kernel/git/stable/linux.git/drivers/media/rc, branch linux-3.2.y

media: rc: check for integer overflow

2018-02-13T18:32:09+00:00

commit 3e45067f94bbd61dec0619b1c32744eb0de480c8 upstream. The ioctl LIRC_SET_REC_TIMEOUT would set a timeout of 704ns if called with a timeout of 4294968us. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: open-code U32_MAX] Signed-off-by: Ben Hutchings

media: imon: Fix null-ptr-deref in imon_probe

2017-11-26T13:51:11+00:00

commit 58fd55e838276a0c13d1dc7c387f90f25063cbf3 upstream. It seems that the return value of usb_ifnum_to_if() can be NULL and needs to be checked. Signed-off-by: Arvind Yadav Tested-by: Andrey Konovalov Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Ben Hutchings

rc: Fix input deadlock and transmit error in redrat3 driver

2017-11-11T13:34:50+00:00

commit dbea1880368071dfa97d5e6aa4a368e7d0146a85 upstream. Fixed submit urb logic so hardware doesn't hang trying to transmit signal data Removed unneeded enable/disable detector commands in redrat3_transmit_ir (the hardware does this anyway) and converted arguments to unsigned as per 5588dc2 Signed-off-by: Andrew Vincer Cc: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Ben Hutchings

mceusb: fix memory leaks in error path

2017-10-12T14:27:09+00:00

commit 2d5a6ce71c72d98d4f7948672842e3e8c265a8b7 upstream. Fix urb and transfer-buffer leaks in an urb-submission error path which may be hit when a device is disconnected. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: Jarod Wilson Signed-off-by: Johan Hovold Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: - Add check on urb_type, as async_buf and async_urb aren't always allocated - Adjust context] Signed-off-by: Ben Hutchings

rc-core: race condition during ir_raw_event_register()

2017-09-15T17:30:50+00:00

commit 963761a0b2e85663ee4a5630f72930885a06598a upstream. A rc device can call ir_raw_event_handle() after rc_allocate_device(), but before rc_register_device() has completed. This is racey because rcdev->raw is set before rcdev->raw->thread has a valid value. Reported-by: kbuild test robot Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: adjust filename, context, indentation] Signed-off-by: Ben Hutchings

mceusb: fix NULL-deref at probe

2017-08-26T01:13:58+00:00

commit 03eb2a557ed552e920a0942b774aaf931596eec1 upstream. Make sure to check for the required out endpoint to avoid dereferencing a NULL-pointer in mce_request_packet should a malicious device lack such an endpoint. Note that this path is hit during probe. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Signed-off-by: Johan Hovold Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: using mce_dbg() instead of dev_dbg()] Signed-off-by: Ben Hutchings

ite-cir: initialize use_demodulator before using it

2017-03-16T02:18:23+00:00

commit 7ec03e60ef81c19b5d3a46dd070ee966774b860f upstream. Function ite_set_carrier_params() uses variable use_demodulator after having initialized it to false in some if branches, but this variable is never set to true otherwise. This bug has been found using clang -Wsometimes-uninitialized warning flag. Fixes: 620a32bba4a2 ("[media] rc: New rc-based ite-cir driver for several ITE CIRs") Signed-off-by: Nicolas Iooss Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Ben Hutchings

rc: allow rc modules to be loaded if rc-main is not a module

2016-02-13T10:34:03+00:00

commit 2ff56fadd94cdaeeaeccbc0a9b703a0101ada128 upstream. rc-main mistakenly uses #ifdef MODULE to determine whether it should load the rc keymap modules. This symbol is only defined if rc-main is being built as a module itself, and bears no relation to whether the rc keymaps are modules. Fix this to use CONFIG_MODULES instead. Fixes: 631493ecacd8 ("[media] rc-core: merge rc-map.c into rc-main.c") Signed-off-by: Russell King Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Ben Hutchings

rc-core: fix remove uevent generation

2015-10-13T02:46:04+00:00

commit a66b0c41ad277ae62a3ae6ac430a71882f899557 upstream. The input_dev is already gone when the rc device is being unregistered so checking for its presence only means that no remove uevent will be generated. Signed-off-by: David Härdeman Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Ben Hutchings

media/rc: Send sync space information on the lirc device

2015-03-06T00:39:19+00:00

commit a8f29e89f2b54fbf2c52be341f149bc195b63a8b upstream. Userspace expects to see a long space before the first pulse is sent on the lirc device. Currently, if a long time has passed and a new packet is started, the lirc codec just returns and doesn't send anything. This makes lircd ignore many perfectly valid signals unless they are sent in quick sucession. When a reset event is delivered, we cannot know anything about the duration of the space. But it should be safe to assume it has been a long time and we just set the duration to maximum. Signed-off-by: Austin Lund Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Ben Hutchings