{"push_id":1946943562,"size":49,"distinct_size":4,"ref":"refs/heads/mediatree/master-ddbridge-jj_CAM-test","head":"e9dc1bb96326c246e6b0aa012d82d71e52411fc9","before":"3c5846b30157f337974ca9d440b8bb573981b802","commits":[{"sha":"412b16d623cf4fd794713f314db5aad10c46ad87","author":{"name":"Matthias Schwarzott","email":"4a88f08b46e1a34171c972a67ea4ea52aa1d401f@gentoo.org"},"message":"media: cx23885: Fix use-after-free when unregistering the i2c_client for the dvb demod\n\nUnregistering the i2c_client of the demod driver destroys the frontend\nobject.\nCalling vb2_dvb_unregister_bus later accesses the frontend (and with the\nrefcount_t) conversion the refcount_t code complains:\n\nkernel: ------------[ cut here ]------------\nkernel: WARNING: CPU: 0 PID: 7883 at lib/refcount.c:128 refcount_sub_and_test+0x70/0x80\nkernel: refcount_t: underflow; use-after-free.\nkernel: Modules linked in: bluetooth si2165(O) a8293(O) tda10071(O) tea5767(O) tuner(O) cx23885(O-) tda18271(O) videobuf2_dvb(O) videobuf2_dma_sg(O) m88ds3103(O) tveeprom(O) cx2341x(O) v4l2_common(O) dvb_core(O) rc_core(O) videobuf2_memops(O) videobuf2_v4l2(O) ums_realtek videobuf2_core(O) uas videodev(O) media(O) rtl8192cu i2c_mux usb_storage rtl_usb rtl8192c_common rtlwifi snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core x86_pkg_temp_thermal kvm_intel kvm irqbypass\nkernel: CPU: 0 PID: 7883 Comm: rmmod Tainted: G        W  O    4.11.3-gentoo #3\nkernel: Hardware name: MEDION E2050 2391/H81H3-EM2, BIOS H81EM2W08.308 08/25/2014\nkernel: Call Trace:\nkernel:  dump_stack+0x4d/0x66\nkernel:  __warn+0xc6/0xe0\nkernel:  warn_slowpath_fmt+0x46/0x50\nkernel:  ? kobject_put+0x2f/0x60\nkernel:  refcount_sub_and_test+0x70/0x80\nkernel:  refcount_dec_and_test+0x11/0x20\nkernel:  dvb_unregister_frontend+0x42/0x60 [dvb_core]\nkernel:  vb2_dvb_dealloc_frontends+0x9e/0x100 [videobuf2_dvb]\nkernel:  vb2_dvb_unregister_bus+0xd/0x20 [videobuf2_dvb]\nkernel:  cx23885_dvb_unregister+0xc3/0x110 [cx23885]\nkernel:  cx23885_dev_unregister+0xea/0x150 [cx23885]\nkernel:  cx23885_finidev+0x4f/0x70 [cx23885]\nkernel:  pci_device_remove+0x34/0xb0\nkernel:  device_release_driver_internal+0x150/0x200\nkernel:  driver_detach+0x33/0x70\nkernel:  bus_remove_driver+0x47/0xa0\nkernel:  driver_unregister+0x27/0x50\nkernel:  pci_unregister_driver+0x34/0x90\nkernel:  cx23885_fini+0x10/0x12 [cx23885]\nkernel:  SyS_delete_module+0x166/0x220\nkernel:  ? exit_to_usermode_loop+0x7b/0x80\nkernel:  entry_SYSCALL_64_fastpath+0x17/0x98\nkernel: RIP: 0033:0x7f5901680b07\nkernel: RSP: 002b:00007ffdf6cdb028 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0\nkernel: RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5901680b07\nkernel: RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000000001500258\nkernel: RBP: 00000000015001f0 R08: 0000000000000000 R09: 1999999999999999\nkernel: R10: 0000000000000884 R11: 0000000000000206 R12: 00007ffdf6cda010\nkernel: R13: 0000000000000000 R14: 00000000015001f0 R15: 00000000014ff010\nkernel: ---[ end trace c3a4659b89086061 ]---\n\nSigned-off-by: Matthias Schwarzott <zzam@gentoo.org>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/412b16d623cf4fd794713f314db5aad10c46ad87"},{"sha":"e59eb4adf0d79fe7692c08c07445ec9efc8ddc1c","author":{"name":"Matthias Schwarzott","email":"4a88f08b46e1a34171c972a67ea4ea52aa1d401f@gentoo.org"},"message":"media: cx231xx: fix use-after-free when unregistering the i2c_client for the dvb demod\n\nCalling i2c_unregister_device for a demod driver destroys the frontend object.\nLater it is accessed by calling dvb_unregister_frontend and\ndvb_frontend_detach.\n\nIn some cases this leads to a general protection fault with this\ncallstack:\n\n  dvb_unregister_frontend+0x25/0x50 [dvb_core]\n  dvb_fini+0xdb/0x160 [cx231xx_dvb]\n  cx231xx_unregister_extension+0x3d/0xb0 [cx231xx]\n  cx231xx_dvb_unregister+0x10/0x809 [cx231xx_dvb]\n  SyS_delete_module+0x18a/0x240\n  ? exit_to_usermode_loop+0x7b/0x80\n  entry_SYSCALL_64_fastpath+0x17/0x98\n\nSigned-off-by: Matthias Schwarzott <zzam@gentoo.org>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/e59eb4adf0d79fe7692c08c07445ec9efc8ddc1c"},{"sha":"6b852620fa75d3137929538b4a9aec2f953ff03c","author":{"name":"Daniel Scheller","email":"85de0d9d97db817469a1a8514e24b0d17efa043b@gmx.net"},"message":"media: dvb-frontends/stv0910: release lock on gate_ctrl() failure\n\nWhenever write_reg() fails to open/close the demod's I2C gate, release the\nlock to avoid deadlocking situations. If I2c gate open failed, there's no\nneed to hold a lock, and if close fails, the mutex_unlock() at the end of\nthe function is never reached, leaving the mutex_lock in locked state,\nwhich in turn will cause potential for deadlocks. Thus, release the lock\non failure.\n\nWhile we're touching gate_ctrl(), add some explanation about the need for\nlocking and the shared I2C bus/gate.\n\nCc: Julia Lawall <julia.lawall@lip6.fr>\nSigned-off-by: Daniel Scheller <d.scheller@gmx.net>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/6b852620fa75d3137929538b4a9aec2f953ff03c"},{"sha":"1502efd2d5960c11593c5f002278cdc1e14c4520","author":{"name":"Daniel Scheller","email":"85de0d9d97db817469a1a8514e24b0d17efa043b@gmx.net"},"message":"media: ddbridge: fix teardown/deregistration order in ddb_input_detach()\n\nBrought to attention by Matthias Schwarzott <zzam@gentoo.org> by fixing\npossible use-after-free faults in some demod drivers:\n\nIn ddb_input_detach(), the i2c_client is unregistered and removed before\ndvb frontends are unregistered and detached. While no use-after-free issue\nwas observed so far, there is another issue with this:\n\ndvb->attached keeps track of the state of the input/output registration,\nand the i2c_client unregistration takes place only if everything was\nsuccessful (dvb->attached == 0x31). If for some reason an error occurred\nduring the frontend setup, that value stays at 0x20. In the following\nerror handling and cleanup, ddb_input_detach() will skip down to that\nstate, leaving the i2c_client registered, causing refcount issues.\n\nFix this by moving the i2c_client deregistration down to case 0x20.\n\nCc: Matthias Schwarzott <zzam@gentoo.org>\nSigned-off-by: Daniel Scheller <d.scheller@gmx.net>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/1502efd2d5960c11593c5f002278cdc1e14c4520"},{"sha":"b5967860c6dae3fd64dd87371eef97e2f2e25490","author":{"name":"Daniel Scheller","email":"85de0d9d97db817469a1a8514e24b0d17efa043b@gmx.net"},"message":"media: ddbridge: fix sparse warnings\n\nFix several\n\n  drivers/media/pci/ddbridge/ddbridge-core.c: warning: symbol ... was not declared. Should it be static?\n  drivers/media/pci/ddbridge/ddbridge-core.c: warning: Using plain integer as NULL pointer\n  drivers/media/pci/ddbridge/ddbridge-io.h: warning: cast removes address space of expression\n  drivers/media/pci/ddbridge/ddbridge-io.h: warning: incorrect type in argument 1 (different address spaces)\n\nat multiple places.\n\nCc: Ralph Metzler <rjkm@metzlerbros.de>\nSigned-off-by: Daniel Scheller <d.scheller@gmx.net>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/b5967860c6dae3fd64dd87371eef97e2f2e25490"},{"sha":"2b64e4de39c791fa12cd7ec0307f01609d4b7f1b","author":{"name":"Daniel Scheller","email":"85de0d9d97db817469a1a8514e24b0d17efa043b@gmx.net"},"message":"media: staging/cxd2099: Add module parameter for buffer mode\n\nThe buffer mode of the cxd2099 driver requires more work regarding error\nhandling and thus can cause issues in some cases, so disable it by default\nand make that mode of operation controllable by users via a module\nparameter (ie. 'modprobe cxd2099 buffermode=1' enables current behaviour).\n\nThe upstream codebase also has the buffer mode disabled by default, so\nwe should match this (but users still can test things out using the\nmodparm).\n\nSigned-off-by: Daniel Scheller <d.scheller@gmx.net>\nSigned-off-by: Jasmin Jessich <jasmin@anw.at>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/2b64e4de39c791fa12cd7ec0307f01609d4b7f1b"},{"sha":"e5d9ce4ddea934d1243747bfc142749ba6ff0c5a","author":{"name":"Daniel Scheller","email":"85de0d9d97db817469a1a8514e24b0d17efa043b@gmx.net"},"message":"media: dvb-frontends/stv0910: change minsymrate to 100Ksyms/s\n\nThe demodulator supports symbol rates as low as 100Ksyms/s - the demod\nsetup in start() already handles such low symbol rates and reviewers\nof stv0910 equipped cards even found and tested transponders with\nSRs in that range. So, announce this in the fe_ops.\n\nCc: Ralph Metzler <rjkm@metzlerbros.de>\nCc: Richard Scobie <r.scobie@clear.net.nz>\nSigned-off-by: Daniel Scheller <d.scheller@gmx.net>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/e5d9ce4ddea934d1243747bfc142749ba6ff0c5a"},{"sha":"be90cc8e4ac08bcb4ca517cd4ae25aa8441e2d88","author":{"name":"Anton Vasilyev","email":"f870451e33da55944e0e7f96ddf4ebddf5b2d56d@ispras.ru"},"message":"media: dvb-usb: Add memory free on error path in dw2102_probe()\n\nIf dw2102_probe() fails on dvb_usb_device_init(), then memleak occurs.\n\nThe patch adds deallocation to the error path.\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\nSigned-off-by: Anton Vasilyev <vasilyev@ispras.ru>\nReviewed-by: Enrico Mioso <mrkiko.rs@gmail.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/be90cc8e4ac08bcb4ca517cd4ae25aa8441e2d88"},{"sha":"9793e1d214dc62a2685fa33dd0dc59b7f5e838b6","author":{"name":"Gustavo A. R. Silva","email":"c66b90184dd80a00a6f6ef8d0ff70881e786347b@embeddedor.com"},"message":"media: au0828: fix unbalanced lock/unlock in au0828_usb_probe\n\nCall mutex_unlock and free dev on failure.\n\nReported-by: Julia Lawall <julia.lawall@lip6.fr>\nSigned-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/9793e1d214dc62a2685fa33dd0dc59b7f5e838b6"},{"sha":"87e9201108b7d63cc4a50faca3baad48c4ec99f8","author":{"name":"Eugeniu Rosca","email":"0e829cfdc4e55c39119c3c21dab0a2ac04313db6@de.adit-jv.com"},"message":"media: mxl111sf: Fix potential null pointer dereference\n\nReviewing the delta between cppcheck output of v4.9.39 and v4.9.40\nstable updates, I stumbled on the new warning:\n\nmxl111sf.c:80: (warning) Possible null pointer dereference: rbuf\n\nSince copying state->rcvbuf into rbuf is not needed in the 'write-only'\nscenario (i.e. calling mxl111sf_ctrl_msg() from mxl111sf_i2c_send_data()\nor from mxl111sf_write_reg()), bypass memcpy() in this case.\n\nFixes: d90b336f3f65 (\"[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages\")\n\nSigned-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>\nReviewed-by: Michael Ira Krufky <mkrufky@linuxtv.org>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/87e9201108b7d63cc4a50faca3baad48c4ec99f8"},{"sha":"d60908759c459774b0c0f637bdf19ddf1d137e3a","author":{"name":"Cihangir Akturk","email":"92310e5ee45063ed6e5b0bafe5da0a46f11a3572@gmail.com"},"message":"media: imx: use setup_timer\n\nUse setup_timer function instead of initializing timer with the\nfunction and data fields.\n\nGenerated by: scripts/coccinelle/api/setup_timer.cocci.\n\nSigned-off-by: Cihangir Akturk <cakturk@gmail.com>\nReviewed-by: Philipp Zabel <p.zabel@pengutronix.de>\nReviewed-by: Steve Longerbeam <steve_longerbeam@mentor.com>\nTested-by: Steve Longerbeam <steve_longerbeam@mentor.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/d60908759c459774b0c0f637bdf19ddf1d137e3a"},{"sha":"c67215263e0b41d35067c77f9ac6cb2873317912","author":{"name":"Daniel Scheller","email":"85de0d9d97db817469a1a8514e24b0d17efa043b@gmx.net"},"message":"media: dvb-frontends/stv0367: remove QAM_AUTO from ddb_fe_ops\n\nSince the cab_* codepath doesn't recognize QAM_AUTO, don't announce that\nit is supported when it really isn't. Fixes ie. w_scan from\nunconditionally using QAM_AUTO on DVB-C scans.\n\nSigned-off-by: Daniel Scheller <d.scheller@gmx.net>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/c67215263e0b41d35067c77f9ac6cb2873317912"},{"sha":"3cdb977ec878b23eb6e3380d262985b6a7c93c54","author":{"name":"Sakari Ailus","email":"20e5d1d02c2f1dd1e848b2d45f5d9cb636f7f9d6@linux.intel.com"},"message":"media: docs-rst: media: Document broken frame handling in stream stop for CSI-2\n\nSome CSI-2 transmitters will finish an ongoing frame whereas others will\nnot. Document that receiver drivers should not assume a particular\nbehaviour but to work in both cases.\n\nSigned-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>\nReviewed-by: Hans Verkuil <hans.verkuil@cisco.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/3cdb977ec878b23eb6e3380d262985b6a7c93c54"},{"sha":"d4e192cc44914787cfe1231e2f1f9d0e8855f77b","author":{"name":"Fabio Estevam","email":"f37aab7b304f42579817075af31d50648f6a90af@nxp.com"},"message":"media: mx2_emmaprp: Check for platform_get_irq() error\n\nplatform_get_irq() may fail, so we should better check its return\nvalue and propagate it in the case of error.\n\nSigned-off-by: Fabio Estevam <fabio.estevam@nxp.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/d4e192cc44914787cfe1231e2f1f9d0e8855f77b"},{"sha":"87c014867181c3ec6e20bf3e71db37939d1782c7","author":{"name":"Gustavo A. R. Silva","email":"c66b90184dd80a00a6f6ef8d0ff70881e786347b@embeddedor.com"},"message":"media: dib0090: fix duplicated code for different branches\n\nRefactor code in order to avoid identical code for different branches.\n\nThis issue was detected with the help of Coccinelle.\n\nAddresses-Coverity-ID: 1226795\n\nSigned-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/87c014867181c3ec6e20bf3e71db37939d1782c7"},{"sha":"3db4b68e4693bc2421a0cbb7777bd7e60e412549","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"media: au0828: fix RC_CORE dependency\n\nWhen RC_CORE is a loadable module, and au0828 is built-in including\nthe RC support, we get a link error:\n\ndrivers/media/usb/au0828/au0828-input.o: In function `au0828_get_key_au8522':\nau0828-input.c:(.text+0x474): undefined reference to `ir_raw_event_store'\ndrivers/media/usb/au0828/au0828-input.o: In function `au0828_rc_register':\nau0828-input.c:(.text+0x7c8): undefined reference to `rc_allocate_device'\nau0828-input.c:(.text+0x8f8): undefined reference to `rc_register_device'\n\nThis adds an additional dependency, similar to the one for em28xx,\nto ensure the broken configuration is never used.\n\nFixes: 2fcfd317f66c (\"[media] au0828: add support for IR on HVR-950Q\")\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/3db4b68e4693bc2421a0cbb7777bd7e60e412549"},{"sha":"5303135c178c2f51044ddbc30037af9f030e6017","author":{"name":"Bhumika Goyal","email":"6772c1c4ab60b4e27071637dbf89f6cfbd4e0fbc@gmail.com"},"message":"media: platform: make video_device const\n\nMake these const as they are only used during a copy operation.\nDone using Coccinelle:\n\n@match disable optional_qualifier@\nidentifier s;\n@@\nstatic struct video_device s = {...};\n\n@ref@\nposition p;\nidentifier match.s;\n@@\ns@p\n\n@good1@\nidentifier match.s;\nexpression list[3] es;\nposition ref.p;\n@@\ncx88_vdev_init(es,&s@p,...)\n\n@good2@\nposition ref.p;\nidentifier match.s,f,c;\nexpression e;\n@@\n(\ne = s@p\n|\ne = s@p.f\n|\nc(...,s@p.f,...)\n|\nc(...,s@p,...)\n)\n\n@bad depends on  !good1 && !good2@\nposition ref.p;\nidentifier match.s;\n@@\ns@p\n\n@depends on forall !bad disable optional_qualifier@\nidentifier match.s;\n@@\nstatic\n+ const\nstruct video_device s;\n\nSigned-off-by: Bhumika Goyal <bhumirks@gmail.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/5303135c178c2f51044ddbc30037af9f030e6017"},{"sha":"507e190946297c34a27d9366b0661d5e506fdd03","author":{"name":"Bhumika Goyal","email":"6772c1c4ab60b4e27071637dbf89f6cfbd4e0fbc@gmail.com"},"message":"media: pci: make video_device const\n\nMake these const as they are either used during a copy operation or\npassed to a const argument of the function cx88_vdev_init.\n\nSigned-off-by: Bhumika Goyal <bhumirks@gmail.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/507e190946297c34a27d9366b0661d5e506fdd03"},{"sha":"868449422081f8f4b5d2969709c0aa9021184167","author":{"name":"Bhumika Goyal","email":"6772c1c4ab60b4e27071637dbf89f6cfbd4e0fbc@gmail.com"},"message":"media: usb: make video_device const\n\nMake these const as they are only used during a copy operation.\n\nSigned-off-by: Bhumika Goyal <bhumirks@gmail.com>\nAcked-by: Mike Isely <isely@pobox.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/868449422081f8f4b5d2969709c0aa9021184167"},{"sha":"e66fb184e749d70358df0e849e5f6ca2b5dabfc9","author":{"name":"Bhumika Goyal","email":"6772c1c4ab60b4e27071637dbf89f6cfbd4e0fbc@gmail.com"},"message":"media: cx18: make v4l2_file_operations const\n\nMake this const as it is only stored in a const field of a\nvideo_device structure.\n\nSigned-off-by: Bhumika Goyal <bhumirks@gmail.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>","distinct":false,"url":"https://api.github.com/repos/jasmin-j/dddvb-linux-kernel/commits/e66fb184e749d70358df0e849e5f6ca2b5dabfc9"}]}
{"actor":{"display_login":"jasmin-j"}}