From dd3c5d0086e0285ba5f1fc4ce3abde0f5a4092bc Mon Sep 17 00:00:00 2001 From: Ralph Metzler Date: Sun, 25 Jun 2017 18:37:08 -0300 Subject: media: staging: cxd2099: Fixed buffer mode The buffer mode was already implemented in this driver, but it did not work as expected. This has been fixed now, but it is still deactivated and can be activated by removing a comment at the begin of the file. Original code change by Ralph Metzler, modified by Jasmin Jessich and Daniel Scheller to match Kernel code style. Signed-off-by: Ralph Metzler Signed-off-by: Daniel Scheller Signed-off-by: Jasmin Jessich Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/cxd2099/cxd2099.c | 162 +++++++++++++++++++++++--------- drivers/staging/media/cxd2099/cxd2099.h | 6 +- 2 files changed, 122 insertions(+), 46 deletions(-) (limited to 'drivers/staging') diff --git a/drivers/staging/media/cxd2099/cxd2099.c b/drivers/staging/media/cxd2099/cxd2099.c index 370ecb959543..60d8dd03e7ff 100644 --- a/drivers/staging/media/cxd2099/cxd2099.c +++ b/drivers/staging/media/cxd2099/cxd2099.c @@ -1,7 +1,7 @@ /* * cxd2099.c: Driver for the CXD2099AR Common Interface Controller * - * Copyright (C) 2010-2011 Digital Devices GmbH + * Copyright (C) 2010-2013 Digital Devices GmbH * * * This program is free software; you can redistribute it and/or @@ -33,7 +33,9 @@ #include "cxd2099.h" -#define MAX_BUFFER_SIZE 248 +/* #define BUFFER_MODE 1 */ + +static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount); struct cxd { struct dvb_ca_en50221 en; @@ -48,6 +50,7 @@ struct cxd { int mode; int ready; int dr; + int write_busy; int slot_stat; u8 amem[1024]; @@ -55,6 +58,9 @@ struct cxd { int cammode; struct mutex lock; + + u8 rbuf[1028]; + u8 wbuf[1028]; }; static int i2c_write_reg(struct i2c_adapter *adapter, u8 adr, @@ -73,7 +79,7 @@ static int i2c_write_reg(struct i2c_adapter *adapter, u8 adr, } static int i2c_write(struct i2c_adapter *adapter, u8 adr, - u8 *data, u8 len) + u8 *data, u16 len) { struct i2c_msg msg = {.addr = adr, .flags = 0, .buf = data, .len = len}; @@ -100,12 +106,12 @@ static int i2c_read_reg(struct i2c_adapter *adapter, u8 adr, } static int i2c_read(struct i2c_adapter *adapter, u8 adr, - u8 reg, u8 *data, u8 n) + u8 reg, u8 *data, u16 n) { struct i2c_msg msgs[2] = {{.addr = adr, .flags = 0, - .buf = ®, .len = 1}, - {.addr = adr, .flags = I2C_M_RD, - .buf = data, .len = n} }; + .buf = ®, .len = 1}, + {.addr = adr, .flags = I2C_M_RD, + .buf = data, .len = n} }; if (i2c_transfer(adapter, msgs, 2) != 2) { dev_err(&adapter->dev, "error in i2c_read\n"); @@ -114,14 +120,26 @@ static int i2c_read(struct i2c_adapter *adapter, u8 adr, return 0; } -static int read_block(struct cxd *ci, u8 adr, u8 *data, u8 n) +static int read_block(struct cxd *ci, u8 adr, u8 *data, u16 n) { - int status; + int status = 0; - status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, adr); + if (ci->lastaddress != adr) + status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, adr); if (!status) { ci->lastaddress = adr; - status = i2c_read(ci->i2c, ci->cfg.adr, 1, data, n); + + while (n) { + int len = n; + + if (ci->cfg.max_i2c && (len > ci->cfg.max_i2c)) + len = ci->cfg.max_i2c; + status = i2c_read(ci->i2c, ci->cfg.adr, 1, data, len); + if (status) + return status; + data += len; + n -= len; + } } return status; } @@ -182,16 +200,16 @@ static int write_io(struct cxd *ci, u16 address, u8 val) static int write_regm(struct cxd *ci, u8 reg, u8 val, u8 mask) { - int status; + int status = 0; - status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, reg); + if (ci->lastaddress != reg) + status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, reg); if (!status && reg >= 6 && reg <= 8 && mask != 0xff) status = i2c_read_reg(ci->i2c, ci->cfg.adr, 1, &ci->regs[reg]); + ci->lastaddress = reg; ci->regs[reg] = (ci->regs[reg] & (~mask)) | val; - if (!status) { - ci->lastaddress = reg; + if (!status) status = i2c_write_reg(ci->i2c, ci->cfg.adr, 1, ci->regs[reg]); - } if (reg == 0x20) ci->regs[reg] &= 0x7f; return status; @@ -203,16 +221,31 @@ static int write_reg(struct cxd *ci, u8 reg, u8 val) } #ifdef BUFFER_MODE -static int write_block(struct cxd *ci, u8 adr, u8 *data, int n) +static int write_block(struct cxd *ci, u8 adr, u8 *data, u16 n) { - int status; - u8 buf[256] = {1}; - - status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, adr); - if (!status) { - ci->lastaddress = adr; - memcpy(buf + 1, data, n); - status = i2c_write(ci->i2c, ci->cfg.adr, buf, n + 1); + int status = 0; + u8 *buf = ci->wbuf; + + if (ci->lastaddress != adr) + status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, adr); + if (status) + return status; + dev_info(&ci->i2c->dev, "write_block %d\n", n); + + ci->lastaddress = adr; + buf[0] = 1; + while (n) { + int len = n; + + if (ci->cfg.max_i2c && (len + 1 > ci->cfg.max_i2c)) + len = ci->cfg.max_i2c - 1; + dev_info(&ci->i2c->dev, "write %d\n", len); + memcpy(buf + 1, data, len); + status = i2c_write(ci->i2c, ci->cfg.adr, buf, len + 1); + if (status) + return status; + n -= len; + data += len; } return status; } @@ -238,6 +271,8 @@ static void set_mode(struct cxd *ci, int mode) static void cam_mode(struct cxd *ci, int mode) { + u8 dummy; + if (mode == ci->cammode) return; @@ -246,16 +281,15 @@ static void cam_mode(struct cxd *ci, int mode) write_regm(ci, 0x20, 0x80, 0x80); break; case 0x01: -#ifdef BUFFER_MODE if (!ci->en.read_data) return; + ci->write_busy = 0; dev_info(&ci->i2c->dev, "enable cam buffer mode\n"); - /* write_reg(ci, 0x0d, 0x00); */ - /* write_reg(ci, 0x0e, 0x01); */ + write_reg(ci, 0x0d, 0x00); + write_reg(ci, 0x0e, 0x01); write_regm(ci, 0x08, 0x40, 0x40); - /* read_reg(ci, 0x12, &dummy); */ + read_reg(ci, 0x12, &dummy); write_regm(ci, 0x08, 0x80, 0x80); -#endif break; default: break; @@ -325,7 +359,10 @@ static int init(struct cxd *ci) if (status < 0) break; - if (ci->cfg.clock_mode) { + if (ci->cfg.clock_mode == 2) { + /* bitrate*2^13/ 72000 */ + u32 reg = ((ci->cfg.bitrate << 13) + 71999) / 72000; + if (ci->cfg.polarity) { status = write_reg(ci, 0x09, 0x6f); if (status < 0) @@ -335,6 +372,25 @@ static int init(struct cxd *ci) if (status < 0) break; } + status = write_reg(ci, 0x20, 0x08); + if (status < 0) + break; + status = write_reg(ci, 0x21, (reg >> 8) & 0xff); + if (status < 0) + break; + status = write_reg(ci, 0x22, reg & 0xff); + if (status < 0) + break; + } else if (ci->cfg.clock_mode == 1) { + if (ci->cfg.polarity) { + status = write_reg(ci, 0x09, 0x6f); /* D */ + if (status < 0) + break; + } else { + status = write_reg(ci, 0x09, 0x6d); + if (status < 0) + break; + } status = write_reg(ci, 0x20, 0x68); if (status < 0) break; @@ -346,7 +402,7 @@ static int init(struct cxd *ci) break; } else { if (ci->cfg.polarity) { - status = write_reg(ci, 0x09, 0x4f); + status = write_reg(ci, 0x09, 0x4f); /* C */ if (status < 0) break; } else { @@ -354,7 +410,6 @@ static int init(struct cxd *ci) if (status < 0) break; } - status = write_reg(ci, 0x20, 0x28); if (status < 0) break; @@ -401,7 +456,6 @@ static int read_attribute_mem(struct dvb_ca_en50221 *ca, set_mode(ci, 1); read_pccard(ci, address, &val, 1); mutex_unlock(&ci->lock); - /* printk(KERN_INFO "%02x:%02x\n", address,val); */ return val; } @@ -446,6 +500,9 @@ static int slot_reset(struct dvb_ca_en50221 *ca, int slot) { struct cxd *ci = ca->data; + if (ci->cammode) + read_data(ca, slot, ci->rbuf, 0); + mutex_lock(&ci->lock); cam_mode(ci, 0); write_reg(ci, 0x00, 0x21); @@ -465,7 +522,6 @@ static int slot_reset(struct dvb_ca_en50221 *ca, int slot) } } mutex_unlock(&ci->lock); - /* msleep(500); */ return 0; } @@ -474,11 +530,19 @@ static int slot_shutdown(struct dvb_ca_en50221 *ca, int slot) struct cxd *ci = ca->data; dev_info(&ci->i2c->dev, "%s\n", __func__); + if (ci->cammode) + read_data(ca, slot, ci->rbuf, 0); mutex_lock(&ci->lock); + write_reg(ci, 0x00, 0x21); + write_reg(ci, 0x06, 0x1F); + msleep(300); + write_regm(ci, 0x09, 0x08, 0x08); write_regm(ci, 0x20, 0x80, 0x80); /* Reset CAM Mode */ write_regm(ci, 0x06, 0x07, 0x07); /* Clear IO Mode */ + ci->mode = -1; + ci->write_busy = 0; mutex_unlock(&ci->lock); return 0; } @@ -490,9 +554,7 @@ static int slot_ts_enable(struct dvb_ca_en50221 *ca, int slot) mutex_lock(&ci->lock); write_regm(ci, 0x09, 0x00, 0x08); set_mode(ci, 0); -#ifdef BUFFER_MODE cam_mode(ci, 1); -#endif mutex_unlock(&ci->lock); return 0; } @@ -510,8 +572,10 @@ static int campoll(struct cxd *ci) ci->dr = 1; dev_info(&ci->i2c->dev, "DR\n"); } - if (istat & 0x20) + if (istat & 0x20) { + ci->write_busy = 0; dev_info(&ci->i2c->dev, "WC\n"); + } if (istat & 2) { u8 slotstat; @@ -519,7 +583,8 @@ static int campoll(struct cxd *ci) read_reg(ci, 0x01, &slotstat); if (!(2 & slotstat)) { if (!ci->slot_stat) { - ci->slot_stat = DVB_CA_EN50221_POLL_CAM_PRESENT; + ci->slot_stat |= + DVB_CA_EN50221_POLL_CAM_PRESENT; write_regm(ci, 0x03, 0x08, 0x08); } @@ -531,8 +596,8 @@ static int campoll(struct cxd *ci) ci->ready = 0; } } - if (istat & 8 && - ci->slot_stat == DVB_CA_EN50221_POLL_CAM_PRESENT) { + if ((istat & 8) && + (ci->slot_stat == DVB_CA_EN50221_POLL_CAM_PRESENT)) { ci->ready = 1; ci->slot_stat |= DVB_CA_EN50221_POLL_CAM_READY; } @@ -553,7 +618,6 @@ static int poll_slot_status(struct dvb_ca_en50221 *ca, int slot, int open) return ci->slot_stat; } -#ifdef BUFFER_MODE static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount) { struct cxd *ci = ca->data; @@ -571,23 +635,33 @@ static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount) mutex_lock(&ci->lock); read_reg(ci, 0x0f, &msb); read_reg(ci, 0x10, &lsb); - len = (msb << 8) | lsb; + len = ((u16)msb << 8) | lsb; + if (len > ecount || len < 2) { + /* read it anyway or cxd may hang */ + read_block(ci, 0x12, ci->rbuf, len); + mutex_unlock(&ci->lock); + return -EIO; + } read_block(ci, 0x12, ebuf, len); ci->dr = 0; mutex_unlock(&ci->lock); - return len; } +#ifdef BUFFER_MODE + static int write_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount) { struct cxd *ci = ca->data; + if (ci->write_busy) + return -EAGAIN; mutex_lock(&ci->lock); dev_info(&ci->i2c->dev, "%s %d\n", __func__, ecount); write_reg(ci, 0x0d, ecount >> 8); write_reg(ci, 0x0e, ecount & 0xff); write_block(ci, 0x11, ebuf, ecount); + ci->write_busy = 1; mutex_unlock(&ci->lock); return ecount; } diff --git a/drivers/staging/media/cxd2099/cxd2099.h b/drivers/staging/media/cxd2099/cxd2099.h index 0eb607c5b423..f4b29b1d6eb8 100644 --- a/drivers/staging/media/cxd2099/cxd2099.h +++ b/drivers/staging/media/cxd2099/cxd2099.h @@ -30,8 +30,10 @@ struct cxd2099_cfg { u32 bitrate; u8 adr; - u8 polarity:1; - u8 clock_mode:1; + u8 polarity; + u8 clock_mode; + + u32 max_i2c; }; #if defined(CONFIG_DVB_CXD2099) || \ -- cgit v1.2.3 From 6475483734d86f88848fcd61db3d4c35123abcba Mon Sep 17 00:00:00 2001 From: Ralph Metzler Date: Sun, 25 Jun 2017 18:37:09 -0300 Subject: media: staging: cxd2099: Removed useless printing in cxd2099 driver campoll and read_data are called very often and the printouts are very annoying and make the driver unusable. They seem to be left over from developing the buffer mode. Original code change by Ralph Metzler, modified by Jasmin Jessich to match current Kernel code. Signed-off-by: Ralph Metzler Signed-off-by: Jasmin Jessich Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/cxd2099/cxd2099.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) (limited to 'drivers/staging') diff --git a/drivers/staging/media/cxd2099/cxd2099.c b/drivers/staging/media/cxd2099/cxd2099.c index 60d8dd03e7ff..6426ff1b86ea 100644 --- a/drivers/staging/media/cxd2099/cxd2099.c +++ b/drivers/staging/media/cxd2099/cxd2099.c @@ -568,14 +568,10 @@ static int campoll(struct cxd *ci) return 0; write_reg(ci, 0x05, istat); - if (istat & 0x40) { + if (istat & 0x40) ci->dr = 1; - dev_info(&ci->i2c->dev, "DR\n"); - } - if (istat & 0x20) { + if (istat & 0x20) ci->write_busy = 0; - dev_info(&ci->i2c->dev, "WC\n"); - } if (istat & 2) { u8 slotstat; @@ -628,7 +624,6 @@ static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount) campoll(ci); mutex_unlock(&ci->lock); - dev_info(&ci->i2c->dev, "%s\n", __func__); if (!ci->dr) return 0; -- cgit v1.2.3 From 3e8d8a085ff454527a422aafe9b7dcfa95c09cc5 Mon Sep 17 00:00:00 2001 From: Jasmin Jessich Date: Sun, 25 Jun 2017 18:37:10 -0300 Subject: media: staging: cxd2099: Removed printing in write_block There were remaining debug prints which haven't been found earlier due to the disabled buffer mode. See commit 5abe108bdb67 ("media: staging: cxd2099: Removed useless printing in cxd2099 driver") for the already removed printings. Signed-off-by: Jasmin Jessich Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/cxd2099/cxd2099.c | 3 --- 1 file changed, 3 deletions(-) (limited to 'drivers/staging') diff --git a/drivers/staging/media/cxd2099/cxd2099.c b/drivers/staging/media/cxd2099/cxd2099.c index 6426ff1b86ea..3431cf62cbc1 100644 --- a/drivers/staging/media/cxd2099/cxd2099.c +++ b/drivers/staging/media/cxd2099/cxd2099.c @@ -230,7 +230,6 @@ static int write_block(struct cxd *ci, u8 adr, u8 *data, u16 n) status = i2c_write_reg(ci->i2c, ci->cfg.adr, 0, adr); if (status) return status; - dev_info(&ci->i2c->dev, "write_block %d\n", n); ci->lastaddress = adr; buf[0] = 1; @@ -239,7 +238,6 @@ static int write_block(struct cxd *ci, u8 adr, u8 *data, u16 n) if (ci->cfg.max_i2c && (len + 1 > ci->cfg.max_i2c)) len = ci->cfg.max_i2c - 1; - dev_info(&ci->i2c->dev, "write %d\n", len); memcpy(buf + 1, data, len); status = i2c_write(ci->i2c, ci->cfg.adr, buf, len + 1); if (status) @@ -652,7 +650,6 @@ static int write_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount) if (ci->write_busy) return -EAGAIN; mutex_lock(&ci->lock); - dev_info(&ci->i2c->dev, "%s %d\n", __func__, ecount); write_reg(ci, 0x0d, ecount >> 8); write_reg(ci, 0x0e, ecount & 0xff); write_block(ci, 0x11, ebuf, ecount); -- cgit v1.2.3 From 2748e76ddb2967c4030171342ebdd3faa6a5e8e8 Mon Sep 17 00:00:00 2001 From: Jasmin Jessich Date: Sun, 25 Jun 2017 18:37:11 -0300 Subject: media: staging: cxd2099: Activate cxd2099 buffer mode Activate the cxd2099 buffer mode. Signed-off-by: Jasmin Jessich Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/cxd2099/cxd2099.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/staging') diff --git a/drivers/staging/media/cxd2099/cxd2099.c b/drivers/staging/media/cxd2099/cxd2099.c index 3431cf62cbc1..f28916ea69f1 100644 --- a/drivers/staging/media/cxd2099/cxd2099.c +++ b/drivers/staging/media/cxd2099/cxd2099.c @@ -33,7 +33,8 @@ #include "cxd2099.h" -/* #define BUFFER_MODE 1 */ +/* comment this line to deactivate the cxd2099ar buffer mode */ +#define BUFFER_MODE 1 static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount); -- cgit v1.2.3 From 105967ad68d2eb1a041bc041f9cf96af2a653b65 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Fri, 14 Jul 2017 11:31:03 +0200 Subject: staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read gcc-7 points out an older regression: drivers/staging/iio/resolver/ad2s1210.c: In function 'ad2s1210_read_raw': drivers/staging/iio/resolver/ad2s1210.c:515:42: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context] The original code had 'unsigned short' here, but incorrectly got converted to 'bool'. This reverts the regression and uses a normal type instead. Fixes: 29148543c521 ("staging:iio:resolver:ad2s1210 minimal chan spec conversion.") Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Jonathan Cameron --- drivers/staging/iio/resolver/ad2s1210.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/staging') diff --git a/drivers/staging/iio/resolver/ad2s1210.c b/drivers/staging/iio/resolver/ad2s1210.c index a6a8393d6664..3e00df74b18c 100644 --- a/drivers/staging/iio/resolver/ad2s1210.c +++ b/drivers/staging/iio/resolver/ad2s1210.c @@ -472,7 +472,7 @@ static int ad2s1210_read_raw(struct iio_dev *indio_dev, long m) { struct ad2s1210_state *st = iio_priv(indio_dev); - bool negative; + u16 negative; int ret = 0; u16 pos; s16 vel; -- cgit v1.2.3 From a1a0a56ffc0f587161a4e2830c4afa690e497730 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 12 Jul 2017 09:29:16 -0300 Subject: media: staging: atomisp: disable warnings with cc-disable-warning Instead of directly using -Wno-foo, use cc-disable-warning, as it checks if the compiler has the warnings we want to disable. Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/atomisp/pci/atomisp2/Makefile | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'drivers/staging') diff --git a/drivers/staging/media/atomisp/pci/atomisp2/Makefile b/drivers/staging/media/atomisp/pci/atomisp2/Makefile index 726eaa293c55..2bd98f0667ec 100644 --- a/drivers/staging/media/atomisp/pci/atomisp2/Makefile +++ b/drivers/staging/media/atomisp/pci/atomisp2/Makefile @@ -354,7 +354,9 @@ ccflags-y += $(INCLUDES) $(DEFINES) -fno-common # HACK! While this driver is in bad shape, don't enable several warnings # that would be otherwise enabled with W=1 -ccflags-y += -Wno-unused-const-variable -Wno-missing-prototypes \ - -Wno-unused-but-set-variable -Wno-missing-declarations \ - -Wno-suggest-attribute=format -Wno-missing-prototypes \ - -Wno-implicit-fallthrough +ccflags-y += $(call cc-disable-warning, implicit-fallthrough) +ccflags-y += $(call cc-disable-warning, missing-prototypes) +ccflags-y += $(call cc-disable-warning, missing-declarations) +ccflags-y += $(call cc-disable-warning, suggest-attribute=format) +ccflags-y += $(call cc-disable-warning, unused-const-variable) +ccflags-y += $(call cc-disable-warning, unused-but-set-variable) -- cgit v1.2.3 From f3aa68405d907cdec852078d73a200608d5aa473 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Mon, 17 Jul 2017 04:58:54 -0300 Subject: media: staging: atomisp: array underflow in ioctl I noticed an array underflow in ov5693_enum_frame_size(). The code looks like this: int index = fse->index; if (index >= N_RES) retur -EINVAL; fse->index is a u32 that comes from the user. We want negative values to be counted as -EINVAL but they aren't. There are several ways to fix this but I feel like the best fix for future proofing is to change the type of N_RES from int to unsigned long to make it the same as if we were comparing against ARRAY_SIZE(). Signed-off-by: Dan Carpenter Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/atomisp/i2c/gc0310.h | 2 +- drivers/staging/media/atomisp/i2c/gc2235.h | 2 +- drivers/staging/media/atomisp/i2c/ov2680.h | 3 +-- drivers/staging/media/atomisp/i2c/ov2722.h | 2 +- drivers/staging/media/atomisp/i2c/ov5693/ov5693.h | 2 +- 5 files changed, 5 insertions(+), 6 deletions(-) (limited to 'drivers/staging') diff --git a/drivers/staging/media/atomisp/i2c/gc0310.h b/drivers/staging/media/atomisp/i2c/gc0310.h index f31eb277f542..7d8a0aeecb6c 100644 --- a/drivers/staging/media/atomisp/i2c/gc0310.h +++ b/drivers/staging/media/atomisp/i2c/gc0310.h @@ -454,6 +454,6 @@ struct gc0310_resolution gc0310_res_video[] = { #define N_RES_VIDEO (ARRAY_SIZE(gc0310_res_video)) static struct gc0310_resolution *gc0310_res = gc0310_res_preview; -static int N_RES = N_RES_PREVIEW; +static unsigned long N_RES = N_RES_PREVIEW; #endif diff --git a/drivers/staging/media/atomisp/i2c/gc2235.h b/drivers/staging/media/atomisp/i2c/gc2235.h index ccbc757045a5..7c3d994180cc 100644 --- a/drivers/staging/media/atomisp/i2c/gc2235.h +++ b/drivers/staging/media/atomisp/i2c/gc2235.h @@ -668,5 +668,5 @@ struct gc2235_resolution gc2235_res_video[] = { #define N_RES_VIDEO (ARRAY_SIZE(gc2235_res_video)) static struct gc2235_resolution *gc2235_res = gc2235_res_preview; -static int N_RES = N_RES_PREVIEW; +static unsigned long N_RES = N_RES_PREVIEW; #endif diff --git a/drivers/staging/media/atomisp/i2c/ov2680.h b/drivers/staging/media/atomisp/i2c/ov2680.h index 944fe8e3bcbf..ab8907e6c9ef 100644 --- a/drivers/staging/media/atomisp/i2c/ov2680.h +++ b/drivers/staging/media/atomisp/i2c/ov2680.h @@ -934,7 +934,6 @@ static struct ov2680_resolution ov2680_res_video[] = { #define N_RES_VIDEO (ARRAY_SIZE(ov2680_res_video)) static struct ov2680_resolution *ov2680_res = ov2680_res_preview; -static int N_RES = N_RES_PREVIEW; - +static unsigned long N_RES = N_RES_PREVIEW; #endif diff --git a/drivers/staging/media/atomisp/i2c/ov2722.h b/drivers/staging/media/atomisp/i2c/ov2722.h index b0d40965d89e..73ecb1679718 100644 --- a/drivers/staging/media/atomisp/i2c/ov2722.h +++ b/drivers/staging/media/atomisp/i2c/ov2722.h @@ -1263,5 +1263,5 @@ struct ov2722_resolution ov2722_res_video[] = { #define N_RES_VIDEO (ARRAY_SIZE(ov2722_res_video)) static struct ov2722_resolution *ov2722_res = ov2722_res_preview; -static int N_RES = N_RES_PREVIEW; +static unsigned long N_RES = N_RES_PREVIEW; #endif diff --git a/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h b/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h index d88ac1777d86..8c2e6794463b 100644 --- a/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h +++ b/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h @@ -1377,5 +1377,5 @@ struct ov5693_resolution ov5693_res_video[] = { #define N_RES_VIDEO (ARRAY_SIZE(ov5693_res_video)) static struct ov5693_resolution *ov5693_res = ov5693_res_preview; -static int N_RES = N_RES_PREVIEW; +static unsigned long N_RES = N_RES_PREVIEW; #endif -- cgit v1.2.3 From 7b065c554ca55fbc96eced98c7cec0f442ab018a Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 19 Jul 2017 05:55:47 -0400 Subject: media: atomisp2: Array underflow in atomisp_enum_input() The problem here is this code from atomisp_enum_input(): 581 int index = input->index; 582 583 if (index >= isp->input_cnt) 584 return -EINVAL; 585 586 if (!isp->inputs[index].camera) 587 return -EINVAL; "input->index" is a u32 which comes from the ioctl. We want negative values of "index" to be counted as -EINVAL but they aren't. I've fixed this by changing the type of "isp->input_cnt" to unsigned int. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Dan Carpenter Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/staging') diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h index d3667132851b..c8e0c4fe3717 100644 --- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h +++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h @@ -275,7 +275,7 @@ struct atomisp_device { */ struct mutex streamoff_mutex; - int input_cnt; + unsigned int input_cnt; struct atomisp_input_subdev inputs[ATOM_ISP_MAX_INPUTS]; struct v4l2_subdev *flash; struct v4l2_subdev *motor; -- cgit v1.2.3 From 115b7ac211d11c5995296dc612c4c8fab349d4b9 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 19 Jul 2017 05:56:18 -0400 Subject: media: atomisp2: array underflow in ap1302_enum_frame_size() The problem is this code from ap1302_enum_frame_size(): 738 int index = fse->index; 739 740 mutex_lock(&dev->input_lock); 741 context = ap1302_get_context(sd); 742 if (index >= dev->cntx_res[context].res_num) { 743 mutex_unlock(&dev->input_lock); 744 return -EINVAL; 745 } 746 747 res_table = dev->cntx_res[context].res_table; 748 fse->min_width = res_table[index].width; "fse->index" is a u32 that come from the user. We want negative values of "index" to be treated as -EINVAL but they're not so we can read from before the start of the res_table[] array. I've fixed this by making "res_num" a u32. I made "cur_res" a u32 as well, just for consistency. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Dan Carpenter Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/atomisp/i2c/ap1302.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/staging') diff --git a/drivers/staging/media/atomisp/i2c/ap1302.h b/drivers/staging/media/atomisp/i2c/ap1302.h index 9341232c580d..4d0b181a9671 100644 --- a/drivers/staging/media/atomisp/i2c/ap1302.h +++ b/drivers/staging/media/atomisp/i2c/ap1302.h @@ -158,8 +158,8 @@ struct ap1302_res_struct { }; struct ap1302_context_res { - s32 res_num; - s32 cur_res; + u32 res_num; + u32 cur_res; struct ap1302_res_struct *res_table; }; -- cgit v1.2.3 From 8033120f36c0b7212825f621a54e2d0f5ce72f72 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 19 Jul 2017 05:58:20 -0400 Subject: media: atomisp2: array underflow in imx_enum_frame_size() The code looks in imx_enum_frame_size() looks like this: 2066 int index = fse->index; 2067 struct imx_device *dev = to_imx_sensor(sd); 2068 2069 mutex_lock(&dev->input_lock); 2070 if (index >= dev->entries_curr_table) { 2071 mutex_unlock(&dev->input_lock); 2072 return -EINVAL; 2073 } 2074 2075 fse->min_width = dev->curr_res_table[index].width; "fse->index" is a u32 that comes from the user. We want negative values of "index" to be -EINVAL so we don't read before the start of the dev->curr_res_table[] array. I've made "entries_curr_table" unsigned long to fix this. I thought about making it unsigned int, but because of struct alignment, it doesn't use more memory either way. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Dan Carpenter Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/atomisp/i2c/imx/imx.h | 2 +- drivers/staging/media/atomisp/i2c/ov8858.h | 2 +- drivers/staging/media/atomisp/i2c/ov8858_btns.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers/staging') diff --git a/drivers/staging/media/atomisp/i2c/imx/imx.h b/drivers/staging/media/atomisp/i2c/imx/imx.h index 36b3f3a5a41f..41b4133ca995 100644 --- a/drivers/staging/media/atomisp/i2c/imx/imx.h +++ b/drivers/staging/media/atomisp/i2c/imx/imx.h @@ -480,7 +480,7 @@ struct imx_device { struct imx_vcm *vcm_driver; struct imx_otp *otp_driver; const struct imx_resolution *curr_res_table; - int entries_curr_table; + unsigned long entries_curr_table; const struct firmware *fw; struct imx_reg_addr *reg_addr; const struct imx_reg *param_hold; diff --git a/drivers/staging/media/atomisp/i2c/ov8858.h b/drivers/staging/media/atomisp/i2c/ov8858.h index 9be6a0e63861..d3fde200c013 100644 --- a/drivers/staging/media/atomisp/i2c/ov8858.h +++ b/drivers/staging/media/atomisp/i2c/ov8858.h @@ -266,7 +266,7 @@ struct ov8858_device { const struct ov8858_reg *regs; struct ov8858_vcm *vcm_driver; const struct ov8858_resolution *curr_res_table; - int entries_curr_table; + unsigned long entries_curr_table; struct v4l2_ctrl_handler ctrl_handler; struct v4l2_ctrl *run_mode; diff --git a/drivers/staging/media/atomisp/i2c/ov8858_btns.h b/drivers/staging/media/atomisp/i2c/ov8858_btns.h index 09e3cdc1a394..f9a3cf8fbf1a 100644 --- a/drivers/staging/media/atomisp/i2c/ov8858_btns.h +++ b/drivers/staging/media/atomisp/i2c/ov8858_btns.h @@ -266,7 +266,7 @@ struct ov8858_device { const struct ov8858_reg *regs; struct ov8858_vcm *vcm_driver; const struct ov8858_resolution *curr_res_table; - int entries_curr_table; + unsigned long entries_curr_table; struct v4l2_ctrl_handler ctrl_handler; struct v4l2_ctrl *run_mode; -- cgit v1.2.3 From cef988642cdac44e910a27cb6e8166c96f86a0df Mon Sep 17 00:00:00 2001 From: Ian Abbott Date: Fri, 28 Jul 2017 16:22:31 +0100 Subject: staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING Comedi's read and write file operation handlers (`comedi_read()` and `comedi_write()`) currently call `copy_to_user()` or `copy_from_user()` whilst in the `TASK_INTERRUPTIBLE` state, which falls foul of the `might_fault()` checks when enabled. Fix it by setting the current task state back to `TASK_RUNNING` a bit earlier before calling these functions. Reported-by: Piotr Gregor Signed-off-by: Ian Abbott Cc: # 4.5+ Signed-off-by: Greg Kroah-Hartman --- drivers/staging/comedi/comedi_fops.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/staging') diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c index ca11be21f64b..34ca7823255d 100644 --- a/drivers/staging/comedi/comedi_fops.c +++ b/drivers/staging/comedi/comedi_fops.c @@ -2396,6 +2396,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, continue; } + set_current_state(TASK_RUNNING); wp = async->buf_write_ptr; n1 = min(n, async->prealloc_bufsz - wp); n2 = n - n1; @@ -2528,6 +2529,8 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes, } continue; } + + set_current_state(TASK_RUNNING); rp = async->buf_read_ptr; n1 = min(n, async->prealloc_bufsz - rp); n2 = n - n1; -- cgit v1.2.3