This reverts commit 5be2b76a9c.
Only when the lirc device is freed, should we drop our reference to
rc_dev, else we the rc_dev is freed to early. If userspace has
a file descriptor open during unplug, it goes bang.
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10
Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609
-snip-
mutex_lock_nested+0x1b/0x20
? mutex_lock_nested+0x1b/0x20
rc_close.part.6+0x20/0x60 [rc_core]
rc_close+0x13/0x20 [rc_core]
lirc_dev_fop_close+0x62/0xd0 [lirc_dev]
__fput+0x236/0x410
? fput+0xb0/0xb0
? do_raw_spin_trylock+0x110/0x110
? set_rq_offline.part.70+0xa0/0xa0
____fput+0xe/0x10
task_work_run+0x116/0x180
? task_work_cancel+0x170/0x170
? _raw_spin_unlock+0x27/0x40
? switch_task_namespaces+0x5f/0x90
do_exit+0x68b/0xe80
Cc: stable@vger.kernel.org # For Kernel 4.13
Fixes: 5be2b76a9c ("[media] lirc_dev: remove superfluous get/put_device() calls")
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit a607f51e5a)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
Move the calculation to where it is needed, so the result doesn't
need to be stored in the device struct.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit fce4b371fe)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
CEC needs a keypress timeout of 550ms, which is too high for the IR
protocols. Also fill in known repeat times, with 50ms error margin.
Also, combine all protocol data into one structure.
Signed-off-by: Sean Young <sean@mess.org>
Suggested-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit d57ea877af)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
Since commit 12749b198fa4 ("[media] rc: saa7134: add trailing space for
timely decoding"), the workaround of inserting reset events is no
longer needed.
Note that the initial reset is not needed either; other rc-core drivers
that don't use ir_raw_event_store_edge() never call this at all.
Verified on a HVR-1150 and Raspberry Pi.
Fixes: 3f5c4c7332 ("[media] rc: fix ghost keypresses with certain hw")
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 86fe1ac0d5)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
The gpio-ir-recv driver adds timeouts which the saa7134 lacks; this
causes keypress not to arrive, and to only arrive once more IR is
received. This is what the commit below calls "ghost keypresses",
and that commit does not solve the issue completely.
This makes the IR on the HVR-1150 much more reliable and responsive.
Fixes: 3f5c4c7332 ("[media] rc: fix ghost keypresses with certain hw")
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 48b2de1971)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
The gpio-ir-recv driver does many wakeups (once per edge); the saa7134
driver has special handling to only wakeup 15ms after the first edge.
Make this part of rc-core so gpio-ir-recv also benefits from
this (so a rc-5 keypress now causes 3 wakeups rather than 24).
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit e5e26439d1)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
The NEC scancode composing and protocol type detection in
ir_nec_decode() is generic enough to be a shared function. Let's create
an inline function in rc-core.h, so that other remote control drivers
can reuse this function to save some code.
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit e8ffda7862)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
This is new driver which uses pwm, so it is more power-efficient
than the bit banging gpio-ir-tx driver.
Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Pavel Machek <pavel@ucw.cz>
Tested-by: Matthias Reichl <hias@horus.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit db3df8765e)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
When an ir-spi is registered, you get this message.
rc rc0: Unspecified device as /devices/platform/soc/3f215080.spi/spi_master/spi32766/spi32766.128/rc/rc0
"Unspecified device" refers to input_name, which makes no sense for IR
TX only devices. So, rename to device_name.
Also make driver_name const char* so that no casts are needed anywhere.
Now ir-spi reports:
rc rc0: IR SPI as /devices/platform/soc/3f215080.spi/spi_master/spi32766/spi32766.128/rc/rc0
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 518f4b26be)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
Note: it didn't change anything due to we didn't need this rc_dev.
Conflicts:
drivers/media/rc/igorplugusb.c
drivers/media/rc/nuvoton-cir.c
(I didn't cherry-pick the following re_dev)
drivers/media/rc/ir-spi.c
drivers/media/rc/mtk-cir.c
drivers/media/rc/sir_ir.c
attribute_groups are not supposed to change at runtime. All functions
working with attribute_groups provided by <linux/sysfs.h> work with const
attribute_group. So mark the non-const structs as const.
File size before:
text data bss dec hex filename
11605 880 20 12505 30d9 drivers/media/rc/rc-main.o
File size After adding 'const':
text data bss dec hex filename
11797 720 20 12537 30f9 drivers/media/rc/rc-main.o
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit db68102c8d)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
The NEC decoder and the Sanyo decoders check if dev->keypressed is true
before calling rc_repeat (without holding dev->keylock).
Meanwhile, the XMP and JVC decoders do no such checks.
This patch makes sure all users of rc_repeat() do so consistently by
removing extra checks in NEC/Sanyo and modifying the check a bit in
rc_repeat() so that no input event is generated if the key isn't pressed.
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 265a2988d2)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
Since commit e8f4818895 ("[media] lirc: advertise
LIRC_CAN_GET_REC_RESOLUTION and improve") lircd uses the ioctl
LIRC_GET_REC_RESOLUTION to determine the shortest pulse or space that
the hardware can detect. This breaks decoding in lirc because lircd
expects the answer in microseconds, but nanoseconds is returned.
Cc: <stable@vger.kernel.org> # v2.6.36+
Reported-by: Derek <user.vdr@gmail.com>
Tested-by: Derek <user.vdr@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 9f5039ba44)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
Now that rc_register_device() is reorganised, the dev->initialized
hack can be removed. Any driver which calls rc_register_device()
must be prepared for the device to go live immediately.
The dev->initialized commits that are relevant are commit c73bbaa4ec
("[media] rc-core: don't lock device at rc_register_device()") and
commit 08aeb7c9a4 ("[media] rc: add locking to fix register/show race").
The original problem was that show_protocols() would access
dev->rc_map.* and various other bits which are now properly
initialized before device_add() is called.
At the same time, remove the bogus "device is being removed" check.
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 18726a349d)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
The device core infrastructure is based on the presumption that
once a driver calls device_add(), it must be ready to accept
userspace interaction.
This requires splitting rc_setup_rx_device() into two functions
and reorganizing rc_register_device() so that as much work
as possible is performed before calling device_add().
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit f56928abaa)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
A rc device can call ir_raw_event_handle() after rc_allocate_device(),
but before rc_register_device() has completed. This is racey because
rcdev->raw is set before rcdev->raw->thread has a valid value.
Cc: stable@kernel.org
Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 963761a0b2)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
device_add() and friends already manage the references to the parent
device so these calls aren't necessary.
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 5be2b76a9c)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
These two functions only make the logic in lirc_register_driver()
harder to follow.
(Note that almost no other driver calls kobject_set_name() on their cdev
so I simply removed that part).
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 712551f0e4)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
Merging the two means that lirc_allocate_buffer() is called before
device_add() and cdev_add() which makes more sense. This also
simplifies the locking slightly because lirc_allocate_buffer() will
always be called with lirc_dev_lock held.
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 56481f0060)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
Every caller of lirc_register_driver() passes their own fops and there
are no users of lirc_dev_fop_write() in the kernel tree. Thus we can
make fops mandatory and remove lirc_dev_fop_write().
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit e0e3c77cc2)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
out_sysfs is misleading, sysfs only comes into play after device_add().
Also, calling device_init() before the rest of struct dev is filled out
is clearer.
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 2582322695)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
drv->set_use_inc and drv->set_use_dec are already optional so we can
remove all dummy functions.
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 52e809f9fe)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
ir_lirc_register() currently creates its own lirc_buffer before
passing the lirc_driver to lirc_register_driver().
When a module is later unloaded, ir_lirc_unregister() gets called
which performs a call to lirc_unregister_driver() and then free():s
the lirc_buffer.
The problem is that:
a) there can still be a userspace app holding an open lirc fd
when lirc_unregister_driver() returns; and
b) the lirc_buffer contains "wait_queue_head_t wait_poll" which
is potentially used as long as any userspace app is still around.
The result is an oops which can be triggered quite easily by a
userspace app monitoring its lirc fd using epoll() and not closing
the fd promptly on device removal.
The minimalistic fix is to let lirc_dev create the lirc_buffer since
lirc_dev will then also free the buffer once it believes it is safe to
do so.
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 0f7c4063f8)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
The call to input_register_device() needs to take place
before the repeat parameters are set or the input subsystem
repeat handling will be disabled (as was already noted in
the comments in that function).
Cc: stable <stable@vger.kernel.org> # v4.11
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit b2aceb739b)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
ir_raw_event_register() sets up change_protocol(), and without that set,
rc_setup_rx_device() does not set the protocol for the device on register.
The standard udev rules run ir-keytable, which writes to the protocols
file again, which hides this problem.
Fixes: 7ff2c2b ("[media] rc-main: split setup and unregister functions")
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 5df62771c5)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
When the protocol is set via the sysfs protocols attribute, the
decoder is loaded. However, when it is not when a device is first
plugged in or registered.
Fixes: acc1c3c ("[media] media: rc: load decoder modules on-demand")
Signed-off-by: Sean Young <sean@mess.org>
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 413808685d)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
When the interrupt requested with devm_request_irq(), serial_ir.rcdev
is still null so will cause null deference if the irq handler is called
early on.
Also ensure that timeout_timer is setup.
Link: http://lkml.kernel.org/r/CA+55aFxsh2uF8gi5sN_guY3Z+tiLv7LpJYKBw+y8vqLzp+TsnQ@mail.gmail.com
[mchehab@s-opensource.com: moved serial_ir_probe() back to its original place]
Cc: <stable@vger.kernel.org> # 4.10
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 0265634eb9)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
If a lirc device is unplugged, the struct rc_dev is freed even though
userspace can still have a file descriptor open on the lirc chardev. The
rc_dev structure can be used in a subsequent, or even currently executing
ioctl, read or write.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 74c839b2f5)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
Split the protocol into two variants, one for keyboard and one for mouse
data.
Note that the mce_kbd protocol cannot be used on the igorplugusb, since
the IR is too long.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit b73bc16d08)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
The UK layout of the Microsoft Remote Keyboard has two missing keys:
the hash key, and the messenger key which is sent using rc6 mce.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 44750606b9)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
This feature was never set. The ioctl should fail if no resolution
is set.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit e8f4818895)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
Conflicts:
drivers/media/rc/ir-lirc-codec.c
The lirc keymap existed once upon a time to select the lirc protocol.
Since '275ddb4 [media] rc-core: remove the LIRC "protocol"', IR is
always passed to the lirc decoder so this keymap is no longer needed.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 7dc2df1476)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
We shouldn't be using ENOSYS when a feature is not available. I've tested
lirc; nothing is broken as far as I can make out.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit 5c86275869)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
