Commit Graph

17 Commits

Author SHA1 Message Date
Alan Stern
76e31045ba media: radio-shark: Add endpoint checks
The syzbot fuzzer was able to provoke a WARNING from the radio-shark2
driver:

------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504
Modules linked in:
CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504
Code: 7c 24 18 e8 00 36 ea fb 48 8b 7c 24 18 e8 36 1c 02 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 b6 90 8a e8 9a 29 b8 03 <0f> 0b e9 58 f8 ff ff e8 d2 35 ea fb 48 81 c5 c0 05 00 00 e9 84 f7
RSP: 0018:ffffc90003876dd0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff8880750b0040 RSI: ffffffff816152b8 RDI: fffff5200070edac
RBP: ffff8880172d81e0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880285c5040 R14: 0000000000000002 R15: ffff888017158200
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe03235b90 CR3: 000000000bc8e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58
 usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:387
 shark_write_reg+0x1ff/0x2e0 drivers/media/radio/radio-shark2.c:88
...

The problem was caused by the fact that the driver does not check
whether the endpoints it uses are actually present and have the
appropriate types.  This can be fixed by adding a simple check of
these endpoints (and similarly for the radio-shark driver).

Link: https://syzkaller.appspot.com/bug?extid=4b3f8190f6e13b3efd74
Reported-and-tested-by: syzbot+4b3f8190f6e13b3efd74@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/e2858ab4-4adf-46e5-bbf6-c56742034547@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-20 11:43:22 +02:00
Mauro Carvalho Chehab
c0decac19d media: use strscpy() instead of strlcpy()
The implementation of strscpy() is more robust and safer.

That's now the recommended way to copy NUL terminated strings.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2018-09-11 13:32:17 -04:00
Arvind Yadav
1ab2234eef media: radio: constify usb_device_id
usb_device_id are not supposed to change at runtime. All functions
working with usb_device_id provided by <linux/usb.h> work with
const usb_device_id. So mark the non-const structs as const.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-20 08:04:59 -04:00
Sakari Ailus
bcb63314e2 [media] media: Drop FSF's postal address from the source code files
Drop the FSF's postal address from the source code files that typically
contain mostly the license text. Of the 628 removed instances, 578 are
outdated.

The patch has been created with the following command without manual edits:

git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \
	drivers/media/ include/media|while read i; do i=$i perl -e '
open(F,"< $ENV{i}");
$a=join("", <F>);
$a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m
	&& $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m;
close(F);
open(F, "> $ENV{i}");
print F $a;
close(F);'; done

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2017-01-27 11:38:09 -02:00
Julia Lawall
22dbec265c [media] media, sound: tea575x: constify snd_tea575x_ops structures
The snd_tea575x_ops structures are never modified, so declare them as
const.

Done with the help of Coccinelle.

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-12-03 11:26:45 -02:00
Mauro Carvalho Chehab
d647f0b70c [media] include/media: move driver interface headers to a separate dir
Let's not mix headers used by the core with those headers that
are needed by some driver-specific interface header.

The headers used on drivers were manually moved using:
    mkdir include/media/drv-intf/
    git mv include/media/cx2341x.h include/media/cx25840.h \
	include/media/exynos-fimc.h include/media/msp3400.h \
	include/media/s3c_camif.h include/media/saa7146.h \
	include/media/saa7146_vv.h  include/media/sh_mobile_ceu.h \
	include/media/sh_mobile_csi2.h include/media/sh_vou.h \
	include/media/si476x.h include/media/soc_mediabus.h \
	include/media/tea575x.h include/media/drv-intf/

And the references for those headers were corrected using:

    MAIN_DIR="media/"
    PREV_DIR="media/"
    DIRS="drv-intf/"

    echo "Checking affected files" >&2
    for i in $DIRS; do
	for j in $(find include/$MAIN_DIR/$i -type f -name '*.h'); do
		 n=`basename $j`
		git grep -l $n
	done
    done|sort|uniq >files && (
	echo "Handling files..." >&2;
	echo "for i in \$(cat files|grep -v Documentation); do cat \$i | \\";
	(
		cd include/$MAIN_DIR;
		for j in $DIRS; do
			for i in $(ls $j); do
				echo "perl -ne 's,(include [\\\"\\<])$PREV_DIR($i)([\\\"\\>]),\1$MAIN_DIR$j\2\3,; print \$_' |\\";
			done;
		done;
		echo "cat > a && mv a \$i; done";
	);
	echo "Handling documentation..." >&2;
	echo "for i in MAINTAINERS \$(cat files); do cat \$i | \\";
	(
		cd include/$MAIN_DIR;
		for j in $DIRS; do
			for i in $(ls $j); do
				echo "  perl -ne 's,include/$PREV_DIR($i)\b,include/$MAIN_DIR$j\1,; print \$_' |\\";
			done;
		done;
		echo "cat > a && mv a \$i; done"
	);
    ) >script && . ./script

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
2015-11-17 06:57:29 -02:00
Geert Uytterhoeven
812c083ec4 [media] radio-shark: Mark shark_resume_leds() inline to kill compiler warning
If SHARK_USE_LEDS=1, but CONFIG_PM=n:
drivers/media/radio/radio-shark.c:275: warning: ‘shark_resume_leds’ defined but not used
Instead of making the #ifdef logic even more complicated (there are already
two definitions of shark_resume_leds()), mark shark_resume_leds() inline to
kill the compiler warning. shark_resume_leds() is small and it has only one
caller.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
2013-12-09 14:50:49 -02:00
Mauro Carvalho Chehab
c5b0b3cb8a [media] radio-shark: remove a warning when CONFIG_PM is not defined
On alpha, allyesconfig doesn't have CONFIG_PM, and produces the following warnings:
	drivers/media/radio/radio-shark.c:274:13: warning: 'shark_resume_leds' defined but not used [-Wunused-function]
	drivers/media/radio/radio-shark2.c:240:13: warning: 'shark_resume_leds' defined but not used [-Wunused-function]
That's because those functions are used only at device resume.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
2013-11-07 15:03:14 -02:00
Ondrej Zary
59b564599b [media] tea575x: Move header from sound to media
Move include/sound/tea575x-tuner.h to include/media/tea575x.h and update files that include it.

Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Acked-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
2013-08-18 08:08:05 -03:00
Paul Bolle
0bb9121c88 radio-shark: Fix printk "CONFIG_LED_CLASS"
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-03-27 13:21:49 +01:00
Mauro Carvalho Chehab
1f71927ed5 [media] shark,shark2: declare resume/suspend functions as static
drivers/media/radio/shark2.o: In function `_GLOBAL__sub_I_65535_0_usb_shark_suspend':
drivers/media/radio/radio-shark2.c:344: multiple definition of `usb_shark_suspend'
drivers/media/radio/radio-shark.o:/home/v4l/v4l/patchwork/drivers/media/radio/radio-shark.c:379: first defined here
drivers/media/radio/shark2.o: In function `usb_shark_resume':
drivers/media/radio/radio-shark2.c:349: multiple definition of `usb_shark_resume'
drivers/media/radio/radio-shark.o:/home/v4l/v4l/patchwork/drivers/media/radio/radio-shark.c:384: first defined here

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-09-13 17:42:13 -03:00
Hans de Goede
559c200900 [media] radio-shark: Add support for suspend & resume
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-09-13 17:42:12 -03:00
Hans de Goede
fc488517cc [media] snd_tea575x: Add support for tuning AM
Add support for tuning AM (on devices with the necessary additional
hardware components), and advertise the available bands using the new
VIDIOC_ENUM_FREQ_BANDS ioctl.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
CC: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-09-13 17:42:09 -03:00
Hans de Goede
3e3b92cac5 [media] radio-shark: Only compile led support when CONFIG_LED_CLASS is set
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-08-12 13:50:00 -03:00
Hans de Goede
cfc1b2a06f [media] radio-shark*: Call cancel_work_sync from disconnect rather then release
This removes the need for shark_led_work to take the v4l2 lock.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-08-12 13:49:44 -03:00
Hans de Goede
820ddfa6ca [media] radio-shark*: Remove work-around for dangling pointer in usb intfdata
Recent kernels properly clear the usb intfdata pointer when another
driver fails to bind (in the radio-shark* case the usbhid driver would try
to bind first.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-08-12 13:49:19 -03:00
Hans de Goede
8e2ce73e93 [media] radio-shark: New driver for the Griffin radioSHARK USB radio receiver
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-07-30 18:00:32 -03:00