[ Upstream commit 6fa54bc713c262e1cfbc5613377ef52280d7311f ]
If em28xx_ir_init fails, it would decrease the refcount of dev. However,
in the em28xx_ir_fini, when ir is NULL, it goes to ref_put and decrease
the refcount of dev. This will lead to a refcount bug.
Fix this bug by removing the kref_put in the error handling code
of em28xx_ir_init.
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28
Modules linked in:
CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.13.0 #3
Workqueue: usb_hub_wq hub_event
RIP: 0010:refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28
Call Trace:
kref_put.constprop.0+0x60/0x85 include/linux/kref.h:69
em28xx_usb_disconnect.cold+0xd7/0xdc drivers/media/usb/em28xx/em28xx-cards.c:4150
usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458
__device_release_driver drivers/base/dd.c:1201 [inline]
device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1232
bus_remove_device+0x108/0x160 drivers/base/bus.c:529
device_del+0x1fe/0x510 drivers/base/core.c:3540
usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419
usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2221
hub_port_connect drivers/usb/core/hub.c:5151 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
port_event drivers/usb/core/hub.c:5586 [inline]
hub_event+0xf81/0x1d40 drivers/usb/core/hub.c:5668
process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
process_scheduled_works kernel/workqueue.c:2338 [inline]
worker_thread+0x333/0x5b0 kernel/workqueue.c:2424
kthread+0x188/0x1d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Reported-by: Dongliang Mu <mudongliangabcd@gmail.com>
Fixes: ac5688637144 ("media: em28xx: Fix possible memory leak of em28xx struct")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ac5688637144644f06ed1f3c6d4dd8bb7db96020 ]
The em28xx struct kref isn't being decreased after an error in the
em28xx_ir_init, leading to a possible memory leak.
A kref_put and em28xx_shutdown_buttons is added to the error handler code.
Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This also populates the version member correctly.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Give the RC device the name of the board rather than "1-2:1.0 IR".
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Don't populate the array addr_list on the stack but instead make it
static. Makes the object code smaller by 20 bytes
Before:
text data bss dec hex filename^M
16929 3626 384 20939 51cb ../usb/em28xx/em28xx-input.o
After:
text data bss dec hex filename^M
16829 3706 384 20919 51b7 ../usb/em28xx/em28xx-input.o
(gcc version 8.3.0, aarch64)
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
From now on, I'll start using my @kernel.org as my development e-mail.
As such, let's remove the entries that point to the old
mchehab@s-opensource.com at MAINTAINERS file.
For the files written with a copyright with mchehab@s-opensource,
let's keep Samsung on their names, using mchehab+samsung@kernel.org,
in order to keep pointing to my employer, with sponsors the work.
For the files written before I join Samsung (on July, 4 2013),
let's just use mchehab@kernel.org.
For bug reports, we can simply point to just kernel.org, as
this will reach my mchehab+samsung inbox anyway.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Brian Warner <brian.warner@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
The current I2C error handling logic makes static analyzers
confused:
drivers/media/usb/em28xx/em28xx-input.c:96 em28xx_get_key_terratec() error: uninitialized symbol 'b'.
Change it to match the coding style we're using elsewhere.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
There are a number of coding style issues at em28xx-input.
Fix most of them, by using checkpatch in strict mode to point
for it.
Automatic fixes were made with --fix-inplace, but those
were complemented by manual work.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Most of the files there are missing a SPDX license tag. Add.
While here fix some DRIVER_LICENSE macro in order to reflect
the source file license, as some of the headers are GPL v2
only.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
There are several em28xx static structs that can now be constified.
That caused a significant reduction at data segment:
Before:
text data bss dec hex filename
85017 59588 576 145181 2371d drivers/media/usb/em28xx/em28xx.o
After:
text data bss dec hex filename
112345 32292 576 145213 2373d drivers/media/usb/em28xx/em28xx.o
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
RC_TYPE is confusing and it's just the protocol. So rename it.
Suggested-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
When an ir-spi is registered, you get this message.
rc rc0: Unspecified device as /devices/platform/soc/3f215080.spi/spi_master/spi32766/spi32766.128/rc/rc0
"Unspecified device" refers to input_name, which makes no sense for IR
TX only devices. So, rename to device_name.
Also make driver_name const char* so that no casts are needed anywhere.
Now ir-spi reports:
rc rc0: IR SPI as /devices/platform/soc/3f215080.spi/spi_master/spi32766/spi32766.128/rc/rc0
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
While committing a change on em28xx, I got a warning of a
typo there. So, fix it on em28xx and on two other media drivers
with the same typo.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
The driver type can be assigned immediately when an RC device
requests to the framework to allocate the device.
This is an 'enum rc_driver_type' data type and specifies whether
the device is a raw receiver or scancode receiver. The type will
be given as parameter to the rc_allocate_device device.
Change accordingly all the drivers calling rc_allocate_device()
so that the device type is specified during the rc device
allocation. Whenever the device type is not specified, it will be
set as RC_DRIVER_SCANCODE which was the default '0' value.
Suggested-by: Sean Young <sean@mess.org>
Signed-off-by: Andi Shyti <andi.shyti@samsung.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Now that we're storing usb_interface at em28xx struct,
there's no good reason to keep storing usb_device, as we can
get it from usb_interface. So, get rid of it.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
The usb_device->dev is not the right device for dev_foo() calls.
Instead, it should use usb_interface->dev.
Tested-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Instead of using pr_foo(), use dev_foo(), with provides a
better output. As this device is a multi-interface one,
we'll set the device name to show the chipset and the driver
used.
While here, get rid of printk continuation messages.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
There are still several places with printk's called directly.
Convert them to pr_foo() macros, except for the debug printk's,
as those are enabled via modprobe vars.
While here, realign the pr_foo() arguments to match the
recommended CodingStyle.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Due to the 80-cols checkpatch warnings, several strings
were broken into multiple lines. This is not considered
a good practice anymore, as it makes harder to grep for
strings at the source code. So, join those continuation
lines.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Inspection shows that newlines are missing from several kernel messages
in em28xx-input. Fix these.
Fixes: 5025076aad ("[media] em28xx-input: implement em28xx_ops: suspend/resume hooks")
Cc: <stable@vger.kernel.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The lockdep splat addressed in a previous commit revealed that at
least one message in em28xx-input.c was missing a new line:
em28178 #0: Closing input extensionINFO: trying to register non-static key.
Further inspection shows several other messages also miss a new line.
These will be fixed in a subsequent patch.
Fixes: aa929ad783 ("[media] em28xx: print a message at disconnect")
Cc: <stable@vger.kernel.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This patch is basically produced while testing a tool that
Joe Perches sent upstream sometime ago:
https://lkml.org/lkml/2014/7/11/794
I used it with those arguments:
$ reformat_with_checkpatch.sh drivers/media/usb/em28xx/em28xx*.[ch]
It actually produced 24 patches, with is too much, and showed
interesting things: gcc produced different codes on most of the
patches, even with just linespace changes. The total code data
remained the same on all cases I checked though.
Anyway, provided that we fold the resulting patches, this tool
seems useful.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
GIT_AUTHOR_DATE=1416486805
The functions pvr2_hdw_destroy(), rc_unregister_device() and vfree() perform
also input parameter validation. Thus the test around the call is not needed.
This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
We call "kfree(ir->i2c_client);" in the error handling and that doesn't
work if "ir" is NULL.
Fixes: 78e719a5f3 ('[media] em28xx-input: i2c IR decoders: improve i2c_client handling')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Instead of using a temporary stack allocated i2c_client in em28xx_i2c_ir_handle_key(),
allocate/free the i2c_client at module init/uninit and hook it into struct em28xx_IR
(if the device has an i2c IR decoder).
This reduces the frame size of function em28xx_i2c_ir_handle_key() and speeds
it up a bit.
Also make sure that all fields of struct i2c_client are initialized properly.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The basic API of rc-core used to be:
dev = rc_allocate_device();
dev->x = a;
dev->y = b;
dev->z = c;
rc_register_device();
which is a pretty common pattern in the kernel, after the introduction of
protocol arrays the API looks something like:
dev = rc_allocate_device();
dev->x = a;
rc_set_allowed_protocols(dev, RC_BIT_X);
dev->z = c;
rc_register_device();
There's no real need for the protocols to be an array, so change it
back to be consistent (and in preparation for the following patches).
[m.chehab@samsung.com: added missing changes at some files]
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Right now the protocol information is not preserved, rc-core gets handed a
scancode but has no idea which protocol it corresponds to.
This patch (which required reading through the source/keymap for all drivers,
not fun) makes the protocol information explicit which is important
documentation and makes it easier to e.g. support multiple protocols with one
decoder (think rc5 and rc-streamzap). The information isn't used yet so there
should be no functional changes.
[m.chehab@samsung.com: rebased, added cxusb and removed bad whitespacing]
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
The allowed and enabled protocol masks need to be expanded to be per
filter type in order to support wakeup filter protocol selection. To
ease that process abstract access to the rc_dev::allowed_protos and
rc_dev::enabled_protocols members with inline functions.
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Reviewed-by: Antti Seppälä <a.seppala@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
We can't free struct em28xx while one of the extensions is still
using it.
So, add a kref() to control it, freeing it only after the
extensions fini calls.
Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Implement em28xx_ops: suspend/resume hooks. em28xx usb driver will
invoke em28xx_ops: suspend and resume hooks for all its extensions
from its suspend() and resume() interfaces.
[m.chehab@samsung.com: Fix a breakage caused by calling a non-existing
function call: schedule_delayed_work_sync(), and test if IR was defined
at suspend/resume]
Signed-off-by: Shuah Khan <shuah.kh@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
There are several left overs with my old email address.
Remove their occurrences and add myself at CREDITS, to
allow people to be able to reach me on my new addresses.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
That helps to identify if something fails and explain why em28xx
struct is not freed (if it ever happens).
Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Tested-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Emitting an OOM message isn't necessary after input_allocate_device
as there's a generic OOM and a dump_stack already done.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
A few devices (em2860) use a separate interface for audio only
Audio Vendor Class USB. That interface should not be used by
Remote Controller, Analog TV or Digital TV.
Prevents initializing all non-audio extensions for the audio
only interface.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Use the same module version on all em28xx sub-modules, and use
the same naming convention to describe the driver.
Reviewed-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Add a message with consistent prints before and after each
extension initialization, and provide a better text for module
load.
While here, add a missing sanity check for extension finish
code at em28xx-v4l extension.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
For GPI-connected buttons without (hardware) debouncing, the polling interval
needs to be reduced to detect button presses properly.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
New chip version, which is very similar than EM28174.
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
The SpeedLink VAD Laplace webcam is equipped with an illumination button and
an illumination LED. When the button is pressed, the driver must toggle the
LED state via the corresponding GPO port.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
So far, the driver only supports a snapshot button which is assigned to
register 0x0c bit 5. This special port has a built-in debouncing mechanism.
For buttons connected to ordinary GPI ports, this patch implements a software
debouncing mechanism.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
The current code supports only a single snapshot button assigned to
register 0x0c bit 5. But devices may be equipped with multiple buttons
with different functionalities and they can also be assigned to the
various GPI-ports.
Extend the em28xx-input code to handle multiple buttons assigned to different
GPI-ports / register addresses and bits.
Also make easier to extend the code with further button types.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Newer em28xx devices have 2 buses. Change the logic to allow
using both buses.
This patch was generated by this small script:
for i in drivers/media/usb/em28xx/*.c; do
sed 's,->i2c_adap,->i2c_adap[dev->def_i2c_bus],g;s,->i2c_client,->i2c_client[dev->def_i2c_bus],'
done
Of course, em28xx.h needed manual edit.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Remove em28xx_i2c_ir_work() and check the device type in the common callback
function em28xx_ir_work() instead. Simplifies em28xx_ir_start().
Reduces the code size with a minor performance drawback.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Set up the i2c_client locally in em28xx_i2c_ir_handle_key().
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
