Commit Graph

11 Commits

Author SHA1 Message Date
Guy Martin e65f8c4e3e V4L/DVB: stv6110x: Fix kernel null pointer deref
The following OOPS happened when plugging two TT s2-1600:

[   96.521023] saa7146: register extension 'budget dvb'.
[   96.521052] budget dvb 0000:05:00.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16
[   96.521070] IRQ 16/: IRQF_DISABLED is not guaranteed on shared IRQs
[   96.521076] saa7146: found saa7146 @ mem ffffc90011182c00 (revision 1, irq 16) (0x13c2,0x101c).
[   96.521080] saa7146 (0): dma buffer size 192512
[   96.521081] DVB: registering new adapter (TT-Budget S2-1600 PCI)
[   96.539929] adapter has MAC addr = 00:d0:5c:cc:b0:a2
[   96.890149] stv6110x_attach: Attaching STV6110x
[   96.912516] DVB: registering adapter 0 frontend 0 (STV090x Multistandard)...
[   96.912600] budget dvb 0000:05:01.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
[   96.912639] IRQ 17/: IRQF_DISABLED is not guaranteed on shared IRQs
[   96.912667] saa7146: found saa7146 @ mem ffffc90011314800 (revision 1, irq 17) (0x13c2,0x101c).
[   96.912673] saa7146 (1): dma buffer size 192512
[   96.912676] DVB: registering new adapter (TT-Budget S2-1600 PCI)
[   96.930893] adapter has MAC addr = 00:d0:5c:cc:b0:a3
[   97.233478] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[   97.233647] IP: [<ffffffffa029c450>] stv6110x_set_mode+0x70/0x80 [stv6110x]
[   97.233753] PGD 3c16f067 PUD 3c383067 PMD 0
[   97.234147] CPU 0
[   97.234246] Pid: 5200, comm: modprobe Not tainted 2.6.33.2 #1 P5QSE/P5Q SE
[   97.234317] RIP: 0010:[<ffffffffa029c450>]  [<ffffffffa029c450>] stv6110x_set_mode+0x70/0x80 [stv6110x]
[   97.234456] RSP: 0018:ffff88003c125c98  EFLAGS: 00010246
[   97.234461] RAX: ffffffffa029c460 RBX: ffff88003f84d800 RCX: ffff88003a19e140
[   97.234461] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
[   97.234461] RBP: ffff88003f84d828 R08: 0000000000000002 R09: 0000000000000004
[   97.234461] R10: 0000000000000003 R11: 0000000000000010 R12: ffff88003f84d800
[   97.234461] R13: ffff88003f84d828 R14: ffff88003f84d828 R15: 0000000000000001
[   97.234461] FS:  00007f9f7253e6f0(0000) GS:ffff880001800000(0000) knlGS:0000000000000000
[   97.234461] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   97.234461] CR2: 0000000000000010 CR3: 000000003c382000 CR4: 00000000000006b0
[   97.234461] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   97.234461] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[   97.234461] Process modprobe (pid: 5200, threadinfo ffff88003c124000, task ffff88003e893ac0)
[   97.234461]  ffff88003f84d800 ffff88003f84d828 ffff88003f84d800 ffffffffa0292343
[   97.234461] <0> ffff88003f84d828 ffff88003ef70ae0 ffffffffa0280800 ffffffffa02934d2
[   97.234461] <0> ffffffffa0295260 0000000000000000 ffffffffa02948b0 ffff88003df79800
[   97.234461]  [<ffffffffa0292343>] ? stv090x_sleep+0x33/0x120 [stv090x]
[   97.234461]  [<ffffffffa02934d2>] ? stv090x_attach+0x1e2/0x73c [stv090x]
[   97.234461]  [<ffffffff81007cc5>] ? dma_generic_alloc_coherent+0xa5/0x160
[   97.234461]  [<ffffffffa026e1f5>] ? saa7146_init_one+0x7d5/0x910 [saa7146]
[   97.234461]  [<ffffffff811b84b2>] ? local_pci_probe+0x12/0x20
[   97.234461]  [<ffffffff811b87d0>] ? pci_device_probe+0x110/0x120
[   97.234461]  [<ffffffff81221788>] ? driver_probe_device+0x98/0x1b0
[   97.234461]  [<ffffffff81221933>] ? __driver_attach+0x93/0xa0
[   97.234461]  [<ffffffff812218a0>] ? __driver_attach+0x0/0xa0
[   97.234461]  [<ffffffff81220f18>] ? bus_for_each_dev+0x58/0x80
[   97.234461]  [<ffffffff8122079d>] ? bus_add_driver+0x14d/0x280
[   97.234461]  [<ffffffffa0284000>] ? budget_init+0x0/0xc [budget]
[   97.234461]  [<ffffffff81221c29>] ? driver_register+0x79/0x170
[   97.234461]  [<ffffffffa0284000>] ? budget_init+0x0/0xc [budget]
[   97.234461]  [<ffffffff811b8a48>] ? __pci_register_driver+0x58/0xe0
[   97.234461]  [<ffffffffa0284000>] ? budget_init+0x0/0xc [budget]
[   97.234461]  [<ffffffff810001d5>] ? do_one_initcall+0x35/0x190
[   97.234461]  [<ffffffff81063d37>] ? sys_init_module+0xe7/0x260
[   97.234461]  [<ffffffff8100256b>] ? system_call_fastpath+0x16/0x1b
[   97.234461] RIP  [<ffffffffa029c450>] stv6110x_set_mode+0x70/0x80 [stv6110x]
[   97.234461]  RSP <ffff88003c125c98>
[   97.240074] ---[ end trace b53ecbbbbef15e99 ]---

Prevents calling stv6110x_set_mode() if fe->tuner_priv is not defined,
in order to avoid the above bug.

Signed-off-by: Guy Martin <gmsoft@tuxicoman.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-06-01 01:21:50 -03:00
Dan Carpenter 83b6601c88 V4L/DVB: dvb/stv6110x: cleanup error handling
The "stv6110x" is NULL so we can just return directly without calling
kfree().  Also I changed the printk() to make checkpatch.pl happy.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-05-19 12:59:12 -03:00
Andreas Regel 5817ea0c83 V4L/DVB: Budget/STV090x/STV6110x: Initialize the demodulator immediately after the tuner is attached
Signed-off-by: Andreas Regel <andreas.regel@gmx.de>
Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-05-18 00:46:49 -03:00
Manu Abraham c5b74b0f5e V4L/DVB: [STV090x, STV6110x] Use tuner sleep within the demodulator control
Oliver Endriss <o.endriss@gmx.de> pointed out:
Imho not a good idea, as the frontend thread calls
- fe->ops.tuner_ops.init
- fe->ops.tuner_ops.sleep

If you remove fe->ops.i2c_gate_ctrl, init and sleep will fail,
because gate_ctrl was never called...

--

Signed-off-by: Manu Abraham <manu@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-05-18 00:46:47 -03:00
Tejun Heo 5a0e3ad6af include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files.  percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.

percpu.h -> slab.h dependency is about to be removed.  Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability.  As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.

  http://userweb.kernel.org/~tj/misc/slabh-sweep.py

The script does the followings.

* Scan files for gfp and slab usages and update includes such that
  only the necessary includes are there.  ie. if only gfp is used,
  gfp.h, if slab is used, slab.h.

* When the script inserts a new include, it looks at the include
  blocks and try to put the new include such that its order conforms
  to its surrounding.  It's put in the include block which contains
  core kernel includes, in the same order that the rest are ordered -
  alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
  doesn't seem to be any matching order.

* If the script can't find a place to put a new include (mostly
  because the file doesn't have fitting include block), it prints out
  an error message indicating which .h file needs to be added to the
  file.

The conversion was done in the following steps.

1. The initial automatic conversion of all .c files updated slightly
   over 4000 files, deleting around 700 includes and adding ~480 gfp.h
   and ~3000 slab.h inclusions.  The script emitted errors for ~400
   files.

2. Each error was manually checked.  Some didn't need the inclusion,
   some needed manual addition while adding it to implementation .h or
   embedding .c file was more appropriate for others.  This step added
   inclusions to around 150 files.

3. The script was run again and the output was compared to the edits
   from #2 to make sure no file was left behind.

4. Several build tests were done and a couple of problems were fixed.
   e.g. lib/decompress_*.c used malloc/free() wrappers around slab
   APIs requiring slab.h to be added manually.

5. The script was run on all .h files but without automatically
   editing them as sprinkling gfp.h and slab.h inclusions around .h
   files could easily lead to inclusion dependency hell.  Most gfp.h
   inclusion directives were ignored as stuff from gfp.h was usually
   wildly available and often used in preprocessor macros.  Each
   slab.h inclusion directive was examined and added manually as
   necessary.

6. percpu.h was updated not to include slab.h.

7. Build test were done on the following configurations and failures
   were fixed.  CONFIG_GCOV_KERNEL was turned off for all tests (as my
   distributed build env didn't work with gcov compiles) and a few
   more options had to be turned off depending on archs to make things
   build (like ipr on powerpc/64 which failed due to missing writeq).

   * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
   * powerpc and powerpc64 SMP allmodconfig
   * sparc and sparc64 SMP allmodconfig
   * ia64 SMP allmodconfig
   * s390 SMP allmodconfig
   * alpha SMP allmodconfig
   * um on x86_64 SMP allmodconfig

8. percpu.h modifications were reverted so that it could be applied as
   a separate patch and serve as bisection point.

Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.

Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-30 22:02:32 +09:00
Andreas Regel ca108b39a7 V4L/DVB (13983): [STV6110x] add clk_div member to stv6110x_config structure
Using clk_div member of stv6110x_config structure the tuner's clock
output divider can be configured. It is set in stv6110x_attach.

Signed-off-by: Andreas Regel <andreas.regel@gmx.de>
Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-02-26 15:10:37 -03:00
Andreas Regel ec2d3a62ef V4L/DVB (13981): [STV6110x] Add a local register map for each instance of the driver.
Before there was used a static register map that could lead to issues
when there are are multiple adapters with the STV6110(A).

Signed-off-by: Andreas Regel <andreas.regel@gmx.de>
Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-02-26 15:10:36 -03:00
Andreas Regel 0c3f9fd807 V4L/DVB (13980): [STV6110x] Added function stv6110x_write_regs
The function stv6110x_write_regs is used to write several registers at once.

Signed-off-by: Andreas Regel <andreas.regel@gmx.de>
Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2010-02-26 15:10:36 -03:00
Andreas Regel 7c236e37dd V4L/DVB (13360): stv090x: fix the calculation of the r divider in stv6110x_set_frequency
It had always the value 3 no matter what frequency was given.

Signed-off-by: Andreas Regel <andreas.regel@gmx.de>
Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-12-05 18:41:31 -02:00
Andreas Regel f2b2fd4013 V4L/DVB (11592): stv6110x: Fix read bug
Signed-off-by: Andreas Regel <andreas.regel@gmx.de>
Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-06-16 18:20:40 -03:00
Manu Abraham e415c689a8 V4L/DVB (11579): Initial go at TT S2-1600
[mchehab@redhat.com: fix compilation when the new drivers aren't selected]

Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-06-16 18:20:37 -03:00