[patch 3/3] V4L/DVB: s5p-fimc: dubious one-bit signed bitfields

These are signed so instead of being 1 and 0 as intended they are -1 and 0. It doesn't cause a bug in the current code but Sparse warns about it: drivers/media/video/s5p-fimc/fimc-core.h:226:28: error: dubious one-bit signed bitfield Signed-off-by: Dan Carpenter erro...@gmail.com diff

[patch 2/3] V4L/DVB: s5p-fimc: make it compile

/media/video/s5p-fimc/fimc-core.c:286: error: ‘TASK_NORMAL’ undeclared (first use in this function) Signed-off-by: Dan Carpenter erro...@gmail.com --- Compile tested only. :P diff --git a/drivers/media/video/s5p-fimc/fimc-core.h b/drivers/media/video/s5p

[patch -next] V4L/DVB: IR/streamzap: fix usec to nsec conversion

. The original code had a deadline of 1.005 seconds and the new code has a deadline of .065 seconds. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/IR/streamzap.c b/drivers/media/IR/streamzap.c index 2cf57e6..d5d3cee 100644 --- a/drivers/media/IR/streamzap.c +++ b/drivers

[patch] V4L/DVB: saa7134: add test after for loop

Add a check after the for loops to see if we found what we were looking for or if we reached the end of the list. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/saa7134/saa7134-video.c b/drivers/media/video/saa7134/saa7134-video.c index 45f0ac8..24c3a78 100644

[patch] V4L/DVB: opera1: remove unneeded NULL check

fw is always a non-NULL pointer at this point, and anyway release_firmware() accepts NULL pointers. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/dvb/dvb-usb/opera1.c b/drivers/media/dvb/dvb-usb/opera1.c index 6b22ec6..f896337 100644 --- a/drivers/media/dvb/dvb-usb

[patch] V4L/DVB: pvrusb2: remove unneeded NULL checks

We dereference maskptr unconditionally at the start of the function and also inside the call to parse_tlist() towards the end of the function. This function is called from store_val_any() and it always passes a non-NULL pointer. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git

[patch] V4L/DVB: saa7164: move dereference under NULL check

.) There is only one caller for this function and it passes non-NULL pointers, so this is essentially a cleanup rather than a bugfix. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/saa7164/saa7164-buffer.c b/drivers/media/video/saa7164/saa7164-buffer.c index 5713f3a

[patch] V4L/DVB: unlock on error path

If we return directly here then we miss out on some mutex_unlock()s Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c index b151c7b..1beb226 100644 --- a/drivers/media/video/s5p-fimc/fimc-core.c +++ b

[patch] IR: ene_ir: problems in unwinding on probe

There were a couple issues here. If the allocation failed for dev then it would lead to a NULL dereference. If request_irq() or request_region() failed it would release the irq and the region even though they were not successfully aquired. Signed-off-by: Dan Carpenter erro...@gmail.com diff

[patch] IR: ir-raw-event: null pointer dereference

The original code dereferenced ir-raw after freeing it and setting it to NULL. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/IR/ir-raw-event.c b/drivers/media/IR/ir-raw-event.c index 43094e7..8e0e1b1 100644 --- a/drivers/media/IR/ir-raw-event.c +++ b/drivers/media/IR

Re: [patch] IR: ene_ir: problems in unwinding on probe

On Thu, Aug 12, 2010 at 05:35:04PM +0300, Maxim Levitsky wrote: On Thu, 2010-08-12 at 09:46 +0200, Dan Carpenter wrote: There were a couple issues here. If the allocation failed for dev then it would lead to a NULL dereference. If request_irq() or request_region() failed it would release

[patch -next] V4L: media/IR: testing the wrong variable

There is a typo here. We meant to test rbuf instead of drv. We already tested drv earlier. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/IR/ir-lirc-codec.c b/drivers/media/IR/ir-lirc-codec.c index 178bc5b..87e 100644 --- a/drivers/media/IR/ir-lirc-codec.c +++ b

[patch -next] V4L: au0828: move dereference below sanity checks

This function has sanity checks to make sure that dev is non-null. I moved the dereference down below the checks. In the current code dev is never actually null. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828

[patch -next] V4L: ivtv: remove unneeded NULL checks

for v4l2_dev, but I looked at the code and I don't think that can be NULL either. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/ivtv/ivtvfb.c b/drivers/media/video/ivtv/ivtvfb.c index 2c2d862..be03a71 100644 --- a/drivers/media/video/ivtv/ivtvfb.c +++ b/drivers/media/video

Re: [patch -next] V4L: ivtv: remove unneeded NULL checks

On Fri, Jul 23, 2010 at 07:46:47AM -0400, Andy Walls wrote: On Fri, 2010-07-23 at 12:12 +0200, Dan Carpenter wrote: In ivtvfb_callback_cleanup() we dereference itv before checking that it's NULL. itv is assigned with container_of() which basically never returns a NULL pointer so the check

[patch] Staging: tm6000: fix problem in alsa init

assumed it was non-null in the other function and in fact it always is non-null with the current code. I removed these uneeded checks because it made writing this patch slightly simpler. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/staging/tm6000/tm6000-alsa.c b/drivers/staging

[patch] V4L/DVB: cx23885: reversed condition in dvb_register()

videobuf_dvb_register_bus() returns negative error codes on failure. This was introduced in e4425eab6b2: V4L/DVB: cx23885: Check register errors. Signed-off-by: Dan Carpenter erro...@gmail.com --- I don't have the hardware to test this, but it looks reversed. diff --git a/drivers/media/video

[patch] media/radio: fix copy_to_user to user handling

copy_to/from_user() returns the number of bytes remaining to be copied but the code here was testing for negative returns. I modified it to return -EFAULT. These functions are called from si4713_s_ext_ctrls() and that only tests for negative error codes. Signed-off-by: Dan Carpenter erro

[patch] V4L/DVB: dvb_ca_en50221: return -EFAULT on copy_to_user errors

copy_to_user() returns the number of bytes remaining to be copied which isn't the right thing to return here. The comments say that these functions in dvb_ca_en50221.c should return the number of bytes copied or an error return. I've changed it to return -EFAULT. Signed-off-by: Dan Carpenter

Re: [patch] V4L/DVB: dvb_ca_en50221: return -EFAULT on copy_to_user errors

OK to leave it. But I now recognize this as pure laziness on my part and I appologize. Twenty lashes for me and all that. Fixed patch coming up. ;) regards, dan carpenter -- To unsubscribe from this list: send the line unsubscribe linux-media in the body of a message to majord

[patch v2] V4L/DVB: dvb_ca_en50221: return -EFAULT on copy_to_user errors

copy_to_user() returns the number of bytes remaining to be copied which isn't the right thing to return here. The comments say that these functions in dvb_ca_en50221.c should return the number of bytes copied or an error return. I've changed it to return -EFAULT. Signed-off-by: Dan Carpenter

[patch] V4L/DVB: cpia_usb: remove unneeded variable

This is just a cleanup patch. We never use the udev variable so I have removed it. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/cpia_usb.c b/drivers/media/video/cpia_usb.c index ef1f893..58d193f 100644 --- a/drivers/media/video/cpia_usb.c +++ b/drivers/media

dereferencing uninitialized variable in anysee_probe()

-desc.bAlternateSetting); I'm not sure how to fix this. regards, dan carpenter -- To unsubscribe from this list: send the line unsubscribe linux-media in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html

Re: dereferencing uninitialized variable in anysee_probe()

On Mon, May 31, 2010 at 06:22:49PM +0300, Antti Palosaari wrote: Terve Dan, On 05/31/2010 06:09 PM, Dan Carpenter wrote: Hi I'm going through some smatch stuff and I had a question. drivers/media/dvb/dvb-usb/anysee.c +482 anysee_probe(30) warn: variable dereferenced before check 'd

[patch] V4L/DVB: remove unneeded null check in anysee_probe()

a comment and removed the unneeded null check. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/dvb/dvb-usb/anysee.c b/drivers/media/dvb/dvb-usb/anysee.c index faca1ad..aa5c7d5 100644 --- a/drivers/media/dvb/dvb-usb/anysee.c +++ b/drivers/media/dvb/dvb-usb/anysee.c @@ -463,6

[patch v4 1/2] video/saa7134: change dprintk() to i2cdprintk()

The problem is that dprintk() dereferences dev which is null here. The i2cdprintk() uses ir so that's OK. Also Jean Delvare pointed out a typo in the comment so we may as well fix that. Signed-off-by: Dan Carpenter erro...@gmail.com Acked-by: Jean Delvare kh...@linux-fr.org --- v2: Jean Delvare

[patch v3 2/2] video/saa7134: remove duplicate break

The original code had two break statements in a row. Signed-off-by: Dan Carpenter erro...@gmail.com --- v3: Put this in a seperate patch. diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c index e5565e2..7691bf2 100644 --- a/drivers/media

[patch v3 1/2] video/saa7134: change dprintk() to i2cdprintk()

The problem is that dprintk() dereferences dev which is null here. The i2cdprintk() uses ir so that's OK. Signed-off-by: Dan Carpenter erro...@gmail.com --- v2: Jean Delvare suggested that I use i2cdprintk() instead of modifying dprintk(). v3: V2 had a bonus cleanup that I removed from v3 diff

[patch v2] video/saa7134: change dprintk() to i2cdprintk()

The problem is that dprintk() dereferences dev which is null here. The i2cdprintk() uses ir so that's OK. Also removed a duplicated break statement. Signed-off-by: Dan Carpenter erro...@gmail.com --- v2: Jean Delvare suggested that I use i2cdprintk() instead of modifying dprintk(). diff --git

[patch] em28xx: remove unneeded null checks

The dev variable is used as a list cursor in a list_for_each_entry() loop and can never be null here so I removed the check. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c index 331e1ca..44c63cb

[patch] video/saa7134: potential null dereferences in debug code

I modified the dprintk and i2cdprintk macros to handle null dev and ir pointers. There are two couple places that call dprintk() when dev is null. One is in get_key_msi_tvanywhere_plus() and the other is in get_key_flydvb_trio(). Signed-off-by: Dan Carpenter erro...@gmail.com diff --git

[patch] media/ov511: cleanup: remove unneeded null check

We dereference ov unconditionally throughout the function so there is no way it can be NULL here. This code has been around for ages so if it were possible for ov to be NULL someone would have complained. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/ov511.c b

[patch -next 2/2] media/s2255drv: remove dead code

My concern initially was we dereference dev in the parameter list to s2255_dev_err() but it turns out that code path is never used. The s2255_stop_readpipe() is only called from one place and dev is never null. So this patch just removes the whole condition here. Signed-off-by: Dan Carpenter

[patch -next 1/2] media/s2255drv: return if vdev not found

The original code didn't handle the case where vdev was not found so I added a check for that. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c index ac9c40c..1f9a49e 100644 --- a/drivers/media/video/s2255drv.c +++ b

-next: staging/cx25821: please revert 7a02f549fcc

this is going through the V4L/DVB so it needs to be reverted there as well as in the -staging tree. Sorry for the inconvenience. regards, dan carpenter PS. The correct version is: 423f5c0d016 V4L/DVB (13955): cx25821: fix double unlock in medusa_video_init(). That one is needed and fixes a bug

Re: -next: staging/cx25821: please revert 7a02f549fcc

fold it into your patch? Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/staging/cx25821/cx25821-medusa-video.c b/drivers/staging/cx25821/cx25821-medusa-video.c index 7545314..34616dc 100644 --- a/drivers/staging/cx25821/cx25821-medusa-video.c +++ b/drivers/staging/cx25821

Re: [patch 10/11] ir-keytable: avoid double lock

On Mon, May 03, 2010 at 08:07:29PM -0300, Mauro Carvalho Chehab wrote: a...@linux-foundation.org wrote: From: Dan Carpenter erro...@gmail.com It's possible that we wanted to resize to a smaller size but we didn't have enough memory to create the new table. We need to test for that here

[patch -next 3/3] media/IR/imon: potential double unlock on error

If there is an error here we should unlock in the caller (which is imon_init_intf1()). We can remove this stray unlock. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c index b65c31a..d48ad6d 100644 --- a/drivers/media/IR/imon.c

[patch -next 1/3] media/IR/imon: precendence issue: ! vs ==

The original condition is always false because ! has higher precedence than == and neither 0 nor 1 is equal to IMON_DISPLAY_TYPE_VGA. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c index b65c31a..93b5796 100644 --- a/drivers/media/IR

[patch -next 2/3] media/IR/imon: testing the wrong variable

There is a typo here. We meant to test ir instead of props. The props variable was tested earlier. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c index b65c31a..f2066d0 100644 --- a/drivers/media/IR/imon.c +++ b/drivers/media/IR

[patch -next 1/2] media/az6027: doing dma on the stack

corrected yet. Btw. Smatch includes a pretty good test to find places which use stack memory as a dma buffer. That's how I found these. (http://smatch.sf.net). Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/dvb/dvb-usb/az6027.c b/drivers/media/dvb/dvb-usb/az6027.c index

[-next] [bug report] media/IR/imon: array overflow

== (code | 0xffee)) 1209 break; After the for loop i can be 0 to 21. 1210 1211 keycode = imon_panel_key_table[i % IMON_KEY_RELEASE_OFFSET].keycode; IMON_KEY_RELEASE_OFFSET is 1000 so it doesn't affect anything. regards, dan carpenter -- To unsubscribe from

[patch -next 1/2] media/az6027: handle -EIO failure

If the az6027_usb_in_op() returns a negative errno ret is -EIO and in that case the value of b[0] may be undefined. The original code assigned 0 to ret, but since it's already 0 now we can skip that. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/dvb/dvb-usb/az6027.c

Re: [PATCH] IR/imon: remove dead IMON_KEY_RELEASE_OFFSET

% IMON_KEY_RELEASE_OFFSET].keycode; + keycode = imon_panel_key_table[i].keycode; return keycode; } There is still potentially a problem here because if we don't hit the break statement, then we're one past the end of the array. regards, dan carpenter -- To unsubscribe from this list: send the line

[patch -next] input: unlock on error paths

We can't return here directly, we need to unlock the event_lock first. This was introduced in: edeada2cde V4L/DVB: input: Add support for EVIO[CS]GKEYCODEBIG Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/input/input.c b/drivers/input/input.c index e623edf..7c3fc5e 100644

[patch -next] media/mem2mem: dereferencing free memory

We dereferenced ctx on the error path. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c index baf211b..b161d26 100644 --- a/drivers/media/video/mem2mem_testdev.c +++ b/drivers/media/video/mem2mem_testdev.c

[patch] davinci: don't return under lock on error path

If the kmalloc() failed for ccdc_cfg = kmalloc(...); then we would exit with the lock held. I moved the mutex_lock() below the allocation because it isn't protecting anything in that block and allocations are allocations are sometimes slow. Signed-off-by: Dan Carpenter erro...@gmail.com diff

[patch] video: comparing unsigned with negative 0

soc_mbus_bytes_per_line() returns -EINVAL on error but we store it in an unsigned int so the test for less than zero doesn't work. I think it always returns small positive values so we can just cast it to int here. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video

[patch] cx231xx: improve error handling

Return -EINVAL if we don't find the control id. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/cx231xx/cx231xx-video.c b/drivers/media/video/cx231xx/cx231xx-video.c index d4f546f..5a74ef8 100644 --- a/drivers/media/video/cx231xx/cx231xx-video.c +++ b/drivers

[patch] cx88: improve error handling

Return -EINVAL if we don't find the right query control id. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c index 48c450f..b4c80cb 100644 --- a/drivers/media/video/cx88/cx88-video.c +++ b/drivers/media

[patch] ir-keytable: avoid double lock

It's possible that we wanted to resize to a smaller size but we didn't have enough memory to create the new table. We need to test for that here so we don't try to lock twice and dead lock. Also we free the oldkeymap on that path and that would be bad. Signed-off-by: Dan Carpenter erro

[patch] video/au0828: off by one bug

The AUVI_INPUT(tmp) macro uses tmp as an index of an array with AU0828_MAX_INPUT elements. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828/au0828-video.c index dc67bc4..19a5773 100644 --- a/drivers/media/video

[patch] video/s255drv: cleanup. remove uneeded NULL check

dev can never be NULL there so there is no need to check it. Also I made a couple of white space changes to the declaration of dev. This eliminates a smatch warning about checking for NULL after a dereference. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video

[patch] video/cx231xx: cleanup. remove unneed null checks

dev is never NULL here so there is no need to check. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/cx231xx/cx231xx-core.c b/drivers/media/video/cx231xx/cx231xx-core.c index 4a60dfb..866fb12 100644 --- a/drivers/media/video/cx231xx/cx231xx-core.c +++ b/drivers

[patch] video/zc0301: improve error handling

Return an error if the controller is not found. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/zc0301/zc0301_core.c b/drivers/media/video/zc0301/zc0301_core.c index e44e4b5..bb51cfb 100644 --- a/drivers/media/video/zc0301/zc0301_core.c +++ b/drivers/media/video

[patch] video/et61x251: improve error handling

The original code doesn't handle the situation where the controller is not found. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/et61x251/et61x251_core.c b/drivers/media/video/et61x251/et61x251_core.c index e6c23d5..a5cfc76 100644 --- a/drivers/media/video

[patch] video/sn9c102: improve error handling

Return an error if the controller is not found. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/sn9c102/sn9c102_core.c b/drivers/media/video/sn9c102/sn9c102_core.c index cbf8087..28e19da 100644 --- a/drivers/media/video/sn9c102/sn9c102_core.c +++ b/drivers/media

Re: [patch] video/sn9c102: improve error handling

Unfortunately, lkml.org puts some white space on the end of diffs. Patch complains but it still applies them fine. regards, dan carpenter -- To unsubscribe from this list: send the line unsubscribe linux-media in the body of a message to majord...@vger.kernel.org More majordomo info at http

Re: [PATCH 5/5] Staging: cx25821: fix coding style issues in cx25821-medusa-video.c

away problem + * when the input switching rate 16 fields + */ ^^^ Missing a space here. Otherwise looks good. Acked-by: Dan Carpenter erro...@gmail.com regard, dan carpenter -- To unsubscribe from this list: send the line unsubscribe linux-media

Re: [PATCH 5/5] Staging: cx25821: fix coding style issues in cx25821-medusa-video.c

On Tue, Mar 23, 2010 at 02:03:00PM +0300, Dan Carpenter wrote: On Mon, Mar 22, 2010 at 10:10:30PM +0200, Olimpiu Pascariu wrote: From 32591165a537a03f472c68289798044d6eeea2e0 Mon Sep 17 00:00:00 2001 From: Olimpiu Pascariu olimpiu.pasca...@gmail.com Date: Mon, 22 Mar 2010 22:07:20 +0200

[patch v2] em28xx: Empia Em28xx Audio too long

card-driver is 15 characters and a NULL. The original code goes past the end of the array. Signed-off-by: Dan Carpenter erro...@gmail.com --- V2: Takashi Iwai asked me to change the space to a hyphen since this is used as an identifier in alsa-lib. diff --git a/drivers/media/video/em28xx

[patch] cx23885: strcpy() = strlcpy()

cap-driver is a 16 char buffer and dev-name is a 32 char buffer. I don't see an actual problem, but we may as well make the static checkers happy. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c

Re: [PATCH 5/5] Staging: cx25821: fix coding style issues in cx25821-medusa-video.c

filed output if no video + * +*/ Missing a space there. Otherwise looks good. Acked-by: Dan Carpenter erro...@gmail.com regards, dan carpenter -- To unsubscribe from this list: send the line unsubscribe linux-media in the body of a message to majord...@vger.kernel.org More majordomo info

[patch v2] cx231xx: card-driver Conexant cx231xx Audio too long

card-driver is 15 characters and a NULL, the original code could cause a buffer overflow. Signed-off-by: Dan Carpenter erro...@gmail.com --- In version 2, I used a better name that Takashi Iwai suggested. diff --git a/drivers/media/video/cx231xx/cx231xx-audio.c b/drivers/media/video/cx231xx

Re: [patch v2] cx231xx: card-driver Conexant cx231xx Audio too long

On Mon, Mar 22, 2010 at 05:04:55PM +0100, Takashi Iwai wrote: At Mon, 22 Mar 2010 08:43:47 -0700, Joe Perches wrote: On Mon, 2010-03-22 at 18:39 +0300, Dan Carpenter wrote: card-driver is 15 characters and a NULL, the original code could cause a buffer overflow. In version 2, I

[patch] em28xx: Empia Em28xx Audio too long

card-driver is 15 characters and a NULL. The original code goes past the end of the array. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c index bd78338..530df0a 100644 --- a/drivers/media/video

[patch] cx231xx: card-driver Conexant cx231xx Audio too long

card-driver is 15 characters and a NULL, the original code could cause a buffer overflow. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/cx231xx/cx231xx-audio.c b/drivers/media/video/cx231xx/cx231xx-audio.c index 7793d60..b3282ae 100644 --- a/drivers/media

[patch] ivtv: sizeof() = ARRAY_SIZE()

This fixes a smatch warning: drivers/media/video/ivtv/ivtv-vbi.c +138 ivtv_write_vbi(43) error: buffer overflow 'vi-cc_payload' 256 = 1023 Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/ivtv/ivtv-vbi.c b/drivers/media/video/ivtv/ivtv-vbi.c index f420d31

[patch] omap24xxcam: potential buffer overflow

The previous loop goes until last == VIDEO_MAX_FRAME, so this could potentially go one past the end of the loop. Signed-off-by: Dan Carpenter erro...@gmail.com diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c index 142c327..bedbee9 100644 --- a/drivers/media

smatch on V4L/DVB updates

). Eventually, the goal is to start testing linux-next using smatch but it could be a couple months yet because I'm going to be on the road for a while. regards, dan carpenter drivers/media/dvb/dvb-usb/az6027.c +1043 az6027_identify_state(6) error: doing dma on the stack (b) drivers/media/dvb

Re: [PATCH] input: imon driver for SoundGraph iMON/Antec Veris IR devices

/input/misc/imon.c +1979 imon_probe(383) error: double unlock 'mutex:context-lock' drivers/input/misc/imon.c +1983 imon_probe(387) error: double unlock 'mutex:context-lock' It sometimes unlocks both before and after the goto. regards, dan carpenter -- To unsubscribe from this list: send the line

[patch] cx25821: fix double unlock in medusa_video_init()

medusa_set_videostandard() takes the lock but it always drops it before returning. This was found with a static checker and compile tested only. :/ Signed-off-by: Dan Carpenter erro...@gmail.com --- orig/drivers/staging/cx25821/cx25821-medusa-video.c 2009-12-28 09:13:01.0 +0200

[patch] fix weird array index in zl10036.c

I was initially concerned about the weird array index (the 2 bumps into the next row of the array). Matthias Schwarzott look at the datasheet and it turns out it should be zl10036_init_tab[1][0] |= 0x01; Signed-off-by: Dan Carpenter erro...@gmail.com --- orig/drivers/media/dvb/frontends/zl10036

weird array index in zl10036.c

*/ 410 state-br = 0xff; 411 state-bf = 0xff; 412 413 if (!state-config-rf_loop_enable) 414 zl10036_init_tab[1][2] |= 0x01; This seems like an off by one error. I think it maybe should say zl10036_init_tab[1][1] |= 0x01;? regards, dan

passing stack variables to usb_control_msg()

I saw a patch earlier from Johan Hovold which said you shouldn't pass stack variables to usb_control_msg() so I used smatch to do an audit. Here are the results for 2.6.33-rc1 + Johan's patch. regards, dan carpenter drivers/media/dvb/dvb-usb/a800.c +82 a800_rc_query(3) error: doing dma

bttv locking problem

== VIDEOBUF_DONE || 3198 buf-vb.state == VIDEOBUF_ERROR) 3199 rc = POLLIN|POLLRDNORM; 3200 else 3201 rc = 0; 3202 err: 3203 mutex_unlock(fh-cap.vb_lock); regards, dan carpenter -- To unsubscribe from this list: send the line

[patch] ov511.c typo: lock = unlock

. Signed-off-by: Dan Carpenter erro...@gmail.com --- orig/drivers/media/video/ov511.c2009-11-29 14:44:46.0 +0200 +++ devel/drivers/media/video/ov511.c 2009-11-29 14:44:57.0 +0200 @@ -5878,7 +5878,7

Re: [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame

starting with @@ into 2 lines so the patch doesn't apply. Could you resend the patch without line wrapping? regards, dan carpenter -- To unsubscribe from this list: send the line unsubscribe linux-media in the body of a message to majord...@vger.kernel.org More majordomo info at http

double unlock in bttv_poll() and in saa7134-video.c

rc = 0; 3200 err: 3201 mutex_unlock(fh-cap.vb_lock); I looked at the code but I wasn't sure what the correct way to fix it is. video_poll() from drivers/media/video/saa7134/saa7134-video.c has the same issue. regards, dan carpenter -- To unsubscribe from this list

potential null deref in mpeg_open()

(level, fmt, arg...)\ 60 do { if (v4l_debug = level) \ 61 printk(KERN_DEBUG %s: fmt, dev-name , ## arg);\ 62 } while (0) regards, dan carpenter -- To unsubscribe from this list: send the line unsubscribe linux-media in the body of a message to majord

<    2   3   4   5   6   7