As reported by smatch:
drivers/media/tuners/qt1010.c:357 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34
This should not happen with the current code, as the i2c_data array
doesn't end with a QT1010_M1, but it doesn't hurt add a BUG_ON
to notify if one modifies it and breaks.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/usb/gspca/zc3xx.c:5994 transfer_update() info: ignoring unreachable code.
That happens because there's a return that it is never called,
as the work queue runs an infinite loop, except when the device is
put to sleep or an error happens.
When an error happens, a break statement is enough to go out of
the loop. So, let's remove the goto, as break is the typical
instruction used to end a loop.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
If userspace sends an invalid bandwidth, it should either return
EINVAL or switch to auto mode.
This driver will go past an array and program the hardware on a
wrong way if this happens.
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up to 7 values:
drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/dvb-frontends/dib3000mc.c:134 dib3000mc_setup_pwm_state() warn: inconsistent indenting
drivers/media/dvb-frontends/dib3000mc.c:144 dib3000mc_setup_pwm_state() warn: inconsistent indenting
drivers/media/dvb-frontends/dib3000mc.c:420 dib3000mc_sleep() warn: inconsistent indenting
drivers/media/dvb-frontends/dib3000mc.c:453 dib3000mc_set_channel_cfg() warn: inconsistent indenting
The last one is actually due to a commented code. Let's rework
it, in order to remove the sparse warning without removing the
dead code, as it may be useful in the future.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/usb/go7007/go7007-driver.c:452 frame_boundary() warn: variable dereferenced before check 'vb' (see line 449)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Using static const allows the compiler to optimize the code.
Before static const:
text data bss dec hex filename
4982 524 1568 7074 1ba2 drivers/media/tuners/qt1010.o
After static const:
text data bss dec hex filename
4714 524 1568 6806 1a96 drivers/media/tuners/qt1010.o
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The streg_cbdata can have a negative error value. So, it should be
an integer, and not u8, as reported by smatch:
drivers/media/radio/wl128x/fmdrv_common.c:1517 fmc_prepare() warn: assigning (-115) to unsigned variable 'fmdev->streg_cbdata'
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
There are some false-positive warnings produced by smatch:
drivers/media/rc/ir-sony-decoder.c:129 ir_sony_decode() warn: missing break? reassigning 'data->state'
drivers/media/rc/ir-sony-decoder.c:137 ir_sony_decode() warn: missing break? reassigning 'data->state'
drivers/media/rc/ir-sony-decoder.c:165 ir_sony_decode() warn: missing break? reassigning 'data->state'
This is due to the logic used there to detect the need of a break.
While those are false positives, it is easy to get rid of them without
any drawbacks. The side effect is a cleaner function, with is good.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/platform/s5p-mfc/s5p_mfc.c:1340 s5p_mfc_runtime_resume() warn: this array is probably non-NULL. 'm_dev->alloc_ctx'
alloc_ctx can never be NULL, as it is embeeded inside the struct
s5p_mfc_dev.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/zoran/zoran_device.c:1594 zoran_init_hardware() warn: inconsistent indenting
Fix indent. While here, fix CodingStyle and remove dead code, as it
can always be recovered from git logs.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/ivtv/ivtv-driver.c:832 ivtv_init_struct2() error: buffer overflow 'itv->card->video_inputs' 6 <= 6
That happens because nof_inputs and nof_audio_inputs can be initialized
as IVTV_CARD_MAX_VIDEO_INPUTS, instead of IVTV_CARD_MAX_VIDEO_INPUTS - 1.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/i2c/saa717x.c:155 saa717x_read() warn: mask and shift to zero
drivers/media/i2c/saa717x.c:155 saa717x_read() warn: mask and shift to zero
This is done right at saa717x_write(), but the read function is
broken. Thankfully, there's just one place at saa717x driver that
uses multibyte read (for status report, via printk).
Yet, let's fix it. From saa717x_write(), it is clear that the
bytes are in little endian:
mm1[4] = (value >> 16) & 0xff;
mm1[3] = (value >> 8) & 0xff;
mm1[2] = value & 0xff;
So, the same order should be valid for read too.
Compile-tested only.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/saa7164/saa7164-core.c:631 saa7164_irq() warn: variable dereferenced before check 'dev' (see line 621)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/ngene/ngene-core.c:1529 init_channel() error: we previously assumed 'chan->fe' could be null (see line 1521)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
As reported by smatch:
drivers/media/pci/cx18/cx18-driver.c:807 cx18_init_struct2() error: buffer overflow 'cx->card->video_inputs' 6 <= 6
That happens because nof_inputs and nof_audio_inputs can be initialized
as CX18_CARD_MAX_VIDEO_INPUTS, instead of CX18_CARD_MAX_VIDEO_INPUTS - 1.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Andy Walls <awalls@md.metrocast.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/rc/rc-main.c:749 rc_close() warn: inconsistent indenting
There's an extra space there.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/platform/am437x/am437x-vpfe.c: In function 'vpfe_ccdc_update_raw_params':
drivers/media/platform/am437x/am437x-vpfe.c:430:38: warning: variable 'config_params' set but not used [-Wunused-but-set-variable]
struct vpfe_ccdc_config_params_raw *config_params =
^
vpfe_ccdc_update_raw_params() is supposed to update the raw
params at ccdc. However, it is just creating a local var and changing
it.
Compile-tested only.
Cc: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In file included from include/uapi/linux/posix_types.h:4:0,
from include/uapi/linux/types.h:13,
from include/linux/types.h:5,
from include/uapi/linux/sysinfo.h:4,
from include/uapi/linux/kernel.h:4,
from include/linux/cache.h:4,
from include/linux/time.h:4,
from include/linux/input.h:11,
from drivers/media/usb/dvb-usb/dvb-usb.h:13,
from drivers/media/usb/dvb-usb/dib0700.h:13,
from drivers/media/usb/dvb-usb/dib0700_devices.c:9:
drivers/media/dvb-frontends/dib8000.h: In function 'dib8000_attach':
include/linux/stddef.h:8:14: warning: return makes integer from pointer without a cast [-Wint-conversion]
#define NULL ((void *)0)
^
drivers/media/dvb-frontends/dib8000.h:72:9: note: in expansion of macro 'NULL'
return NULL;
^
Reported-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In file included from drivers/media/common/b2c2/flexcop-fe-tuner.c:13:0:
drivers/media/dvb-frontends/cx24123.h:54:2: warning: 'cx24123_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
cx24123_get_tuner_i2c_adapter(struct dvb_frontend *fe)
^
In file included from drivers/media/usb/em28xx/em28xx-dvb.c:46:0:
drivers/media/dvb-frontends/s921.h:40:2: warning: 's921_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
s921_get_tuner_i2c_adapter(struct dvb_frontend *fe)
^
In file included from drivers/media/usb/em28xx/em28xx-dvb.c:55:0:
drivers/media/dvb-frontends/mb86a20s.h:49:2: warning: 'mb86a20s_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
mb86a20s_get_tuner_i2c_adapter(struct dvb_frontend *fe)
^
In file included from drivers/media/usb/cx231xx/cx231xx-dvb.c:35:0:
drivers/media/dvb-frontends/mb86a20s.h:49:2: warning: 'mb86a20s_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
mb86a20s_get_tuner_i2c_adapter(struct dvb_frontend *fe)
^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Fix these compiler warnings that appeared after switching to gcc-5.1.0:
drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_power':
drivers/media/platform/s3c-camif/camif-capture.c:118:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
if (!on == camif->sensor.power_count)
^
drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_streaming':
drivers/media/platform/s3c-camif/camif-capture.c:134:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
if (!on == camif->sensor.stream_count)
^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Fix these compiler warnings that appeared after switching to gcc-5.1.0:
drivers/media/i2c/s5k5baf.c: In function 's5k5baf_set_power':
drivers/media/i2c/s5k5baf.c:1057:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
if (!on != state->power)
^
drivers/media/i2c/s5k6aa.c: In function 's5k6aa_set_power':
drivers/media/i2c/s5k6aa.c:878:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
if (!on == s5k6aa->power) {
^
drivers/media/i2c/s5c73m3/s5c73m3-core.c: In function 's5c73m3_oif_set_power':
drivers/media/i2c/s5c73m3/s5c73m3-core.c:1456:17: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
} else if (!on == state->power) {
^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
For these encodings the quantization range should be ignored, since
there is only one possible Y'CbCr encoding.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In order to be consistent with the other Y'CbCr encodings add
support for full range V4L2_YCBCR_ENC_BT2020_CONST_LUM.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In order to be consistent with the other Y'CbCr encodings add
support for full range V4L2_YCBCR_ENC_BT2020.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In order to be consistent with the other Y'CbCr encodings add
support for full range V4L2_YCBCR_ENC_SMPTE240M.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Add a log_status function to the test pattern generator and use that
in vivid. This simplifies debugging complex colorspace problems.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Use the VIVID_WEBCAM_SIZES constant where appropriate and add a
1920x1080 pixel frame size setting with frame rates of 2 fps and
5 fps.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Add device tree support for adp1653 flash LED driver.
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Instead of parsing the link-frequencies property in the driver, let
v4l2_of_alloc_parse_endpoint() do it.
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Reviewed-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The link-frequencies property is a variable length array of link frequencies
in an endpoint. The array is needed by an increasing number of drivers, so
it makes sense to add it to struct v4l2_of_endpoint.
However, the length of the array is variable and the size of struct
v4l2_of_endpoint is fixed since it is allocated by the caller. The options
here are
1. to define a fixed maximum limit of link frequencies that has to be the
global maximum of all boards. This is seen as problematic since the maximum
could be largish, and everyone hitting the problem would need to submit a
patch to fix it, or
2. parse the property in every driver. This doesn't sound appealing as two
of the three implementations submitted to linux-media were wrong, and one of
them was even merged before this was noticed, or
3. change the interface so that allocating and releasing memory according to
the size of the array is possible. This is what the patch does.
v4l2_of_alloc_parse_endpoint() is just like v4l2_of_parse_endpoint(), but it
will allocate the memory resources needed to store struct v4l2_of_endpoint
and the additional arrays pointed to by this struct. A corresponding release
function v4l2_of_free_endpoint() is provided to release the memory allocated
by v4l2_of_alloc_parse_endpoint().
In addition to this, the link-frequencies property is parsed as well, and
the result is stored to struct v4l2_of_endpoint field link_frequencies.
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Tested-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Zero the entire struct starting from bus_type. As more fields are added, no
changes will be needed in the function to reset their value explicitly.
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
