kernel/git/stable/linux.git/drivers/media/rc, branch linux-6.0.y

media: imon: fix a race condition in send_packet()

2022-12-31T12:26:02+00:00

[ Upstream commit 813ceef062b53d68f296aa3cb944b21a091fabdb ] The function send_packet() has a race condition as follows: func send_packet() { // do work call usb_submit_urb() mutex_unlock() wait_for_event_interruptible() <-- lock gone mutex_lock() } func vfd_write() { mutex_lock() call send_packet() <- prev call is not completed mutex_unlock() } When the mutex is unlocked and the function send_packet() waits for the call to complete, vfd_write() can start another call, which leads to the "URB submitted while active" warning in usb_submit_urb(). Fix this by removing the mutex_unlock() call in send_packet() and using mutex_lock_interruptible(). Link: https://syzkaller.appspot.com/bug?id=e378e6a51fbe6c5cc43e34f131cc9a315ef0337e Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver") Reported-by: syzbot+0c3cb6dc05fbbdc3ad66@syzkaller.appspotmail.com Signed-off-by: Gautam Menghani Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: mceusb: set timeout to at least timeout provided

2022-10-29T08:08:31+00:00

commit 20b794ddce475ed012deb365000527c17b3e93e6 upstream. By rounding down, the actual timeout can be lower than requested. As a result, long spaces just below the requested timeout can be incorrectly reported as timeout and truncated. Fixes: 877f1a7cee3f ("media: rc: mceusb: allow the timeout to be configurable") Cc: stable@vger.kernel.org Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

media: mceusb: Use new usb_control_msg_*() routines

2022-08-30T13:32:07+00:00

Automatic kernel fuzzing led to a WARN about invalid pipe direction in the mceusb driver: ------------[ cut here ]------------ usb 6-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType 40 WARNING: CPU: 0 PID: 2465 at drivers/usb/core/urb.c:410 usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410 Modules linked in: CPU: 0 PID: 2465 Comm: kworker/0:2 Not tainted 5.19.0-rc4-00208-g69cb6c6556ad #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410 Code: 7c 24 40 e8 ac 23 91 fd 48 8b 7c 24 40 e8 b2 70 1b ff 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 a0 30 a9 86 e8 48 07 11 02 <0f> 0b e9 1c f0 ff ff e8 7e 23 91 fd 0f b6 1d 63 22 83 05 31 ff 41 RSP: 0018:ffffc900032becf0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8881100f3058 RCX: 0000000000000000 RDX: ffffc90004961000 RSI: ffff888114c6d580 RDI: fffff52000657d90 RBP: ffff888105ad90f0 R08: ffffffff812c3638 R09: 0000000000000000 R10: 0000000000000005 R11: ffffed1023504ef1 R12: ffff888105ad9000 R13: 0000000000000040 R14: 0000000080000380 R15: ffff88810ba96500 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe810bda58 CR3: 000000010b720000 CR4: 0000000000350ef0 Call Trace: usb_start_wait_urb+0x101/0x4c0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:153 mceusb_gen1_init drivers/media/rc/mceusb.c:1431 [inline] mceusb_dev_probe+0x258e/0x33f0 drivers/media/rc/mceusb.c:1807 The reason for the warning is clear enough; the driver sends an unusual read request on endpoint 0 but does not set the USB_DIR_IN bit in the bRequestType field. More importantly, the whole situation can be avoided and the driver simplified by converting it over to the relatively new usb_control_msg_recv() and usb_control_msg_send() routines. That's what this fix does. Link: https://lore.kernel.org/all/CAB7eexLLApHJwZfMQ=X-PtRhw0BgO+5KcSMS05FNUYejJXqtSA@mail.gmail.com/ Cc: Mauro Carvalho Chehab Cc: stable@vger.kernel.org Reported-and-tested-by: Rondreis Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YwkfnBFCSEVC6XZu@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman

media: lirc: ensure lirc device receives repeats

2022-07-15T13:55:23+00:00

Pressing a button on a remote control unit will typically lead to messages being sent several times per second until the button is released. Some remote control units indicate long key presses by sending special "repeat" messages, for which the protocol driver calls rc_repeat(). Other units repeat the same message over and over, which will be handled by calling rc_keydown(). The function rc_keydown() never set the LIRC "repeat" flag to distinguish repeated messages that were sent due to a long keypress, and messages sent due to repeated short keypresses. While a user-space program may implement special logic to distinguish long keypresses, it is much simpler to be able to rely on the flag. Commit de142c32410649e64d44928505ffad2176a96a9e ("media: lirc: implement reading scancode") would never set the LIRC_SCANCODE_FLAG_REPEAT flag. Commit b66218fddfd29f315a103db811152ab0c95fb054 ("media: lirc: ensure lirc device receives nec repeats") fixed it up for rc_repeat() but not rc_keydown(). Signed-off-by: Marko Mäkelä Co-developed-by: Sean Young Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: ati-remote: remove private err() macro

2022-07-15T13:54:59+00:00

Drivers should use dev_err() Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: igorplugusb: use correct size pass to igorplugusb_probe()

2022-07-15T13:52:20+00:00

After 'buf_in' change to pointer, the sizeof() is not correct buffer size, it should be MAX_PACKET. Fixes: b3f820b905c9 ("media: igorplugusb: respect DMA coherency") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: rc: Directly use ida_free()

2022-06-20T09:30:33+00:00

Use ida_alloc() and ida_free() instead of the deprecated ida_simple_get() and ida_simple_remove(). Signed-off-by: keliu Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: ttusbir: avoid unnecessary usb_unlink_urb()

2022-06-20T09:30:33+00:00

While the completion handler is running, usb_unlink_urb() on yourself is a NOP. Remove it. Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: ttusbir: NOIO during resume

2022-06-20T09:30:33+00:00

During resume we must assume tat devices are not ready for block IO. Use GFP_NOIO. Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: xbox_remote: xbox_remote_initialize() cannot fail

2022-06-20T09:30:33+00:00

It cannot fail. Make it void. Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab