kernel/git/stable/linux.git/drivers/media, branch linux-2.6.25.y

security: avoid calling a NULL function pointer in drivers/video/tvaudio.c

2008-10-22T21:05:18+00:00

commit 5ba2f67afb02c5302b2898949ed6fc3b3d37dcf1 upstream NULL function pointers are very bad security wise. This one got caught by kerneloops.org quite a few times, so it's happening in the field.... Fix is simple, check the function pointer for NULL, like 6 other places in the same function are already doing. Signed-off-by: Arjan van de Ven Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

V4L: zr36067: Fix RGBR pixel format

2008-10-22T21:05:16+00:00

(cherry picked from commit a30ee3c747728f9151664118ffcbdeefd202c332) The zr36067 driver is improperly declaring pixel format RGBP twice, once as "16-bit RGB LE" and once as "16-bit RGB BE". The latter is actually RGBR. Fix the code to properly map both pixel formats. Signed-off-by: Jean Delvare Acked-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman

V4L: bttv: Prevent NULL pointer dereference in radio_open

2008-10-22T21:05:16+00:00

cherry picked from commit c37396c19403e249f12626187d51e92c915f2bc9 Fix the following crash in the bttv driver: BUG: unable to handle kernel NULL pointer dereference at 000000000000036c IP: [] radio_open+0x3a/0x170 [bttv] This happens because radio_open assumes that all present bttv devices have a radio function. If a bttv device without radio and one with radio are installed on the same system, and the one without radio is registered first, then radio_open checks for the radio device number of a bttv device that has no radio function, and this breaks. All we have to do to fix it is to skip bttv devices without a radio function. Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman

V4L/DVB (7475): Added support for Terratec Cinergy T USB XXS

2008-07-24T16:14:12+00:00

commit dc88807ed61ed0fc0d57bd80a92508b9de638f5d upstream. Alexander Simon found out that the Terratec Cinergy T USB XXS is just a clone of another DiB7070P-based device. Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab Cc: Ludwig Nussel Signed-off-by: Greg Kroah-Hartman

ov7670: clean up ov7670_read semantics

2008-07-24T16:14:09+00:00

commit bca5c2c550f16d2dc2d21ffb7b4712bd0a7d32a9 upstream Cortland Setlow pointed out a bug in ov7670.c where the result from ov7670_read() was just being checked for !0, rather than <0. This made me realize that ov7670_read's semantics were rather confusing; it both fills in 'value' with the result, and returns it. This is goes against general kernel convention; so rather than fixing callers, let's fix the function. This makes ov7670_read return <0 in the case of an error, and 0 upon success. Thus, code like: res = ov7670_read(...); if (!res) goto error; .will work properly. Signed-off-by: Cortland Setlow Signed-off-by: Andres Salomon Acked-by: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

bttv: Fix a deadlock in the bttv driver

2008-06-16T20:20:06+00:00

commit 81b2dbcad86732ffc02bad87aa25c4651199fc77 in mainline. vidiocgmbuf() does this: mutex_lock(&fh->cap.vb_lock); retval = videobuf_mmap_setup(&fh->cap, gbuffers, gbufsize, V4L2_MEMORY_MMAP); and videobuf_mmap_setup() then just does mutex_lock(&q->vb_lock); ret = __videobuf_mmap_setup(q, bcount, bsize, memory); mutex_unlock(&q->vb_lock); which is an obvious double-take deadlock. This patch fixes this by having vidiocgmbuf() just call the __videobuf_mmap_setup function instead. Acked-by: Mauro Carvalho Chehab Reported-by: Koos Vriezen Signed-off-by: Arjan van de Ven Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

V4L/DVB (7473): PATCH for various Dibcom based devices

2008-05-15T14:49:58+00:00

patch 6ca8f0b97473dcef3a754bab5239dcfcdd00b244 upstream This patch introduces support for dvb-t for the following DiBcom based cards: - Terratec Cinergy HT USB XE (USB-ID: 0ccd:0058) - Terratec Cinergy HT Express (USB-ID: 0ccd:0060) - Pinnacle 320CX (USB-ID: 2304:022e) - Pinnacle PCTV72e (USB-ID: 2304:0236) - Pinnacle PCTV73e (USB-ID: 2304:0237) - Yuan EC372S (USB-ID: 1164:1edc) Signed-off-by: Hans-Frieder Vogt Signed-off-by: Felix Apitzsch Signed-off-by: Antti Palosaari Signed-off-by: Albert Comerma Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab Cc: Michel Morisot Signed-off-by: Greg Kroah-Hartman

V4L: cx88: enable radio GPIO correctly

2008-05-01T21:44:34+00:00

(cherry picked from commit 6b92b3bd7ac91b7e255541f4be9bfd55b12dae41) This patch fixes an issue on the HVR1300, where GPIO is blown away due to the radio input being undefined, breaking the functionality of the DVB demodulator and MPEG2 encoder used on the cx8802 mpeg TS port. This is a minimal patch for 2.6.26 and the -stable series. This must be fixed a better way for 2.6.27. Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman

V4L: tea5761: bugzilla #10462: tea5761 autodetection code were broken

2008-05-01T21:44:34+00:00

(cherry picked from commit 867e835f4db4eba6d49072382cc05fc210c4ed1c) Fix bugzilla #10462: "tea5761 autodetection code were broken" Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman

V4L: Fix VIDIOCGAP corruption in ivtv

2008-05-01T21:44:34+00:00

(cherry picked from commit d2b213f7b76f187c4391079c7581d3a08b940133) Frank Bennett reported that ivtv was causing skype to crash. With help from one of their developers he showed it was a kernel problem. VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names that are too long and does not truncate them so corrupts a few bytes of the app data area. Possibly the names also want trimming but for now this should fix the corruption case. Signed-off-by: Alan Cox Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Michael Krufky Signed-off-by: Greg Kroah-Hartman