media: xc4000: Fix atomicity violation in xc4000_get_frequency

[ Upstream commit 36d503ad547d1c75758a6fcdbec2806f1b6aeb41 ]

In xc4000_get_frequency():
*freq = priv->freq_hz + priv->freq_offset;
Th

media: xc4000: Fix atomicity violation in xc4000_get_frequency

[ Upstream commit 36d503ad547d1c75758a6fcdbec2806f1b6aeb41 ]

In xc4000_get_frequency():
*freq = priv->freq_hz + priv->freq_offset;
The code accesses priv->freq_hz and priv->freq_offset without holding any
lock.

In xc4000_set_params():
// Code that updates priv->freq_hz and priv->freq_offset
...

xc4000_get_frequency() and xc4000_set_params() may execute concurrently,
risking inconsistent reads of priv->freq_hz and priv->freq_offset. Since
these related data may update during reading, it can result in incorrect
frequency calculation, leading to atomicity violations.

This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 6.2.

To address this issue, it is proposed to add a mutex lock pair in
xc4000_get_frequency() to ensure atomicity. With this patch applied, our
tool no longer reports the possible bug, with the kernel configuration
allyesconfig for x86_64. Due to the lack of associated hardware, we cannot
test the patch in runtime testing, and just verify it according to the
code logic.

[1] https://sites.google.com/view/basscheck/

Fixes: 4c07e32884ab ("[media] xc4000: Fix get_frequency()")
Cc: stable@vger.kernel.org
Reported-by: BassCheck <bass@buaa.edu.cn>
Signed-off-by: Gui-Dong Han <2045gemini@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>

show more ...

media: xc4000: Fix atomicity violation in xc4000_get_frequency

[ Upstream commit 36d503ad547d1c75758a6fcdbec2806f1b6aeb41 ]

In xc4000_get_frequency():
*freq = priv->freq_hz + priv->freq_offset;
Th

media: xc4000: Fix atomicity violation in xc4000_get_frequency

[ Upstream commit 36d503ad547d1c75758a6fcdbec2806f1b6aeb41 ]

In xc4000_get_frequency():
*freq = priv->freq_hz + priv->freq_offset;
The code accesses priv->freq_hz and priv->freq_offset without holding any
lock.

In xc4000_set_params():
// Code that updates priv->freq_hz and priv->freq_offset
...

xc4000_get_frequency() and xc4000_set_params() may execute concurrently,
risking inconsistent reads of priv->freq_hz and priv->freq_offset. Since
these related data may update during reading, it can result in incorrect
frequency calculation, leading to atomicity violations.

This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 6.2.

To address this issue, it is proposed to add a mutex lock pair in
xc4000_get_frequency() to ensure atomicity. With this patch applied, our
tool no longer reports the possible bug, with the kernel configuration
allyesconfig for x86_64. Due to the lack of associated hardware, we cannot
test the patch in runtime testing, and just verify it according to the
code logic.

[1] https://sites.google.com/view/basscheck/

Fixes: 4c07e32884ab ("[media] xc4000: Fix get_frequency()")
Cc: stable@vger.kernel.org
Reported-by: BassCheck <bass@buaa.edu.cn>
Signed-off-by: Gui-Dong Han <2045gemini@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>

show more ...

media: dvb: symbol fixup for dvb_attach()

In commit 9011e49d54dc ("modules: only allow symbol_get of
EXPORT_SYMBOL_GPL modules") the use of symbol_get is properly restricted
to GPL-only marked symbo

media: dvb: symbol fixup for dvb_attach()

In commit 9011e49d54dc ("modules: only allow symbol_get of
EXPORT_SYMBOL_GPL modules") the use of symbol_get is properly restricted
to GPL-only marked symbols. This interacts oddly with the DVB logic
which only uses dvb_attach() to load the dvb driver which then uses
symbol_get().

Fix this up by properly marking all of the dvb_attach attach symbols as
EXPORT_SYMBOL_GPL().

Fixes: 9011e49d54dc ("modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules")
Cc: stable <stable@kernel.org>
Reported-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: linux-media@vger.kernel.org
Cc: linux-modules@vger.kernel.org
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Link: https://lore.kernel.org/r/20230908092035.3815268-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

media: tuners: Remove the unneeded result variable

Return the value xc_send_i2c_data() directly instead of storing it in
another redundant variable.

Signed-off-by: ye xingchen <ye.xingchen@zte.com.

media: tuners: Remove the unneeded result variable

Return the value xc_send_i2c_data() directly instead of storing it in
another redundant variable.

Signed-off-by: ye xingchen <ye.xingchen@zte.com.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

show more ...

media: xc2028: rename the driver from tuner-xc2028

This is the only tuner driver that has "tuner-" on its name.

Rename it, in order to match all the other tuner drivers.

Signed-off-by: Mauro Carva

media: xc2028: rename the driver from tuner-xc2028

This is the only tuner driver that has "tuner-" on its name.

Rename it, in order to match all the other tuner drivers.

Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

show more ...

media: media/tuners: Use kmemdup rather than duplicating its implementation

kmemdup is introduced to duplicate a region of memory in a neat way.
Rather than kmalloc/kzalloc + memcpy, which the progr

media: media/tuners: Use kmemdup rather than duplicating its implementation

kmemdup is introduced to duplicate a region of memory in a neat way.
Rather than kmalloc/kzalloc + memcpy, which the programmer needs to
write the size twice (sometimes lead to mistakes), kmemdup improves
readability, leads to smaller code and also reduce the chances of mistakes.
Suggestion to use kmemdup rather than using kmalloc/kzalloc + memcpy.

Signed-off-by: Fuqian Huang <huangfq.daxian@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

show more ...

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157

Based on 3 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of th

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157

Based on 3 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version this program is distributed in the
hope that it will be useful but without any warranty without even
the implied warranty of merchantability or fitness for a particular
purpose see the gnu general public license for more details

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version [author] [kishon] [vijay] [abraham]
[i] [kishon]@[ti] [com] this program is distributed in the hope that
it will be useful but without any warranty without even the implied
warranty of merchantability or fitness for a particular purpose see
the gnu general public license for more details

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version [author] [graeme] [gregory]
[gg]@[slimlogic] [co] [uk] [author] [kishon] [vijay] [abraham] [i]
[kishon]@[ti] [com] [based] [on] [twl6030]_[usb] [c] [author] [hema]
[hk] [hemahk]@[ti] [com] this program is distributed in the hope
that it will be useful but without any warranty without even the
implied warranty of merchantability or fitness for a particular
purpose see the gnu general public license for more details

extracted by the scancode license scanner the SPDX license identifier

GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 1105 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Reviewed-by: Richard Fontana <rfontana@redhat.com>
Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070033.202006027@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

media: tuners: fix several typos

Use codespell to fix lots of typos over frontends.

Manually verified to avoid false-positives.

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

media: xc4000: get rid of uneeded casts

Instead of doing casts, use %zd to print sizes, in order to make
smatch happier:
drivers/media/tuners/xc4000.c:818 xc4000_fwupload() warn: argument 4 to %d s

media: xc4000: get rid of uneeded casts

Instead of doing casts, use %zd to print sizes, in order to make
smatch happier:
drivers/media/tuners/xc4000.c:818 xc4000_fwupload() warn: argument 4 to %d specifier is cast from pointer

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

show more ...

media: dvb: convert tuner_info frequencies to Hz

Right now, satellite tuner drivers specify frequencies in kHz,
while terrestrial/cable ones specify in Hz. That's confusing
for developers.

However,

media: dvb: convert tuner_info frequencies to Hz

Right now, satellite tuner drivers specify frequencies in kHz,
while terrestrial/cable ones specify in Hz. That's confusing
for developers.

However, the main problem is that universal tuners capable
of handling both satellite and non-satelite delivery systems
are appearing. We end by needing to hack the drivers in
order to support such hybrid tuners.

So, convert everything to specify tuner frequencies in Hz.

Plese notice that a similar patch is also needed for frontends.

Tested-by: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
Acked-by: Michael Büsch <m@bues.ch>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

show more ...

media: move dvb kAPI headers to include/media

Except for DVB, all media kAPI headers are at include/media.

Move the headers to it.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

media: xc4000: don't ignore error if hwmodel fails

If, for some reason, reading the hwmodel register on
xc4000 fails, it will cause the following logig to
use a random value, as reported by smatch:

media: xc4000: don't ignore error if hwmodel fails

If, for some reason, reading the hwmodel register on
xc4000 fails, it will cause the following logig to
use a random value, as reported by smatch:

drivers/media/tuners/xc4000.c:1047 check_firmware() error: uninitialized symbol 'hwmodel'.
drivers/media/tuners/xc4000.c:1060 check_firmware() error: uninitialized symbol 'hwmodel'.
drivers/media/tuners/xc4000.c:1064 check_firmware() error: uninitialized symbol 'hwmodel'.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

show more ...

[media] media: Drop FSF's postal address from the source code files

Drop the FSF's postal address from the source code files that typically
contain mostly the license text. Of the 628 removed instan

[media] media: Drop FSF's postal address from the source code files

Drop the FSF's postal address from the source code files that typically
contain mostly the license text. Of the 628 removed instances, 578 are
outdated.

The patch has been created with the following command without manual edits:

git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \
drivers/media/ include/media|while read i; do i=$i perl -e '
open(F,"< $ENV{i}");
$a=join("", <F>);
$a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m
&& $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m;
close(F);
open(F, "> $ENV{i}");
print F $a;
close(F);'; done

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>

show more ...

[media] dvb_frontend: tuner_ops.release returns void

It is not clear what this return value means. All implemenations
return 0, and the one caller ignores the value. Let's remove this
useless retu

[media] dvb_frontend: tuner_ops.release returns void

It is not clear what this return value means. All implemenations
return 0, and the one caller ignores the value. Let's remove this
useless return value completely.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

show more ...

[media] tuners: don't break long lines

Due to the 80-cols restrictions, and latter due to checkpatch
warnings, several strings were broken into multiple lines. This
is not considered a good practice

[media] tuners: don't break long lines

Due to the 80-cols restrictions, and latter due to checkpatch
warnings, several strings were broken into multiple lines. This
is not considered a good practice anymore, as it makes harder
to grep for strings at the source code.

As we're right now fixing other drivers due to KERN_CONT, we need
to be able to identify what printk strings don't end with a "\n".
It is a way easier to detect those if we don't break long lines.

So, join those continuation lines.

The patch was generated via the script below, and manually
adjusted if needed.

</script>
use Text::Tabs;
while (<>) {
if ($next ne "") {
$c=$_;
if ($c =~ /^\s+\"(.*)/) {
$c2=$1;
$next =~ s/\"\n$//;
$n = expand($next);
$funpos = index($n, '(');
$pos = index($c2, '",');
if ($funpos && $pos > 0) {
$s1 = substr $c2, 0, $pos + 2;
$s2 = ' ' x ($funpos + 1) . substr $c2, $pos + 2;
$s2 =~ s/^\s+//;

$s2 = ' ' x ($funpos + 1) . $s2 if ($s2 ne "");

print unexpand("$next$s1\n");
print unexpand("$s2\n") if ($s2 ne "");
} else {
print "$next$c2\n";
}
$next="";
next;
} else {
print $next;
}
$next="";
} else {
if (m/\"$/) {
if (!m/\\n\"$/) {
$next=$_;
next;
}
}
}
print $_;
}
</script>

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

show more ...

[media] xc4000: shut up a bogus smatch message

smatch complains about:
drivers/media/tuners/xc4000.c:1511 xc4000_get_signal() warn: '~value << 3' 524280 can't fit into 65535 'value'

Remove the bog

[media] xc4000: shut up a bogus smatch message

smatch complains about:
drivers/media/tuners/xc4000.c:1511 xc4000_get_signal() warn: '~value << 3' 524280 can't fit into 65535 'value'

Remove the bogus complain.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

show more ...

[media] xc4000: Fix bad alignments

As reported by cocinelle:

drivers/media/tuners/xc4000.c:573:2-28: code aligned with following code on line 574
drivers/media/tuners/xc4000.c:575:2-29: code aligne

[media] xc4000: Fix bad alignments

As reported by cocinelle:

drivers/media/tuners/xc4000.c:573:2-28: code aligned with following code on line 574
drivers/media/tuners/xc4000.c:575:2-29: code aligned with following code on line 576
drivers/media/tuners/xc4000.c:577:2-29: code aligned with following code on line 578
drivers/media/tuners/xc4000.c:579:2-27: code aligned with following code on line 580
drivers/media/tuners/xc4000.c:581:2-29: code aligned with following code on line 582
drivers/media/tuners/xc4000.c:583:2-29: code aligned with following code on line 584
drivers/media/tuners/xc4000.c:585:2-28: code aligned with following code on line 586
drivers/media/tuners/xc4000.c:587:2-27: code aligned with following code on line 588
drivers/media/tuners/xc4000.c:589:2-28: code aligned with following code on line 590
drivers/media/tuners/xc4000.c:591:2-29: code aligned with following code on line 592
drivers/media/tuners/xc4000.c:593:2-28: code aligned with following code on line 594
drivers/media/tuners/xc4000.c:595:2-26: code aligned with following code on line 596
drivers/media/tuners/xc4000.c:597:2-30: code aligned with following code on line 598
drivers/media/tuners/xc4000.c:599:2-27: code aligned with following code on line 600
drivers/media/tuners/xc4000.c:601:2-28: code aligned with following code on line 602
drivers/media/tuners/xc4000.c:603:2-28: code aligned with following code on line 604
drivers/media/tuners/xc4000.c:605:2-28: code aligned with following code on line 606
drivers/media/tuners/xc4000.c:607:2-26: code aligned with following code on line 608
drivers/media/tuners/xc4000.c:609:2-28: code aligned with following code on line 610
drivers/media/tuners/xc4000.c:611:2-30: code aligned with following code on line 612
drivers/media/tuners/xc4000.c:613:2-31: code aligned with following code on line 614
drivers/media/tuners/xc4000.c:615:2-30: code aligned with following code on line 616
drivers/media/tuners/xc4000.c:617:2-33: code aligned with following code on line 618
drivers/media/tuners/xc4000.c:619:2-33: code aligned with following code on line 620
drivers/media/tuners/xc4000.c:621:2-32: code aligned with following code on line 622
drivers/media/tuners/xc4000.c:623:2-34: code aligned with following code on line 624
drivers/media/tuners/xc4000.c:625:2-29: code aligned with following code on line 626
drivers/media/tuners/xc4000.c:627:2-29: code aligned with following code on line 628
drivers/media/tuners/xc4000.c:629:2-30: code aligned with following code on line 630
drivers/media/tuners/xc4000.c:631:2-29: code aligned with following code on line 632

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

show more ...

[media] xc4000: Fix get_frequency()

The programmed frequency on xc4000 is not the middle
frequency, but the initial frequency on the bandwidth range.
However, the DVB API works with the middle frequ

[media] xc4000: Fix get_frequency()

The programmed frequency on xc4000 is not the middle
frequency, but the initial frequency on the bandwidth range.
However, the DVB API works with the middle frequency.

This works fine on set_frontend, as the device calculates
the needed offset. However, at get_frequency(), the returned
value is the initial frequency. That's generally not a big
problem on most drivers, however, starting with changeset
6fe1099c7aec, the frequency drift is taken into account at
dib7000p driver.

This broke support for PCTV 340e, with uses dib7000p demod and
xc4000 tuner.

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

show more ...

[media] xc4000: add module meta-tag with the firmware names

This meta-tag is used by some distros to help them package
the firmware and generate proper initrd images.

So, add the firmware names the

[media] xc4000: add module meta-tag with the firmware names

This meta-tag is used by some distros to help them package
the firmware and generate proper initrd images.

So, add the firmware names there.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

show more ...

[media] xc4000: Update firmware name

The firmware name at:
http://www.kernellabs.com/firmware/xc4000/

Is different from the one at the Kernel. Update it
try first the new name, falling back to t

[media] xc4000: Update firmware name

The firmware name at:
http://www.kernellabs.com/firmware/xc4000/

Is different from the one at the Kernel. Update it
try first the new name, falling back to the previous one
if the new name can't be found.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

show more ...

[media] xc4000: remove unnecessary break after goto

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

[media] tuners/xc4000: Replace memcpy with struct assignment

This kind of memcpy() is error-prone. Its replacement with a struct
assignment is prefered because it's type-safe and much easier to read

[media] tuners/xc4000: Replace memcpy with struct assignment

This kind of memcpy() is error-prone. Its replacement with a struct
assignment is prefered because it's type-safe and much easier to read.
Found by coccinelle. Hand patched and reviewed.
Tested by compilation only.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
identifier struct_name;
struct struct_name to;
struct struct_name from;
expression E;
@@
-memcpy(&(to), &(from), E);
+to = from;
// </smpl>

Signed-off-by: Peter Senna Tschudin <peter.senna@gmail.com>
Signed-off-by: Ezequiel Garcia <elezegarcia@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

show more ...

[media] xc4000: Fix a few warnings

drivers/media/tuners/xc4000.c: In function ‘check_firmware’:
drivers/media/tuners/xc4000.c:1048:45: warning: ‘fw_minor’ may be used uninitialized in this function

[media] xc4000: Fix a few warnings

drivers/media/tuners/xc4000.c: In function ‘check_firmware’:
drivers/media/tuners/xc4000.c:1048:45: warning: ‘fw_minor’ may be used uninitialized in this function [-Wmaybe-uninitialized]
drivers/media/tuners/xc4000.c:1048:39: warning: ‘fw_major’ may be used uninitialized in this function [-Wmaybe-uninitialized]
drivers/media/tuners/xc4000.c:1062:39: warning: ‘hw_minor’ may be used uninitialized in this function [-Wmaybe-uninitialized]
drivers/media/tuners/xc4000.c:1062:33: warning: ‘hw_major’ may be used uninitialized in this function [-Wmaybe-uninitialized]

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

show more ...

[media] common: move media/common/tuners to media/tuners

Move the tuners one level up, as the "common" directory will be used
by drivers that are shared between more than one driver.

Signed-off-by:

[media] common: move media/common/tuners to media/tuners

Move the tuners one level up, as the "common" directory will be used
by drivers that are shared between more than one driver.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

show more ...

media: media/tuners: Use kmemdup rather than duplicating its implementation

kmemdup is introduced to duplicate a region of memory in a neat way.
Rather than kmalloc/kzalloc + memcpy, whi

media: media/tuners: Use kmemdup rather than duplicating its implementation

kmemdup is introduced to duplicate a region of memory in a neat way.
Rather than kmalloc/kzalloc + memcpy, which the programmer needs to
write the size twice (sometimes lead to mistakes), kmemdup improves
readability, leads to smaller code and also reduce the chances of mistakes.
Suggestion to use kmemdup rather than using kmalloc/kzalloc + memcpy.

Signed-off-by: Fuqian Huang <huangfq.daxian@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

show more ...