aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2010-09-27V4L/DVB: videobuf-dma-sg: set correct size in last sg elementHans Verkuil2-4/+8
This fixes a nasty memory corruption bug when using userptr I/O. The function videobuf_pages_to_sg() sets up the scatter-gather list for the DMA transfer to the userspace pages. The first transfer is setup correctly (the size is set to PAGE_SIZE - offset), but all other transfers have size PAGE_SIZE. This is wrong for the last transfer which may be less than PAGE_SIZE. Most, if not all, drivers will program the boards DMA engine correctly, i.e. even though the size in the last sg element is wrong, they will do their own size calculations and make sure the right amount is DMA-ed, and so seemingly prevent memory corruption. However, behind the scenes the dynamic DMA mapping support (in lib/swiotlb.c) may create bounce buffers if the memory pages are not in DMA-able memory. This happens for example on a 64-bit linux with a board that only supports 32-bit DMA. These bounce buffers DO use the information in the sg list to determine the size. So while the DMA engine transfers the correct amount of data, when the data is 'bounced' back too much is copied, causing buffer overwrites. The fix is simple: calculate and set the correct size for the last sg list element. Signed-off-by: Hans Verkuil <[email protected]> Cc: [email protected] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: cx231xx: Avoid an OOPS when card is unknown (card=0)Mauro Carvalho Chehab1-6/+8
As reported by: Carlos Americo Domiciano <[email protected]>: [ 220.033500] cx231xx v4l2 driver loaded. [ 220.033571] cx231xx #0: New device Conexant Corporation Polaris AV Capturb @ 480 Mbps (1554:5010) with 6 interfaces [ 220.033577] cx231xx #0: registering interface 0 [ 220.033591] cx231xx #0: registering interface 1 [ 220.033654] cx231xx #0: registering interface 6 [ 220.033910] cx231xx #0: Identified as Unknown CX231xx video grabber (card=0) [ 220.033946] BUG: unable to handle kernel NULL pointer dereference at (null) [ 220.033955] IP: [<ffffffffa0d3c8bd>] cx231xx_pre_card_setup+0x5d/0xb0 [cx231xx] Thanks-to: Carlos Americo Domiciano <[email protected]> Cc: [email protected] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: dvb: fix smscore_getbuffer() logicRichard Zidlicky1-19/+12
Drivers shouldn't sleep while holding a spinlock. A previous workaround were to release the spinlock before callinc schedule(). This patch uses a different approach: it just waits for the siano hardware to answer. Signed-off-by: Richard Zidlicky <[email protected]> Cc: [email protected] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: dib7000p: add disable sample and hold, and diversity delay parameterOlivier Grenie3-1/+8
This patch improves the overall driver performance in diversity-reception scenarios. Signed-off-by: Olivier Grenie <[email protected]> Signed-off-by: Patrick Boettcher <[email protected]> Cc: [email protected] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: dib7770: enable the current mirrorOlivier Grenie3-1/+57
To improve performance on DiB7770-devices enabling the current mirror is needed. This patch adds an option to the dib7000p-driver to do that and it creates a separate device-entry in dib0700-device to use those changes on hardware which is using the DiB7770. Signed-off-by: Olivier Grenie <[email protected]> Signed-off-by: Patrick Boettcher <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: IR: extend MCE keymapMaxim Levitsky1-0/+3
These keys are found on remote bundled with Toshiba Qosmio F50-10q. Found and tested by, Sami R <[email protected]> Signed-off-by: Maxim Levitsky <[email protected]> Acked-by: Jarod Wilson <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: IR: fix keys beeing stuck down foreverMaxim Levitsky1-1/+1
The logic in ir_timer_keyup was inverted. In case that values aren't equal, the meaning of the time_is_after_eq_jiffies(ir->keyup_jiffies) is that ir->keyup_jiffies is after the the jiffies or equally that that jiffies are before the the ir->keyup_jiffies which is exactly the situation we want to avoid (that the timeout is in the future) Confusing Eh? Signed-off-by: Maxim Levitsky <[email protected]> Acked-by: Jarod Wilson <[email protected]> Cc: [email protected] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: IR: fix duty cycle capabilityMaxim Levitsky1-1/+1
Due to typo lirc bridge enabled wrong capability. Signed-off-by: Maxim Levitsky <[email protected]> Acked-by: Jarod Wilson <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: rc-core: increase repeat timeMauro Carvalho Chehab2-3/+7
As reported by Anton Blanchard <[email protected]>, double IR events on 2.6.36-rc2 and a DViCO FusionHDTV DVB-T Dual Express are happening: [ 1351.032084] ir_keydown: i2c IR (FusionHDTV): key down event, key 0x0067, scancode 0x0051 [ 1351.281284] ir_keyup: keyup key 0x0067 ie one key down event and one key up event 250ms later. So, we need to increase the repeat timeout, to avoid this bug to hit. As we're doing it at core, this fix is not needed anymore at dib0700 driver. Thanks-to: Anton Blanchard <[email protected]> Cc: [email protected] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: Don't identify PV SBTVD Hybrid as a DibCom deviceMauro Carvalho Chehab3-1/+5
As reported by Carlos, Prolink Pixelview SBTVD Hybrid is based on Conexant cx231xx + Fujitsu 86A20S demodulator. However, both shares the same USB ID. So, we need to use USB bcdDevice, in order to properly discover what's the board. We know for sure that bcd 0x100 is used for a dib0700 device, while bcd 0x4001 is used for a cx23102 device. This patch reserves two ranges, the first one from 0x0000-0x3f00 for dib0700, and the second from 0x4000-0x4fff for cx231xx devices. This may need fixes in the future, as we get access to other devices. Thanks-to: Carlos Americo Domiciano <[email protected]> Cc: [email protected] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: mceusb: add two new ASUS device IDsJarod Wilson1-0/+4
Reported in lirc sf.net tracker and on lirc mailing list Signed-off-by: Jarod Wilson <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: gspca - main: Fix a crash of some webcams on ARM archJason Wang1-0/+1
When plugging some webcams on ARM, the system crashes. This is because we alloc buffer for an urb through usb_buffer_alloc, the alloced buffer is already in DMA coherent region, so we should set the flag of this urb to URB_NO_TRANSFER_DMA_MAP, otherwise when we submit this urb, the hcd core will handle this address as an non-DMA address and call dma_map_single/sg to map it. On arm architecture, dma_map_single a DMA coherent address will be catched by a BUG_ON(). Signed-off-by: Jason Wang <[email protected]> Signed-off-by: Jean-François Moine <[email protected]> Cc: [email protected] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: Fix regression for BeholdTV ColumbusDmitri Belimov1-5/+5
Some time a go our customers wrote me about problem with our TV card BeholdTV Columbus. It's PCMCIA TV card for notebook. As I understand v4l has some regression with autodetect address of tuners. I can set incorrect I2C address and had report about detect tuner. No any TV of course. When I set correct tuner type and I2C address of the tuners all works well. Signed-off-by: Beholder Intl. Ltd. Dmitry Belimov <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: saa7164: move dereference under NULL checkDan Carpenter1-2/+3
The original code dereferenced "port" before checking it for NULL. I moved the test down below the check. Also I changed the comparisons a little so people wouldn't get confused and think "port" and "buf" were ints instead of pointers. (Probably that's what lead to this issue in the first place.) There is only one caller for this function and it passes non-NULL pointers, so this is essentially a cleanup rather than a bugfix. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: pvrusb2: remove unneeded NULL checksDan Carpenter1-3/+3
We dereference "maskptr" unconditionally at the start of the function and also inside the call to parse_tlist() towards the end of the function. This function is called from store_val_any() and it always passes a non-NULL pointer. Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Mike Isely <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: opera1: remove unneeded NULL checkDan Carpenter1-3/+1
"fw" is always a non-NULL pointer at this point, and anyway release_firmware() accepts NULL pointers. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: IR: ir-raw-event: null pointer dereferenceDan Carpenter1-1/+3
The original code dereferenced ir->raw after freeing it and setting it to NULL. Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Jarod Wilson <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: unlock on error pathDan Carpenter1-1/+2
If we return directly here then we miss out on some mutex_unlock()s Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Sylwester Nawrocki <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: cx88: Kconfig: Remove EXPERIMENTAL dependency from VIDEO_CX88_ALSAlawrence rust1-1/+1
The cx88-alsa module has been around since January 2006 and has seen no significant changes since September 2007. It is stable in operation and so I believe that the 'experimental' tag is no longer warranted. Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27V4L/DVB: tm6000: depends on IR_CORERandy Dunlap1-1/+1
tm6000 uses IR interfaces, so it should depend on IR_CORE. ERROR: "get_rc_map" [drivers/staging/tm6000/tm6000.ko] undefined! ERROR: "ir_input_unregister" [drivers/staging/tm6000/tm6000.ko] undefined! ERROR: "__ir_input_register" [drivers/staging/tm6000/tm6000.ko] undefined! Signed-off-by: Randy Dunlap <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2010-09-27Fix pktcdvd ioctl dev_minor range checkDan Rosenberg1-1/+1
The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a pktcdvd_device from the global pkt_devs array. The index into this array is provided directly by the user and is a signed integer, so the comparison to ensure that it falls within the bounds of this array will fail when provided with a negative index. This can be used to read arbitrary kernel memory or cause a crash due to an invalid pointer dereference. This can be exploited by users with permission to open /dev/pktcdvd/control (on many distributions, this is readable by group "cdrom"). Signed-off-by: Dan Rosenberg <[email protected]> [ Rather than add a cast, just make the function take the right type -Linus ] Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27MN10300: Default config choice GDBSTUB_TTYSM0 should be GDBSTUB_ON_TTYSM0David Howells1-1/+1
The configuration choice for the port on which the GDB stub listens has a default of GDBSTUB_TTYSM0, but this should be GDBSTUB_ON_TTYSM0 to match the option. Signed-off-by: David Howells <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-28drm/radeon/kms: add quirk for MSI K9A2GM motherboardAlex Deucher1-0/+9
Board has no digital connectors Reported-by: Andy Walls <[email protected]> Tested-by: Andy Walls <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected] Signed-off-by: Dave Airlie <[email protected]>
2010-09-28drm/radeon/kms: fix potential segfault in r600_ioctl_wait_idleAlex Deucher1-1/+2
radeon_gem_wait_idle_ioctl can apparently get called prior to the vram page being set up or even if accel if false, so make sure it's valid before using it. Should fix: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=597636 https://bugs.freedesktop.org/show_bug.cgi?id=29834 Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected] Signed-off-by: Dave Airlie <[email protected]>
2010-09-28drm: Prune GEM vma entriesChris Wilson3-11/+27
Hook the GEM vm open/close ops into the generic drm vm open/close so that the private vma entries are created and destroy appropriately. Fixes the leak of the drm_vma_entries during the lifetime of the filp. Reported-by: Matt Mackall <[email protected]> Cc: Jesse Barnes <[email protected]> Signed-off-by: Chris Wilson <[email protected]> Acked-by: Jesse Barnes <[email protected]> Cc: [email protected] Signed-off-by: Dave Airlie <[email protected]>
2010-09-28i2c-davinci: Fix race when setting up for TXJon Povey1-3/+3
When setting up to transmit, a race exists between the ISR and i2c_davinci_xfer_msg() trying to load the first byte and adjust counters. This is mostly visible for transmits > 1 byte long. The hardware starts sending immediately that MDR is loaded. IMR trickery doesn't work because if we start sending, finish the first byte and an XRDY event occurs before we load IMR to unmask it, we never get an interrupt, and we timeout. Move the MDR load after DXR,IMR loads to avoid this race without locking. Tested on DM355 connected to Techwell TW2836 and Wolfson WM8985 Signed-off-by: Jon Povey <[email protected]> Signed-off-by: Ben Dooks <[email protected]>
2010-09-27net/9p: Mount only matching virtio channelsSven Eckelmann1-1/+2
p9_virtio_create will only compare the the channel's tag characters against the device name till the end of the channel's tag but not till the end of the device name. This means that if a user defines channels with the tags foo and foobar then he would mount foo when he requested foonot and may mount foo when he requested foobar. Thus it is necessary to check both string lengths against each other in case of a successful partial string match. Signed-off-by: Sven Eckelmann <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-09-27de2104x: fix ethtoolOndrej Zary1-2/+5
When the interface is up, using ethtool breaks it because: a) link is put down but media_timer interval is not shortened to NO_LINK b) rxtx is stopped but not restarted Also manual 10baseT-HD (and probably FD too - untested) mode does not work - the link is forced up, packets are transmitted but nothing is received. Changing CSR14 value to match documentation (not disabling link check) fixes this. Signed-off-by: Ondrej Zary <[email protected]> Acked-by: Jeff Garzik <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-09-27i2c-octeon: Return -ETIMEDOUT in octeon_i2c_wait() on timeoutBernhard Walle1-1/+1
It doesn't make sense to set result to -ETIMEDOUT but return 0 (success) afterwards. Since there's code in octeon_i2c_start() to handle the error, it should be called. Signed-off-by: Bernhard Walle <[email protected]> Acked-by: David Daney <[email protected]> Signed-off-by: Ben Dooks <[email protected]>
2010-09-27Merge branch 'vhost-net' of ↵David S. Miller1-3/+4
git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
2010-09-27tproxy: check for transparent flag in ip_route_newportsUlrich Weber1-0/+2
as done in ip_route_connect() Signed-off-by: Ulrich Weber <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-09-27ipv6: add IPv6 to neighbour table overflow warningUlrich Weber2-2/+2
IPv4 and IPv6 have separate neighbour tables, so the warning messages should be distinguishable. [ Add a suitable message prefix on the ipv4 side as well -DaveM ] Signed-off-by: Ulrich Weber <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-09-27tcp: fix TSO FACK loss marking in tcp_mark_head_lostYuchung Cheng1-1/+2
When TCP uses FACK algorithm to mark lost packets in tcp_mark_head_lost(), if the number of packets in the (TSO) skb is greater than the number of packets that should be marked lost, TCP incorrectly exits the loop and marks no packets lost in the skb. This underestimates tp->lost_out and affects the recovery/retransmission. This patch fargments the skb and marks the correct amount of packets lost. Signed-off-by: Yuchung Cheng <[email protected]> Acked-by: Ilpo Järvinen <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2010-09-27Merge branch 'for-linus' of ↵Linus Torvalds1-2/+4
git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: RDMA/cxgb3: Turn off RX coalescing for iWARP connections
2010-09-27Merge master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds27-81/+207
* master.kernel.org:/home/rmk/linux-2.6-arm: (28 commits) ARM: 6411/1: vexpress: set RAM latencies to 1 cycle for PL310 on ct-ca9x4 tile ARM: 6409/1: davinci: map sram using MT_MEMORY_NONCACHED instead of MT_DEVICE ARM: 6408/1: omap: Map only available sram memory ARM: 6407/1: mmu: Setup MT_MEMORY and MT_MEMORY_NONCACHED L1 entries ARM: pxa: remove pr_<level> uses of KERN_<level> ARM: pxa168fb: clear enable bit when not active ARM: pxa: fix cpu_is_pxa*() not expanding to zero when not configured ARM: pxa168: fix corrected reset vector ARM: pxa: Use PIO for PI2C communication on Palm27x ARM: pxa: Fix Vpac270 gpio_power for MMC ARM: 6401/1: plug a race in the alignment trap handler ARM: 6406/1: at91sam9g45: fix i2c bus speed leds: leds-ns2: fix locking ARM: dove: fix __io() definition to use bus based offset dmaengine: fix interrupt clearing for mv_xor ARM: kirkwood: Unbreak PCIe I/O port ARM: Fix build error when using KCONFIG_CONFIG ARM: 6383/1: Implement phys_mem_access_prot() to avoid attributes aliasing ARM: 6400/1: at91: fix arch_gettimeoffset fallout ARM: 6398/1: add proc info for ARM11MPCore/Cortex-A9 from ARM ...
2010-09-27Merge branch 'for-linus' of ↵Linus Torvalds1-11/+18
git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: net/9p: fix memory handling/allocation in rdma_request()
2010-09-27Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bpLinus Torvalds1-0/+3
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: amd64_edac: Fix driver module removal
2010-09-27Merge branch 'for-linus' of ↵Linus Torvalds2-4/+5
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: TOMOYO: Don't abuse sys_getpid(), sys_getppid()
2010-09-27Merge branch 'drm-intel-fixes' of ↵Linus Torvalds2-10/+7
git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: drm/i915/sdvo: Handle unsupported GET_SUPPORTED_ENHANCEMENTS gracefully drm/i915/sdvo: Cleanup connector on error path drm/i915: Fix 945GM regression in e259befd
2010-09-27Merge branch 'for-linus' of ↵Linus Torvalds2-6/+14
git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: sdhci-s3c: fix NULL ptr access in sdhci_s3c_remove mmc: sdhci-s3c: fix incorrect spinlock usage after merge mmc: MAINTAINERS: add myself as MMC maintainer
2010-09-27Merge branch 'urgent' of ↵Linus Torvalds2-1/+7
git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6 * 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: pcmcia: pd6729: Fix error path pcmcia: preserve configuration information if request_io fails partly
2010-09-27Merge git://git.infradead.org/iommu-2.6Linus Torvalds1-0/+27
* git://git.infradead.org/iommu-2.6: intel-iommu: Use symbolic values instead of magic numbers in Lenovo w/a intel-iommu: Abort IOMMU setup for igfx if BIOS gave no shadow GTT space
2010-09-27Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds6-24/+82
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86/amd-iommu: Fix rounding-bug in __unmap_single x86/amd-iommu: Work around S3 BIOS bug x86/amd-iommu: Set iommu configuration flags in enable-loop x86, setup: Fix earlyprintk=serial,0x3f8,115200 x86, setup: Fix earlyprintk=serial,ttyS0,115200
2010-09-27Merge branch 'perf-fixes-for-linus' of ↵Linus Torvalds2-1/+13
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf, x86: Catch spurious interrupts after disabling counters tracing/x86: Don't use mcount in kvmclock.c tracing/x86: Don't use mcount in pvclock.c
2010-09-27mn10300: check __get_user/__put_user results...Al Viro1-6/+6
Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27mn10300: get rid of set_fs(USER_DS) in sigframe setupAl Viro1-4/+0
It really has no business being there; short of a serious kernel bug we should already have USER_DS at that point. It shouldn't have been done on x86 either... Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27mn10300: ->restart_block.fn needs to be reset on sigreturnAl Viro1-0/+3
Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27mn10300: prevent double syscall restartsAl Viro1-3/+9
set ->orig_d0 to -1, same as what sigreturn does Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27mn10300: avoid SIGSEGV delivery loopAl Viro1-2/+2
force_sigsegv() is there for purpose... Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2010-09-27alpha: __get_user/__put_user results need to be checked...Al Viro1-4/+4
Signed-off-by: Al Viro <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.