There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a
large xmap->menu_count is passed from the userspace, the subsequent call
to kmalloc() will allocate a buffer smaller than expected.
map->menu_count and map->menu_info would later be used in a loop (e.g.
in uvc_query_v4l2_ctrl), which leads to out-of-bound access.
The patch checks the ioctl argument and returns -EINVAL for zero or too
large values in xmap->menu_count.
Signed-off-by: Haogang Chen <haogangchen@gmail.com>
[laurent.pinchart@ideasonboard.com Prevent excessive memory consumption]
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
UVC devices transmit a device timestamp along with video frames. Convert
the timestamp to a host timestamp and use it to fill the V4L2 buffer
timestamp field.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Create a debugfs entry per UVC stream. This will be used to export
stream statistics.
Signed-off-by: Alexey Fisher <bug-track@fisher-privat.net>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
[mchehab@redhat.com: add incude <linux/module.h> to avoid compilation breakage]
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
GET_RES request support is mandatory for extension units, but some
cameras still choke on it (one example is the Logitech QuickCam PTZ that
returns a single byte for the PTZ relative control instead of four).
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Instead of skipping the payload completely, which would make the
resulting image corrupted anyway, store the payload normally and mark
the buffer as erroneous. If the no_drop module parameter is set to 1 the
buffer will then be passed to userspace, and tt will then be up to the
application to decide what to do with the buffer.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The function is not used outside of its compilation unit. Make it
static.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The camera requires the PROBE_MINMAX quirk. Add a corresponding entry in
the device IDs list.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The macros are defined in both drivers/media/video/uvc/uvc_video.c and
include/linux/usb/video.h. Remove definitions from the former.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Turn streaming off (by selecting alternate setting 0) and disable the
video buffers queue in the uvc_video_enable() error path.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Replace the current video buffers queue implementation with
videobuf2-vmalloc.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Add mem, length and bytesused fields to the uvc_buffer structure and use
them instead of accessing the uvc_buffer::buf m.offset, length and
bytesused fields directly. This prepares the driver to the conversion to
videobuf2.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The ati_remote driver currently uses 2-byte scancodes. However, one of
those bytes is actually a checksum and therefore shouldn't be considered
as part of the scancode.
Fix the driver to only use the actual data byte as a scancode and to
check the checksum itself. Update the bundled keymaps accordingly.
Since ati_remote was only migrated to the rc subsystem for 3.2, the
previous scancodes weren't emitted on any stable kernel.
Reported-by: George Spelvin <linux@horizon.com>
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Checking for &dev->int_in is useless because it returns the address of
the embedded struct tm6000_endpoint, which will always be positive and
therefore true.
Signed-off-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Function parameters on subsequent lines should never be aligned with the
function name but rather be indented.
Signed-off-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The original patch used the fast USB quirk to enable fast access to
registers in the tm6000_read_write_usb(). The applied patch moved the
check to the tm6000_reset(), probably due to some merge conflicts.
Signed-off-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Improve the use of the WARN_ON() macro and use a local variable, instead
of reduntantly dereferencing a pointer in v4l2-dev.c
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Otherwise compilation breaks with:
...
after apparently no longer included recursively from other header files.
Signed-off-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
priv gets dereferenced in mt9t112_set_params() so we should return
before calling that.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
On 64-bit platforms assigning a pointer to a 32-bit variable causes a
compiler warning and cannot actually work. Soc-camera currently doesn't
support any 64-bit systems, but such platforms can be added in the
and in any case compiler warnings should be avoided.
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Adjustment of the colors by the po2030n is finer than by the bridge controls.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The 'open-drain' mode was not reset when starting the webcams.
This problem was introduced by commit 0e4d413af1 and
its exact effects are unknown.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
As the alternate settings are now sorted in gspca main,
the variable 'nbalt' is no more useful.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The alternate settings are now sorted in gspca main, so the flag
'reverse_alts' is no more useful.
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
If there are two or more different it913x devices on the system they share the same
ite_config and over write its settings.
To over come this, the ite_config is copied to the priv area.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This removes comment tags intended for emacs configuration from
67 files in the Media API DocBook. Such comments are not really
helpful and violate the coding style rules.
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This a bus repeater for it913x devices. Commands usually fail because of other
activity on the USB bus.
Bulk failures that report -ETIMEDOUT or -EBUSY are repeated.
Enpoints that return actlen not equal len request -EAGAIN.
The retry is set at 10.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This patch is against the mainline v3.1 release (c3b92c8) and
fixes a compile error when building for OMAP3+DSS+VOUT
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Gary Thomas <gary@mlbassoc.com>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Support add for IT9135 9005 devices
With this patch IT9135 devices now move to using
dvb-usb-it9135-01.fw firmware
IT9137 remain on previous firmware.
IT9135 devices seem more stable on this firmware.
If the user wishes to remain on it9137 firmware they can change
back using firmware=1 module option.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Multi firmware loader
This uses scatter write firmware headers
The firmware must start with 03 XX 00
and be the extract firmware length.
I have tried all available firmwares with this loader.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Add support for NEC extended keys.
The default remote has now changed to RC_MAP_MSI_DIGIVOX_III
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
There appears to be differences in the tuner registers
on earlier IT9135 devices.
Using the current IT9137 settings cause corruptions on
some channels
This patch is in preparation for multi firmware loading and
current unsupported types.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The msg->command field is 32 bits, and we should fill it with a call
to cpu_to_le32(). The current code is broke on big endian systems.
On little endian systems it truncates the 32 bit value to 16 bits
which probably still works fine.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Steven Toth <stoth@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
More debugging and user info from it913x-fe.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Previously endpoint had been aligned to packet size (128)
Some early it9135 devices appear to have problems with this.
This patch now aligns with mpeg TS size (188)
With the pid filter off max size is increased to the maxmium
size (348 * 188)
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
Acked-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The sound driver refuses to load as module, because of the missing
MODULE_LICENSE("GPL").
The file header indicates that the driver is indeed published under
the GPL.
Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
Acked-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
mmc_suspend_host() tries to claim host during suspend
and release it only when the bus suspend operation is
compeleted. If CONFIG_MMC_UNSAFE_RESUME is defined and
the host is flagged as removable, mmc_suspend_host()
tries to remove the card. In this process, the file system
sync can get blocked trying to acquire host which is already
claimed by mmc_suspend_host() causing deadlock.
Fix this deadlock by releasing host before ->remove() is called.
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
Acked-by: Ulf Hansson <ulf.hansson@stericsson.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Chris Ball <cjb@laptop.org>
Now that the driver is using dev_pm_ops the suspend operations in the
platform_driver structure won't get called so don't need to be there,
and certainly shouldn't be the same function as dev_pm_ops since the
signatures are different.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
