aboutsummaryrefslogtreecommitdiff
path: root/drivers/media
AgeCommit message (Collapse)AuthorFilesLines
2019-03-20media: ov7670: don't access registers when the device is powered offAkinobu Mita1-5/+26
Since commit 3d6a8fe25605 ("media: ov7670: hook s_power onto v4l2 core"), the device is actually powered off while the video stream is stopped. So now set_format and s_frame_interval could be called while the device is powered off, but these callbacks try to change the register settings at this time. The frame format and framerate will be restored right after power-up, so we can just postpone applying these changes at these callbacks if the device is not powered up. Fixes: 3d6a8fe25605 ("media: ov7670: hook s_power onto v4l2 core") Cc: Jonathan Corbet <[email protected]> Signed-off-by: Akinobu Mita <[email protected]> Reviewed-by: Lubomir Rintel <[email protected]> Tested-by: Lubomir Rintel <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-20media: ov7670: restore default settings after power-upAkinobu Mita1-0/+1
Since commit 3d6a8fe25605 ("media: ov7670: hook s_power onto v4l2 core"), the device is actually powered off while the video stream is stopped. The frame format and framerate are restored right after power-up, but restoring the default register settings is forgotten. Fixes: 3d6a8fe25605 ("media: ov7670: hook s_power onto v4l2 core") Cc: Jonathan Corbet <[email protected]> Signed-off-by: Akinobu Mita <[email protected]> Reviewed-by: Lubomir Rintel <[email protected]> Tested-by: Lubomir Rintel <[email protected]> Signed-off-by: Sakari Ailus <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-20media: vicodec: reset last_src/dst_buf based on the IS_OUTPUTHans Verkuil1-2/+5
When start_streaming was called both last_src_buf and last_dst_buf pointers were set to NULL, but this depends on whether the capture or output queue starts streaming. When decoding with resolution changes in between the capture queue has to restart streaming whenever a resolution change occurs. And that would reset last_src_buf as well, which causes a problem if the decoder was stopped by the application. Since last_src_buf is now NULL, the LAST flag is never set for the last capture buffer. Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-20media: vicodec: remove WARN_ON(1) from get_q_data()Hans Verkuil1-1/+0
Some functions like enum_fmt use the buffer type as was passed from userspace, which might cause the switch to fall into the default case. Just drop the WARN_ON(1) to avoid kernel log pollution. Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: em28xx-input: make const array addr_list staticColin Ian King1-1/+1
Don't populate the array addr_list on the stack but instead make it static. Makes the object code smaller by 20 bytes Before: text data bss dec hex filename^M 16929 3626 384 20939 51cb ../usb/em28xx/em28xx-input.o After: text data bss dec hex filename^M 16829 3706 384 20919 51b7 ../usb/em28xx/em28xx-input.o (gcc version 8.3.0, aarch64) Signed-off-by: Colin Ian King <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: dvb: Add support for the Avermedia TD310Jose Alberto Reguero2-6/+26
This patch add support for Avermedia TD310 usb stick. Signed-off-by: Jose Alberto Reguero <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: dvb: init i2c already in it930x_frontend_attachAndreas Kemnade1-42/+42
i2c bus is already needed when the frontend is probed, so init it already in it930x_frontend_attach. That prevents errors like: si2168: probe of 6-0067 failed with error -5 Signed-off-by: Andreas Kemnade <[email protected]> Signed-off-by: Jose Alberto Reguero <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: si2165: fix a missing check of return valueKangjie Lu1-3/+5
si2165_readreg8() may fail. Looking into si2165_readreg8(), we will find that "val_tmp" will be an uninitialized value when regmap_read() fails. "val_tmp" is then assigned to "val". So if si2165_readreg8() fails, "val" will be a random value. Further use will lead to undefined behaviors. The fix checks if si2165_readreg8() fails, and if so, returns its error code upstream. Signed-off-by: Kangjie Lu <[email protected]> Reviewed-by: Matthias Schwarzott <[email protected]> Tested-by: Matthias Schwarzott <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: serial_ir: Fix use-after-free in serial_ir_init_moduleYueHaibing1-8/+1
Syzkaller report this: BUG: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468 Read of size 8 at addr ffff8881dc7ae030 by task syz-executor.0/6249 CPU: 1 PID: 6249 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xfa/0x1ce lib/dump_stack.c:113 print_address_description+0x65/0x270 mm/kasan/report.c:187 kasan_report+0x149/0x18d mm/kasan/report.c:317 ? 0xffffffffc1728000 sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468 sysfs_remove_file include/linux/sysfs.h:519 [inline] driver_remove_file+0x40/0x50 drivers/base/driver.c:122 remove_bind_files drivers/base/bus.c:585 [inline] bus_remove_driver+0x186/0x220 drivers/base/bus.c:725 driver_unregister+0x6c/0xa0 drivers/base/driver.c:197 serial_ir_init_module+0x169/0x1000 [serial_ir] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462e99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9450132c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003 RBP: 00007f9450132c70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94501336bc R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004 Allocated by task 6249: set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495 kmalloc include/linux/slab.h:545 [inline] kzalloc include/linux/slab.h:740 [inline] bus_add_driver+0xc0/0x610 drivers/base/bus.c:651 driver_register+0x1bb/0x3f0 drivers/base/driver.c:170 serial_ir_init_module+0xe8/0x1000 [serial_ir] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 6249: set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:457 slab_free_hook mm/slub.c:1430 [inline] slab_free_freelist_hook mm/slub.c:1457 [inline] slab_free mm/slub.c:3005 [inline] kfree+0xe1/0x270 mm/slub.c:3957 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:67 [inline] kobject_put+0x146/0x240 lib/kobject.c:708 bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732 driver_unregister+0x6c/0xa0 drivers/base/driver.c:197 serial_ir_init_module+0x14c/0x1000 [serial_ir] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881dc7ae000 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 48 bytes inside of 256-byte region [ffff8881dc7ae000, ffff8881dc7ae100) The buggy address belongs to the page: page:ffffea000771eb80 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0 flags: 0x2fffc0000000200(slab) raw: 02fffc0000000200 ffffea0007d14800 0000000400000002 ffff8881f6c02e00 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881dc7adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881dc7adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8881dc7ae000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881dc7ae080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881dc7ae100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 There are already cleanup handlings in serial_ir_init error path, no need to call serial_ir_exit do it again in serial_ir_init_module, otherwise will trigger a use-after-free issue. Fixes: fa5dc29c1fcc ("[media] lirc_serial: move out of staging and rename to serial_ir") Reported-by: Hulk Robot <[email protected]> Signed-off-by: YueHaibing <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: rc: remove unused including <linux/version.h>YueHaibing1-1/+0
Remove including <linux/version.h> that don't need it. Signed-off-by: YueHaibing <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: cx23885: check allocation returnNicholas Mc Guire1-2/+3
Checking of kmalloc() seems to have been committed - as cx23885_dvb_register() is checking for != 0 return, returning -ENOMEM should be fine here. While at it address the coccicheck suggestion to move to kmemdup rather than using kmalloc+memcpy. Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2") Signed-off-by: Nicholas Mc Guire <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: m88ds3103: serialize reset messages in m88ds3103_set_frontendJames Hutchinson1-5/+4
Ref: https://bugzilla.kernel.org/show_bug.cgi?id=199323 Users are experiencing problems with the DVBSky S960/S960C USB devices since the following commit: 9d659ae: ("locking/mutex: Add lock handoff to avoid starvation") The device malfunctions after running for an indeterminable period of time, and the problem can only be cleared by rebooting the machine. It is possible to encourage the problem to surface by blocking the signal to the LNB. Further debugging revealed the cause of the problem. In the following capture: - thread #1325 is running m88ds3103_set_frontend - thread #42 is running ts2020_stat_work a> [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 07 80 [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 08 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 68 3f [42] usb 1-1: dvb_usb_v2_generic_io: <<< 08 ff [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 3d [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff b> [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 07 00 [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 21 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 66 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11 [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 60 02 10 0b [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07 Two i2c messages are sent to perform a reset in m88ds3103_set_frontend: a. 0x07, 0x80 b. 0x07, 0x00 However, as shown in the capture, the regmap mutex is being handed over to another thread (ts2020_stat_work) in between these two messages. >From here, the device responds to every i2c message with an 07 message, and will only return to normal operation following a power cycle. Use regmap_multi_reg_write to group the two reset messages, ensuring both are processed before the regmap mutex is unlocked. Signed-off-by: James Hutchinson <[email protected]> Reviewed-by: Antti Palosaari <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: dvbsky: Avoid leaking dvb frontendStefan Brüns1-8/+10
Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <[email protected]> Signed-off-by: Sean Young <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: wl128x: Fix an error code in fm_download_firmware()Dan Carpenter1-2/+3
We forgot to set "ret" on this error path. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: i2c: adv748x: select V4L2_FWNODEArnd Bergmann1-0/+1
Building adv748x fails now unless V4L2_FWNODE is selected: drivers/media/i2c/adv748x/adv748x-core.o: In function `adv748x_probe': adv748x-core.c:(.text+0x1b2c): undefined reference to `v4l2_fwnode_endpoint_parse' Fixes: 6a18865da8e3 ("media: i2c: adv748x: store number of CSI-2 lanes described in device tree") Signed-off-by: Arnd Bergmann <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Reviewed-by: Niklas Söderlund <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: strscpy() returns a negative value on failure unlike strlcpy().Hans Petter Selasky1-1/+1
strscpy() returns a negative value on failure unlike strlcpy(), so fix the WARN_ON accordingly. Signed-off-by: Hans Petter Selasky <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [[email protected]: added commit message] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vimc: stream: init/terminate the first entityHelen Fornazier1-10/+16
The s_stream callback was not being called for the first entity in the stream pipeline array. Instead of verifying the type of the node (video or subdevice) and calling s_stream from the second entity in the pipeline, do this process for all the entities in the pipeline for consistency. The previous code was not a problem because the first entity is a video device and not a subdevice, but this patch prepares vimc to allow setting some configuration in the entity before calling s_stream. Signed-off-by: Helen Koike <[email protected]> Tested-by: André Almeida <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [[email protected]: fix line-too-long warning] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vimc: stream: add docs to struct vimc_streamHelen Fornazier1-0/+15
Add missing documentation for struct vimc_stream Signed-off-by: Helen Koike <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vimc: stream: cleanup frame field from struct vimc_streamHelen Fornazier2-7/+4
There is no need to have the frame field in the vimc_stream struct. Signed-off-by: Helen Koike <[email protected]> Tested-by: André Almeida <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vimc: cap: fix step width/height in enum framesizeHelen Fornazier1-2/+2
The type V4L2_FRMSIZE_TYPE_CONTINUOUS expects a step of 1. This fixes v4l2-compliance test error: fail: v4l2-test-formats.cpp(184): invalid step_width/height for continuous framesize test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: FAIL Signed-off-by: Helen Koike <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vimc: stream: fix thread state before sleepHelen Fornazier1-1/+1
The state TASK_UNINTERRUPTIBLE should be set just before schedule_timeout() call, so it knows the sleep mode it should enter. There is no point in setting TASK_UNINTERRUPTIBLE at the initialization of the thread as schedule_timeout() will set the state back to TASK_RUNNING. This fixes a warning in __might_sleep() call, as it's expecting the task to be in TASK_RUNNING state just before changing the state to a sleeping state. Reported-by: Hans Verkuil <[email protected]> Signed-off-by: Helen Koike <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vimc: deb: fix default sink bayer formatHelen Fornazier1-1/+1
The format of the sink pad should be a bayer mbus format. This fixes a kernel NULL pointer dereference error that was caused when the stream starts because the configured format was not found in the pixelmap table. Reported-by: Hans Verkuil <[email protected]> Signed-off-by: Helen Koike <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: videobuf2: Return error after allocation failureSouptick Joarder1-5/+5
There is no point to continuing assignment after memory allocation failed, rather throw error immediately. Signed-off-by: Souptick Joarder <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [[email protected]: rebase and remove empty line before the if] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: gspca: do not resubmit URBs when streaming has stoppedHans Verkuil1-2/+6
When streaming is stopped all URBs are killed, but in fill_frame and in bulk_irq this results in an attempt to resubmit the killed URB. That is not what you want and causes spurious kernel messages. So check if streaming has stopped before resubmitting. Also check against gspca_dev->streaming rather than vb2_start_streaming_called() since vb2_start_streaming_called() will return true when in stop_streaming, but gspca_dev->streaming is set to false when stop_streaming is called. Fixes: 6992effe5344 ("gspca: Kill all URBs before releasing any of them") Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: au0828: minor fix to a misleading comment in _close()Shuah Khan1-2/+2
Fix a misleading comment in _close() and a spelling error. Reviewed-by: Niklas Söderlund <[email protected]> Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: replace WARN_ON in __media_pipeline_start()Shuah Khan1-1/+4
__media_pipeline_start() does WARN_ON() when active pipe doesn't match the input arg entity's pipe. Replace WARN_ON with a conditional and error message that includes names of both entities. Signed-off-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vicodec: avoid clang frame size warningArnd Bergmann1-11/+18
Clang-9 makes some different inlining decisions compared to gcc, which leads to a warning about a possible stack overflow problem when building with CONFIG_KASAN, including when setting asan-stack=0, which avoids most other frame overflow warnings: drivers/media/platform/vicodec/codec-fwht.c:673:12: error: stack frame size of 2224 bytes in function 'encode_plane' Manually adding noinline_for_stack annotations in those functions called by encode_plane() or decode_plane() that require a significant amount of kernel stack makes this impossible to happen with any compiler. Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: cx18: update *pos correctly in cx18_read_pos()Dan Carpenter1-1/+1
We should be updating *pos. The current code is a no-op. Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: ivtv: update *pos correctly in ivtv_read_pos()Dan Carpenter1-1/+1
We had intended to update *pos, but the current code is a no-op. Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: go7007: avoid clang frame overflow warning with KASANArnd Bergmann1-2/+2
clang-8 warns about one function here when KASAN is enabled, even without the 'asan-stack' option: drivers/media/usb/go7007/go7007-fw.c:1551:5: warning: stack frame size of 2656 bytes in function I have reported this issue in the llvm bugzilla, but to make it work with the clang-8 release, a small annotation is still needed. Link: https://bugs.llvm.org/show_bug.cgi?id=38809 Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [[email protected]: fix checkpatch warning] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: saa7146: avoid high stack usage with clangArnd Bergmann2-6/+4
Two saa7146/hexium files contain a construct that causes a warning when built with clang: drivers/media/pci/saa7146/hexium_orion.c:210:12: error: stack frame size of 2272 bytes in function 'hexium_probe' [-Werror,-Wframe-larger-than=] static int hexium_probe(struct saa7146_dev *dev) ^ drivers/media/pci/saa7146/hexium_gemini.c:257:12: error: stack frame size of 2304 bytes in function 'hexium_attach' [-Werror,-Wframe-larger-than=] static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info) ^ This one happens regardless of KASAN, and the problem is that a constructor to initialize a dynamically allocated structure leads to a copy of that structure on the stack, whereas gcc initializes it in place. Link: https://bugs.llvm.org/show_bug.cgi?id=40776 Signed-off-by: Arnd Bergmann <[email protected]> Reviewed-by: Nick Desaulniers <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [[email protected]: fix checkpatch warnings] Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: atmel-isc: Add support for BT656 with CRC decodingKen Sloat2-1/+8
The ISC driver currently supports ITU-R 601 encoding which utilizes the external hsync and vsync signals. ITU-R 656 format removes the need for these pins by embedding the sync pulses within the data packet. To support this feature, enable necessary register bits when this feature is enabled via device tree. Signed-off-by: Ken Sloat <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vb2: drop VB2_BUF_STATE_REQUEUEINGHans Verkuil2-13/+3
The last user of this state has been converted, so we can now drop this. Requeueing causes the queue to become unordered, which causes problems with requests and (in the future) fences. Since it is no longer needed, just get rid of this. Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: cobalt: replace VB2_BUF_STATE_REQUEUEING by _ERRORHans Verkuil1-1/+1
The cobalt driver is the only driver that uses VB2_BUF_STATE_REQUEUEING. Replace it by VB2_BUF_STATE_ERROR so we can drop support for the REQUEUEING state. The requeueing state was used in the cobalt driver to optimize buffer handling while waiting for a valid signal: by requeueing buffers internally there was no need for userspace to handle and requeue buffers with the ERROR flag set. However, requeueing also makes the buffer handling unordered, which is generally a bad idea. Requeueing also does not work with requests and any future fence support. Since it is really a minor optimization in the cobalt driver it is best to just return the buffer in an ERROR state. With this change support for requeueing can now be removed in vb2. Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: stm32-dcmi: fix DMA corruption when stopping streamingHugues Fruchet1-0/+17
Avoid call of dmaengine_terminate_all() between dmaengine_prep_slave_single() and dmaengine_submit() by locking the whole DMA submission sequence. Signed-off-by: Hugues Fruchet <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: stm32-dcmi: fix check of pm_runtime_get_sync return valueHugues Fruchet1-3/+3
Start streaming was sometimes failing because of pm_runtime_get_sync() non-0 return value. In fact return value was not an error but a positive value (1), indicating that PM was already enabled. Fix this by going to error path only with negative return value. Signed-off-by: Hugues Fruchet <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: platform/sh_veu.c: remove redundant NULL pointer checksShaobo He1-6/+0
Function `sh_veu_find_fmt` returns an address that is an addition of a base pointer `sh_veu_fmt` and an offset. The base pointer refers to a global variable of which address cannot be NULL. Therefore, this commit removes the NULL pointer checks on the return values of function `sh_veu_find_fmt`. Signed-off-by: Shaobo He <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: cpia2: Fix use-after-free in cpia2_exitYueHaibing1-2/+1
Syzkaller report this: BUG: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468 Read of size 8 at addr ffff8881f59a6b70 by task syz-executor.0/8363 CPU: 0 PID: 8363 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xfa/0x1ce lib/dump_stack.c:113 print_address_description+0x65/0x270 mm/kasan/report.c:187 kasan_report+0x149/0x18d mm/kasan/report.c:317 sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468 sysfs_remove_file include/linux/sysfs.h:519 [inline] driver_remove_file+0x40/0x50 drivers/base/driver.c:122 usb_remove_newid_files drivers/usb/core/driver.c:212 [inline] usb_deregister+0x12a/0x3b0 drivers/usb/core/driver.c:1005 cpia2_exit+0xa/0x16 [cpia2] __do_sys_delete_module kernel/module.c:1018 [inline] __se_sys_delete_module kernel/module.c:961 [inline] __x64_sys_delete_module+0x3dc/0x5e0 kernel/module.c:961 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462e99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f86f3754c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000300 RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f86f37556bc R13: 00000000004bcca9 R14: 00000000006f6b48 R15: 00000000ffffffff Allocated by task 8363: set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495 kmalloc include/linux/slab.h:545 [inline] kzalloc include/linux/slab.h:740 [inline] bus_add_driver+0xc0/0x610 drivers/base/bus.c:651 driver_register+0x1bb/0x3f0 drivers/base/driver.c:170 usb_register_driver+0x267/0x520 drivers/usb/core/driver.c:965 0xffffffffc1b4817c do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 8363: set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:457 slab_free_hook mm/slub.c:1430 [inline] slab_free_freelist_hook mm/slub.c:1457 [inline] slab_free mm/slub.c:3005 [inline] kfree+0xe1/0x270 mm/slub.c:3957 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:67 [inline] kobject_put+0x146/0x240 lib/kobject.c:708 bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732 driver_unregister+0x6c/0xa0 drivers/base/driver.c:197 usb_register_driver+0x341/0x520 drivers/usb/core/driver.c:980 0xffffffffc1b4817c do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881f59a6b40 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 48 bytes inside of 256-byte region [ffff8881f59a6b40, ffff8881f59a6c40) The buggy address belongs to the page: page:ffffea0007d66980 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0 flags: 0x2fffc0000000200(slab) raw: 02fffc0000000200 dead000000000100 dead000000000200 ffff8881f6c02e00 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881f59a6a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881f59a6a80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc >ffff8881f59a6b00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8881f59a6b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881f59a6c00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc cpia2_init does not check return value of cpia2_init, if it failed in usb_register_driver, there is already cleanup using driver_unregister. No need call cpia2_usb_cleanup on module exit. Reported-by: Hulk Robot <[email protected]> Signed-off-by: YueHaibing <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: mtk-vcodec: fix access to vb2_v4l2_buffer structAlexandre Courbot1-2/+2
Commit 0650a91499e0 ("media: mtk-vcodec: Correct return type for mem2mem buffer helpers") fixed the return types for mem2mem buffer helper functions, but omitted two occurrences that are accessed in the mtk_v4l2_debug() macro. These only trigger compiler errors when DEBUG is defined. Fixes: 0650a91499e0 ("media: mtk-vcodec: Correct return type for mem2mem buffer helpers") Signed-off-by: Alexandre Courbot <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: rcar-vin: Enable support for r8a774a1Biju Das1-0/+4
Add the SoC specific information for RZ/G2M(r8a774a1) SoC. The VIN module of RZ/G2M is similar to R-Car M3-W. Signed-off-by: Biju Das <[email protected]> Reviewed-by: Fabrizio Castro <[email protected]> Acked-by: Niklas Söderlund <[email protected]> Reviewed-by: Simon Horman <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: rcar-csi2: Enable support for r8a774a1Biju Das1-0/+4
Add the MIPI CSI-2 driver support for RZ/G2M(r8a774a1) SoC. The CSI-2 module of RZ/G2M is similar to R-Car M3-W. Signed-off-by: Biju Das <[email protected]> Reviewed-by: Fabrizio Castro <[email protected]> Acked-by: Niklas Söderlund <[email protected]> Reviewed-by: Simon Horman <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: rcar_drif: Remove devm_ioremap_resource() error printingGeert Uytterhoeven1-5/+3
devm_ioremap_resource() already prints an error message on failure, so there is no need to repeat that. Signed-off-by: Geert Uytterhoeven <[email protected]> Reviewed-by: Niklas Söderlund <[email protected]> Reviewed-by: Simon Horman <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: rcar-vin: Fix lockdep warning at stream onNiklas Söderlund1-11/+32
Changes to v4l2-fwnode in commit [1] triggered a lockdep warning in rcar-vin. The first attempt to solve this warning in the rcar-vin driver was incomplete and only pushed the warning to happen at stream on time instead of at probe time. This change reverts the incomplete fix and properly fixes the warning by removing the need to hold the rcar-vin specific group lock when calling v4l2_async_notifier_parse_fwnode_endpoints_by_port(). And instead takes it in the callback where it's really needed. [1] commit eae2aed1eab9bf08 ("media: v4l2-fwnode: Switch to v4l2_async_notifier_add_subdev") Fixes: 6458afc8c49148f0 ("media: rcar-vin: remove unneeded locking in async callbacks") Signed-off-by: Niklas Söderlund <[email protected]> Reviewed-by: Kieran Bingham <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vimc: use new release opHans Verkuil5-9/+46
Use the new v4l2_subdev_internal_ops release op to free the subdev memory only when the last user closed the file handle. Move v4l2_device_unregister_subdev() to the end of the vimc_ent_sd_unregister() function since now the unregister_subdev() call may free the vimc_ent_device struct which is used after the unregister_subdev() call. So this now has to be done last. Signed-off-by: Hans Verkuil <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vimc: free vimc_cap_device when the last user disappearsHans Verkuil1-3/+10
Don't free vimc_cap_device immediately, instead do this in the video_device release function which is called when the last user closes the video device. Only then is it safe to free the memory. Signed-off-by: Hans Verkuil <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vimc: zero the media_device on probeHans Verkuil1-0/+2
The media_device is part of a static global vimc_device struct. The media framework expects this to be zeroed before it is used, however, since this is a global this is not the case if vimc is unbound and then bound again. So call memset to ensure any left-over values are cleared. Signed-off-by: Hans Verkuil <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: v4l2-subdev: handle module refcounting hereHans Verkuil2-41/+9
The module ownership refcounting was done in media_entity_get/put, but that was very confusing and it did not work either in case an application had a v4l-subdevX device open and the module was unbound. When the v4l-subdevX device was closed the media_entity_put was never called and the module refcount was left one too high, making it impossible to unload it. Since v4l2-subdev.c was the only place where media_entity_get/put was called, just move the functionality to v4l2-subdev.c and drop those confusing entity functions. Store the module in subdev_fh so module_put no longer depends on the media_entity struct. Signed-off-by: Hans Verkuil <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: v4l2-subdev: add release() internal opHans Verkuil1-5/+14
If the subdevice created a device node, then the v4l2_subdev cannot be freed until the last user of the device node closes it. This means that we need a release() callback in v4l2_subdev_internal_ops that is called from the video_device release function so the subdevice driver can postpone freeing memory until the that callback is called. If no video device node was created then the release callback can be called immediately when the subdev is unregistered. Signed-off-by: Hans Verkuil <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vim2m: replace devm_kzalloc by kzallocHans Verkuil1-13/+22
It is not possible to use devm_kzalloc since that memory is freed immediately when the device instance is unbound. Various objects like the video device may still be in use since someone has the device node open, and when that is closed it expects the memory to be around. So use kzalloc and release it at the appropriate time. Signed-off-by: Hans Verkuil <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2019-03-19media: vivid: use vzalloc for dev->bitmap_outHans Verkuil1-5/+9
When vivid is unloaded it used vfree to free dev->bitmap_out, but it was actually allocated using kmalloc. Use vzalloc instead, conform what vivid-vid-cap.c does. Signed-off-by: Hans Verkuil <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.