Commit graph

47 commits

Author SHA1 Message Date
Duoming Zhou
ebad8e731c media: usb: siano: Fix use after free bugs caused by do_submit_urb
There are UAF bugs caused by do_submit_urb(). One of the KASan reports
is shown below:

[   36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890
[   36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49
[   36.408316]
[   36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8
[   36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584
[   36.416157] Workqueue:  0x0 (events)
[   36.417654] Call Trace:
[   36.418546]  <TASK>
[   36.419320]  dump_stack_lvl+0x96/0xd0
[   36.420522]  print_address_description+0x75/0x350
[   36.421992]  print_report+0x11b/0x250
[   36.423174]  ? _raw_spin_lock_irqsave+0x87/0xd0
[   36.424806]  ? __virt_addr_valid+0xcf/0x170
[   36.426069]  ? worker_thread+0x4a2/0x890
[   36.427355]  kasan_report+0x131/0x160
[   36.428556]  ? worker_thread+0x4a2/0x890
[   36.430053]  worker_thread+0x4a2/0x890
[   36.431297]  ? worker_clr_flags+0x90/0x90
[   36.432479]  kthread+0x166/0x190
[   36.433493]  ? kthread_blkcg+0x50/0x50
[   36.434669]  ret_from_fork+0x22/0x30
[   36.435923]  </TASK>
[   36.436684]
[   36.437215] Allocated by task 24:
[   36.438289]  kasan_set_track+0x50/0x80
[   36.439436]  __kasan_kmalloc+0x89/0xa0
[   36.440566]  smsusb_probe+0x374/0xc90
[   36.441920]  usb_probe_interface+0x2d1/0x4c0
[   36.443253]  really_probe+0x1d5/0x580
[   36.444539]  __driver_probe_device+0xe3/0x130
[   36.446085]  driver_probe_device+0x49/0x220
[   36.447423]  __device_attach_driver+0x19e/0x1b0
[   36.448931]  bus_for_each_drv+0xcb/0x110
[   36.450217]  __device_attach+0x132/0x1f0
[   36.451470]  bus_probe_device+0x59/0xf0
[   36.452563]  device_add+0x4ec/0x7b0
[   36.453830]  usb_set_configuration+0xc63/0xe10
[   36.455230]  usb_generic_driver_probe+0x3b/0x80
[   36.456166] printk: console [ttyGS0] disabled
[   36.456569]  usb_probe_device+0x90/0x110
[   36.459523]  really_probe+0x1d5/0x580
[   36.461027]  __driver_probe_device+0xe3/0x130
[   36.462465]  driver_probe_device+0x49/0x220
[   36.463847]  __device_attach_driver+0x19e/0x1b0
[   36.465229]  bus_for_each_drv+0xcb/0x110
[   36.466466]  __device_attach+0x132/0x1f0
[   36.467799]  bus_probe_device+0x59/0xf0
[   36.469010]  device_add+0x4ec/0x7b0
[   36.470125]  usb_new_device+0x863/0xa00
[   36.471374]  hub_event+0x18c7/0x2220
[   36.472746]  process_one_work+0x34c/0x5b0
[   36.474041]  worker_thread+0x4b7/0x890
[   36.475216]  kthread+0x166/0x190
[   36.476267]  ret_from_fork+0x22/0x30
[   36.477447]
[   36.478160] Freed by task 24:
[   36.479239]  kasan_set_track+0x50/0x80
[   36.480512]  kasan_save_free_info+0x2b/0x40
[   36.481808]  ____kasan_slab_free+0x122/0x1a0
[   36.483173]  __kmem_cache_free+0xc4/0x200
[   36.484563]  smsusb_term_device+0xcd/0xf0
[   36.485896]  smsusb_probe+0xc85/0xc90
[   36.486976]  usb_probe_interface+0x2d1/0x4c0
[   36.488303]  really_probe+0x1d5/0x580
[   36.489498]  __driver_probe_device+0xe3/0x130
[   36.491140]  driver_probe_device+0x49/0x220
[   36.492475]  __device_attach_driver+0x19e/0x1b0
[   36.493988]  bus_for_each_drv+0xcb/0x110
[   36.495171]  __device_attach+0x132/0x1f0
[   36.496617]  bus_probe_device+0x59/0xf0
[   36.497875]  device_add+0x4ec/0x7b0
[   36.498972]  usb_set_configuration+0xc63/0xe10
[   36.500264]  usb_generic_driver_probe+0x3b/0x80
[   36.501740]  usb_probe_device+0x90/0x110
[   36.503084]  really_probe+0x1d5/0x580
[   36.504241]  __driver_probe_device+0xe3/0x130
[   36.505548]  driver_probe_device+0x49/0x220
[   36.506766]  __device_attach_driver+0x19e/0x1b0
[   36.508368]  bus_for_each_drv+0xcb/0x110
[   36.509646]  __device_attach+0x132/0x1f0
[   36.510911]  bus_probe_device+0x59/0xf0
[   36.512103]  device_add+0x4ec/0x7b0
[   36.513215]  usb_new_device+0x863/0xa00
[   36.514736]  hub_event+0x18c7/0x2220
[   36.516130]  process_one_work+0x34c/0x5b0
[   36.517396]  worker_thread+0x4b7/0x890
[   36.518591]  kthread+0x166/0x190
[   36.519599]  ret_from_fork+0x22/0x30
[   36.520851]
[   36.521405] Last potentially related work creation:
[   36.523143]  kasan_save_stack+0x3f/0x60
[   36.524275]  kasan_record_aux_stack_noalloc+0x9d/0xb0
[   36.525831]  insert_work+0x25/0x130
[   36.527039]  __queue_work+0x4d4/0x620
[   36.528236]  queue_work_on+0x72/0xb0
[   36.529344]  __usb_hcd_giveback_urb+0x13f/0x1b0
[   36.530819]  dummy_timer+0x350/0x1a40
[   36.532149]  call_timer_fn+0x2c/0x190
[   36.533567]  expire_timers+0x69/0x1f0
[   36.534736]  __run_timers+0x289/0x2d0
[   36.535841]  run_timer_softirq+0x2d/0x60
[   36.537110]  __do_softirq+0x116/0x380
[   36.538377]
[   36.538950] Second to last potentially related work creation:
[   36.540855]  kasan_save_stack+0x3f/0x60
[   36.542084]  kasan_record_aux_stack_noalloc+0x9d/0xb0
[   36.543592]  insert_work+0x25/0x130
[   36.544891]  __queue_work+0x4d4/0x620
[   36.546168]  queue_work_on+0x72/0xb0
[   36.547328]  __usb_hcd_giveback_urb+0x13f/0x1b0
[   36.548805]  dummy_timer+0x350/0x1a40
[   36.550116]  call_timer_fn+0x2c/0x190
[   36.551570]  expire_timers+0x69/0x1f0
[   36.552762]  __run_timers+0x289/0x2d0
[   36.553916]  run_timer_softirq+0x2d/0x60
[   36.555118]  __do_softirq+0x116/0x380
[   36.556239]
[   36.556807] The buggy address belongs to the object at ffff888005960000
[   36.556807]  which belongs to the cache kmalloc-4k of size 4096
[   36.560652] The buggy address is located 232 bytes inside of
[   36.560652]  4096-byte region [ffff888005960000, ffff888005961000)
[   36.564791]
[   36.565355] The buggy address belongs to the physical page:
[   36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00
[   36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0
[   36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1)
[   36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000
[   36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
[   36.580175] page dumped because: kasan: bad access detected
[   36.581994]
[   36.582548] Memory state around the buggy address:
[   36.583983]  ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   36.586240]  ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   36.591071]                                                           ^
[   36.593295]  ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   36.595705]  ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   36.598026] ==================================================================
[   36.600224] Disabling lock debugging due to kernel taint
[   36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I
[   36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G    B              6.2.0-rc3-15798-8
[   36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584
[   36.615026] Workqueue: events do_submit_urb
[   36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0
[   36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5
[   36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046
[   36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7
[   36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0
[   36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f
[   36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020
[   36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001
[   36.636438] FS:  0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
[   36.639092] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0
[   36.643411] Call Trace:
[   36.644215]  <TASK>
[   36.644902]  smscore_getbuffer+0x3e/0x1e0
[   36.646147]  do_submit_urb+0x4f/0x190
[   36.647449]  process_one_work+0x34c/0x5b0
[   36.648777]  worker_thread+0x4b7/0x890
[   36.649984]  ? worker_clr_flags+0x90/0x90
[   36.651166]  kthread+0x166/0x190
[   36.652151]  ? kthread_blkcg+0x50/0x50
[   36.653547]  ret_from_fork+0x22/0x30
[   36.655051]  </TASK>
[   36.655733] Modules linked in:
[   36.656787] ---[ end trace 0000000000000000 ]---
[   36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0
[   36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5
[   36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046
[   36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7
[   36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0
[   36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f
[   36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020
[   36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001
[   36.679184] FS:  0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
[   36.681655] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0
[   36.685733] Kernel panic - not syncing: Fatal exception
[   36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff)
[   36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]---

When the siano device is plugged in, it may call the following functions
to initialize the device.

smsusb_probe()-->smsusb_init_device()-->smscore_start_device().

When smscore_start_device() gets failed, the function smsusb_term_device()
will be called and smsusb_device_t will be deallocated. Although we use
usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests
and wait for them to finish, the worker threads that are scheduled by
smsusb_onresponse() may be still running. As a result, the UAF bugs
could happen.

We add cancel_work_sync() in smsusb_stop_streaming() in order that the
worker threads could finish before the smsusb_device_t is deallocated.

Fixes: dd47fbd40e ("[media] smsusb: don't sleep while atomic")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2023-02-08 09:02:42 +01:00
Krzysztof Kozlowski
051d3b5437 media: siano: remove duplicate USB device IDs
The devices 0x187f,0x0202 and 0x187f,0x0301 are already on the list.

Link: https://lore.kernel.org/linux-media/20210917092132.19576-1-krzysztof.kozlowski@canonical.com

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-12-07 11:29:58 +01:00
Gustavo A. R. Silva
1771e9fb67 media: Use fallthrough pseudo-keyword
Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.

[1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-08-29 08:35:27 +02:00
Linus Torvalds
e49c8547fb USB fixes for 5.2-rc3
Here are some tiny USB fixes for a number of reported issues for
 5.2-rc3.
 
 Nothing huge here, just a small collection of xhci and other driver bugs
 that syzbot has been finding in some drivers.  There is also a usbip fix
 and a fix for the usbip fix in here :)
 
 All have been in linux-next with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXPCDwQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yli6QCaAmaLPqpgO12vsYlD7KYfktM7wYEAnjD+L73Z
 Sc9htZ4BudpBzjK3FPyH
 =rCpe
 -----END PGP SIGNATURE-----

Merge tag 'usb-5.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some tiny USB fixes for a number of reported issues for
  5.2-rc3.

  Nothing huge here, just a small collection of xhci and other driver
  bugs that syzbot has been finding in some drivers. There is also a
  usbip fix and a fix for the usbip fix in here :)

  All have been in linux-next with no reported issues"

* tag 'usb-5.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usbip: usbip_host: fix stub_dev lock context imbalance regression
  media: smsusb: better handle optional alignment
  xhci: Use %zu for printing size_t type
  xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()
  xhci: Fix immediate data transfer if buffer is already DMA mapped
  usb: xhci: avoid null pointer deref when bos field is NULL
  usb: xhci: Fix a potential null pointer dereference in xhci_debugfs_create_endpoint()
  xhci: update bounce buffer with correct sg num
  media: usb: siano: Fix false-positive "uninitialized variable" warning
  USB: rio500: update Documentation
  USB: rio500: simplify locking
  USB: rio500: fix memory leak in close after disconnect
  USB: rio500: refuse more than one device at a time
  usbip: usbip_host: fix BUG: sleeping function called from invalid context
  USB: sisusbvga: fix oops in error path of sisusb_probe
  USB: Add LPM quirk for Surface Dock GigE adapter
  media: usb: siano: Fix general protection fault in smsusb
  usb: mtu3: fix up undefined reference to usb_debug_root
  USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor
2019-05-31 08:16:31 -07:00
Mauro Carvalho Chehab
a47686636d media: smsusb: better handle optional alignment
Most Siano devices require an alignment for the response.

Changeset f3be52b0056a ("media: usb: siano: Fix general protection fault in smsusb")
changed the logic with gets such aligment, but it now produces a
sparce warning:

drivers/media/usb/siano/smsusb.c: In function 'smsusb_init_device':
drivers/media/usb/siano/smsusb.c:447:37: warning: 'in_maxp' may be used uninitialized in this function [-Wmaybe-uninitialized]
  447 |   dev->response_alignment = in_maxp - sizeof(struct sms_msg_hdr);
      |                             ~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~

The sparse message itself is bogus, but a broken (or fake) USB
eeprom could produce a negative value for response_alignment.

So, change the code in order to check if the result is not
negative.

Fixes: 31e0456de5 ("media: usb: siano: Fix general protection fault in smsusb")
CC: <stable@vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-24 21:09:20 +02:00
Alan Stern
45457c0117 media: usb: siano: Fix false-positive "uninitialized variable" warning
GCC complains about an apparently uninitialized variable recently
added to smsusb_init_device().  It's a false positive, but to silence
the warning this patch adds a trivial initialization.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: kbuild test robot <lkp@intel.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-22 14:25:34 +02:00
Thomas Gleixner
1ccea77e2a treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
Based on 2 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation either version 2 of the license or at
  your option any later version this program is distributed in the
  hope that it will be useful but without any warranty without even
  the implied warranty of merchantability or fitness for a particular
  purpose see the gnu general public license for more details you
  should have received a copy of the gnu general public license along
  with this program if not see http www gnu org licenses

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation either version 2 of the license or at
  your option any later version this program is distributed in the
  hope that it will be useful but without any warranty without even
  the implied warranty of merchantability or fitness for a particular
  purpose see the gnu general public license for more details [based]
  [from] [clk] [highbank] [c] you should have received a copy of the
  gnu general public license along with this program if not see http
  www gnu org licenses

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 355 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Jilayne Lovejoy <opensource@jilayne.com>
Reviewed-by: Steve Winslow <swinslow@gmail.com>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190519154041.837383322@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-21 11:28:45 +02:00
Alan Stern
31e0456de5 media: usb: siano: Fix general protection fault in smsusb
The syzkaller USB fuzzer found a general-protection-fault bug in the
smsusb part of the Siano DVB driver.  The fault occurs during probe
because the driver assumes without checking that the device has both
IN and OUT endpoints and the IN endpoint is ep1.

By slightly rearranging the driver's initialization code, we can make
the appropriate checks early on and thus avoid the problem.  If the
expected endpoints aren't present, the new code safely returns -ENODEV
from the probe routine.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+53f029db71c19a47325a@syzkaller.appspotmail.com
CC: <stable@vger.kernel.org>
Reviewed-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-21 10:08:56 +02:00
Mauro Carvalho Chehab
3e4d8f48b9 media: usb: fix several typos
Use codespell to fix lots of typos over frontends.

Manually verified to avoid false-positives.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-03-01 09:43:27 -05:00
Wen Yang
0f4bb10857 media: siano: Use kmemdup instead of duplicating its function
kmemdup has implemented the function that kmalloc() + memcpy().
We prefer to kmemdup rather than code opened implementation.

This issue was detected with the help of coccinelle.

Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
CC: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
CC: linux-kernel@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-12-07 09:42:18 -05:00
Mauro Carvalho Chehab
782b9d2011 media: siano: use GFP_DMA only for smssdio
Right now, the Siano's core uses GFP_DMA for both USB and
SDIO variants of the driver. There's no reason to use it
for USB. So, pass GFP_DMA as a parameter during sms core
register.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-05-15 08:04:42 -04:00
Tomoki Sekiyama
564246fd3f media: siano: Fix coherent memory allocation failure on arm64
On some architectures such as arm64, siano chip based TV-tuner
USB devices are not recognized correctly due to coherent memory
allocation failure with the following error:

[  663.556135] usbcore: deregistering interface driver smsusb
[  683.624809] smsusb:smsusb_probe: board id=18, interface number 0
[  683.633530] smsusb:smsusb_init_device: smscore_register_device(...) failed, rc -12
[  683.641501] smsusb:smsusb_probe: Device initialized with return code -12
[  683.652978] smsusb: probe of 1-1:1.0 failed with error -12

This is caused by dma_alloc_coherent(NULL, ...) returning NULL in
smscoreapi.c.

To fix this error, allocate the buffer memory for the USB devices
via kmalloc() and let the USB core do the DMA mapping and free.

Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-03-06 12:46:15 -05:00
Mauro Carvalho Chehab
6e6a8b5a38 media: replace all <spaces><tab> occurrences
There are a lot of places where sequences of space/tabs are
found. Get rid of all spaces before tabs.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-04 13:15:05 -05:00
Mauro Carvalho Chehab
929b99ed9b media: siano: get rid of documentation warnings
The Siano driver doesn't use kernel-doc markups. While it
would be wanderful to convert to use it, it is probably
not worth the time.

So, instead of solving all problems there, just make
sure that it won't produce dozens of warnings.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-11-27 08:40:36 -05:00
Mauro Carvalho Chehab
f9c85ee671 [media] siano: make it work again with CONFIG_VMAP_STACK
Reported as a Kaffeine bug:
	https://bugs.kde.org/show_bug.cgi?id=375811

The USB control messages require DMA to work. We cannot pass
a stack-allocated buffer, as it is not warranted that the
stack would be into a DMA enabled area.

On Kernel 4.9, the default is to not accept DMA on stack anymore
on x86 architecture. On other architectures, this has been a
requirement since Kernel 2.2. So, after this patch, this driver
should likely work fine on all archs.

Tested with USB ID 2040:5510: Hauppauge Windham

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-02-14 18:13:49 -02:00
Mauro Carvalho Chehab
67390d21fe [media] siano: don't break long lines
Due to the 80-cols restrictions, and latter due to checkpatch
warnings, several strings were broken into multiple lines. This
is not considered a good practice anymore, as it makes harder
to grep for strings at the source code.

As we're right now fixing other drivers due to KERN_CONT, we need
to be able to identify what printk strings don't end with a "\n".
It is a way easier to detect those if we don't break long lines.

So, join those continuation lines.

The patch was generated via the script below, and manually
adjusted if needed.

</script>
use Text::Tabs;
while (<>) {
	if ($next ne "") {
		$c=$_;
		if ($c =~ /^\s+\"(.*)/) {
			$c2=$1;
			$next =~ s/\"\n$//;
			$n = expand($next);
			$funpos = index($n, '(');
			$pos = index($c2, '",');
			if ($funpos && $pos > 0) {
				$s1 = substr $c2, 0, $pos + 2;
				$s2 = ' ' x ($funpos + 1) . substr $c2, $pos + 2;
				$s2 =~ s/^\s+//;

				$s2 = ' ' x ($funpos + 1) . $s2 if ($s2 ne "");

				print unexpand("$next$s1\n");
				print unexpand("$s2\n") if ($s2 ne "");
			} else {
				print "$next$c2\n";
			}
			$next="";
			next;
		} else {
			print $next;
		}
		$next="";
	} else {
		if (m/\"$/) {
			if (!m/\\n\"$/) {
				$next=$_;
				next;
			}
		}
	}
	print $_;
}
</script>

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-21 09:52:50 -02:00
Mauro Carvalho Chehab
6cf5dad17e [media] media_device: move allocation out of media_device_*_init
Right now, media_device_pci_init and media_device_usb_init does
media_device allocation internaly. That preents its usage when
the media_device struct is embedded on some other structure.

Move memory allocation outside it, to make it more generic.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-23 07:19:39 -03:00
Mauro Carvalho Chehab
41b44e35ba [media] media-device: move PCI/USB helper functions from v4l2-mc
Those ancillary functions could be called even when compiled
without V4L2 support, as warned by ktest build robot:

All errors (new ones prefixed by >>):

>> ERROR: "__v4l2_mc_usb_media_device_init" [drivers/media/usb/dvb-usb/dvb-usb.ko] undefined!
>> ERROR: "__v4l2_mc_usb_media_device_init" [drivers/media/usb/dvb-usb-v2/dvb_usb_v2.ko] undefined!
>> ERROR: "__v4l2_mc_usb_media_device_init" [drivers/media/usb/au0828/au0828.ko] undefined!

Also, there's nothing there that are specific to V4L2. So, move
those ancillary functions to MC core.

No functional changes. Just function rename.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-23 07:18:45 -03:00
Mauro Carvalho Chehab
3d0ccad0db [media] siano: use generic function to create MC device
Currently, it is initializing the driver name using the wrong
name ("usb"). Use the generic function, as its logic works
best, and avoids repeating the very same code everywhere.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-16 09:30:46 -02:00
Mauro Carvalho Chehab
dd47fbd40e [media] smsusb: don't sleep while atomic
smscore_getbuffer() calls internally wait_event(), with can sleep.
As smsusb_onresponse() is called on interrupt context, this causes
the following warning:

	BUG: sleeping function called from invalid context at drivers/media/common/siano/smscoreapi.c:1653
	in_atomic(): 1, irqs_disabled(): 1, pid: 11084, name: systemd-udevd
	INFO: lockdep is turned off.
	irq event stamp: 0
	hardirqs last  enabled at (0): [<          (null)>]           (null)
	hardirqs last disabled at (0): [<ffffffff811480f7>] copy_process.part.7+0x10e7/0x56d0
	softirqs last  enabled at (0): [<ffffffff81148193>] copy_process.part.7+0x1183/0x56d0
	softirqs last disabled at (0): [<          (null)>]           (null)
	CPU: 2 PID: 11084 Comm: systemd-udevd Tainted: G    B   W       4.5.0-rc3+ #47
	Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015
	 0000000000000000 ffff8803c6907a80 ffffffff81933901 ffff8802bd916000
	 ffff8802bd9165c8 ffff8803c6907aa8 ffffffff811c6af5 ffff8802bd916000
	 ffffffffa0ce9b60 0000000000000675 ffff8803c6907ae8 ffffffff811c6ce5
	Call Trace:
	 <IRQ>  [<ffffffff81933901>] dump_stack+0x85/0xc4
	 [<ffffffff811c6af5>] ___might_sleep+0x245/0x3a0
	 [<ffffffff811c6ce5>] __might_sleep+0x95/0x1a0
	 [<ffffffffa0ce020a>] ? list_add_locked+0xca/0x140 [smsmdtv]
	 [<ffffffffa0ce3b8d>] smscore_getbuffer+0x7d/0x120 [smsmdtv]
	 [<ffffffff8123819d>] ? trace_hardirqs_off+0xd/0x10
	 [<ffffffffa0ce3b10>] ? smscore_sendrequest_and_wait.isra.5+0x120/0x120 [smsmdtv]
	 [<ffffffffa0ce020a>] ? list_add_locked+0xca/0x140 [smsmdtv]
	 [<ffffffffa0ce13ca>] ? smscore_putbuffer+0x3a/0x40 [smsmdtv]
	 [<ffffffffa0d107bc>] smsusb_submit_urb+0x2ec/0x4f0 [smsusb]
	 [<ffffffffa0d10e36>] smsusb_onresponse+0x476/0x720 [smsusb]

Let's add a work queue to handle the bottom half, preventing this
problem.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-16 09:29:34 -02:00
Javier Martinez Canillas
9832e155f1 [media] media-device: split media initialization and registration
The media device node is registered and so made visible to user-space
before entities are registered and links created which means that the
media graph obtained by user-space could be only partially enumerated
if that happens too early before all the graph has been created.

To avoid this race condition, split the media init and registration
in separate functions and only register the media device node when
all the pending subdevices have been registered, either explicitly
by the driver or asynchronously using v4l2_async_register_subdev().

The media_device_register() had a check for drivers not filling dev
and model fields but all drivers in mainline set them and not doing
it will be a driver bug so change the function return to void and
add a BUG_ON() for dev being NULL instead.

Also, add a media_device_cleanup() function that will destroy the
graph_mutex that is initialized in media_device_init().

[mchehab@osg.samsung.com: Fix compilation if !CONFIG_MEDIA_CONTROLLER
 and remove two warnings added by this changeset]
Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-01-11 12:19:15 -02:00
Mauro Carvalho Chehab
f704eab5b6 [media] siano: avoid a linkedit error if !MC
If the media controller (MC) is not enabled, it will compile
fine, but will fail at the linkedition:

 ERROR: "media_device_unregister" [drivers/media/usb/siano/smsusb.ko] undefined!

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-03-02 14:17:01 -03:00
Mauro Carvalho Chehab
4b208f8b56 [media] siano: register media controller earlier
We need to initialize the media controller earlier, as the core
will call the smsdvb hotplug during register time. Ok, this is
an async operation, so, when the module is not loaded, the media
controller works.

However, if the module is already loaded, nothing will be
registered at the media controller, as it will load too late.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-02-26 09:10:39 -03:00
Mauro Carvalho Chehab
d9f3836b7b [media] siano: get rid of sms_dbg parameter
All siano modules have a sms_dbg parameter. Now that we're using
the standard pr_debug() macro, we can get rid of it.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-02-26 09:10:05 -03:00
Mauro Carvalho Chehab
0dd5f20cb3 [media] siano: get rid of sms_info()
On most cases, sms_info() should actually be pr_debug(), but,
on other places, it should be pr_info().

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-02-26 09:10:04 -03:00
Mauro Carvalho Chehab
6908368879 [media] siano: replace sms_debug() by pr_debug()
There's no reason to use a macro here. Just replace everything,
and let those debug messages to be activated via dynamic printk.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-02-26 09:10:04 -03:00
Mauro Carvalho Chehab
5ed0a2c7ec [media] siano: replace sms_err by pr_err
Originally, sms_err() would be also displaying the line where
the error occurs, but the messages are clear enough. Also,
the function is always printed. So, no need for it.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-02-26 09:10:02 -03:00
Mauro Carvalho Chehab
535bd1e96e [media] siano: replace sms_warn() by pr_warn()
There's no reason for a sms' own sms_warn macro. Just replace
it by the standard pr_warn().

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-02-26 09:10:02 -03:00
Mauro Carvalho Chehab
5e022d1aa0 [media] siano: use pr_* print functions
Instead of defining its own set of printk functions, let's
use the common Kernel debug logic provided by pr_foo functions.

As a first step, let's just define the existing macros as the
Kernel ones.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-02-26 09:10:01 -03:00
Mauro Carvalho Chehab
46b1e21fe5 [media] siano: add support for the media controller at USB driver
Adding support for the media controller for a pure DVB device
is simple: just create a struct media_device and add it to the
dvb adapter. After creating all DVB devices, we need to call
the DVB core, for it to create the media graph.

More work is needed for pure DVB tuners, but this is hidden
at the Siano driver, just like several others non-hybrid
devices. So, this is streight forward.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-02-26 08:46:48 -03:00
Mauro Carvalho Chehab
7983b773ba [media] usb drivers: use %zu instead of %zd
size_t is unsigned.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2014-09-26 06:51:00 -03:00
Mauro Carvalho Chehab
29bbb7bd0a [media] siano: add support for PCTV 77e
Add support for PCTV microStick (77e) device that uses a sms1140
chipset.

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
2014-08-21 15:25:27 -05:00
Satoshi Nagahama
f61e2268a0 [media] Siano: smsusb - Add a device id for PX-S1UD
Add a device id to support for PX-S1UD (PLEX ISDB-T usb dongle) which
has sms2270.

Signed-off-by: Satoshi Nagahama <sattnag@aim.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
2014-03-11 12:12:53 -03:00
Mauro Carvalho Chehab
b00ade2bb1 [media] siano: Use the default firmware for Stellar
The Stellar firmware load routine is different. Improve it to use
the default firmware, if no modprobe parameter tells otherwise.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Tested-by: André Roth <neolynx@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
2013-10-14 06:41:10 -03:00
Mauro Carvalho Chehab
811a4f6d11 [media] siano: Fix initialization for Stellar models
Since kernel 3.8, the initialization for Stellar (sms1000)
devices are broken.
Those devices have a behaviour different than usual sms1100
and sms2270: they start with one USB ID (devices in cold state),
but after firmware load, they get a different USB ID.
This weren't docummented at the driver. So, the patches that added
support for sms2270 broke it.
Properly documment it, and provide a debug log that allows to
follow all phases of the device initialization:
	smsusb_probe: board id=13, interface number 0
	smsusb_probe: interface 0 won't be used. Expecting interface 1 to popup
	smsusb_probe: board id=13, interface number 1
	smsusb_probe: smsusb_probe 1
	smsusb_probe: endpoint 0 81 02 64
	smsusb_probe: endpoint 1 02 02 64
	smsusb_probe: stellar device in cold state was found at usb\4-2.
	smsusb1_load_firmware: sent 38144(38144) bytes, rc 0
	smsusb1_load_firmware: read FW dvbt_bda_stellar_usb.inp, size=38144
	smsusb_probe: stellar device now in warm state
	usbcore: registered new interface driver smsusb
	usb 4-2: USB disconnect, device number 52
	usb 4-2: new full-speed USB device number 53 using uhci_hcd
	usb 4-2: New USB device found, idVendor=187f, idProduct=0100
	usb 4-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
	usb 4-2: Product: SMS DVBT-BDA Receiver
	usb 4-2: Manufacturer: Siano Mobile Silicon
	smsusb_probe: board id=1, interface number 0
	smsusb_probe: smsusb_probe 0
	smsusb_probe: endpoint 0 81 02 64
	smsusb_probe: endpoint 1 02 02 64
	smsusb_init_device: in_ep = 81, out_ep = 02
	smscore_register_device: allocated 50 buffers
	smscore_register_device: device ffff88012a00bc00 created
	smsusb_init_device: smsusb_start_streaming(...).
	smscore_set_device_mode: set device mode to 4
	smsusb1_detectmode: 4 "SMS DVBT-BDA Receiver"
	smsusb_sendrequest: sending MSG_SMS_INIT_DEVICE_REQ(578) size: 12
	smsusb_onresponse: received MSG_SMS_INIT_DEVICE_RES(579) size: 12
	smscore_set_device_mode: Success setting device mode.
	smscore_init_ir: IR port has not been detected
	smscore_start_device: device ffff88012a00bc00 started, rc 0
	smsusb_init_device: device 0xffff88002cfa6000 created
	smsusb_probe: Device initialized with return code 0
	DVB: registering new adapter (Siano Stellar Digital Receiver)
	usb 4-2: DVB: registering adapter 0 frontend 0 (Siano Mobile Digital MDTV Receiver)...
	smscore_register_client: ffff88012174a000 693 1
	sms_board_dvb3_event: DVB3_EVENT_HOTPLUG
	smsdvb_hotplug: success
	smsdvb_module_init:

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Tested-by: André Roth <neolynx@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
2013-10-14 06:40:56 -03:00
Mauro Carvalho Chehab
f43b396c71 [media] siano: Improve debug/info messages
Some messages are not clear, some are debug data, but are
shown as errors, and one message is duplicated.
Cleanup that mess in order to provide a cleaner log.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Tested-by: André Roth <neolynx@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
2013-10-14 06:40:32 -03:00
Mauro Carvalho Chehab
28a59df4d7 [media] siano: remove the remaining CamelCase compliants
Remove the remaining CamelCase checkpatch.pl compliants.
There are still a few left, but those are due to USB and
DVB APIs.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21 10:03:45 -03:00
Mauro Carvalho Chehab
dfef84fc13 [media] siano: get rid of CammelCase from smscoreapi.h
It is almost impossible to see a compliant with checkpatch.pl
on those Siano drivers, as there are simply too much violations
on it. So, now that a big change was done, the better is to
cleanup the checkpatch compliants.

Let's first replace all CammelCase symbols found at smscoreapi.h
using camel_case namespace. That removed 144 checkpatch.pl
compliants on this file. Of course, the other files need to be
fixed accordingly.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21 10:03:16 -03:00
Mauro Carvalho Chehab
07bb6bdddf [media] siano: remove a bogus printk line
The logic that detects the types of sms devices is bogus. It returns
	[ 4645.187790] smsusb_init_device: line: 372: Unspecified sms device type!
For several devices, including the one I have (SMS_RIO). In a matter
of fact, the right thing to do there is to print an error only if
the device is really unknown (SMS_UNKNOWN_TYPE).

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21 07:53:42 -03:00
Mauro Carvalho Chehab
503efe5cfc [media] siano: split debugfs code into a separate file
To avoid mixing two different things at the same place, move the
debugfs code into a separate file.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21 07:48:41 -03:00
Mauro Carvalho Chehab
80ccb51a0f [media] siano: simplify message endianness logic
Currently, every time a message is sent or received, the endiannes
need to be fixed on big endian machines. This is currently done
on every call to the send API, and on every msg reception logic.
Instead of doing that, move it to the send/receive functions.
That simplifies the logic and avoids the risk of forgetting to
fix it somewhere.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21 07:46:18 -03:00
Mauro Carvalho Chehab
347d8f1fa6 [media] siano: add new devices to the Siano Driver
This patch is based on Doron Cohen's patches:
	http://patchwork.linuxtv.org/patch/7881/
	http://patchwork.linuxtv.org/patch/7888/
	http://patchwork.linuxtv.org/patch/7883/
It basically merges the above patches, rebasing them to
the macro definitions used upstream, with are different
 than the ones used by them internally.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21 07:45:06 -03:00
Mauro Carvalho Chehab
05f0ffbc48 [media] siano: use USB endpoint descriptors for in/out endp
Instead of using hardcoded descriptors, detect them from the
USB descriptors.
This patch is rebased form Doron Cohen's patch:
	http://patchwork.linuxtv.org/patch/7883/

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21 07:38:02 -03:00
Mauro Carvalho Chehab
4c3bdb5e2f [media] siano: better debug send/receive messages
Instead of printing a message for some random messages, print
it for all sent/received ones. That helps a lot to debug
what's going on.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21 07:35:49 -03:00
Greg Kroah-Hartman
4c62e9764a Drivers: media: remove __dev* attributes.
CONFIG_HOTPLUG is going away as an option.  As a result, the __dev*
markings need to be removed.

This change removes the use of __devinit, __devexit_p, __devinitdata,
__devinitconst, and __devexit from these drivers.

Based on patches originally written by Bill Pemberton, but redone by me
in order to handle some of the coding style issues better, by hand.

Cc: Bill Pemberton <wfp5p@virginia.edu>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-01-03 15:57:02 -08:00
Mauro Carvalho Chehab
79e8c7bebb Linux 3.6-rc3
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQEcBAABAgAGBQJQNUEyAAoJEHm+PkMAQRiGs+sH/iLtdAVcfBfUwdmGV0qDXbVE
 L3gCg3IERPCSaQo8qsT3zujdLAQ2HsiMs73jbqJaBWSV16ZMqkglRKbn+QMGpqJV
 bi/pf5Akrm9IL/u+427ycB8QxzyjGal8uJ6btuwXa03VROSfOsEiQbtsByFNaDv/
 8oq0/DaE8mWRedlcAaeN+l8nD4Enb2jSKp0UADkBMnUr4KCbwSVQ+ITXAggqVq23
 htA3Yt0oGf1JYq+k99D5k92h0I/4VwiorUgwPKhmS5DM9gVtJ4L+SigbekS/MFq+
 huyzOHRWlO++OxBlgSTMuJAE1k/G2B7tGeoERY0tEL/hAWcKYTfGIXSc7X6JvM0=
 =Dmsv
 -----END PGP SIGNATURE-----

Merge tag 'v3.6-rc3' into staging/for_v3.7

Linux 3.6-rc3

* tag 'v3.6-rc3': (764 commits)
  Linux 3.6-rc3
  task_work: add a scheduling point in task_work_run()
  fs: fix fs/namei.c kernel-doc warnings
  eventpoll: use-after-possible-free in epoll_create1()
  vfio: grab vfio_device reference *before* exposing the sucker via fd_install()
  vfio: get rid of vfio_device_put()/vfio_group_get_device* races
  vfio: get rid of open-coding kref_put_mutex
  introduce kref_put_mutex()
  vfio: don't dereference after kfree...
  fbcon: fix race condition between console lock and cursor timer (v1.1)
  mm: compaction: Abort async compaction if locks are contended or taking too long
  mm: have order > 0 compaction start near a pageblock with free pages
  rapidio/tsi721: fix unused variable compiler warning
  rapidio/tsi721: fix inbound doorbell interrupt handling
  drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode
  mm: correct page->pfmemalloc to fix deactivate_slab regression
  drivers/rtc/rtc-pcf2123.c: initialize dynamic sysfs attributes
  mm/compaction.c: fix deferring compaction mistake
  drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources
  string: do not export memweight() to userspace
  ...
2012-08-24 11:25:10 -03:00
Mauro Carvalho Chehab
786baecfe7 [media] dvb-usb: move it to drivers/media/usb/dvb-usb
As media/dvb will be removed, move it to a proper place.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-08-13 23:26:31 -03:00
Renamed from drivers/media/dvb/siano/smsusb.c (Browse further)