Eric Lee / smarc-fsl-linux-kernel

18 Apr, 2017

1 commit

  • e7080d447   [media] media/dvb-core: Race condition when writing to CAM ... Browse Code »

    It started with a sporadic message in syslog: "CAM tried to send a
    buffer larger than the ecount size" This message is not the fault
    itself, but a consecutive fault, after a read error from the CAM. This
    happens only on several CAMs, several hardware, and of course sporadic.

    It is a consecutive fault, if the last read from the CAM did fail. I
    guess this will not happen on all CAMs, but at least it did on mine.
    There was a write error to the CAM and during the re-initialization
    procedure, the CAM finished the last read, although it got a RS.

    The write error to the CAM happened because a race condition between HC
    write, checking DA and FR.

    This patch added an additional check for DA(RE), just after checking FR.
    It is important to read the CAMs status register again, to give the CAM
    the necessary time for a proper reaction to HC. Please note the
    description within the source code (patch below).

    [mchehab@s-opensource.com: make checkpatch happy]

    Signed-off-by: Jasmin jessich
    Tested-by: Ralph Metzler
    Signed-off-by: Mauro Carvalho Chehab

    Jasmin J
     

02 Mar, 2017

1 commit

27 Jan, 2017

1 commit

  • bcb63314e   [media] media: Drop FSF's postal address from the source code files ... Browse Code »

    Drop the FSF's postal address from the source code files that typically
    contain mostly the license text. Of the 628 removed instances, 578 are
    outdated.

    The patch has been created with the following command without manual edits:

    git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \
    drivers/media/ include/media|while read i; do i=$i perl -e '
    open(F,"< $ENV{i}");
    $a=join("", );
    $a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m
    && $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m;
    close(F);
    open(F, "> $ENV{i}");
    print F $a;
    close(F);'; done

    Signed-off-by: Sakari Ailus

    Sakari Ailus
     

19 Nov, 2016

1 commit

  • 4d5030b69   [media] dvb-core/en50221: use dvb_remove_device() ... Browse Code »

    Commit da677fe14364 ("[media] dvb-core/en50221: use kref to manage
    struct dvb_ca_private") moved the dvb_unregister_device() call to the
    kref callback, but that left lots of stale device state visible to
    userspace (e.g. in sysfs). By using dvb_remove_device() and
    dvb_free_device() instead of dvb_unregister_device(), we can avoid
    that.

    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     

21 Oct, 2016

1 commit

14 Jul, 2016

1 commit

  • da677fe14   [media] dvb-core/en50221: use kref to manage struct dvb_ca_private ... Browse Code »

    Don't free the object until the file handle has been closed. Fixes
    use-after-free bug which occurs when I disconnect my DVB-S received
    while VDR is running.

    This is a crash dump of such a use-after-free:

    general protection fault: 0000 [#1] SMP
    CPU: 0 PID: 2541 Comm: CI adapter on d Not tainted 4.7.0-rc1-hosting+ #49
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    task: ffff880027d7ce00 ti: ffff88003d8f8000 task.ti: ffff88003d8f8000
    RIP: 0010:[] [] dvb_ca_en50221_io_read_condition.isra.7+0x6f/0x150
    RSP: 0018:ffff88003d8fba98 EFLAGS: 00010206
    RAX: 0000000059534255 RBX: 000000753d470f90 RCX: ffff88003c74d181
    RDX: 00000001bea04ba9 RSI: ffff88003d8fbaf4 RDI: 3a3030a56d763fc0
    RBP: ffff88003d8fbae0 R08: ffff88003c74d180 R09: 0000000000000000
    R10: 0000000000000001 R11: 0000000000000000 R12: ffff88003c480e00
    R13: 00000000ffffffff R14: 0000000059534255 R15: 0000000000000000
    FS: 00007fb4209b4700(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f06445f4078 CR3: 000000003c55b000 CR4: 00000000000006b0
    Stack:
    ffff88003d8fbaf4 000000003c2170c0 0000000000004000 0000000000000000
    ffff88003c480e00 ffff88003d8fbc80 ffff88003c74d180 ffff88003d8fbb8c
    0000000000000000 ffff88003d8fbb10 ffffffff812f3e37 ffff88003d8fbb00
    Call Trace:
    [] dvb_ca_en50221_io_poll+0x37/0xa0
    [] do_sys_poll+0x2db/0x520

    This is a backtrace of the kernel attempting to lock a freed mutex:

    #0 0xffffffff81083d40 in rep_nop () at ./arch/x86/include/asm/processor.h:569
    #1 cpu_relax () at ./arch/x86/include/asm/processor.h:574
    #2 virt_spin_lock (lock=) at ./arch/x86/include/asm/qspinlock.h:57
    #3 native_queued_spin_lock_slowpath (lock=0xffff88003c480e90, val=761492029) at kernel/locking/qspinlock.c:304
    #4 0xffffffff810d1a06 in pv_queued_spin_lock_slowpath (val=, lock=) at ./arch/x86/include/asm/paravirt.h:669
    #5 queued_spin_lock_slowpath (val=, lock=) at ./arch/x86/include/asm/qspinlock.h:28
    #6 queued_spin_lock (lock=) at include/asm-generic/qspinlock.h:107
    #7 __mutex_lock_common (use_ww_ctx=, ww_ctx=, ip=, nest_lock=, subclass=,
    state=, lock=) at kernel/locking/mutex.c:526
    #8 mutex_lock_interruptible_nested (lock=0xffff88003c480e88, subclass=) at kernel/locking/mutex.c:647
    #9 0xffffffff812f49fe in dvb_ca_en50221_io_do_ioctl (file=, cmd=761492029, parg=0x1 )
    at drivers/media/dvb-core/dvb_ca_en50221.c:1210
    #10 0xffffffff812ee660 in dvb_usercopy (file=, cmd=761492029, arg=, func=) at drivers/media/dvb-core/dvbdev.c:883
    #11 0xffffffff812f3410 in dvb_ca_en50221_io_ioctl (file=, cmd=, arg=) at drivers/media/dvb-core/dvb_ca_en50221.c:1284
    #12 0xffffffff8112eddd in vfs_ioctl (arg=, cmd=, filp=) at fs/ioctl.c:43
    #13 do_vfs_ioctl (filp=0xffff88003c480e90, fd=, cmd=, arg=) at fs/ioctl.c:674
    #14 0xffffffff8112f30c in SYSC_ioctl (arg=, cmd=, fd=) at fs/ioctl.c:689
    #15 SyS_ioctl (fd=6, cmd=2148298626, arg=140734533693696) at fs/ioctl.c:680
    #16 0xffffffff8103feb2 in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:207

    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     

08 Jun, 2016

1 commit

11 Jan, 2016

1 commit

22 Aug, 2015

1 commit

08 Apr, 2015

2 commits

26 Feb, 2015

1 commit

14 Feb, 2015

1 commit

06 Jan, 2013

1 commit

28 Dec, 2012

1 commit

  • 30ad64b8a   [media] dvb: push down ioctl lock in dvb_usercopy ... Browse Code »

    Since most dvb ioctls wrap their real work with dvb_usercopy, the static mutex
    used in dvb_usercopy effectively is a global lock for dvb ioctls.
    Unfortunately, frontend ioctls can be blocked by the frontend thread for
    several seconds; this leads to unacceptable lock contention. Mitigate that by
    pushing the mutex from dvb_usercopy down to the individual, device specific
    ioctls.
    There are 10 such ioctl functions using dvb_usercopy, either calling it
    directly, or via the trivial wrapper dvb_generic_ioctl. The following already
    employ their own locking and look safe:
    • dvb_demux_ioctl (as per dvb_demux_do_ioctl)
    • dvb_dvr_ioctl (as per dvb_dvr_do_ioctl)
    • dvb_osd_ioctl (as per single non-trivial callee)
    • fdtv_ca_ioctl (as per callees)
    • dvb_frontend_ioctl
    The following functions do not, and are thus changed to use a device specific
    mutex:
    • dvb_net_ioctl (as per dvb_net_do_ioctl)
    • dvb_ca_en50221_io_ioctl (as per dvb_ca_en50221_io_do_ioctl)
    • dvb_video_ioctl
    • dvb_audio_ioctl
    • dvb_ca_ioctl

    Signed-off-by: Nikolaus Schulz
    Signed-off-by: Michael Krufky
    Signed-off-by: Mauro Carvalho Chehab

    Nikolaus Schulz
     

14 Aug, 2012

1 commit