Commit Graph

1025 Commits

Author SHA1 Message Date
David Härdeman
2265425fd9 media: lirc_dev: remove min_timeout and max_timeout
There are no users of this functionality (ir-lirc-codec.c has its own
implementation and lirc_zilog.c doesn't use it) so remove it.

This only affects users of the lirc kapi, not rc-core drivers.

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-10-11 12:37:36 -04:00
Ladislav Michl
c130107721 [media] media: rc: fix gpio-ir-receiver build failure
The 0-day robot reports:

   drivers/media/rc/gpio-ir-recv.c: In function 'gpio_ir_recv_irq':
>> drivers/media/rc/gpio-ir-recv.c:38:8: error: implicit declaration of function 'gpiod_get_value' [-Werror=implicit-function-declaration]

Fixes: eed008e605 ("[media] media: rc: gpio-ir-recv: use gpiolib API")

For some reason only partial patch was applied. Also include
gpio/consumer.h otherwise compile test fails.

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Acked-by: Sean Young <sean@mess.org>
2017-10-05 10:16:21 -03:00
James Hogan
e0a8631287 Update James Hogan's email address
Update my imgtec.com and personal email address to my kernel.org one in
a few places as MIPS will soon no longer be part of Imagination
Technologies, and add mappings in .mailcap so get_maintainer.pl reports
the right address.

Signed-off-by: James Hogan <jhogan@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-10-04 17:11:53 -07:00
Markus Elfring
a8c779eb05 [media] imon: Improve a size determination in two functions
Replace the specification of data structures by pointer dereferences
as the parameter for the operator "sizeof" to make the corresponding size
determination a bit safer according to the Linux coding style convention.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 16:19:40 -03:00
Marc Gonzalez
d7a6795b1d [media] media: rc: Delete duplicate debug message
ir_setkeytable() and ir_create_table() print the same debug message.
Delete the one in ir_setkeytable()

Signed-off-by: Marc Gonzalez <marc_gonzalez@sigmadesigns.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 16:07:58 -03:00
Stephen Hemminger
5573d12429 [media] media: default for RC_CORE should be n
The Linus policy on Kconfig is that the default should be no
for all new devices. I.e the user rebuild a new kernel from an
old config should not by default get a larger kernel.

Fixes: b4c184e506 ("[media] media: reorganize the main Kconfig items")

Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
Acked-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 16:07:27 -03:00
Thomas Meyer
8ca01d4f95 [media] media: rc: Use bsearch library function
Replace self coded binary search, by existing library version.

Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 16:07:03 -03:00
Ladislav Michl
eed008e605 [media] media: rc: gpio-ir-recv: use gpiolib API
Gpiolib API is preferred way to access gpios.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 16:05:35 -03:00
Ladislav Michl
5c95878f61 [media] media: rc: gpio-ir-recv: remove gpio_ir_recv_platform_data
gpio_ir_recv_platform_data are not used anywhere in kernel tree,
so remove it.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 16:04:58 -03:00
Ladislav Michl
916d1c9fd4 [media] media: rc: gpio-ir-recv: use KBUILD_MODNAME
There already is standard macro providing driver name, use it.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 16:03:51 -03:00
Ladislav Michl
1a2a60b1af [media] media: rc: gpio-ir-recv: use devm_request_irq
Use of devm_request_irq simplifies error unwinding and as
free_irq was the last user of driver remove function,
remove it too.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 16:03:18 -03:00
Ladislav Michl
375929f9f4 [media] media: rc: gpio-ir-recv: do not allow threaded interrupt handler
Requesting any context irq is not actually great idea since threaded
interrupt handler is run at too unpredictable time which turns
timing information wrong. Fix it by requesting regular interrupt.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:31:54 -03:00
Ladislav Michl
52ea799107 [media] media: rc: gpio-ir-recv: use devm_rc_register_device
Use of devm_rc_register_device simplifies error unwinding.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:30:52 -03:00
Ladislav Michl
fcca09edb9 [media] media: rc: gpio-ir-recv: use devm_gpio_request_one
Use of devm_gpio_request_one simplifies error unwinding.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:30:25 -03:00
Ladislav Michl
f4940b563f [media] media: rc: gpio-ir-recv: use devm_rc_allocate_device
Use of devm_rc_allocate_device simplifies error unwinding.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:28:06 -03:00
Ladislav Michl
08d94274b8 [media] media: rc: gpio-ir-recv: use devm_kzalloc
Use of devm_kzalloc simplifies error unwinding.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:27:17 -03:00
Ladislav Michl
94d40b2ff2 [media] media: rc: gpio-ir-recv: use helper variable to access device info
Using explicit struct device variable makes code a bit more readable.

Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:26:49 -03:00
Colin Ian King
c25895c7d6 [media] media: imon: make two const arrays static, reduces object code size
Don't populate the const arrays vfd_packet6 and fp_packet on the
stack, instead make them static.  Makes the object code smaller
by over 600 bytes:

Before:
   text	   data	    bss	    dec	    hex	filename
  43794	  17920	   1024	  62738	   f512	drivers/media/rc/imon.o

After:
   text	   data	    bss	    dec	    hex	filename
  42994	  18080	   1024	  62098	   f292	drivers/media/rc/imon.o

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:25:53 -03:00
Sean Young
771f87268e [media] media: vp7045: port TwinhanDTV Alpha to rc-core
Only the nec protocol is understood, but then it doesn't pass on
the full scancode and it ignores the nec repeats its own remote
sends, so holding buttons does not work.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:25:13 -03:00
Sean Young
b9f407e31c [media] media: rc: include device name in rc udev event
This name is also stored in the input's device name, but that
is not available in TX only hardware (no input device).

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:24:31 -03:00
Sean Young
6d75db305b [media] media: rc: if protocols can't be changed, don't be writable
If the protocols of an rc device cannot be changed, ensure the sysfs
file is not writable.

This makes it possible to detect this from userspace, so ir-keytable
can deal with case without giving an error.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:23:50 -03:00
Sean Young
831c4c81e8 [media] media: rc: ensure that protocols are enabled for scancode drivers
rc scancode drivers without change_protocol should have all
protocols enabled at all time. This was only true for cec and
ir-kbd-i2c.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:22:26 -03:00
Sean Young
efdc16adb7 [media] media: rc: avermedia keymap for a800
The keymap is missing one key, and correct another.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:20:28 -03:00
Markus Elfring
6805454b9c [media] media: img-ir: delete an error message for a failed memory allocation
Omit an extra message for a memory allocation failure in this function.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:19:06 -03:00
Markus Elfring
3e70b256a6 [media] media: imon: delete an error message for a failed memory allocation
Omit an extra message for a memory allocation failure in this function.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:09:58 -03:00
Bhumika Goyal
f03f02f9d2 [media] media: rc: make device_type const
Make this const as it is only stored in the type field of a device
structure, which is const.
Done using Coccinelle.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:09:32 -03:00
Arvind Yadav
5fad16b596 [media] media: rc: constify usb_device_id
usb_device_id are not supposed to change at runtime. All functions
working with usb_device_id provided by <linux/usb.h> work with
const usb_device_id. So mark the non-const structs as const.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 15:06:09 -03:00
David Härdeman
b15e39379f [media] media: lirc_dev: merge struct irctl into struct lirc_dev
The use of two separate structs (lirc_dev aka lirc_driver and irctl) makes
it much harder to follow the proper lifetime of the various structs and
necessitates hacks such as keeping a copy of struct lirc_dev inside
struct irctl.

Merging the two structs means that lirc_dev can properly manage the
lifetime of the resulting struct and simplifies the code at the same time.

[mchehab@s-opensource.com: fix merge conflict]
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 14:53:07 -03:00
David Härdeman
6ecccc379b [media] media: lirc_dev: introduce lirc_allocate_device and lirc_free_device
Introduce two new functions so that the API for lirc_dev matches that
of the rc-core and input subsystems.

This means that lirc_dev structs are managed using the usual four
functions:

lirc_allocate_device
lirc_free_device
lirc_register_device
lirc_unregister_device

The functions are pretty simplistic at this point, later patches will put
more flesh on the bones of both.

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
2017-10-04 14:19:17 -03:00
David Härdeman
5ddc9c098d [media] media: rename struct lirc_driver to struct lirc_dev
This is in preparation for the later patches which do away with
struct irctl entirely.

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 14:13:08 -03:00
David Härdeman
46c8f47711 [media] media: lirc_dev: use an IDA instead of an array to keep track of registered devices
Using the kernel-provided IDA simplifies the code and makes it possible
to remove the lirc_dev_lock mutex.

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 14:03:21 -03:00
David Härdeman
3381b779a7 [media] media: lirc_dev: sanitize locking
Use the irctl mutex for all device operations and only use lirc_dev_lock
to protect the irctls array. Also, make sure that the device is alive
early in each fops function before doing anything else.

Since this patch touches nearly every line where the irctl mutex is
taken/released, it also renames the mutex at the same time (the name
irctl_lock will be misleading once struct irctl goes away in later
patches).

[mchehab@s-opensource.com: fix a merge conflict]
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 14:02:27 -03:00
David Härdeman
3bce557236 [media] media: lirc_dev: change irctl->attached to be a boolean
The "attached" member of struct irctl is a boolean value, so let the code
reflect that.

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 13:57:45 -03:00
David Härdeman
b145ef94f6 [media] media: lirc_dev: make chunk_size and buffer_size mandatory
Make setting chunk_size and buffer_size mandatory for drivers which
expect lirc_dev to allocate the lirc_buffer (i.e. ir-lirc-codec) and
don't set them in lirc-zilog (which creates its own buffer).

Also remove an unnecessary copy of chunk_size in struct irctl (the
same information is already available from struct lirc_buffer).

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 13:53:32 -03:00
David Härdeman
615cd3fe6c [media] media: lirc_dev: make better use of file->private_data
By making better use of file->private_data in lirc_dev we can avoid
digging around in the irctls[] array, thereby simplifying the code.

External drivers need to use lirc_get_pdata() instead of mucking around
in file->private_data.

The newly introduced lirc_init_pdata() function isn't very elegant, but
it's a stopgap measure which can be removed once lirc_zilog is converted
to rc-core.

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 13:52:12 -03:00
David Härdeman
0510d81081 [media] media: lirc_dev: use cdev_device_add() helper function
Replace calls to cdev_add() and device_add() with the cdev_device_add()
helper function.

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 13:51:31 -03:00
David Härdeman
c3c6dd750e [media] media: lirc_dev: remove support for manually specifying minor number
All users of lirc_register_driver() uses dynamic minor allocation,
therefore we can remove the ability to explicitly request a given number.

This changes the function prototype of lirc_unregister_driver() to also
take a struct lirc_driver pointer as the sole argument.

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 13:50:42 -03:00
David Härdeman
de226ec8a6 [media] media: lirc_dev: clarify error handling
If an error is generated, it is more logical to error out ASAP.

Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2017-10-04 13:49:49 -03:00
Sean Young
a607f51e5a media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls"
This reverts commit 5be2b76a9c.

Only when the lirc device is freed, should we drop our reference to
rc_dev, else we the rc_dev is freed to early. If userspace has
a file descriptor open during unplug, it goes bang.

==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10
Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609

-snip-
 mutex_lock_nested+0x1b/0x20
 ? mutex_lock_nested+0x1b/0x20
 rc_close.part.6+0x20/0x60 [rc_core]
 rc_close+0x13/0x20 [rc_core]
 lirc_dev_fop_close+0x62/0xd0 [lirc_dev]
 __fput+0x236/0x410
 ? fput+0xb0/0xb0
 ? do_raw_spin_trylock+0x110/0x110
 ? set_rq_offline.part.70+0xa0/0xa0
 ____fput+0xe/0x10
 task_work_run+0x116/0x180
 ? task_work_cancel+0x170/0x170
 ? _raw_spin_unlock+0x27/0x40
 ? switch_task_namespaces+0x5f/0x90
 do_exit+0x68b/0xe80

Cc: stable@vger.kernel.org # For Kernel 4.13
Fixes: 5be2b76a9c ("[media] lirc_dev: remove superfluous get/put_device() calls")
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-09-05 07:28:59 -04:00
Sean Young
fce4b371fe media: serial_ir: fix tx timing calculation on 32-bit
Move the calculation to where it is needed, so the result doesn't
need to be stored in the device struct.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-31 05:36:42 -04:00
Sean Young
766cbb3189 media: rc: gpio-ir-tx: use ktime accessor functions
Prefer using accessor functions so we are not dependent on the ktime_t
type.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-31 05:35:54 -04:00
Jasmin Jessich
800846c4d9 media: rc: use ktime accessor functions
Prefer using accessor functions so we are not dependent on the ktime_t
type.

Signed-off-by: Jasmin Jessich <jasmin@anw.at>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-31 05:35:18 -04:00
Sean Young
6d741bfed5 media: rc: rename RC_TYPE_* to RC_PROTO_* and RC_BIT_* to RC_PROTO_BIT_*
RC_TYPE is confusing and it's just the protocol. So rename it.

Suggested-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-20 10:02:48 -04:00
Sean Young
d57ea877af media: rc: per-protocol repeat period
CEC needs a keypress timeout of 550ms, which is too high for the IR
protocols. Also fill in known repeat times, with 50ms error margin.

Also, combine all protocol data into one structure.

Signed-off-by: Sean Young <sean@mess.org>
Suggested-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-20 09:58:50 -04:00
Sean Young
2168b416c8 media: rc: ensure we do not read out of bounds
If rc_validate_filter() is called for CEC or XMP, then we would read
beyond the end of the array.

Suggested-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-20 09:57:54 -04:00
Sean Young
86fe1ac0d5 media: rc: simplify ir_raw_event_store_edge()
Since commit 12749b198fa4 ("[media] rc: saa7134: add trailing space for
timely decoding"), the workaround of inserting reset events is no
longer needed.

Note that the initial reset is not needed either; other rc-core drivers
that don't use ir_raw_event_store_edge() never call this at all.

Verified on a HVR-1150 and Raspberry Pi.

Fixes: 3f5c4c7332 ("[media] rc: fix ghost keypresses with certain hw")

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-20 09:57:24 -04:00
Sean Young
48b2de1971 media: rc: saa7134: add trailing space for timely decoding
The gpio-ir-recv driver adds timeouts which the saa7134 lacks; this
causes keypress not to arrive, and to only arrive once more IR is
received. This is what the commit below calls "ghost keypresses",
and that commit does not solve the issue completely.

This makes the IR on the HVR-1150 much more reliable and responsive.

Fixes: 3f5c4c7332 ("[media] rc: fix ghost keypresses with certain hw")

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-20 09:56:20 -04:00
Sean Young
e5e26439d1 media: rc-core: improve ir_raw_store_edge() handling
The gpio-ir-recv driver does many wakeups (once per edge); the saa7134
driver has special handling to only wakeup 15ms after the first edge.
Make this part of rc-core so gpio-ir-recv also benefits from
this (so a rc-5 keypress now causes 3 wakeups rather than 24).

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-20 09:55:48 -04:00
Sean Young
4fe055ecfc media: winbond-cir: buffer overrun during transmit
We're reading beyond the buffer before checking its length.

BUG: KASAN: slab-out-of-bounds in wbcir_irq_tx

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-20 09:52:04 -04:00
Sean Young
ff05cf0937 media: mceusb: do not read data parameters unless required
This causes out-of-bounds read on device probe.

BUG: KASAN: slab-out-of-bounds in mceusb_dev_printdata+0xdc/0x830 [mceusb]

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-20 09:51:43 -04:00