Skip to content

L
linux-davinci
Switch branch/tag
  1. 14 Nov, 2008 11 commits
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9624): CVE-2008-5033: fix OOPS on tvaudio when controlling bass/treble · 01a1a3cc
      Mauro Carvalho Chehab authored 
      This bug were supposed to be fixed by 5ba2f67a,
where a call to NULL happens.

Not all tvaudio chips allow controlling bass/treble. So, the driver
has a table with a flag to indicate if the chip does support it.

Unfortunately, the handling of this logic were broken for a very long
time (probably since the first module version). Due to that, an OOPS
were generated for devices that don't support bass/treble.

This were the resulting OOPS message before the patch, with debug messages
enabled:

tvaudio' 1-005b: VIDIOC_S_CTRL
BUG: unable to handle kernel NULL pointer dereference at 00000000
IP: [<00000000>]
*pde = 22fda067 *pte = 00000000
Oops: 0000 [#1] SMP
Modules linked in: snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_hwdep snd soundcore tuner_simple tuner_types tea5767 tuner
tvaudio bttv bridgebnep rfcomm l2cap bluetooth it87 hwmon_vid hwmon fuse sunrpc ipt_REJECT
nf_conntrack_ipv4 iptable_filter ip_tables ip6t_REJECT xt_tcpudp nf_conntrack_ipv6 xt_state nf_conntrack
ip6table_filter ip6_tables x_tables ipv6 dm_mirrordm_multipath dm_mod configfs videodev v4l1_compat
ir_common 8139cp compat_ioctl32 v4l2_common 8139too videobuf_dma_sg videobuf_core mii btcx_risc tveeprom
i915 button snd_page_alloc serio_raw drm pcspkr i2c_algo_bit i2c_i801 i2c_core iTCO_wdt
iTCO_vendor_support sr_mod cdrom sg ata_generic pata_acpi ata_piix libata sd_mod scsi_mod ext3 jbdmbcache
uhci_hcd ohci_hcd ehci_hcd [last unloaded: soundcore]

Pid: 15413, comm: qv4l2 Not tainted (2.6.25.14-108.fc9.i686 #1)
EIP: 0060:[<00000000>] EFLAGS: 00210246 CPU: 0
EIP is at 0x0
EAX: 00008000 EBX: ebd21600 ECX: e2fd9ec4 EDX: 00200046
ESI: f8c0f0c4 EDI: f8c0f0c4 EBP: e2fd9d50 ESP: e2fd9d2c
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process qv4l2 (pid: 15413, ti=e2fd9000 task=ebe44000 task.ti=e2fd9000)
Stack: f8c0c6ae e2ff2a00 00000d00 e2fd9ec4 ebc4e000 e2fd9d5c f8c0c448 00000000
       f899c12a e2fd9d5c f899c154 e2fd9d68 e2fd9d80 c0560185 e2fd9d88 f8f3e1d8
       f8f3e1dc ebc4e034 f8f3e18c e2fd9ec4 00000000 e2fd9d90 f899c286 c008561c
Call Trace:
 [<f8c0c6ae>] ? chip_command+0x266/0x4b6 [tvaudio]
 [<f8c0c448>] ? chip_command+0x0/0x4b6 [tvaudio]
 [<f899c12a>] ? i2c_cmd+0x0/0x2f [i2c_core]
 [<f899c154>] ? i2c_cmd+0x2a/0x2f [i2c_core]
 [<c0560185>] ? device_for_each_child+0x21/0x49
 [<f899c286>] ? i2c_clients_command+0x1c/0x1e [i2c_core]
 [<f8f283d8>] ? bttv_call_i2c_clients+0x14/0x16 [bttv]
 [<f8f23601>] ? bttv_s_ctrl+0x1bc/0x313 [bttv]
 [<f8f23445>] ? bttv_s_ctrl+0x0/0x313 [bttv]
 [<f8b6096d>] ? __video_do_ioctl+0x1f84/0x3726 [videodev]
 [<c05abb4e>] ? sock_aio_write+0x100/0x10d
 [<c041b23e>] ? kmap_atomic_prot+0x1dd/0x1df
 [<c043a0c9>] ? enqueue_hrtimer+0xc2/0xcd
 [<c04f4fa4>] ? copy_from_user+0x39/0x121
 [<f8b622b9>] ? __video_ioctl2+0x1aa/0x24a [videodev]
 [<c04054fd>] ? do_notify_resume+0x768/0x795
 [<c043c0f7>] ? getnstimeofday+0x34/0xd1
 [<c0437b77>] ? autoremove_wake_function+0x0/0x33
 [<f8b62368>] ? video_ioctl2+0xf/0x13 [videodev]
 [<c048c6f0>] ? vfs_ioctl+0x50/0x69
 [<c048c942>] ? do_vfs_ioctl+0x239/0x24c
 [<c048c995>] ? sys_ioctl+0x40/0x5b
 [<c0405bf2>] ? syscall_call+0x7/0xb
 [<c0620000>] ? cpuid4_cache_sysfs_exit+0x3d/0x69
 =======================
Code:  Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:e2fd9d2c
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      01a1a3cc
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9623): tvaudio: Improve debug msg by printing something more human · c6241b6c
      Mauro Carvalho Chehab authored 
      Before the patch, the used ioctl were printed as an hexadecimal code,
hard to be understand without consulting the way _IO macros work.
Instead, use the V4L default handler for printing such errors into a way
that would be easier to understand.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      c6241b6c
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9622): tvaudio: Improve comments and remove a unneeded prototype · 41f5230f
      Mauro Carvalho Chehab authored 
      Some comments are not clear enough. Improve it to allow a better
understanding of the driver behavior.

While there, remove an unneeded struct prototype.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      41f5230f
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9621): Avoid writing outside shadow.bytes[] array · 49426437
      Mauro Carvalho Chehab authored 
      There were no check about the limits of shadow.bytes array. This offers
a risk of writing values outside the limits, overriding other data
areas.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      49426437
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9620): tvaudio: use a direct reference for chip description · 81cb5c4f
      Mauro Carvalho Chehab authored 
      Instead of storing the pointer for the proper entry at chip description
table, the driver were storing an indirect reference, by using an index.
Better to reference directly the data.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      81cb5c4f
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9619): tvaudio: update initial comments · b4ab114c
      Mauro Carvalho Chehab authored 
      A driver used on several bttv boards since 2000 is not experimental
anymore ;) Remove it from the comments.

While there, update copyrights addind a quick note about the "recent"
updates since 2005.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      b4ab114c
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9618): tvaudio: add additional logic to avoid OOPS · 099b7fcc
      Mauro Carvalho Chehab authored 
      This patch checks for volume, bass, treble, set mode and get mode
callbacks before actually enabling the code that would use them.

Instead of aborting the driver for load, this patch will allow it to
load with a reduced number of functionatities.

This prevents OOPS if some board entry is missing a needed callback.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      099b7fcc
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9617): tvtime: remove generic_checkmode callback · dd03e970
      Mauro Carvalho Chehab authored 
      generic_checkmode() were called, via a callback, for some tvaudio chips.
There's just one callback code used on all those boards. So, it makes no
sense on keeping this as a callback.

Since there were some OOPS reported on tvaudio on kerneloops.org, this
patch removes this callback, adding the code at the only place were it
is called: inside chip_tread. A flag were added to indicate the need for
a kernel thread to set stereo mode on cards that needs it.

Using this more direct approach simplifies the code, making it more
robust against human errors.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      dd03e970
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9616): tvaudio: cleanup - group all callbacks together · af1a9951
      Mauro Carvalho Chehab authored 
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      af1a9951
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9615): tvaudio: instead of using a magic number, use ARRAY_SIZE · 04e6f990
      Mauro Carvalho Chehab authored 
      Also, the default standard is the first one. So, fix the comment at the
array.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      04e6f990
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (9613): tvaudio: fix a memory leak · 5c653351
      Mauro Carvalho Chehab authored 
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      5c653351
  3. 11 Nov, 2008 29 commits