[bug report] media: v4l2-flash-led-class: Create separate sub-devices for indicators

n led_set_flash_strobe(fled_cdev, false); ^ but we had an old unchecked dereference here. 211 case V4L2_FLASH_LED_MODE_FLASH: 212 /* Turn the torch LED off */ regards, dan carpenter

[bug report] [media] vp702x: comment dead code

dev); 140 break; 141 default: 142 break; 143 } regards, dan carpenter

Re: [PATCH 1/2] [media] vb2: Fix an off by one error in 'vb2_plane_vaddr'

mework") Fixes tags are always good too have btw. You should be adding them by default to everything even if it doesn't get backported to stable. regards, dan carpenter

[PATCH 2/2] [media] dib0700: fix error handling in dib0700_i2c_xfer_legacy()

Mostly this adds some unlocks to error paths. But, if you see where there were "break;" statements before, I changed those paths to return error codes instead of returning success. Signed-off-by: Dan Carpenter diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/u

[PATCH 1/2] [media] dib0700: fix locking in dib0700_i2c_xfer_new()

This patch mostly adds unlocks to error paths. But one additional small change is that I made the first "break;" a "goto unlock;" which means that now we return failure instead of success on that path. Signed-off-by: Dan Carpenter diff --git a/drivers/media/usb/dvb-u

[PATCH] staging/atomisp: fix && vs || typos

These sanity checks don't work because they use && instead of ||. It's impossible to be both negative and greater than 5. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Dan Carpenter diff --git a/drivers/staging/

Re: [V1] staging : media : fixed macro expansion error

size, mask, check) > \ > +property_read(prop, size, mask)) breaks the build. regards, dan carpenter

Re: [PATCH] staging/media/atomisp/platform/intel-mid change spaces to tabs and comma/assignment space padding

in_subdev *gs; > -struct i2c_client *client = v4l2_get_subdevdata(subdev); > + struct i2c_client *client = v4l2_get_subdevdata(subdev); Wut? How would this be correct? regards, dan carpenter

Re: [PATCH] Fix spaces ERROR in atomisp_gmin_platform.c

uot;, > + port, lanes, bayer_order); This introduces a checkpatch.pl warning. Do it like this: [tab][tab][tab][space]"camera pdata: port: %d lanes: %d order: %8.8x\n", regards, dan carpenter

[PATCH 1/2] staging/atomisp: one char read beyond end of string

We should verify that "ix < max_len" before we test whether we have reached the NUL terminator. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Reported-by: David Binderman Signed-off-by: Dan Carpenter diff --git a/drivers/staging/media/atomi

Re: [PATCH 1/2] staging/atomisp: one char read beyond end of string

Oops. Please ignore this one. I meant to send it to David Binderman's thread. regards, dan carpenter

[PATCH 1/2] staging/atomisp: one char read beyond end of string

We should verify that "ix < max_len" before we test whether we have reached the NUL terminator. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Reported-by: David Binderman Signed-off-by: Dan Carpenter diff --git a/drivers/staging/media/atomi

[PATCH 2/2] staging/atomisp: putting NULs in the wrong place

support for the Intel IPU v2") Signed-off-by: Dan Carpenter diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/string_support.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/string_support.h index 74b5a1c7ac9a..c53241a7a281 1

Re: [PATCH 2/2] staging/atomisp: putting NULs in the wrong place

On Mon, May 15, 2017 at 12:21:45PM +0200, walter harms wrote: > can this strcpy_s() replaced with strlcpy ? > These functions obviously should be removed, yes. Please send a patch for that and we can drop my patches. Give David reported-by credit. regards, dan carpenter

[PATCH] atomisp2: off by one in atomisp_s_input()

ning -EINVAL a few lines later because the .camera pointer is NULL. Signed-off-by: Dan Carpenter diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c index 6064bb823a47..aa0526ebaff1 100644 --- a/drivers/staging/m

[ragnatech:media-tree 2807/2822] drivers/media/i2c/imx274.c:659 imx274_regmap_util_write_table_8() error: uninitialized symbol 'err'.

tree: git://git.ragnatech.se/linux media-tree head: bbae615636155fa43a9b0fe0ea31c678984be864 commit: 0985dd306f727df6c0e71cd8a8eda93e8fa5206e [2807/2822] media: imx274: V4l2 driver for Sony imx274 CMOS sensor drivers/media/i2c/imx274.c:659 imx274_regmap_util_write_table_8() error: uninitiali

[PATCH] [media] cpia2: Fix a couple off by one bugs

support") Signed-off-by: Dan Carpenter diff --git a/drivers/media/usb/cpia2/cpia2_v4l.c b/drivers/media/usb/cpia2/cpia2_v4l.c index 3dedd83f0b19..a1c59f19cf2d 100644 --- a/drivers/media/usb/cpia2/cpia2_v4l.c +++ b/drivers/media/usb/cpia2/cpia2_v4l.c @@ -808,7 +808,7 @@ static int cpia2_q

Re: [PATCH v4 3/5] staging: Introduce NVIDIA Tegra video decoder driver

; > + > > + return 0; > > if (!err) > return 0; > > and then remove a check above. > Argh Success handling. Always do failure handling, never success handling. The rest of your comments I agree with, though. regards, dan carpenter

Re: [PATCH v2 1/3] media: staging: atomisp: fix for sparse "using plain integer as NULL pointer" warnings.

t's still stinking up the living room. We should leave the warning there until it irritates someone enough to fix it properly. regards, dan carpenter

Re: [PATCH v2 1/3] media: staging: atomisp: fix for sparse "using plain integer as NULL pointer" warnings.

On Tue, Nov 28, 2017 at 11:33:37PM +, Jeremy Sowden wrote: > On 2017-11-28, at 17:15:24 +0300, Dan Carpenter wrote: > > On Mon, Nov 27, 2017 at 12:44:48PM +, Jeremy Sowden wrote: > > > The "address" member of struct ia_css_host_data is a > > > point

[bug report] media: dvb_frontend: cleanup ioctl handling logic

default: 2466 return -ENOTSUPP; 2467 } /* switch */ 2468 2469 return err; ^^ 2470 } regards, dan carpenter

Re: [PATCH 1/3] media: atomisp: convert default struct values to use compound-literals with designated initializers.

I can't apply this (to today's linux-next) but does this really work: > +(struct ia_css_3a_grid_info) { \ > + .ae_enable = 0, \ > + .ae_grd_info= (struct ae_public_config_grid_config) { \ > + width = 0, \ > +

Re: [PATCH v2 1/3] media: atomisp: convert default struct values to use compound-literals with designated initializers.

= DEFAULT_SHADING_INFO, \ > + .grid_info = DEFAULT_GRID_INFO, \ > + .num_invalid_frames = 0 \ > + } \ > +) We need to get better compile test coverage on this... :/ There are some others as well. regards, dan carpenter

Re: [PATCH v2 1/3] media: atomisp: convert default struct values to use compound-literals with designated initializers.

On Sat, Dec 02, 2017 at 08:41:48PM +, Jeremy Sowden wrote: > On 2017-12-02, at 10:35:06 +, Jeremy Sowden wrote: > > On 2017-12-02, at 13:20:09 +0300, Dan Carpenter wrote: > > > On Fri, Dec 01, 2017 at 05:19:37PM +, Jeremy Sowden wrote: > > > &

[PATCH] media: imx274: Silence uninitialized variable warning

Smatch complains that "err" can be uninitialized if we have a zero size write. The flow analysis is a little complicated so I'm not sure if that's possible or not, but it's harmless to set this to zero and it makes the code easier to read. Signed-off-by: Dan Carpent

[bug report] media: lirc: improve locking

long wait? Are you sure you want to hold the lock this whole time? 368 } 369 } 370 371 out: 372 mutex_unlock(&dev->lock); 373 kfree(txbuf); ^ Can't pass an error pointer to kfree(). 374 kfree(raw); regards, dan carpenter

[bug report] drx: add initial drx-d driver

ck the return. Anyway, it's more clear to just "return 0;" 1306 } 1307 return -1; ^^ -1 is not a proper error code. 1308 } regards, dan carpenter

[patch] [media] av7110: make array offset unsigned

return -EINVAL; 282 av7110->ci_slot[info->num].num = info->num; Let's just make it unsigned. Signed-off-by: Dan Carpenter --- Compile tested. diff --git a/include/linux/dvb/ca.h b/include/linux/dvb/ca.h index c18537f..647015e 100644 --- a/include/linux/dvb/ca.h +++

[patch v2] [media] av7110: check for negative array offset

info->num comes from the user. It's type int. If the user passes in a negative value that would cause memory corruption. Signed-off-by: Dan Carpenter --- V2: change the check instead of making num and unsigned int diff --git a/drivers/media/dvb/ttpci/av7110_ca.c b/drivers/media/d

Re: [patch] [media] av7110: make array offset unsigned

to an unsigned int in the userspace API? Who would notice? (I'm still quite a newbie at system programming). regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majord...@vger.kernel.org More majordo

[patch v3] [media] av7110: check for negative array offset

info->num comes from the user. It's type int. If the user passes in a negative value that would cause memory corruption. Signed-off-by: Dan Carpenter --- V2: change the check instead of making num and unsigned int V3: white space changes diff --git a/drivers/media/dvb/ttpci/av7110

[patch 1/2] [media] dib8000: fix small memory leak on error

kfree(state) if fe allocation fails. Signed-off-by: Dan Carpenter diff --git a/drivers/media/dvb/frontends/dib8000.c b/drivers/media/dvb/frontends/dib8000.c index 3e20aa8..c1c3e26 100644 --- a/drivers/media/dvb/frontends/dib8000.c +++ b/drivers/media/dvb/frontends/dib8000.c @@ -2514,7 +2514,7

[patch 1/2] [media] dib9000: fix return type in dib9000_mbx_send_attr()

dib9000_mbx_send_attr() returns an int. It doesn't work to save negative error codes in an unsigned char, so I've made "ret" an int type. Signed-off-by: Dan Carpenter diff --git a/drivers/media/dvb/frontends/dib9000.c b/drivers/media/dvb/frontends/dib9000.c index 43fb6e4..

Re: [PATCH] video/saa7164: Fix sparse warning: Using plain integer as NULL pointer

r of years ago) being told that for things like kmalloc, > the proper test was !x, not x == NULL. > It was Al Viro who said that. Here's the link. http://lwn.net/Articles/331593/ regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe

[patch] [media] stv090x: handle allocation failures

kmalloc() can fail so check whether state->internal is NULL. append_internal() can return NULL on allocation failures so check that. Also if we hit the error condition later in the function then there is a memory leak and we need to call remove_dev() to fix it. Signed-off-by: Dan Carpen

[patch v2] [media] stv090x: handle allocation failures

an additional leak that I missed in the first version of this patch. Signed-off-by: Dan Carpenter --- v2: Fix the leak Oliver noticed. diff --git a/drivers/media/dvb/frontends/stv090x.c b/drivers/media/dvb/frontends/stv090x.c index d3362d0..41d0f0a 100644 --- a/drivers/media/dvb/fronte

[patch 1/2] [media] stv0367: signedness bug in stv0367_get_tuner_freq()

We use err to store negative error codes so it should be signed. And if we return an error from stv0367_get_tuner_freq() that needs to be handled properly as well. (param->frequency is a u32). Signed-off-by: Dan Carpenter diff --git a/drivers/media/dvb/frontends/stv0367.c b/drivers/media/

[patch 2/2] [media] stv0367: typo in function parameter

The CellsCoeffs arrays are [3][6][5] not [2][6][5]. Signed-off-by: Dan Carpenter diff --git a/drivers/media/dvb/frontends/stv0367.c b/drivers/media/dvb/frontends/stv0367.c index 7117ce9..ec9de40 100644 --- a/drivers/media/dvb/frontends/stv0367.c +++ b/drivers/media/dvb/frontends/stv0367.c

[patch] media: ir-keytable: null dereference in debug code

"ir_dev->props" can be NULL. We only use raw mode if "ir_dev->props" is non-NULL and "ir_dev->props->driver_type == RC_DRIVER_IR_RAW". Signed-off-by: Dan Carpenter diff --git a/drivers/media/IR/ir-keytable.c b/drivers/media/IR/ir-keytable.c index 15a0

[patch] V4L/DVB: unlock on error path

If we return directly here then we miss out on some mutex_unlock()s Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c index b151c7b..1beb226 100644 --- a/drivers/media/video/s5p-fimc/fimc-core.c +++ b/drivers/media

[patch] IR: ene_ir: problems in unwinding on probe

There were a couple issues here. If the allocation failed for "dev" then it would lead to a NULL dereference. If request_irq() or request_region() failed it would release the irq and the region even though they were not successfully aquired. Signed-off-by: Dan Carpenter diff --git

[patch] IR: ir-raw-event: null pointer dereference

The original code dereferenced ir->raw after freeing it and setting it to NULL. Signed-off-by: Dan Carpenter diff --git a/drivers/media/IR/ir-raw-event.c b/drivers/media/IR/ir-raw-event.c index 43094e7..8e0e1b1 100644 --- a/drivers/media/IR/ir-raw-event.c +++ b/drivers/media/IR/ir-raw-even

Re: [patch] IR: ene_ir: problems in unwinding on probe

On Thu, Aug 12, 2010 at 05:35:04PM +0300, Maxim Levitsky wrote: > On Thu, 2010-08-12 at 09:46 +0200, Dan Carpenter wrote: > > There were a couple issues here. If the allocation failed for "dev" > > then it would lead to a NULL dereference. If request_irq() or >

[patch] V4L/DVB: opera1: remove unneeded NULL check

"fw" is always a non-NULL pointer at this point, and anyway release_firmware() accepts NULL pointers. Signed-off-by: Dan Carpenter diff --git a/drivers/media/dvb/dvb-usb/opera1.c b/drivers/media/dvb/dvb-usb/opera1.c index 6b22ec6..f896337 100644 --- a/drivers/media/dvb/dvb-usb/oper

[patch] V4L/DVB: pvrusb2: remove unneeded NULL checks

We dereference "maskptr" unconditionally at the start of the function and also inside the call to parse_tlist() towards the end of the function. This function is called from store_val_any() and it always passes a non-NULL pointer. Signed-off-by: Dan Carpenter diff --git a/drivers/m

[patch] V4L/DVB: saa7164: move dereference under NULL check

at lead to this issue in the first place.) There is only one caller for this function and it passes non-NULL pointers, so this is essentially a cleanup rather than a bugfix. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/saa7164/saa7164-buffer.c b/drivers/media/video/saa7164

[patch] V4L/DVB: saa7134: add test after for loop

Add a check after the for loops to see if we found what we were looking for or if we reached the end of the list. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/saa7134/saa7134-video.c b/drivers/media/video/saa7134/saa7134-video.c index 45f0ac8..24c3a78 100644 --- a/drivers

[patch -next] V4L/DVB: IR/streamzap: fix usec to nsec conversion

original code had a deadline of 1.005 seconds and the new code has a deadline of .065 seconds. Signed-off-by: Dan Carpenter diff --git a/drivers/media/IR/streamzap.c b/drivers/media/IR/streamzap.c index 2cf57e6..d5d3cee 100644 --- a/drivers/media/IR/streamzap.c +++ b/drivers/media/IR/streamzap.c

[patch] V4L/DVB: cx88: uninitialized variable

Fixes a gcc warning: drivers/media/video/cx88/cx88-video.c:772: warning: ‘core’ may be used uninitialized in this function Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c index 19c64a7..c19ec71 100644 --- a

[patch] V4L/DVB: cx231xx: fix double lock typo

This was supposed to be an unlock on the error path. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/cx231xx/cx231xx-i2c.c b/drivers/media/video/cx231xx/cx231xx-i2c.c index cce74e5..8356706 100644 --- a/drivers/media/video/cx231xx/cx231xx-i2c.c +++ b/drivers/media/video/cx231xx

[patch 1/3] V4L/DVB: s5p-fimc: add unlock on error path

There was an unlock missing if kzalloc() failed. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c index 1802701..8335045 100644 --- a/drivers/media/video/s5p-fimc/fimc-core.c +++ b/drivers/media/video/s5p-fimc/fimc

[patch 3/3] V4L/DVB: s5p-fimc: dubious one-bit signed bitfields

These are signed so instead of being 1 and 0 as intended they are -1 and 0. It doesn't cause a bug in the current code but Sparse warns about it: drivers/media/video/s5p-fimc/fimc-core.h:226:28: error: dubious one-bit signed bitfield Signed-off-by: Dan Carpenter diff --git a/dr

[patch 2/3] V4L/DVB: s5p-fimc: make it compile

’: drivers/media/video/s5p-fimc/fimc-core.c:286: error: ‘TASK_NORMAL’ undeclared (first use in this function) Signed-off-by: Dan Carpenter --- Compile tested only. :P diff --git a/drivers/media/video/s5p-fimc/fimc-core.h b/drivers/media/video/s5p

Re: [patch 2/3] V4L/DVB: s5p-fimc: make it compile

eeds a separate patch so I could handle it and add you > as reported by it is OK. > I thought it was probably a merge conflict. Thanks for taking care of this. regards, dan carpenter > Regards, > Sylwester > > > ret = fimc_register_m2m_device(fimc); > > if

Re: [patch 3/3] V4L/DVB: s5p-fimc: dubious one-bit signed bitfields

On Fri, Oct 22, 2010 at 09:10:57AM +0200, Sylwester Nawrocki wrote: > > -Original Message- > > From: Dan Carpenter [mailto:erro...@gmail.com] > > Sent: Thursday, October 21, 2010 9:24 PM > > To: Mauro Carvalho Chehab > > Cc: Kyungmin Park; Sylwester Nawrocki;

Re: [PATCH] dvb-core: Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame

oke the line starting with @@ into 2 lines so the patch doesn't apply. Could you resend the patch without line wrapping? regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majord...@vger.kernel.org M

bttv locking problem

done, wait); 3197 if (buf->vb.state == VIDEOBUF_DONE || 3198 buf->vb.state == VIDEOBUF_ERROR) 3199 rc = POLLIN|POLLRDNORM; 3200 else 3201 rc = 0; 3202 err: 3203 mutex_unlock(&fh->cap.vb_lock); regard

[patch] ov511.c typo: lock => unlock

. Signed-off-by: Dan Carpenter --- orig/drivers/media/video/ov511.c2009-11-29 14:44:46.0 +0200 +++ devel/drivers/media/video/ov511.c 2009-11-29 14:44:57.0 +0200 @@ -5878,7 +5878,7 @@ ov51x_probe

passing stack variables to usb_control_msg()

I saw a patch earlier from Johan Hovold which said you shouldn't pass stack variables to usb_control_msg() so I used smatch to do an audit. Here are the results for 2.6.33-rc1 + Johan's patch. regards, dan carpenter drivers/media/dvb/dvb-usb/a800.c +82 a800_rc_query(3) error: doing

weird array index in zl10036.c

*/ 410 state->br = 0xff; 411 state->bf = 0xff; 412 413 if (!state->config->rf_loop_enable) 414 zl10036_init_tab[1][2] |= 0x01; This seems like an off by one error. I think it maybe should say zl10036_init_tab[1][1] |= 0x01;?

[patch] cx25821: fix double unlock in medusa_video_init()

medusa_set_videostandard() takes the lock but it always drops it before returning. This was found with a static checker and compile tested only. :/ Signed-off-by: Dan Carpenter --- orig/drivers/staging/cx25821/cx25821-medusa-video.c 2009-12-28 09:13:01.0 +0200 +++ devel/drivers

[patch] fix weird array index in zl10036.c

I was initially concerned about the weird array index (the 2 bumps into the next row of the array). Matthias Schwarzott look at the datasheet and it turns out it should be zl10036_init_tab[1][0] |= 0x01; Signed-off-by: Dan Carpenter --- orig/drivers/media/dvb/frontends/zl10036.c 2009-12-28 19

Re: [PATCH] input: imon driver for SoundGraph iMON/Antec Veris IR devices

ch over the entire kernel (me). drivers/input/misc/imon.c +1979 imon_probe(383) error: double unlock 'mutex:&context->lock' drivers/input/misc/imon.c +1983 imon_probe(387) error: double unlock 'mutex:&context->lock' It sometimes unlocks both before and after t

Re: [PATCH] tm6000: fix vbuf may be used uninitialized

NULL; > unsigned int linewidth; > This looks like a real bug versus just a GCC warning. It was introduced in 8aff8ba95155df "[media] tm6000: add radio support to the driver". I've added Dmitri to the CC list. regards, dan carpenter -- To unsubscribe from this list:

[PATCH 1/6] [media] pvrusb2: white space changes

"{" char was on its own line but it wasn't the start of a function. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/pvrusb2/pvrusb2-std.c b/drivers/media/video/pvrusb2/pvrusb2-std.c index ca9f83a..a5d4867 100644 --- a/drivers/media/video/pvrusb2/pvrusb2-std.c +++ b/driv

[PATCH 2/6] [media] pvrusb2: fix remaining checkpatch.pl complaints

* Include instead of . * Remove unneeded curly braces. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/pvrusb2/pvrusb2-std.c b/drivers/media/video/pvrusb2/pvrusb2-std.c index a5d4867..370a9ab 100644 --- a/drivers/media/video/pvrusb2/pvrusb2-std.c +++ b/drivers/media/video

[PATCH 3/6] [media] pvrusb2: check for allocation failures

This function returns NULL on failure so lets do that if kzalloc() fails. There is a separate problem that the caller for this function doesn't check for errors... Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/pvrusb2/pvrusb2-std.c b/drivers/media/video/pvrusb2/pvrusb2-

[PATCH 4/6] [media] pvrusb2: fix camel case variables

This patch renames some variables to bring them more in line with kernel CodingStyle. arrPtr => arr arrSize => arr_size bufPtr => buf bufSize => buf_size Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/pvrusb2/pvrusb2-std.c b/drivers/media/video/pvrusb2/pvrusb2

[PATCH 5/5] [media] pvrusb2: delete generic_standards_cnt

The generic_standards_cnt define is only used in one place and it's more readable to just call ARRAY_SIZE(generic_standards) directly. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/pvrusb2/pvrusb2-std.c b/drivers/media/video/pvrusb2/pvrusb2-std.c index d5a679f..9bebc08 1

[PATCH 6/6] [media] pvrusb2: replace !0 with 1

Using !0 is less readable than just saying 1. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/pvrusb2/pvrusb2-std.c b/drivers/media/video/pvrusb2/pvrusb2-std.c index 9bebc08..ca4f67b 100644 --- a/drivers/media/video/pvrusb2/pvrusb2-std.c +++ b/drivers/media/video/pvrusb2/pvrusb2

Re: [PATCH 3/6] [media] pvrusb2: check for allocation failures

On Fri, Mar 25, 2011 at 11:33:36PM -0500, Mike Isely wrote: > > Acked-By: Mike Isely > I'd need to reformat this one to get it to apply... :/ It doesn't actually fix the bug so it's not worth it. regards, dan carpenter -- To unsubscribe from this list: send the line

Re: [PATCH] tm6000: fix vbuf may be used uninitialized (Dmitri please read)

;real bug" I > am missing there? (Or did I already miss a patch posted to linux-media > addressing it?) > My laptop was stolen so I can't review code for the next couple weeks. I remember that I thought your patch looked correct, but I was hoping that Dmitri would Ack it. r

[bug report] cxd2820r: dynamically allocated arrays

20r_core.c:743:28: error: bad constant expression drivers/media/dvb/frontends/cxd2820r_core.c:748:32: error: cannot size expression drivers/media/dvb/frontends/cxd2820r_core.c:762:31: error: cannot size expression CC [M] drivers/media/dvb/frontends/cxd2820r_core.o regards, dan carpe

[patch] [media] DVB: dvb_frontend: off by one in dtv_property_dump()

If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the array. Signed-off-by: Dan Carpenter diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c index 9827804..607e293 100644 --- a/drivers/media/dvb/dvb-core/dvb_frontend.c +++ b/driv

[patch] [media] rc: double unlock in rc_register_device()

If change_protocol() fails and we goto out_raw, then it calls unlock twice. I noticed that the other time we called change_protocol() we held the &dev->lock, so I changed it to hold it here too. Signed-off-by: Dan Carpenter --- Compile tested only. diff --git a/drivers/media/rc/rc-m

[patch] [media] rc/redrat3: dereferencing null pointer

In the original code, if the allocation failed we dereference "rr3" when it was NULL. Signed-off-by: Dan Carpenter diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c index 5147767..4582ef7 100644 --- a/drivers/media/rc/redrat3.c +++ b/drivers/media/rc/redrat3.c

potential null deref in mpeg_open()

17.c 59 #define dprintk(level, fmt, arg...)\ 60 do { if (v4l_debug >= level) \ 61 printk(KERN_DEBUG "%s: " fmt, dev->name , ## arg);\ 62 } while (0) regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscr

double unlock in bttv_poll() and in saa7134-video.c

M; 3198 else 3199 rc = 0; 3200 err: 3201 mutex_unlock(&fh->cap.vb_lock); I looked at the code but I wasn't sure what the correct way to fix it is. video_poll() from drivers/media/video/saa7134/saa7134-video.c has the same issue. regards, dan

[patch] Staging: tm6000: remove unneeded check in get_next_buf()

We dereference "buf" on the line before so if it were NULL here we would have OOPsed earlier. Also list_entry() never returns NULL. And finally, we handled the situation where the list is empty earlier in the function. So this test isn't needed and I've removed it. Signed-o

[patch] [media] pwc: precedence bug in pwc_init_controls()

'!' has higher precedence than '&' so we need parenthesis here. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/pwc/pwc-v4l.c b/drivers/media/video/pwc/pwc-v4l.c index e9a0e94..8c70e64 100644 --- a/drivers/media/video/pwc/pwc-v4l.c +++ b/drivers/m

Re: vp702x

On Thu, Aug 04, 2011 at 12:21:29PM +0200, Florian Mickler wrote: > Mauro, what to do? Apply the fix which Tino tested, perhaps? :P (obviously). The bug is present in 3.0 so it should be tagged for stable as well. regards, dan carpenter -- To unsubscribe from this list: send the l

Re: [patch 10/11] ir-keytable: avoid double lock

On Mon, May 03, 2010 at 08:07:29PM -0300, Mauro Carvalho Chehab wrote: > a...@linux-foundation.org wrote: > > From: Dan Carpenter > > > > It's possible that we wanted to resize to a smaller size but we didn't > > have enough memory to create the new table.

[patch -next 3/3] media/IR/imon: potential double unlock on error

If there is an error here we should unlock in the caller (which is imon_init_intf1()). We can remove this stray unlock. Signed-off-by: Dan Carpenter diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c index b65c31a..d48ad6d 100644 --- a/drivers/media/IR/imon.c +++ b/drivers/media

[patch -next 1/3] media/IR/imon: precendence issue: ! vs ==

The original condition is always false because ! has higher precedence than == and neither 0 nor 1 is equal to IMON_DISPLAY_TYPE_VGA. Signed-off-by: Dan Carpenter diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c index b65c31a..93b5796 100644 --- a/drivers/media/IR/imon.c +++ b

[patch -next 2/3] media/IR/imon: testing the wrong variable

There is a typo here. We meant to test "ir" instead of "props". The "props" variable was tested earlier. Signed-off-by: Dan Carpenter diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c index b65c31a..f2066d0 100644 --- a/drivers/media/IR/imon.c

[patch -next 1/2] media/az6027: doing dma on the stack

ch haven't been corrected yet. Btw. Smatch includes a pretty good test to find places which use stack memory as a dma buffer. That's how I found these. (http://smatch.sf.net). Signed-off-by: Dan Carpenter diff --git a/drivers/media/dvb/dvb-usb/az6027.c b/drivers/media/dvb/dvb-u

[-next] [bug report] media/IR/imon: array overflow

panel_key_table[i].hw_code == (code | 0xffee)) 1209 break; After the for loop i can be 0 to 21. 1210 1211 keycode = imon_panel_key_table[i % IMON_KEY_RELEASE_OFFSET].keycode; IMON_KEY_RELEASE_OFFSET is 1000 so it doesn't affect anything. regards,

[patch -next 1/2] media/az6027: handle -EIO failure

If the az6027_usb_in_op() returns a negative errno ret is -EIO and in that case the value of b[0] may be undefined. The original code assigned 0 to ret, but since it's already 0 now we can skip that. Signed-off-by: Dan Carpenter diff --git a/drivers/media/dvb/dvb-usb/az6027.c b/drivers/

Re: [PATCH] IR/imon: remove dead IMON_KEY_RELEASE_OFFSET

nel_key_table[i % IMON_KEY_RELEASE_OFFSET].keycode; > + keycode = imon_panel_key_table[i].keycode; > > return keycode; > } There is still potentially a problem here because if we don't hit the break statement, then we're one past the end of the array. regards, dan carpenter -- To

[patch -next] input: unlock on error paths

We can't return here directly, we need to unlock the event_lock first. This was introduced in: edeada2cde "V4L/DVB: input: Add support for EVIO[CS]GKEYCODEBIG" Signed-off-by: Dan Carpenter diff --git a/drivers/input/input.c b/drivers/input/input.c index e623edf..7c3fc5e 10064

[patch -next] dvb/stv6110x: cleanup error handling

The "stv6110x" is NULL so we can just return directly without calling kfree(). Also I changed the printk() to make checkpatch.pl happy. Signed-off-by: Dan Carpenter diff --git a/drivers/media/dvb/frontends/stv6110x.c b/drivers/media/dvb/frontends/stv6110x.c index 2f9cd24..42591ce 10

[patch -next] media/mem2mem: dereferencing free memory

We dereferenced "ctx" on the error path. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c index baf211b..b161d26 100644 --- a/drivers/media/video/mem2mem_testdev.c +++ b/drivers/media/video/mem2mem_testdev.c

[patch] media/ov511: cleanup: remove unneeded null check

We dereference "ov" unconditionally throughout the function so there is no way it can be NULL here. This code has been around for ages so if it were possible for "ov" to be NULL someone would have complained. Signed-off-by: Dan Carpenter diff --git a/drivers/media/vid

[patch -next 2/2] media/s2255drv: remove dead code

My concern initially was we dereference "dev" in the parameter list to s2255_dev_err() but it turns out that code path is never used. The s2255_stop_readpipe() is only called from one place and "dev" is never null. So this patch just removes the whole condition here.

[patch -next 1/2] media/s2255drv: return if vdev not found

The original code didn't handle the case where vdev was not found so I added a check for that. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c index ac9c40c..1f9a49e 100644 --- a/drivers/media/video/s2255drv.c +++ b/drivers/media/

-next: staging/cx25821: please revert 7a02f549fcc

ideo_init()" I guess this is going through the V4L/DVB so it needs to be reverted there as well as in the -staging tree. Sorry for the inconvenience. regards, dan carpenter PS. The correct version is: 423f5c0d016 "V4L/DVB (13955): cx25821: fix double unlock in medusa_video_init()".

Re: -next: staging/cx25821: please revert 7a02f549fcc

y you can fold it into your patch? Signed-off-by: Dan Carpenter diff --git a/drivers/staging/cx25821/cx25821-medusa-video.c b/drivers/staging/cx25821/cx25821-medusa-video.c index 7545314..34616dc 100644 --- a/drivers/staging/cx25821/cx25821-medusa-video.c +++ b/drivers/staging/cx25821/cx258

[patch] em28xx: remove unneeded null checks

The "dev" variable is used as a list cursor in a list_for_each_entry() loop and can never be null here so I removed the check. Signed-off-by: Dan Carpenter diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c index 331e1ca..44c63cb 10

[patch] video/saa7134: potential null dereferences in debug code

I modified the dprintk and i2cdprintk macros to handle null dev and ir pointers. There are two couple places that call dprintk() when "dev" is null. One is in get_key_msi_tvanywhere_plus() and the other is in get_key_flydvb_trio(). Signed-off-by: Dan Carpenter diff --git a/dri

[patch v2] video/saa7134: change dprintk() to i2cdprintk()

The problem is that dprintk() dereferences "dev" which is null here. The i2cdprintk() uses "ir" so that's OK. Also removed a duplicated break statement. Signed-off-by: Dan Carpenter --- v2: Jean Delvare suggested that I use i2cdprintk() instead of modifying dprintk

<    1   2   3   4   5   6   7   8   >