#ifndef _VIDEOBUF2_DVB_H_
#define	_VIDEOBUF2_DVB_H_

#include <dvbdev.h>
#include <dmxdev.h>
#include <dvb_demux.h>
#include <dvb_net.h>
#include <dvb_frontend.h>

#include <media/videobuf2-v4l2.h>

/* We don't actually need to include media-device.h here */
struct media_device;

/*
 * TODO: This header file should be replaced with videobuf2-core.h
 * Currently, vb2_thread is not a stuff of videobuf2-core,
 * since vb2_thread has many dependencies on videobuf2-v4l2.
 */

struct vb2_dvb {
	/* filling that the job of the driver */
	char			*name;
	struct dvb_frontend	*frontend;
	struct vb2_queue	dvbq;

	/* video-buf-dvb state info */
	struct mutex		lock;
	int			nfeeds;

	/* vb2_dvb_(un)register manages this */
	struct dvb_demux	demux;
	struct dmxdev		dmxdev;
	struct dmx_frontend	fe_hw;
	struct dmx_frontend	fe_mem;
	struct dvb_net		net;
};

struct vb2_dvb_frontend {
	struct list_head felist;
	int id;
	struct vb2_dvb dvb;
};

struct vb2_dvb_frontends {
	struct list_head felist;
	struct mutex lock;
	struct dvb_adapter adapter;
	int active_fe_id; /* Indicates which frontend in the felist is in use */
	int gate; /* Frontend with gate control 0=!MFE,1=fe0,2=fe1 etc */
};

int vb2_dvb_register_bus(struct vb2_dvb_frontends *f,
			 struct module *module,
			 void *adapter_priv,
			 struct device *device,
			 struct media_device *mdev,
			 short *adapter_nr,
			 int mfe_shared);

void vb2_dvb_unregister_bus(struct vb2_dvb_frontends *f);

struct vb2_dvb_frontend *vb2_dvb_alloc_frontend(struct vb2_dvb_frontends *f, int id);
void vb2_dvb_dealloc_frontends(struct vb2_dvb_frontends *f);

struct vb2_dvb_frontend *vb2_dvb_get_frontend(struct vb2_dvb_frontends *f, int id);
int vb2_dvb_find_frontend(struct vb2_dvb_frontends *f, struct dvb_frontend *p);

#endif			/* _VIDEOBUF2_DVB_H_ */
de/net?id=472ff5be61f9593ee2d3ebbd716768e14de4659d'>tree</a><a href='/cgit.cgi/linux/net-next.git/commit/include/net?id=472ff5be61f9593ee2d3ebbd716768e14de4659d'>commit</a><a href='/cgit.cgi/linux/net-next.git/diff/include/net?id=472ff5be61f9593ee2d3ebbd716768e14de4659d'>diff</a></td><td class='form'><form class='right' method='get' action='/cgit.cgi/linux/net-next.git/log/include/net'>
<input type='hidden' name='id' value='472ff5be61f9593ee2d3ebbd716768e14de4659d'/><input type='hidden' name='showmsg' value='1'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/cgit.cgi/linux/net-next.git/log/?id=472ff5be61f9593ee2d3ebbd716768e14de4659d&amp;showmsg=1'>root</a>/<a href='/cgit.cgi/linux/net-next.git/log/include?id=472ff5be61f9593ee2d3ebbd716768e14de4659d&amp;showmsg=1'>include</a>/<a href='/cgit.cgi/linux/net-next.git/log/include/net?id=472ff5be61f9593ee2d3ebbd716768e14de4659d&amp;showmsg=1'>net</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/cgit.cgi/linux/net-next.git/log/include/net?id=472ff5be61f9593ee2d3ebbd716768e14de4659d'>Collapse</a>)</th><th class='left'>Author</th><th class='left'>Files</th><th class='left'>Lines</th></tr>
<tr class='logheader'><td><span title='2017-02-07 11:19:00 -0500'>2017-02-07</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/include/net?id=69629464e0b587f3711739b3aa2bcdaf2e075276'>udp: properly cope with csum errors</a></td><td>Eric Dumazet</td><td>1</td><td><span class='deletions'>-1</span>/<span class='insertions'>+3</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Dmitry reported that UDP sockets being destroyed would trigger the
WARN_ON(atomic_read(&amp;sk-&gt;sk_rmem_alloc)); in inet_sock_destruct()

It turns out we do not properly destroy skb(s) that have wrong UDP
checksum.

Thanks again to syzkaller team.

Fixes : 7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")
Reported-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Cc: Paolo Abeni &lt;pabeni@redhat.com&gt;
Cc: Hannes Frederic Sowa &lt;hannes@stressinduktion.org&gt;
Acked-by: Paolo Abeni &lt;pabeni@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-04 19:44:22 -0500'>2017-02-04</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/include/net?id=d71b7896886345c53ef1d84bda2bc758554f5d61'>netlabel: out of bound access in cipso_v4_validate()</a></td><td>Eric Dumazet</td><td>1</td><td><span class='deletions'>-0</span>/<span class='insertions'>+4</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
syzkaller found another out of bound access in ip_options_compile(),
or more exactly in cipso_v4_validate()

Fixes: 20e2a8648596 ("cipso: handle CIPSO options correctly when NetLabel is disabled")
Fixes: 446fda4f2682 ("[NetLabel]: CIPSOv4 engine")
Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Reported-by: Dmitry Vyukov  &lt;dvyukov@google.com&gt;
Cc: Paul Moore &lt;paul@paul-moore.com&gt;
Acked-by: Paul Moore &lt;paul@paul-moore.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-01-31 13:16:59 -0500'>2017-01-31</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/include/net?id=90427ef5d2a4b9a24079889bf16afdcdaebc4240'>ipv6: fix flow labels when the traffic class is non-0</a></td><td>Dimitris Michailidis</td><td>1</td><td><span class='deletions'>-0</span>/<span class='insertions'>+5</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
ip6_make_flowlabel() determines the flow label for IPv6 packets. It's
supposed to be passed a flow label, which it returns as is if non-0 and
in some other cases, otherwise it calculates a new value.

The problem is callers often pass a flowi6.flowlabel, which may also
contain traffic class bits. If the traffic class is non-0
ip6_make_flowlabel() mistakes the non-0 it gets as a flow label and
returns the whole thing. Thus it can return a 'flow label' longer than
20b and the low 20b of that is typically 0 resulting in packets with 0
label. Moreover, different packets of a flow may be labeled differently.
For a TCP flow with ECN non-payload and payload packets get different
labels as exemplified by this pair of consecutive packets:

(pure ACK)
Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
    0110 .... = Version: 6
    .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
        .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
        .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    .... .... .... 0001 1100 1110 0100 1001 = Flow Label: 0x1ce49
    Payload Length: 32
    Next Header: TCP (6)

(payload)
Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
    0110 .... = Version: 6
    .... 0000 0010 .... .... .... .... .... = Traffic Class: 0x02 (DSCP: CS0, ECN: ECT(0))
        .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
        .... .... ..10 .... .... .... .... .... = Explicit Congestion Notification: ECN-Capable Transport codepoint '10' (2)
    .... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
    Payload Length: 688
    Next Header: TCP (6)

This patch allows ip6_make_flowlabel() to be passed more than just a
flow label and has it extract the part it really wants. This was simpler
than modifying the callers. With this patch packets like the above become

Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
    0110 .... = Version: 6
    .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
        .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
        .... .... ..00 .... .... .... .... .... = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    .... .... .... 1010 1111 1010 0101 1110 = Flow Label: 0xafa5e
    Payload Length: 32
    Next Header: TCP (6)

Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
    0110 .... = Version: 6
    .... 0000 0010 .... .... .... .... .... = Traffic Class: 0x02 (DSCP: CS0, ECN: ECT(0))
        .... 0000 00.. .... .... .... .... .... = Differentiated Services Codepoint: Default (0)
        .... .... ..10 .... .... .... .... .... = Explicit Congestion Notification: ECN-Capable Transport codepoint '10' (2)
    .... .... .... 1010 1111 1010 0101 1110 = Flow Label: 0xafa5e
    Payload Length: 688
    Next Header: TCP (6)

Signed-off-by: Dimitris Michailidis &lt;dmichail@google.com&gt;
Acked-by: Eric Dumazet &lt;edumazet@google.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>