1. 12 Jun, 2018 1 commit
    • Kees Cook's avatar
      treewide: Use array_size() in vmalloc() · 42bc47b3
      Kees Cook authored
      The vmalloc() function has no 2-factor argument form, so multiplication
      factors need to be wrapped in array_size(). This patch replaces cases of:
      
              vmalloc(a * b)
      
      with:
              vmalloc(array_size(a, b))
      
      as well as handling cases of:
      
              vmalloc(a * b * c)
      
      with:
      
              vmalloc(array3_size(a, b, c))
      
      This does, however, attempt to ignore constant size factors like:
      
              vmalloc(4 * 1024)
      
      though any constants defined via macros get caught up in the conversion.
      
      Any factors with a sizeof() of "unsigned char", "char", and "u8" were
      dropped, since they're redundant.
      
      The Coccinelle script used for this was:
      
      // Fix redundant parens around sizeof().
      @@
      type TYPE;
      expression THING, E;
      @@
      
      (
        vmalloc(
      -	(sizeof(TYPE)) * E
      +	sizeof(TYPE) * E
        , ...)
      |
        vmalloc(
      -	(sizeof(THING)) * E
      +	sizeof(THING) * E
        , ...)
      )
      
      // Drop single-byte sizes and redundant parens.
      @@
      expression COUNT;
      typedef u8;
      typedef __u8;
      @@
      
      (
        vmalloc(
      -	sizeof(u8) * (COUNT)
      +	COUNT
        , ...)
      |
        vmalloc(
      -	sizeof(__u8) * (COUNT)
      +	COUNT
        , ...)
      |
        vmalloc(
      -	sizeof(char) * (COUNT)
      +	COUNT
        , ...)
      |
        vmalloc(
      -	sizeof(unsigned char) * (COUNT)
      +	COUNT
        , ...)
      |
        vmalloc(
      -	sizeof(u8) * COUNT
      +	COUNT
        , ...)
      |
        vmalloc(
      -	sizeof(__u8) * COUNT
      +	COUNT
        , ...)
      |
        vmalloc(
      -	sizeof(char) * COUNT
      +	COUNT
        , ...)
      |
        vmalloc(
      -	sizeof(unsigned char) * COUNT
      +	COUNT
        , ...)
      )
      
      // 2-factor product with sizeof(type/expression) and identifier or constant.
      @@
      type TYPE;
      expression THING;
      identifier COUNT_ID;
      constant COUNT_CONST;
      @@
      
      (
        vmalloc(
      -	sizeof(TYPE) * (COUNT_ID)
      +	array_size(COUNT_ID, sizeof(TYPE))
        , ...)
      |
        vmalloc(
      -	sizeof(TYPE) * COUNT_ID
      +	array_size(COUNT_ID, sizeof(TYPE))
        , ...)
      |
        vmalloc(
      -	sizeof(TYPE) * (COUNT_CONST)
      +	array_size(COUNT_CONST, sizeof(TYPE))
        , ...)
      |
        vmalloc(
      -	sizeof(TYPE) * COUNT_CONST
      +	array_size(COUNT_CONST, sizeof(TYPE))
        , ...)
      |
        vmalloc(
      -	sizeof(THING) * (COUNT_ID)
      +	array_size(COUNT_ID, sizeof(THING))
        , ...)
      |
        vmalloc(
      -	sizeof(THING) * COUNT_ID
      +	array_size(COUNT_ID, sizeof(THING))
        , ...)
      |
        vmalloc(
      -	sizeof(THING) * (COUNT_CONST)
      +	array_size(COUNT_CONST, sizeof(THING))
        , ...)
      |
        vmalloc(
      -	sizeof(THING) * COUNT_CONST
      +	array_size(COUNT_CONST, sizeof(THING))
        , ...)
      )
      
      // 2-factor product, only identifiers.
      @@
      identifier SIZE, COUNT;
      @@
      
        vmalloc(
      -	SIZE * COUNT
      +	array_size(COUNT, SIZE)
        , ...)
      
      // 3-factor product with 1 sizeof(type) or sizeof(expression), with
      // redundant parens removed.
      @@
      expression THING;
      identifier STRIDE, COUNT;
      type TYPE;
      @@
      
      (
        vmalloc(
      -	sizeof(TYPE) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        vmalloc(
      -	sizeof(TYPE) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        vmalloc(
      -	sizeof(TYPE) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        vmalloc(
      -	sizeof(TYPE) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        vmalloc(
      -	sizeof(THING) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        vmalloc(
      -	sizeof(THING) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        vmalloc(
      -	sizeof(THING) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        vmalloc(
      -	sizeof(THING) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      )
      
      // 3-factor product with 2 sizeof(variable), with redundant parens removed.
      @@
      expression THING1, THING2;
      identifier COUNT;
      type TYPE1, TYPE2;
      @@
      
      (
        vmalloc(
      -	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        vmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        vmalloc(
      -	sizeof(THING1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        vmalloc(
      -	sizeof(THING1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        vmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      |
        vmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      )
      
      // 3-factor product, only identifiers, with redundant parens removed.
      @@
      identifier STRIDE, SIZE, COUNT;
      @@
      
      (
        vmalloc(
      -	(COUNT) * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        vmalloc(
      -	COUNT * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        vmalloc(
      -	COUNT * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        vmalloc(
      -	(COUNT) * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        vmalloc(
      -	COUNT * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        vmalloc(
      -	(COUNT) * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        vmalloc(
      -	(COUNT) * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        vmalloc(
      -	COUNT * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      )
      
      // Any remaining multi-factor products, first at least 3-factor products
      // when they're not all constants...
      @@
      expression E1, E2, E3;
      constant C1, C2, C3;
      @@
      
      (
        vmalloc(C1 * C2 * C3, ...)
      |
        vmalloc(
      -	E1 * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      )
      
      // And then all remaining 2 factors products when they're not all constants.
      @@
      expression E1, E2;
      constant C1, C2;
      @@
      
      (
        vmalloc(C1 * C2, ...)
      |
        vmalloc(
      -	E1 * E2
      +	array_size(E1, E2)
        , ...)
      )
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      42bc47b3
  2. 23 Feb, 2018 1 commit
  3. 29 Jan, 2018 2 commits
  4. 28 Dec, 2017 1 commit
  5. 11 Oct, 2017 3 commits
  6. 02 Mar, 2017 1 commit
  7. 27 Jan, 2017 1 commit
    • Sakari Ailus's avatar
      [media] media: Drop FSF's postal address from the source code files · bcb63314
      Sakari Ailus authored
      Drop the FSF's postal address from the source code files that typically
      contain mostly the license text. Of the 628 removed instances, 578 are
      outdated.
      
      The patch has been created with the following command without manual edits:
      
      git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \
      	drivers/media/ include/media|while read i; do i=$i perl -e '
      open(F,"< $ENV{i}");
      $a=join("", <F>);
      $a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m
      	&& $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m;
      close(F);
      open(F, "> $ENV{i}");
      print F $a;
      close(F);'; done
      Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
      bcb63314
  8. 24 Dec, 2016 1 commit
  9. 21 Oct, 2016 5 commits
  10. 08 Jul, 2016 1 commit
  11. 06 Oct, 2015 1 commit
  12. 09 Dec, 2013 1 commit
  13. 29 Nov, 2013 3 commits
  14. 02 Oct, 2013 1 commit
  15. 08 Apr, 2013 1 commit
    • Mauro Carvalho Chehab's avatar
      [media] demux.h: Remove duplicated enum · fde04ab9
      Mauro Carvalho Chehab authored
      "enum dmx_ts_pes" and "typedef enum dmx_pes_type_t" are just the
      same enum declared twice, since Kernel (2.6.12). There's no reason
      to duplicate it there, and sparse complains about that:
      	drivers/media/dvb-core/dmxdev.c:600:55: warning: mixing different enum types
      So, remove the internal define, keeping just the external one.
      Internally, use only "enum dmx_ts_pes", as it is too late to drop
      dmx_pes_type_t from the userspace API.
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      fde04ab9
  16. 19 Mar, 2013 1 commit
  17. 23 Sep, 2012 1 commit
  18. 14 Aug, 2012 1 commit
  19. 13 Aug, 2012 1 commit
    • Michael Krufky's avatar
      [media] DVB: improve handling of TS packets containing a raised TEI bit · ae530205
      Michael Krufky authored
      When the TEI bit is raised, we should not trust any of the contents of
      the packet in question, including but not limited to its PID number.
      
      Considering that we don't trust the PID number of this packet, we should
      not proceed to check the packet counter (if dvb_demux_tscheck is set).
      
      We should expect to see at least one discontinuity after a bad packet is
      received, so any time a TEI is detected, a following TS packet counter
      mismatch is to be expected.
      
      There is no real reason to ever allow bad packets to pass through the
      kernel demux, other than for purposes of attempting error correction via
      software or statistical information.
      
      However, since we have always passed these bad packets though the demux,
      we should not change this default behavior.
      
      Without altering module options, this patch merely prevents the
      TS packet counter check on packets containing a raised TEI.
      
      If module option dvb_demux_feed_err_pkts is set to 0, the kernel demux
      will drop these error packets entirely, preventing any possibility of
      corruption caused by userspace programs that are expecting valid data.
      Signed-off-by: default avatarMichael Krufky <mkrufky@linuxtv.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      ae530205
  20. 20 May, 2012 1 commit
  21. 20 May, 2011 1 commit
  22. 02 Aug, 2010 1 commit
    • Julia Lawall's avatar
      V4L/DVB: drivers/media: Use memdup_user · c6cfe055
      Julia Lawall authored
      Use memdup_user when user data is immediately copied into the
      allocated region.
      
      The semantic patch that makes this change is as follows:
      (http://coccinelle.lip6.fr/)
      
      // <smpl>
      @@
      expression from,to,size,flag;
      position p;
      identifier l1,l2;
      @@
      
      -  to = \(kmalloc@p\|kzalloc@p\)(size,flag);
      +  to = memdup_user(from,size);
         if (
      -      to==NULL
      +      IS_ERR(to)
                       || ...) {
         <+... when != goto l1;
      -  -ENOMEM
      +  PTR_ERR(to)
         ...+>
         }
      -  if (copy_from_user(to, from, size) != 0) {
      -    <+... when != goto l2;
      -    -EFAULT
      -    ...+>
      -  }
      // </smpl>
      Signed-off-by: default avatarJulia Lawall <julia@diku.dk>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      c6cfe055
  23. 18 May, 2010 1 commit
  24. 08 Feb, 2010 2 commits
  25. 05 Dec, 2009 1 commit
  26. 04 Oct, 2009 1 commit
  27. 12 Sep, 2009 1 commit
  28. 16 Jun, 2009 1 commit
  29. 17 Feb, 2009 1 commit
    • Mauro Carvalho Chehab's avatar
      V4L/DVB (10572): Revert commit dda06a8e · 28100165
      Mauro Carvalho Chehab authored
      On Mon, 02 Feb 2009, Hartmut wrote:
      
      This change set is wrong. The affected functions cannot be called from
      an interrupt context, because they may process large buffers. In this
      case, interrupts are disabled for a long time. Functions, like
      dvb_dmx_swfilter_packets(), could be called only from a tasklet.
      
      This change set does hide some strong design bugs in dm1105.c and
      au0828-dvb.c.
      
      Please revert this change set and do fix the bugs in dm1105.c and
      au0828-dvb.c (and other files).
      
      On Sun, 15 Feb 2009, Oliver Endriss wrote:
      
      This changeset _must_ be reverted! It breaks all kernels since 2.6.27
      for applications which use DVB and require a low interrupt latency.
      
      It is a very bad idea to call the demuxer to process data buffers with
      interrupts disabled!
      
      On Mon, 16 Feb 2009, Trent Piepho wrote:
      
      I agree, this is bad.  The demuxer is far too much work to be done with
      IRQs off.  IMHO, even doing it under a spin-lock is excessive.  It should
      be a mutex.  Drivers should use a work-queue to feed the demuxer.
      
      Thank you for testing this changeset and discovering the issues on it.
      
      Cc: Trent Piepho <xyzzy@speakeasy.org>
      Cc: Hartmut <e9hack@googlemail.com>
      Cc: Oliver Endriss <o.endriss@gmx.de>
      Cc: Andreas Oberritter <obi@linuxtv.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      28100165
  30. 05 Oct, 2008 1 commit