aboutsummaryrefslogtreecommitdiff
path: root/drivers/media
AgeCommit message (Collapse)AuthorFilesLines
2023-05-25media: mtk-jpeg: move data/code inside CONFIG_OF blocksRandy Dunlap1-413/+415
Lots of data and functions here are not needed when CONFIG_OF is not set, so move them inside #ifdef CONFIG_OF blocks to prevent the warnings. ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1645:29: warning: ‘mtk_jpeg_clocks’ defined but not used [-Wunused-variable] 1645 | static struct clk_bulk_data mtk_jpeg_clocks[] = { ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1640:29: warning: ‘mt8173_jpeg_dec_clocks’ defined but not used [-Wunused-variable] 1640 | static struct clk_bulk_data mt8173_jpeg_dec_clocks[] = { ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1481:20: warning: ‘mtk_jpeg_dec_irq’ defined but not used [-Wunused-function] 1481 | static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv) ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1461:20: warning: ‘mtk_jpeg_enc_irq’ defined but not used [-Wunused-function] 1461 | static irqreturn_t mtk_jpeg_enc_irq(int irq, void *priv) ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1180:13: warning: ‘mtk_jpegdec_worker’ defined but not used [-Wunused-function] 1180 | static void mtk_jpegdec_worker(struct work_struct *work) ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:986:13: warning: ‘mtk_jpegenc_worker’ defined but not used [-Wunused-function] 986 | static void mtk_jpegenc_worker(struct work_struct *work) ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:79:28: warning: ‘mtk_jpeg_dec_formats’ defined but not used [-Wunused-variable] 79 | static struct mtk_jpeg_fmt mtk_jpeg_dec_formats[] = { ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:31:28: warning: ‘mtk_jpeg_enc_formats’ defined but not used [-Wunused-variable] 31 | static struct mtk_jpeg_fmt mtk_jpeg_enc_formats[] = { ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1222:20: warning: ‘mtk_jpeg_enc_done’ defined but not used [-Wunused-function] 1222 | static irqreturn_t mtk_jpeg_enc_done(struct mtk_jpeg_dev *jpeg) ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1072:12: warning: ‘mtk_jpegdec_set_hw_param’ defined but not used [-Wunused-function] 1072 | static int mtk_jpegdec_set_hw_param(struct mtk_jpeg_ctx *ctx, ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1060:12: warning: ‘mtk_jpegdec_put_hw’ defined but not used [-Wunused-function] 1060 | static int mtk_jpegdec_put_hw(struct mtk_jpeg_dev *jpeg, int hw_id) ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1038:12: warning: ‘mtk_jpegdec_get_hw’ defined but not used [-Wunused-function] 1038 | static int mtk_jpegdec_get_hw(struct mtk_jpeg_ctx *ctx) ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:977:12: warning: ‘mtk_jpegenc_put_hw’ defined but not used [-Wunused-function] 977 | static int mtk_jpegenc_put_hw(struct mtk_jpeg_dev *jpeg, int hw_id) ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:963:12: warning: ‘mtk_jpegenc_set_hw_param’ defined but not used [-Wunused-function] 963 | static int mtk_jpegenc_set_hw_param(struct mtk_jpeg_ctx *ctx, ../drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:941:12: warning: ‘mtk_jpegenc_get_hw’ defined but not used [-Wunused-function] 941 | static int mtk_jpegenc_get_hw(struct mtk_jpeg_ctx *ctx) Signed-off-by: Randy Dunlap <[email protected]> Reported-by: kernel test robot <[email protected]> Link: https://lore.kernel.org/linux-media/[email protected]/ Cc: Bin Liu <[email protected]> Cc: oushixiong <[email protected]> Cc: Mauro Carvalho Chehab <[email protected]> Cc: Hans Verkuil <[email protected]> Cc: [email protected] Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250Andrey Konovalov1-1/+5
From the experiments with camera sensors using SGRBG10_1X10/3280x2464 and SRGGB10_1X10/3280x2464 formats, it becomes clear that on sdm845 and sm8250 VFE outputs the lines padded to a length multiple of 16 bytes. As in the current driver the value of the bpl_alignment is set to 8 bytes, the frames captured in formats with the bytes-per-line value being not a multiple of 16 get corrupted. Set the bpl_alignment of the camss video output device to 16 for sdm845 and sm8250 to fix that. Signed-off-by: Andrey Konovalov <[email protected]> Tested-by: Bryan O'Donoghue <[email protected]> Acked-by: Bryan O'Donoghue <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: pci: remove unnecessary (void*) conversionsSu Hui4-7/+7
No need cast (void*) to (struct dst_state *), (struct cx18_stream *), (struct saa7164_port *) or (struct budget *). Signed-off-by: Su Hui <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: platform: Remove unnecessary (void*) conversionsSu Hui1-4/+4
No need cast (void*) to (struct stdemux *),(struct hva_h264_ctx *) or (struct hva_h264_task *). Signed-off-by: Su Hui <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: usb: remove unnecessary (void*) conversionsSu Hui2-9/+9
No need cast (void*) to (struct dvb_usb_device *) or (struct filter_info *). Signed-off-by: Su Hui <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [hverkuil: drop the obsolete dvb-usb/az6027.c and dvb-usb/pctv452e.c changes]
2023-05-25media: stk1160: Simplify the build config definitionLukas Bulwahn1-9/+3
Commit dfb9f94e8e5e ("[media] stk1160: Build as a module if SND is m and audio support is selected") had to introduce some complex config dependency handling to compile for all combinations of configs VIDEO_STK1160 and VIDEO_STK1160_AC97. Later, commit e36e6b5f26c1 ("[media] stk1160: Remove stk1160-mixer and setup internal AC97 codec automatically") removes the config VIDEO_STK1160_AC97, which renders the previous dependency handling unnecessary. The commit already simplified the dependency of the remaining config VIDEO_STK1160, but it misses the opportunity to merge VIDEO_STK1160 and VIDEO_STK1160_COMMON. So, do that now and simplify the build config definition of the STK1160 USB video capture support. Signed-off-by: Lukas Bulwahn <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: amphion: initiate a drain of the capture queue in dynamic resolution ↵Ming Qian4-8/+10
change The last buffer from before the change must be marked with the V4L2_BUF_FLAG_LAST flag, similarly to the Drain sequence above. initiate a drain of the capture queue in dynamic resolution change Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver") Signed-off-by: Ming Qian <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: common: saa7146: Avoid a leak in vmalloc_to_sg()Christophe JAILLET1-3/+3
Commit in Fixes turned a BUG() into a "normal" memory allocation failure. While at it, it introduced a memory leak. So fix it. Also update the comment on top of the function to reflect what has been change by the commit in Fixes. Fixes: 40e986c99624 ("media: common: saa7146: replace BUG_ON by WARN_ON") Signed-off-by: Christophe JAILLET <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25Revert "media: mediatek: vcodec: Fix bitstream crop information error"Nícolas F. R. A. Prado1-4/+4
This reverts commit cd61f3c6794bea2b717fe6083ca2ad189db75418. That commit's purpose was to prevent the padding from being decoded when userspace didn't set a selection, relying on the default one. However, as described in the Step 6 of the Initialization procedure for the Memory-to-Memory Stateful Video Encoder Interface [1]: "Set the visible resolution for the stream metadata via VIDIOC_S_SELECTION() on the OUTPUT queue if it is desired to be different than the full OUTPUT resolution." And from the Note: "To avoid encoding the padding, the client needs to explicitly configure this selection target" Hence the behavior in the original commit doesn't follow the interface and needs to be reverted. This fixes the following v4l2-compliance failure observed on mt8192-asurada-spherion: fail: v4l2-test-formats.cpp(924): sel.r.width != fmt.g_width() test VIDIOC_S_FMT: FAIL [1] https://www.kernel.org/doc/html/latest/userspace-api/media/v4l/dev-encoder.html#initialization Signed-off-by: Nícolas F. R. A. Prado <[email protected]> Tested-by: AngeloGioacchino Del Regno <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: vivid: Extend FPS rates offered by simulated webcamMax Staudt1-15/+34
This adds an option for higher frame rates from a simulated webcam. Currently, vivid emulates (amongst other things) a webcam with somewhat limited bandwidth - higher resolutions deliver fewer frames per second. $ yavta --enum-formats -c /dev/video0 Device /dev/video0 opened. Device `vivid' on `platform:vivid-000' (driver 'vivid') supports video, capture, without mplanes. - Available formats: Format 0: YUYV (56595559) Type: Video capture (1) Name: YUYV 4:2:2 Frame size: 320x180 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25, 1/15, 1/25, 1/30, 1/40, 1/50, 1/60) Frame size: 640x360 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25, 1/15, 1/25, 1/30, 1/40) Frame size: 640x480 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25, 1/15, 1/25) Frame size: 1280x720 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25) Frame size: 1920x1080 (1/1, 1/2, 1/4, 1/5) Frame size: 3840x2160 (1/1, 1/2) In some test cases, it is useful to allow for higher frame rates, as configurations such as 720p@30 FPS have become commonplace now. This patch allows: 0- 719p - 120fps 720-1079p - 60fps 1080-2159p - 30fps 2160p - 15fps $ yavta --enum-formats -c /dev/video0 Device /dev/video0 opened. Device `vivid' on `platform:vivid-000' (driver 'vivid') supports video, capture, without mplanes. - Available formats: Format 0: YUYV (56595559) Type: Video capture (1) Name: YUYV 4:2:2 Frame size: 320x180 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25, 1/15, 1/25, 1/30, 1/40, 1/50, 1/60, 1/120) Frame size: 640x360 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25, 1/15, 1/25, 1/30, 1/40, 1/50, 1/60, 1/120) Frame size: 640x480 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25, 1/15, 1/25, 1/30, 1/40, 1/50, 1/60, 1/120) Frame size: 1280x720 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25, 1/15, 1/25, 1/30, 1/40, 1/50, 1/60) Frame size: 1920x1080 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25, 1/15, 1/25, 1/30) Frame size: 3840x2160 (1/1, 1/2, 1/4, 1/5, 1/10, 2/25, 1/15) Passes: v4l2-compliance 1.25.0-5039 from v4l-utils git ccc08732823f Signed-off-by: Max Staudt <[email protected]> Reviewed-by: Ricardo Ribalda <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> [hverkuil: unsigned -> unsigned int]
2023-05-25media: amphion: drop repeated codec data for vc1g formatMing Qian1-0/+10
For format V4L2_PIX_FMT_VC1_ANNEX_G, the separate codec data is required only once. The repeated codec data may introduce some decoding error. so drop the repeated codec data. It's amphion vpu's limitation Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format") Signed-off-by: Ming Qian <[email protected]> Tested-by: xiahong.bao <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: amphion: drop repeated codec data for vc1l formatMing Qian1-0/+2
For format V4L2_PIX_FMT_VC1_ANNEX_L, the codec data is replaced with startcode, and then driver drop it, otherwise it may led to decoding error. It's amphion vpu's limitation Driver has dropped the first codec data, but need to drop the repeated codec data too. Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format") Signed-off-by: Ming Qian <[email protected]> Tested-by: xiahong.bao <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: verisilicon: Simplify error handling in tile_buffer_reallocate()Benjamin Gaignard1-14/+9
Rework allocation errors cases handling to simply it by removing useless tests. Signed-off-by: Benjamin Gaignard <[email protected]> Reported-by: Markus Elfring <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: usb: Check az6007_read() return valueDaniil Dulov1-1/+2
If az6007_read() returns error, there is no sence to continue. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter") Signed-off-by: Daniil Dulov <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: platform: mtk-mdp3: release node reference before returningDeepak R Varma1-4/+11
The iterator for_each_child_of_node() increments the refcount of the child node it is processing. Release such a reference when the loop needs to break due to an error during its execution. Issue identified using for_each_child.cocci Coccinelle semantic patch. Signed-off-by: Deepak R Varma <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-25media: platform: rzg2l-cru: rzg2l-csi2: Enclose the macro in parenthesesLad Prabhakar1-4/+4
Fix the below error reported by checkpatch: ERROR: Macros with complex values should be enclosed in parentheses CSIDPHYSKW0_UTIL_DL1_SKW_ADJ(1) | \ CSIDPHYSKW0_UTIL_DL2_SKW_ADJ(1) | \ CSIDPHYSKW0_UTIL_DL3_SKW_ADJ(1) Signed-off-by: Lad Prabhakar <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-23media: amphion: Use alloc_ordered_workqueue() to create ordered workqueuesTejun Heo2-2/+2
BACKGROUND ========== When multiple work items are queued to a workqueue, their execution order doesn't match the queueing order. They may get executed in any order and simultaneously. When fully serialized execution - one by one in the queueing order - is needed, an ordered workqueue should be used which can be created with alloc_ordered_workqueue(). However, alloc_ordered_workqueue() was a later addition. Before it, an ordered workqueue could be obtained by creating an UNBOUND workqueue with @max_active==1. This originally was an implementation side-effect which was broken by 4c16bd327c74 ("workqueue: restore WQ_UNBOUND/max_active==1 to be ordered"). Because there were users that depended on the ordered execution, 5c0338c68706 ("workqueue: restore WQ_UNBOUND/max_active==1 to be ordered") made workqueue allocation path to implicitly promote UNBOUND workqueues w/ @max_active==1 to ordered workqueues. While this has worked okay, overloading the UNBOUND allocation interface this way creates other issues. It's difficult to tell whether a given workqueue actually needs to be ordered and users that legitimately want a min concurrency level wq unexpectedly gets an ordered one instead. With planned UNBOUND workqueue updates to improve execution locality and more prevalence of chiplet designs which can benefit from such improvements, this isn't a state we wanna be in forever. This patch series audits all callsites that create an UNBOUND workqueue w/ @max_active==1 and converts them to alloc_ordered_workqueue() as necessary. WHAT TO LOOK FOR ================ The conversions are from alloc_workqueue(WQ_UNBOUND | flags, 1, args..) to alloc_ordered_workqueue(flags, args...) which don't cause any functional changes. If you know that fully ordered execution is not necessary, please let me know. I'll drop the conversion and instead add a comment noting the fact to reduce confusion while conversion is in progress. If you aren't fully sure, it's completely fine to let the conversion through. The behavior will stay exactly the same and we can always reconsider later. As there are follow-up workqueue core changes, I'd really appreciate if the patch can be routed through the workqueue tree w/ your acks. Thanks. Signed-off-by: Tejun Heo <[email protected]> Acked-by: Hans Verkuil <[email protected]> Cc: Ming Qian <[email protected]> Cc: Shijie Qin <[email protected]> Cc: Zhou Peng <[email protected]> Cc: Mauro Carvalho Chehab <[email protected]> Cc: [email protected] Signed-off-by: Tejun Heo <[email protected]>
2023-05-19Merge tag 'drm-misc-next-2023-05-11' of ↵Dave Airlie1-2/+2
git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-next for 6.5: UAPI Changes: Cross-subsystem Changes: - arch: Consolidate <asm/fb.h> Core Changes: - aperture: Ignore firmware framebuffers with non-primary devices - fbdev: Use fbdev's I/O helpers - sysfs: Expose DRM connector ID - tests: More tests for drm_rect Driver Changes: - armada: Implement fbdev emulation as a client - bridge: - fsl-ldb: Support i.MX6SX - lt9211: Remove blanking packets - lt9611: Remove blanking packets - tc358768: Implement input bus formats reporting, fix various timings and clocks settings - ti-sn65dsi86: Implement wait_hpd_asserted - nouveau: Improve NULL pointer checks before dereference - panel: - nt36523: Support Lenovo J606F - st7703: Support Anbernic RG353V-V2 - new panels: InnoLux G070ACE-L01 - sun4i: Fix MIPI-DSI dotclock - vc4: RGB Range toggle property, BT601 and BT2020 support for HDMI - vkms: Convert to drmm helpers, Add reflection and rotation support Signed-off-by: Dave Airlie <[email protected]> From: Maxime Ripard <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/2pxmxdzsk2ekjy6xvbpj67zrhtwvkkhfspuvdm5pfm5i54hed6@sooct7yq6z4w
2023-05-18media: coda: Use alloc_ordered_workqueue() to create ordered workqueuesTejun Heo1-1/+1
BACKGROUND ========== When multiple work items are queued to a workqueue, their execution order doesn't match the queueing order. They may get executed in any order and simultaneously. When fully serialized execution - one by one in the queueing order - is needed, an ordered workqueue should be used which can be created with alloc_ordered_workqueue(). However, alloc_ordered_workqueue() was a later addition. Before it, an ordered workqueue could be obtained by creating an UNBOUND workqueue with @max_active==1. This originally was an implementation side-effect which was broken by 4c16bd327c74 ("workqueue: restore WQ_UNBOUND/max_active==1 to be ordered"). Because there were users that depended on the ordered execution, 5c0338c68706 ("workqueue: restore WQ_UNBOUND/max_active==1 to be ordered") made workqueue allocation path to implicitly promote UNBOUND workqueues w/ @max_active==1 to ordered workqueues. While this has worked okay, overloading the UNBOUND allocation interface this way creates other issues. It's difficult to tell whether a given workqueue actually needs to be ordered and users that legitimately want a min concurrency level wq unexpectedly gets an ordered one instead. With planned UNBOUND workqueue updates to improve execution locality and more prevalence of chiplet designs which can benefit from such improvements, this isn't a state we wanna be in forever. This patch series audits all callsites that create an UNBOUND workqueue w/ @max_active==1 and converts them to alloc_ordered_workqueue() as necessary. WHAT TO LOOK FOR ================ The conversions are from alloc_workqueue(WQ_UNBOUND | flags, 1, args..) to alloc_ordered_workqueue(flags, args...) which don't cause any functional changes. If you know that fully ordered execution is not ncessary, please let me know. I'll drop the conversion and instead add a comment noting the fact to reduce confusion while conversion is in progress. If you aren't fully sure, it's completely fine to let the conversion through. The behavior will stay exactly the same and we can always reconsider later. As there are follow-up workqueue core changes, I'd really appreciate if the patch can be routed through the workqueue tree w/ your acks. Thanks. Signed-off-by: Tejun Heo <[email protected]> Reviewed-by: Philipp Zabel <[email protected]> Cc: Mauro Carvalho Chehab <[email protected]> Cc: [email protected]
2023-05-14media: dw2102: return -EIO instead of -1 for mac address read errorsMauro Carvalho Chehab1-3/+3
The dvb-usb core function only checks if the returned value is zero, so it doesn't actually matter the error code. Still, returning -1 as an error condition is something that we don't do upstream. So, change the logic to return -EIO in case of I2C transfer failures. Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-usb: remove unnecessary (void*) conversionsYu Zhe6-44/+38
Pointer variables of void * type do not require type cast. Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Yu Zhe <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: c8sectpfe: dvb: remove unnecessary (void*) conversionsYu Zhe1-2/+2
Pointer variables of void * type do not require type cast. Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Yu Zhe <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvbdev: fix most coding style issuesMauro Carvalho Chehab1-83/+74
As we're doing several changes here, address coding style issues, as reported by checkpatch.pl. Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221Hyunwoo Kim1-1/+36
If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()Takashi Iwai1-4/+12
Using a semaphore in the wait_event*() condition is no good idea. It hits a kernel WARN_ON() at prepare_to_wait_event() like: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait_event+0x6d/0x690 For avoiding the potential deadlock, rewrite to an open-coded loop instead. Unlike the loop in wait_event*(), this uses wait_woken() after the condition check, hence the task state stays consistent. CVE-2023-31084 was assigned to this bug. Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/ Link: https://lore.kernel.org/linux-media/[email protected] Reported-by: Yu Hao <[email protected]> Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084 Signed-off-by: Takashi Iwai <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-core: Fix use-after-free due to race at dvb_register_device()Hyunwoo Kim1-21/+63
dvb_register_device() dynamically allocates fops with kmemdup() to set the fops->owner. And these fops are registered in 'file->f_ops' using replace_fops() in the dvb_device_open() process, and kfree()d in dvb_free_device(). However, it is not common to use dynamically allocated fops instead of 'static const' fops as an argument of replace_fops(), and UAF may occur. These UAFs can occur on any dvb type using dvb_register_device(), such as dvb_dvr, dvb_demux, dvb_frontend, dvb_net, etc. So, instead of kfree() the fops dynamically allocated in dvb_register_device() in dvb_free_device() called during the .disconnect() process, kfree() it collectively in exit_dvbdev() called when the dvbdev.c module is removed. Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Hyunwoo Kim <[email protected]> Reported-by: kernel test robot <[email protected]> Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-core: Fix use-after-free due on race condition at dvb_netHyunwoo Kim1-3/+35
A race condition may occur between the .disconnect function, which is called when the device is disconnected, and the dvb_device_open() function, which is called when the device node is open()ed. This results in several types of UAFs. The root cause of this is that you use the dvb_device_open() function, which does not implement a conditional statement that checks 'dvbnet->exit'. So, add 'remove_mutex` to protect 'dvbnet->exit' and use locked_dvb_net_open() function to check 'dvbnet->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Hyunwoo Kim <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-core: Fix use-after-free on race condition at dvb_frontendHyunwoo Kim1-9/+44
If the device node of dvb_frontend is open() and the device is disconnected, many kinds of UAFs may occur when calling close() on the device node. The root cause of this is that wake_up() for dvbdev->wait_queue is implemented in the dvb_frontend_release() function, but wait_event() is not implemented in the dvb_frontend_stop() function. So, implement wait_event() function in dvb_frontend_stop() and add 'remove_mutex' which prevents race condition for 'fe->exit'. [mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic] Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Hyunwoo Kim <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID tableKrzysztof Kozlowski1-1/+1
The driver will match mostly by DT table (even thought there is regular ID table) so there is little benefit in of_match_ptr (this also allows ACPI matching via PRP0001, even though it might not be relevant here). This also fixes !CONFIG_OF error: drivers/media/dvb-frontends/mn88443x.c:782:34: error: ‘mn88443x_of_match’ defined but not used [-Werror=unused-const-variable=] Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Krzysztof Kozlowski <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()Hyunwoo Kim1-2/+1
Since dvb_frontend_detach() is not called in ttusb_dec_exit_dvb(), which is called when the device is disconnected, dvb_frontend_free() is not finally called. This causes a memory leak just by repeatedly plugging and unplugging the device. Fix this issue by adding dvb_frontend_detach() to ttusb_dec_exit_dvb(). Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Hyunwoo Kim <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb_ca_en50221: fix a size write bugYongSu Yoo1-5/+7
The function of "dvb_ca_en50221_write_data" at source/drivers/media /dvb-core/dvb_ca_en50221.c is used for two cases. The first case is for writing APDU data in the function of "dvb_ca_en50221_io_write" at source/drivers/media/dvb-core/ dvb_ca_en50221.c. The second case is for writing the host link buf size on the Command Register in the function of "dvb_ca_en50221_link_init" at source/drivers/media/dvb-core/dvb_ca_en50221.c. In the second case, there exists a bug like following. In the function of the "dvb_ca_en50221_link_init", after a TV host calculates the host link buf_size, the TV host writes the calculated host link buf_size on the Size Register. Accroding to the en50221 Spec (the page 60 of https://dvb.org/wp-content/uploads/2020/02/En50221.V1.pdf), before this writing operation, the "SW(CMDREG_SW)" flag in the Command Register should be set. We can see this setting operation in the function of the "dvb_ca_en50221_link_init" like below. ... if ((ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_SW)) != 0) return ret; ... But, after that, the real writing operation is implemented using the function of the "dvb_ca_en50221_write_data" in the function of "dvb_ca_en50221_link_init", and the "dvb_ca_en50221_write_data" includes the function of "ca->pub->write_cam_control", and the function of the "ca->pub->write_cam_control" in the function of the "dvb_ca_en50221_wrte_data" does not include "CMDREG_SW" flag like below. ... if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN | CMDREG_HC)) != 0) ... In the above source code, we can see only the "IRQEN | CMDREG_HC", but we cannot see the "CMDREG_SW". The "CMDREG_SW" flag which was set in the function of the "dvb_ca_en50221_link_init" was rollbacked by the follwoing function of the "dvb_ca_en50221_write_data". This is a bug. and this bug causes that the calculated host link buf_size is not properly written in the CI module. Through this patch, we fix this bug. Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: YongSu Yoo <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: netup_unidvb: fix irq init by register it at the end of probeWei Chen1-8/+9
IRQ handler netup_spi_interrupt() takes spinlock spi->lock. The lock is initialized in netup_spi_init(). However, irq handler is registered before initializing the lock. Spinlock dma->lock and i2c->lock suffer from the same problem. Fix this by registering the irq at the end of probe. Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Wei Chen <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_addressWei Chen1-1/+1
In su3000_read_mac_address, if i2c_transfer fails to execute two messages, array mac address will not be initialized. Without handling such error, later in function dvb_usb_adapter_dvb_init, proposed_mac is accessed before initialization. Fix this error by returning a negative value if message execution fails. Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Wei Chen <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()Wei Chen1-0/+4
In digitv_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach digitv_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Wei Chen <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xferZhang Shurong1-0/+20
In rtl28xxu_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach rtl28xxu_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Zhang Shurong <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()Wei Chen1-0/+8
In ce6230_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach ce6230_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Wei Chen <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()Wei Chen1-0/+12
In ec168_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. If accessing msg[i].buf[0] without sanity check, null pointer deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Wei Chen <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()Wei Chen1-0/+12
In az6027_i2c_xfer, msg is controlled by user. When msg[i].buf is null, commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") fix the null-ptr-deref bug when msg[i].addr is 0x99. However, null-ptr-deref also happens when msg[i].addr is 0xd0 and 0xc0. We add check on msg[i].len to prevent null-ptr-deref. Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: Wei Chen <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-14media: netup_unidvb: fix use-after-free at del_timer()Duoming Zhou1-1/+1
When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below: (cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | | ndev->pci_dev->dev //USE Fix by changing del_timer() to del_timer_sync(). Link: https://lore.kernel.org/linux-media/[email protected] Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver") Signed-off-by: Duoming Zhou <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-13media: dvb_demux: fix a bug for the continuity counterYongSu Yoo1-2/+2
In dvb_demux.c, some logics exist which compare the expected continuity counter and the real continuity counter. If they are not matched each other, both of the expected continuity counter and the real continuity counter should be printed. But there exists a bug that the expected continuity counter is not correctly printed. The expected continuity counter is replaced with the real countinuity counter + 1 so that the epected continuity counter is not correclty printed. This is wrong. This bug is fixed. Link: https://lore.kernel.org/linux-media/[email protected] Signed-off-by: YongSu Yoo <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-13media: pvrusb2: fix DVB_CORE dependencyArnd Bergmann1-0/+1
Now that DVB_CORE can be a loadable module, pvrusb2 can run into a link error: ld.lld: error: undefined symbol: dvb_module_probe >>> referenced by pvrusb2-devattr.c >>> drivers/media/usb/pvrusb2/pvrusb2-devattr.o:(pvr2_lgdt3306a_attach) in archive vmlinux.a ld.lld: error: undefined symbol: dvb_module_release >>> referenced by pvrusb2-devattr.c >>> drivers/media/usb/pvrusb2/pvrusb2-devattr.o:(pvr2_dual_fe_attach) in archive vmlinux.a Refine the Kconfig dependencies to avoid this case. Link: https://lore.kernel.org/linux-media/[email protected] Fixes: 7655c342dbc4 ("media: Kconfig: Make DVB_CORE=m possible when MEDIA_SUPPORT=y") Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2023-05-09Merge drm/drm-next into drm-misc-nextMaxime Ripard314-16714/+11732
Start the 6.5 release cycle. Signed-off-by: Maxime Ripard <[email protected]>
2023-05-08media: nxp: imx8-isi: fix buiding on 32-bitArnd Bergmann1-20/+21
The #if check is wrong, leading to a build failure: drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c: In function 'mxc_isi_channel_set_inbuf': drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c:33:5: error: "CONFIG_ARCH_DMA_ADDR_T_64BIT" is not defined, evaluates to 0 [-Werror=undef] 33 | #if CONFIG_ARCH_DMA_ADDR_T_64BIT | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ This could just be an #ifdef, but it seems nicer to just remove the check entirely. Apparently the only reason for the #ifdef is to avoid another warning: drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c:55:24: error: right shift count >= width of type [-Werror=shift-count-overflow] But this is best avoided by using the lower_32_bits()/upper_32_bits() helpers. Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") Signed-off-by: Arnd Bergmann <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2023-05-08fbdev: Validate info->screen_{base, buffer} in fb_ops implementationsThomas Zimmermann1-0/+3
Push the test for info->screen_base from fb_read() and fb_write() into the implementations of struct fb_ops.{fb_read,fb_write}. In cases where the driver operates on info->screen_buffer, test this field instead. While bothi fields, screen_base and screen_buffer, are stored in the same location, they refer to different address spaces. For correctness, we want to test each field in exactly the code that uses it. v2: * also test screen_base in pvr2fb (Geert) * also test screen_buffer in ivtvfb, arcfb, broadsheetfb, hecubafb, metronomefb and ssd1307fb (Geert) * give a rational for the change (Geert) Signed-off-by: Thomas Zimmermann <[email protected]> Tested-by: Sui Jingfeng <[email protected]> Reviewed-by: Javier Martinez Canillas <[email protected]> Acked-by: Helge Deller <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2023-05-08fbdev: Don't re-validate info->state in fb_ops implementationsThomas Zimmermann1-3/+0
The file-op entry points fb_read() and fb_write() verify that info->state has been set to FBINFO_STATE_RUNNING. Remove the same test from the implementations of struct fb_ops.{fb_read,fb_write}. v2: * also remove test from ivtvfb, braodsheetfb, hecubafb and metronomefb (Geert) Signed-off-by: Thomas Zimmermann <[email protected]> Tested-by: Sui Jingfeng <[email protected]> Reviewed-by: Javier Martinez Canillas <[email protected]> Reviewed-by: Geert Uytterhoeven <[email protected]> Acked-by: Helge Deller <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
2023-05-08media: platform: mtk-mdp3: work around unused-variable warningArnd Bergmann1-2/+1
When CONFIG_OF is disabled, the 'data' variable is not used at all because of_match_node() turns into a dummy macro: drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c: In function 'mdp_comp_sub_create': drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c:1038:36: error: unused variable 'data' [-Werror=unused-variable] 1038 | const struct mtk_mdp_driver_data *data = mdp->mdp_data; | ^~~~ Remove the variable again by moving the pointer dereference into the of_match_node call. Fixes: b385b991ef2f ("media: platform: mtk-mdp3: chip config split about subcomponents") Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-08media: nxp: ignore unused suspend operationsArnd Bergmann1-3/+3
gcc warns about some functions being unused when CONFIG_PM_SLEEP is disabled: drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:328:12: error: 'mxc_isi_pm_resume' defined but not used [-Werror=unused-function] 328 | static int mxc_isi_pm_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~ drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:314:12: error: 'mxc_isi_pm_suspend' defined but not used [-Werror=unused-function] 314 | static int mxc_isi_pm_suspend(struct device *dev) | ^~~~~~~~~~~~~~~~~~ Use the modern SYSTEM_SLEEP_PM_OPS()/RUNTIME_PM_OPS() helpers in place of the old SET_SYSTEM_SLEEP_PM_OPS()/SET_RUNTIME_PM_OPS() ones. By convention, use pm_ptr() to guard the reference to the operations. This makes no difference as long as the driver requires CONFIG_PM, but is what users of SET_RUNTIME_PM_OPS() are supposed to do. Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver") Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Arnd Bergmann <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-08media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATENiklas Söderlund1-3/+1
When adding proper support for V4L2_FIELD_ALTERNATE it was missed that this field format should trigger an interrupt for each field, not just for the whole frame. Fix this by marking it as progressive in the capture setup, which will then select the correct interrupt mode. Tested on both Gen2 and Gen3 with the result of a doubling of the frame rate for V4L2_FIELD_ALTERNATE. From a PAL video source the frame rate is now 50, which is expected for alternate field capture. Signed-off-by: Niklas Söderlund <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-08media: rcar-vin: Fix NV12 size alignmentNiklas Söderlund1-3/+9
When doing format validation for NV12 the width and height should be aligned to 32 pixels. Signed-off-by: Niklas Söderlund <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
2023-05-08media: rcar-vin: Gen3 can not scale NV12Niklas Söderlund1-0/+5
The VIN modules on Gen3 can not scale NV12, fail format validation if the user tries. Currently no frames are produced if this is attempted. Signed-off-by: Niklas Söderlund <[email protected]> Signed-off-by: Hans Verkuil <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.