statement in drm_fb_helper_panic().
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-test
* 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
drm/nv04/crtc: Bail out if FB is not bound to crtc
drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs
drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
drm/nouveau: fix oops on pre-semaphore hardware
drm/nv50/crtc: Bail out if FB is not bound to crtc
|
|
This commit resolves a possible 'NULL pointer dereference'
It uses the same approach as radeon, intel and nouveau/nv50
Fixes bug 'Nouveau: Kernel oops when unplugging external monitor'
https://bugs.freedesktop.org/show_bug.cgi?id=40336
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
nv04_sgdma_bind binds the same page multiple times on
architectures where PAGE_SIZE != 4096.
Let's fix it.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Not cleaning after alloc failure would result in crash on destroy,
because nouveau_sgdma_clear assumes "ttm_alloced" to be not null when
"pages" is not null.
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
Fixes possbile NULL pointer dereference
Resolves 'kernel crash in nv50_crtc_do_mode_set_base during shutdown'
https://bugs.freedesktop.org/show_bug.cgi?id=40005
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
|
|
* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
dmaengine/ste_dma40: fix memory leak due to prepared descriptors
dmaengine/ste_dma40: fix Oops due to double free of client descriptor
dmaengine/ste_dma40: remove duplicate call to d40_pool_lli_free().
dmaengine/ste_dma40: add missing kernel doc for pending_queue
|
|
* 'for-linus' of git://opensource.wolfsonmicro.com/regmap:
regmap: Remove bitrotted module_put()s
|
|
* 'for-linus' of git://twin.jikos.cz/jikos/hid:
HID: wacom: Unregister sysfs attributes on remove
HID: wacom: Fix error path of power-supply initialization
HID: add support for HuiJia USB Gamepad connector
HID: magicmouse: ignore 'ivalid report id' while switching modes, v2
HID: magicmouse: Set resolution of touch surfaces
|
|
* 'for-31-rc5/i2c-fixes' of git://git.fluff.org/bjdooks/linux:
i2c-tegra: fix possible race condition after tx
i2c-tegra: add I2C_FUNC_SMBUS_EMUL
i2c-tegra: Add of_match_table
i2c-pxa2xx: return proper error code in ce4100_i2c_probe error paths
|
