--- /dev/null
+From 0b41ce991052022c030fd868e03877700220b090 Mon Sep 17 00:00:00 2001
+From: Sebastian Frias <sf84@laposte.net>
+Date: Fri, 18 Dec 2015 17:40:05 +0100
+Subject: 8250: use callbacks to access UART_DLL/UART_DLM
+
+From: Sebastian Frias <sf84@laposte.net>
+
+commit 0b41ce991052022c030fd868e03877700220b090 upstream.
+
+Some UART HW has a single register combining UART_DLL/UART_DLM
+(this was probably forgotten in the change that introduced the
+callbacks, commit b32b19b8ffc05cbd3bf91c65e205f6a912ca15d9)
+
+Fixes: b32b19b8ffc0 ("[SERIAL] 8250: set divisor register correctly ...")
+
+Signed-off-by: Sebastian Frias <sf84@laposte.net>
+Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_core.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -686,22 +686,16 @@ static int size_fifo(struct uart_8250_po
+ */
+ static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p)
+ {
+- unsigned char old_dll, old_dlm, old_lcr;
+- unsigned int id;
++ unsigned char old_lcr;
++ unsigned int id, old_dl;
+
+ old_lcr = serial_in(p, UART_LCR);
+ serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A);
++ old_dl = serial_dl_read(p);
++ serial_dl_write(p, 0);
++ id = serial_dl_read(p);
++ serial_dl_write(p, old_dl);
+
+- old_dll = serial_in(p, UART_DLL);
+- old_dlm = serial_in(p, UART_DLM);
+-
+- serial_out(p, UART_DLL, 0);
+- serial_out(p, UART_DLM, 0);
+-
+- id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8;
+-
+- serial_out(p, UART_DLL, old_dll);
+- serial_out(p, UART_DLM, old_dlm);
+ serial_out(p, UART_LCR, old_lcr);
+
+ return id;
--- /dev/null
+From b339a72e04a62f0b1882c43492fc712f1176b3e6 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Wed, 10 Feb 2016 09:32:25 -0200
+Subject: [media] adv7511: TX_EDID_PRESENT is still 1 after a disconnect
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit b339a72e04a62f0b1882c43492fc712f1176b3e6 upstream.
+
+The V4L2_CID_TX_EDID_PRESENT control reports if an EDID is present.
+The adv7511 however still reported the EDID present after disconnecting
+the HDMI cable. Fix the logic regarding this control. And when the EDID
+is disconnected also call ADV7511_EDID_DETECT to notify the bridge driver.
+This was also missing.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/adv7511.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/adv7511.c
++++ b/drivers/media/i2c/adv7511.c
+@@ -827,12 +827,23 @@ static void adv7511_dbg_dump_edid(int lv
+ }
+ }
+
++static void adv7511_notify_no_edid(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ struct adv7511_edid_detect ed;
++
++ /* We failed to read the EDID, so send an event for this. */
++ ed.present = false;
++ ed.segment = adv7511_rd(sd, 0xc4);
++ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0);
++}
++
+ static void adv7511_edid_handler(struct work_struct *work)
+ {
+ struct delayed_work *dwork = to_delayed_work(work);
+ struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler);
+ struct v4l2_subdev *sd = &state->sd;
+- struct adv7511_edid_detect ed;
+
+ v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+
+@@ -857,9 +868,7 @@ static void adv7511_edid_handler(struct
+ }
+
+ /* We failed to read the EDID, so send an event for this. */
+- ed.present = false;
+- ed.segment = adv7511_rd(sd, 0xc4);
+- v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
++ adv7511_notify_no_edid(sd);
+ v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__);
+ }
+
+@@ -930,7 +939,6 @@ static void adv7511_check_monitor_presen
+ /* update read only ctrls */
+ v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0);
+ v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0);
+- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0);
+
+ if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) {
+ v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__);
+@@ -960,6 +968,7 @@ static void adv7511_check_monitor_presen
+ }
+ adv7511_s_power(sd, false);
+ memset(&state->edid, 0, sizeof(struct adv7511_state_edid));
++ adv7511_notify_no_edid(sd);
+ }
+ }
+
+@@ -1036,6 +1045,7 @@ static bool adv7511_check_edid_status(st
+ }
+ /* one more segment read ok */
+ state->edid.segments = segment + 1;
++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1);
+ if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) {
+ /* Request next EDID segment */
+ v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments);
+@@ -1055,7 +1065,6 @@ static bool adv7511_check_edid_status(st
+ ed.present = true;
+ ed.segment = 0;
+ state->edid_detect_counter++;
+- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0);
+ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
+ return ed.present;
+ }
--- /dev/null
+From 5c915c68763889f0183a1cc61c84bb228b60124a Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 7 Feb 2016 09:24:29 -0200
+Subject: [media] bttv: Width must be a multiple of 16 when capturing planar formats
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 5c915c68763889f0183a1cc61c84bb228b60124a upstream.
+
+On my bttv card "Hauppauge WinTV [card=10]" capturing in YV12 fmt at max
+size results in a solid green rectangle being captured (all colors 0 in
+YUV).
+
+This turns out to be caused by max-width (924) not being a multiple of 16.
+
+We've likely never hit this problem before since normally xawtv / tvtime,
+etc. will prefer packed pixel formats. But when using a video card which
+is using xf86-video-modesetting + glamor, only planar XVideo fmts are
+available, and xawtv will chose a matching capture format to avoid needing
+to do conversion, triggering the solid green window problem.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/bt8xx/bttv-driver.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -2333,6 +2333,19 @@ static int bttv_g_fmt_vid_overlay(struct
+ return 0;
+ }
+
++static void bttv_get_width_mask_vid_cap(const struct bttv_format *fmt,
++ unsigned int *width_mask,
++ unsigned int *width_bias)
++{
++ if (fmt->flags & FORMAT_FLAGS_PLANAR) {
++ *width_mask = ~15; /* width must be a multiple of 16 pixels */
++ *width_bias = 8; /* nearest */
++ } else {
++ *width_mask = ~3; /* width must be a multiple of 4 pixels */
++ *width_bias = 2; /* nearest */
++ }
++}
++
+ static int bttv_try_fmt_vid_cap(struct file *file, void *priv,
+ struct v4l2_format *f)
+ {
+@@ -2342,6 +2355,7 @@ static int bttv_try_fmt_vid_cap(struct f
+ enum v4l2_field field;
+ __s32 width, height;
+ __s32 height2;
++ unsigned int width_mask, width_bias;
+ int rc;
+
+ fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+@@ -2374,9 +2388,9 @@ static int bttv_try_fmt_vid_cap(struct f
+ width = f->fmt.pix.width;
+ height = f->fmt.pix.height;
+
++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias);
+ rc = limit_scaled_size_lock(fh, &width, &height, field,
+- /* width_mask: 4 pixels */ ~3,
+- /* width_bias: nearest */ 2,
++ width_mask, width_bias,
+ /* adjust_size */ 1,
+ /* adjust_crop */ 0);
+ if (0 != rc)
+@@ -2409,6 +2423,7 @@ static int bttv_s_fmt_vid_cap(struct fil
+ struct bttv_fh *fh = priv;
+ struct bttv *btv = fh->btv;
+ __s32 width, height;
++ unsigned int width_mask, width_bias;
+ enum v4l2_field field;
+
+ retval = bttv_switch_type(fh, f->type);
+@@ -2423,9 +2438,10 @@ static int bttv_s_fmt_vid_cap(struct fil
+ height = f->fmt.pix.height;
+ field = f->fmt.pix.field;
+
++ fmt = format_by_fourcc(f->fmt.pix.pixelformat);
++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias);
+ retval = limit_scaled_size_lock(fh, &width, &height, f->fmt.pix.field,
+- /* width_mask: 4 pixels */ ~3,
+- /* width_bias: nearest */ 2,
++ width_mask, width_bias,
+ /* adjust_size */ 1,
+ /* adjust_crop */ 1);
+ if (0 != retval)
+@@ -2433,8 +2449,6 @@ static int bttv_s_fmt_vid_cap(struct fil
+
+ f->fmt.pix.field = field;
+
+- fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+-
+ /* update our state informations */
+ fh->fmt = fmt;
+ fh->cap.field = f->fmt.pix.field;
--- /dev/null
+From 7df5ab8774aa383c6d2bff00688d004585d96dfd Mon Sep 17 00:00:00 2001
+From: Tiffany Lin <tiffany.lin@mediatek.com>
+Date: Tue, 19 Jan 2016 05:56:50 -0200
+Subject: [media] media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32
+
+From: Tiffany Lin <tiffany.lin@mediatek.com>
+
+commit 7df5ab8774aa383c6d2bff00688d004585d96dfd upstream.
+
+In v4l2-compliance utility, test QUERYBUF required correct length
+value to go through each planar to check planar's length in
+multi-planar buffer type
+
+Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 21 ++++++++-------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+@@ -392,7 +392,8 @@ static int get_v4l2_buffer32(struct v4l2
+ get_user(kp->index, &up->index) ||
+ get_user(kp->type, &up->type) ||
+ get_user(kp->flags, &up->flags) ||
+- get_user(kp->memory, &up->memory))
++ get_user(kp->memory, &up->memory) ||
++ get_user(kp->length, &up->length))
+ return -EFAULT;
+
+ if (V4L2_TYPE_IS_OUTPUT(kp->type))
+@@ -404,9 +405,6 @@ static int get_v4l2_buffer32(struct v4l2
+ return -EFAULT;
+
+ if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
+- if (get_user(kp->length, &up->length))
+- return -EFAULT;
+-
+ num_planes = kp->length;
+ if (num_planes == 0) {
+ kp->m.planes = NULL;
+@@ -439,16 +437,14 @@ static int get_v4l2_buffer32(struct v4l2
+ } else {
+ switch (kp->memory) {
+ case V4L2_MEMORY_MMAP:
+- if (get_user(kp->length, &up->length) ||
+- get_user(kp->m.offset, &up->m.offset))
++ if (get_user(kp->m.offset, &up->m.offset))
+ return -EFAULT;
+ break;
+ case V4L2_MEMORY_USERPTR:
+ {
+ compat_long_t tmp;
+
+- if (get_user(kp->length, &up->length) ||
+- get_user(tmp, &up->m.userptr))
++ if (get_user(tmp, &up->m.userptr))
+ return -EFAULT;
+
+ kp->m.userptr = (unsigned long)compat_ptr(tmp);
+@@ -490,7 +486,8 @@ static int put_v4l2_buffer32(struct v4l2
+ copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) ||
+ put_user(kp->sequence, &up->sequence) ||
+ put_user(kp->reserved2, &up->reserved2) ||
+- put_user(kp->reserved, &up->reserved))
++ put_user(kp->reserved, &up->reserved) ||
++ put_user(kp->length, &up->length))
+ return -EFAULT;
+
+ if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
+@@ -513,13 +510,11 @@ static int put_v4l2_buffer32(struct v4l2
+ } else {
+ switch (kp->memory) {
+ case V4L2_MEMORY_MMAP:
+- if (put_user(kp->length, &up->length) ||
+- put_user(kp->m.offset, &up->m.offset))
++ if (put_user(kp->m.offset, &up->m.offset))
+ return -EFAULT;
+ break;
+ case V4L2_MEMORY_USERPTR:
+- if (put_user(kp->length, &up->length) ||
+- put_user(kp->m.userptr, &up->m.userptr))
++ if (put_user(kp->m.userptr, &up->m.userptr))
+ return -EFAULT;
+ break;
+ case V4L2_MEMORY_OVERLAY:
--- /dev/null
+From 401879c57f01cbf2da204ad2e8db910525c6dbea Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Sat, 9 Jan 2016 17:48:45 -0800
+Subject: net: irda: Fix use-after-free in irtty_open()
+
+From: Peter Hurley <peter@hurleysoftware.com>
+
+commit 401879c57f01cbf2da204ad2e8db910525c6dbea upstream.
+
+The N_IRDA line discipline may access the previous line discipline's closed
+and already-fre private data on open [1].
+
+The tty->disc_data field _never_ refers to valid data on entry to the
+line discipline's open() method. Rather, the ldisc is expected to
+initialize that field for its own use for the lifetime of the instance
+(ie. from open() to close() only).
+
+[1]
+ ==================================================================
+ BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
+ Read of size 4 by task a.out/13960
+ =============================================================================
+ BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected
+ -----------------------------------------------------------------------------
+ ...
+ Call Trace:
+ [<ffffffff815fa2ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
+ [<ffffffff836938a2>] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
+ [<ffffffff829f1b80>] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
+ [<ffffffff829f21c0>] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
+ [< inline >] tiocsetd drivers/tty/tty_io.c:2650
+ [<ffffffff829da49e>] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
+ [< inline >] vfs_ioctl fs/ioctl.c:43
+ [<ffffffff816708ac>] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
+ [< inline >] SYSC_ioctl fs/ioctl.c:622
+ [<ffffffff81671204>] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
+ [<ffffffff852a7876>] entry_SYSCALL_64_fastpath+0x16/0x7a
+
+Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/irda/irtty-sir.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/drivers/net/irda/irtty-sir.c
++++ b/drivers/net/irda/irtty-sir.c
+@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct
+
+ /* Module stuff handled via irda_ldisc.owner - Jean II */
+
+- /* First make sure we're not already connected. */
+- if (tty->disc_data != NULL) {
+- priv = tty->disc_data;
+- if (priv && priv->magic == IRTTY_MAGIC) {
+- ret = -EEXIST;
+- goto out;
+- }
+- tty->disc_data = NULL; /* ### */
+- }
+-
+ /* stop the underlying driver */
+ irtty_stop_receiver(tty, TRUE);
+ if (tty->ops->stop)
--- /dev/null
+From 3e71da19f9dc22e39a755d6ae9678661abb66adc Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 14 Feb 2016 17:51:37 -0200
+Subject: [media] saa7134: Fix bytesperline not being set correctly for planar formats
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 3e71da19f9dc22e39a755d6ae9678661abb66adc upstream.
+
+bytesperline should be the bytesperline for the first plane for planar
+formats, not that of all planes combined.
+
+This fixes a crash in xawtv caused by the wrong bpl.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1305389
+Reported-and-tested-by: Stas Sergeev <stsp@list.ru>
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/saa7134/saa7134-video.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/pci/saa7134/saa7134-video.c
++++ b/drivers/media/pci/saa7134/saa7134-video.c
+@@ -1342,10 +1342,13 @@ static int saa7134_g_fmt_vid_cap(struct
+ f->fmt.pix.height = dev->height;
+ f->fmt.pix.field = dev->cap.field;
+ f->fmt.pix.pixelformat = dev->fmt->fourcc;
+- f->fmt.pix.bytesperline =
+- (f->fmt.pix.width * dev->fmt->depth) >> 3;
++ if (dev->fmt->planar)
++ f->fmt.pix.bytesperline = f->fmt.pix.width;
++ else
++ f->fmt.pix.bytesperline =
++ (f->fmt.pix.width * dev->fmt->depth) / 8;
+ f->fmt.pix.sizeimage =
+- f->fmt.pix.height * f->fmt.pix.bytesperline;
++ (f->fmt.pix.height * f->fmt.pix.width * dev->fmt->depth) / 8;
+ f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
+ f->fmt.pix.priv = 0;
+ return 0;
+@@ -1424,10 +1427,13 @@ static int saa7134_try_fmt_vid_cap(struc
+ if (f->fmt.pix.height > maxh)
+ f->fmt.pix.height = maxh;
+ f->fmt.pix.width &= ~0x03;
+- f->fmt.pix.bytesperline =
+- (f->fmt.pix.width * fmt->depth) >> 3;
++ if (fmt->planar)
++ f->fmt.pix.bytesperline = f->fmt.pix.width;
++ else
++ f->fmt.pix.bytesperline =
++ (f->fmt.pix.width * fmt->depth) / 8;
+ f->fmt.pix.sizeimage =
+- f->fmt.pix.height * f->fmt.pix.bytesperline;
++ (f->fmt.pix.height * f->fmt.pix.width * fmt->depth) / 8;
+ f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
+ f->fmt.pix.priv = 0;
+
crypto-ccp-don-t-assume-export-import-areas-are-aligned.patch
crypto-ccp-memset-request-context-to-zero-during-import.patch
hid-logitech-fix-dual-action-gamepad-support.patch
+net-irda-fix-use-after-free-in-irtty_open.patch
+8250-use-callbacks-to-access-uart_dll-uart_dlm.patch
+saa7134-fix-bytesperline-not-being-set-correctly-for-planar-formats.patch
+adv7511-tx_edid_present-is-still-1-after-a-disconnect.patch
+bttv-width-must-be-a-multiple-of-16-when-capturing-planar-formats.patch
+media-v4l2-compat-ioctl32-fix-missing-length-copy-in-put_v4l2_buffer32.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
