Smatch complains that the wrong limiter is used here:
drivers/media/dvb/ttpci/av7110.c +906 dvb_feed_start_pid(12)
error: buffer overflow 'npids' 5 <= 19
Here is the problem code:
905 i = dvbdmxfeed->pes_type;
906 npids[i] = (pid[i]&0x8000) ? 0 : pid[i];
"npids" is a 5 element array declared on the stack. If
dvbdmxfeed->pes_type is more than 4 we probably put a (u16)0 past
the end of the array.
If dvbdmxfeed->pes_type is over 4 the rest of the function doesn't
do anything. dvbdmxfeed->pes_type is capped at less than
DMX_TS_PES_OTHER (20) in the caller function, but I changed it to
less than or equal to DMX_TS_PES_PCR (4).
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This patch fix a bug in the i2c code of ttusb2 driver.
Signed-off-by: Jose Alberto Reguero <jareguero@telefonica.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
I get this error when compiling for_v3.3:
There is a include <linux/module.h> missing.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
priv gets dereferenced in mt9t112_set_params() so we should return
before calling that.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This patch to the IR RC6 decoder adds support for variable length
mode-6A frames which can range in size from 8 to 128 bits. Please refer
to the following link for a detailed explanation or RC6 frames:
http://slydiman.narod.ru/scr/kb/rc6.htm
This change removes the assumption that frames are fixed length
(currently either 24 or 32 data bits) and actually counts the number of
bits until an end of frame marker is seen.
[mchehab@redhat.com: Tested with a RC-6(0) IR - 16 bits]
Tested-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* tag 'v3.2-rc2': (3068 commits)
Linux 3.2-rc2
hfs: add sanity check for file name length
fsl-rio: fix compile error
blackfin: Fixup export.h includes
Blackfin: add serial TX IRQ in individual platform resource
virtio-pci: fix use after free
ACPI / cpuidle: Remove acpi_idle_suspend (to fix suspend regression)
drm/radeon/kms/combios: fix dynamic allocation of PM clock modes
[CPUFREQ] db8500: fix build error due to undeclared i variable
bma023: Add SFI translation for this device
vrtc: change its year offset from 1960 to 1972
ce4100: fix a build error
arm/imx: fix imx6q mmc error when mounting rootfs
arm/imx: fix AUTO_ZRELADDR selection
arm/imx: fix the references to ARCH_MX3
ARM: mx51/53: set pwm clock parent to ipg_perclk
btrfs: rename the option to nospace_cache
drm/radeon/kms/pm: switch to dynamically allocating clock mode array
drm/radeon/kms: optimize r600_pm_profile_init
drm/radeon/kms/pm: add a proper pm profile init function for fusion
...
Conflicts:
drivers/media/radio/Kconfig
With this patch I try again to add initial support for HVR930C.
Tested only DVB-T, since in Italy Analog service is stopped.
Actually "scan -a0 -f1", find only about 50 channel while 400 should
be available.
[mchehab@redhat.com: Tested with DVB-C and fixed a few whitespace issues]
Tested-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Eddi De Pieri <eddi@depieri.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
As reported by Andreas Oberritter <obi@linuxtv.org>, changeset
33ba28eebc did the wrong thing.
Fix it to properly reflect the entries for Terratec H5 revs 1 and 2,
and restore Terratec XS entry.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
* 'fixes' of git://git.linaro.org/people/triad/linux-pinctrl:
pinctrl: hide subsystem from the populace
pinctrl: fix "warning: 'struct pinctrl_dev' declared inside parameter list"
* 'gpio/merge' of git://git.secretlab.ca/git/linux-2.6:
gpio: pca953x: propagate the errno from the chip_init functions
gpio: pca953x: remove unneeded check for chip type
gpio/omap: check return value from irq_alloc_generic_chip
gpio/omap: replace MOD_REG_BIT macro with static inline
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lliubbo/blackfin:
blackfin: Fixup export.h includes
Blackfin: add serial TX IRQ in individual platform resource
On a corrupted file system the ->len field could be wrong leading to
a buffer overflow.
Reported-and-acked-by: Clement LECIGNE <clement.lecigne@netasq.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The "#include <linux/module.h>" was replaced by "#include <linux/export.h>"
in the patch "powerpc: various straight conversions from module.h --> export.h".
This will cause the following compile problem:
arch/powerpc/sysdev/fsl_rio.c: In function 'fsl_rio_mcheck_exception':
arch/powerpc/sysdev/fsl_rio.c:296: error: implicit declaration of function 'search_exception_tables'.
The file fsl_rio.c needs the declaration of function "search_exception_tables"
in the header file "linux/module.h".
Signed-off-by: Liu Gang <Gang.Liu@freescale.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Commit 8dc7a9c84 ("blackfin: Add export.h to files using
EXPORT_SYMBOL/THIS_MODULE") inserted some of the include statements into
sections protected by an unrelated #if CONFIG_... statement. This can cause,
depending on the configuration used, warnings like this one:
arch/blackfin/mach-bf537/boards/stamp.c:2940: warning: data definition has no type or storage class
arch/blackfin/mach-bf537/boards/stamp.c:2940: warning: type defaults to ‘int’ in declaration of ‘EXPORT_SYMBOL’
arch/blackfin/mach-bf537/boards/stamp.c:2940: warning: parameter names (without types) in function declaration
This patch fixes it by moving the includes out of the #if protected sections.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Bob Liu <lliubbo@gmail.com>
The serial TX IRQ is not simply (RX IRQ + 1) on some Blackfin chips,
so move the values to the platform resources.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Bob Liu <lliubbo@gmail.com>
* 'rmobile-fixes-for-linus' of git://github.com/pmundt/linux-sh:
ARM: mach-shmobile: cpuidle single/global and last_state fixes
ARM: mach-shmobile: move helper macro PORTCR to sh_pfc.h
ARM: mach-shmobile: move helper macro PORT_xx to sh_pfc.h
ARM: mach-shmobile: move helper macro PORT_DATA_xx to sh_pfc.h
ARM: mach-shmobile: ap4evb: remove white space from end of line
ARM: mach-shmobile: clock-sh7372: remove un-necessary index
ARM: mach-shmobile: kota2: add comment out separator
ARM: mach-shmobile: sh73a0: add MMC data pin pull-up
Commit 31a3ddda16 introduced
a use after free in virtio-pci. The main issue is
that the release method signals removal of the virtio device,
while remove signals removal of the pci device.
For example, on driver removal or hot-unplug,
virtio_pci_release_dev is called before virtio_pci_remove.
We then might get a crash as virtio_pci_remove tries to use the
device freed by virtio_pci_release_dev.
We allocate/free all resources together with the
pci device, so we can leave the release method empty.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: stable@kernel.org
After commit e978aa7d7d ("cpuidle: Move dev->last_residency update to
driver enter routine; remove dev->last_state") setting acpi_idle_suspend
to 1 by acpi_processor_suspend() causes the ACPI cpuidle routines to
return error codes continuously, which in turn causes cpuidle to lock up
(hard).
However, acpi_idle_suspend doesn't appear to be useful for any
particular purpose (it's racy and doesn't really provide any real
protection), so it can be removed, which makes the problem go away.
Reported-and-tested-by: Tomas M. <tmezzadra@gmail.com>
Reported-and-tested-by: Ferenc Wagner <wferi@niif.hu>
Tested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
I missed the combios path when I updated the atombios pm code.
Reported by amarsh04 on IRC.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
The variable i is removed by commit ded8433
"[CPUFREQ] db8500: remove unneeded for loop iteration over freq_table",
but current code to print available frequencies still uses the i variable.
Thus add the i variable back to fix below buld error:
CC drivers/cpufreq/db8500-cpufreq.o
drivers/cpufreq/db8500-cpufreq.c: In function 'db8500_cpufreq_init':
drivers/cpufreq/db8500-cpufreq.c:123: error: 'i' undeclared (first use in this function)
drivers/cpufreq/db8500-cpufreq.c:123: error: (Each undeclared identifier is reported only once
drivers/cpufreq/db8500-cpufreq.c:123: error: for each function it appears in.)
make[2]: *** [drivers/cpufreq/db8500-cpufreq.o] Error 1
make[1]: *** [drivers/cpufreq] Error 2
make: *** [drivers] Error 2
This patch also fixes using uninitialized i variable as array index.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Dave Jones <davej@redhat.com>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: (29 commits)
m68k/mac: Remove mac_irq_{en,dis}able() wrappers
m68k/irq: Remove obsolete support for user vector interrupt fixups
m68k/irq: Remove obsolete m68k irq framework
m68k/q40: Convert Q40/Q60 to genirq
m68k/sun3: Convert Sun3/3x to genirq
m68k/sun3: Use the kstat_irqs_cpu() wrapper
m68k/apollo: Convert Apollo to genirq
m68k/vme: Convert VME to genirq
m68k/hp300: Convert HP9000/300 and HP9000/400 to genirq
m68k/mac: Optimize interrupts using chain handlers
m68k/mac: Convert Mac to genirq
m68k/amiga: Optimize interrupts using chain handlers
m68k/amiga: Convert Amiga to genirq
m68k/amiga: Refactor amiints.c
m68k/atari: Remove code and comments about different irq types
m68k/atari: Convert Atari to genirq
m68k/irq: Add genirq support
m68k/irq: Remove obsolete IRQ_FLG_* users
m68k/irq: Rename {,__}m68k_handle_int()
m68k/irq: Add m68k_setup_irq_controller()
...
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] v4l2-ctrl: Send change events to all fh for auto cluster slave controls
[media] v4l2-event: Don't set sev->fh to NULL on unsubscribe
[media] v4l2-event: Remove pending events from fh event queue when unsubscribing
[media] v4l2-event: Deny subscribing with a type of V4L2_EVENT_ALL
[media] MAINTAINERS: add a maintainer for s5p-mfc driver
[media] v4l: s5p-mfc: fix reported capabilities
[media] media: vb2: reset queued list on REQBUFS(0) call
[media] media: vb2: set buffer length correctly for all buffer types
[media] media: vb2: add a check for uninitialized buffer
[media] mxl111sf: fix build warning
[media] mxl111sf: remove pointless if condition in mxl111sf_config_spi
[media] mxl111sf: check for errors after mxl111sf_write_reg in mxl111sf_idac_config
[media] mxl111sf: fix return value of mxl111sf_idac_config
[media] uvcvideo: GET_RES should only be checked for BITMAP type menu controls
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc/kvm: Fix build failure with HV KVM and CBE
powerpc/ps3: Fix lv1_gpu_attribute hcall
powerpc/ps3: Fix PS3 repository build warnings
powerpc/ps3: irq: Remove IRQF_DISABLED
powerpc/irq: Remove IRQF_DISABLED
powerpc/numa: NUMA topology support for PowerNV
powerpc: Add System RAM to /proc/iomem
powerpc: Add KVM as module to defconfigs
powerpc/kvm: Fix build with older toolchains
powerpc, tqm5200: update tqm5200_defconfig to fit for charon board.
powerpc/5200: add support for charon board
This needed the sfi IRQ 0xFF fix to go in first. It simply plumbs in the
bma023 driver with the firmware naming of it.
Signed-off-by: William Douglas <william.douglas@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Real world year equals the value in vrtc YEAR register plus an offset.
We used 1960 as the offset to make leap year consistent, but for a
device's first use, its YEAR register is 0 and the system year will
be parsed as 1960 which is not a valid UNIX time and will cause many
applications to fail mysteriously. So we use 1972 instead to fix this
issue.
Updated patch which adds a sanity check suggested by Mathias
This isn't a change in behaviour for systems, because 1972 is the one we
actually use. It's the old version in upstream which is out of sync with
all devices.
Signed-off-by: Feng Tang <feng.tang@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Fix a build error. CE4100 with no serial errors because the alternate
function is only a prototype not a null function as intended.
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
btrfs: rename the option to nospace_cache
Btrfs: handle bio_add_page failure gracefully in scrub
Btrfs: fix deadlock caused by the race between relocation
Btrfs: only map pages if we know we need them when reading the space cache
Btrfs: fix orphan backref nodes
Btrfs: Abstract similar code for btrfs_block_rsv_add{, _noflush}
Btrfs: fix unreleased path in btrfs_orphan_cleanup()
Btrfs: fix no reserved space for writing out inode cache
Btrfs: fix nocow when deleting the item
Btrfs: tweak the delayed inode reservations again
Btrfs: rework error handling in btrfs_mount()
Btrfs: close devices on all error paths in open_ctree()
Btrfs: avoid null dereference and leaks when bailing from open_ctree()
Btrfs: fix subvol_name leak on error in btrfs_mount()
Btrfs: fix memory leak in btrfs_parse_early_options()
Btrfs: fix our reservations for updating an inode when completing io
Btrfs: fix oops on NULL trans handle in btrfs_truncate
btrfs: fix double-free 'tree_root' in 'btrfs_mount()'
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: usb-audio: Use kmemdup rather than duplicating its implementation
ALSA: hda - Re-enable the check NO_PRESENCE misc bit
ALSA: vmaster - Free slave-links when freeing the master element
ALSA: hda - Don't add elements of other codecs to vmaster slave
ALSA: intel8x0: improve virtual environment detection
ALSA: intel8x0: move virtual environment detection code into one place
ALSA: snd_usb_audio: add Logitech HD Webcam c510 to quirk-384
ALSA: hda - fix internal mic on Dell Vostro 3500 laptop
ALSA: HDA: Remove quirk for Toshiba T110
ALSA: usb-audio - Fix the missing volume quirks at delayed init
ALSA: hda - Mute unused capture sources for Realtek codecs
ALSA: intel8x0: Improve comments for VM optimization
ASoC: Ensure we get an impedence reported for WM8958 jack detect
ASoC: Don't use wm8994->control_data when requesting IRQs
ASoC: Don't use wm8994->control_data in wm8994_readable_register()
ASoC: Update git repository URL
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (42 commits)
drm/radeon/kms/pm: switch to dynamically allocating clock mode array
drm/radeon/kms: optimize r600_pm_profile_init
drm/radeon/kms/pm: add a proper pm profile init function for fusion
drm/radeon/kms: remove extraneous calls to radeon_pm_compute_clocks()
drm/exynos: added padding to be 64-bit align.
drm: fix kconfig unmet dependency warning
drm: add some comments to drm_wait_vblank and drm_queue_vblank_event
drm/radeon/benchmark: signedness bug in radeon_benchmark_move()
drm: do not sleep on vblank while holding a mutex
MAINTAINERS: exynos: Add EXYNOS DRM maintainer entry
drm: try to restore previous CRTC config if mode set fails
drm/radeon/kms: make an aux failure debug only
drm: drop select of SLOW_WORK
drm: serialize access to list of debugfs files
drm/radeon/kms: fix use of vram scratch page on evergreen/ni
drm/radeon: Make sure CS mutex is held across GPU reset.
drm: Ensure string is null terminated.
vmwgfx: Only allow 64x64 cursors
vmwgfx: Initialize clip rect loop correctly in surface dirty
vmwgfx: Close screen object system
...
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
xfs: fix force shutdown handling in xfs_end_io
xfs: constify xfs_item_ops
xfs: Fix possible memory corruption in xfs_readlink
The Annex C support were broken with the previous implementation,
as, at xc5000 and tda18271c2dd, it were choosing the wrong bandwidth
for some symbol rates.
At DRX-J, it were always selecting Annex A, even having Annex C
support coded there.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
