drop queue-4.4/media-coda-fix-memory-corruption-in-case-more-than-3.patch

diff --git a/queue-4.4/media-coda-fix-memory-corruption-in-case-more-than-3.patch b/queue-4.4/media-coda-fix-memory-corruption-in-case-more-than-3.patch
deleted file mode 100644 (file)
index 3cd32fb..0000000
--- a/queue-4.4/media-coda-fix-memory-corruption-in-case-more-than-3.patch
+++ /dev/null
@@ -1,140 +0,0 @@
-From 0aecc2dd80345b10cd6ab210a77b3ecc83ca4bdc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 6 Nov 2018 05:40:54 -0500
-Subject: media: coda: fix memory corruption in case more than 32 instances are
- opened
-
-From: Philipp Zabel <p.zabel@pengutronix.de>
-
-[ Upstream commit 649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f ]
-
-The ffz() return value is undefined if the instance mask does not
-contain any zeros. If it returned 32, the following set_bit would
-corrupt the debugfs_root pointer.
-Switch to IDA for context index allocation. This also removes the
-artificial 32 instance limit for all except CodaDx6.
-
-Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
-Signed-off-by: Hans Verkuil <hansverk@cisco.com>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/media/platform/coda/coda-common.c | 26 +++++++++--------------
- drivers/media/platform/coda/coda.h        |  3 ++-
- 2 files changed, 12 insertions(+), 17 deletions(-)
-
-diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
-index 323aad3c89de6..154aa7d73a8d2 100644
---- a/drivers/media/platform/coda/coda-common.c
-+++ b/drivers/media/platform/coda/coda-common.c
-@@ -17,6 +17,7 @@
- #include <linux/firmware.h>
- #include <linux/gcd.h>
- #include <linux/genalloc.h>
-+#include <linux/idr.h>
- #include <linux/interrupt.h>
- #include <linux/io.h>
- #include <linux/irq.h>
-@@ -1644,17 +1645,6 @@ int coda_decoder_queue_init(void *priv, struct vb2_queue *src_vq,
-       return coda_queue_init(priv, dst_vq);
- }
- 
--static int coda_next_free_instance(struct coda_dev *dev)
--{
--      int idx = ffz(dev->instance_mask);
--
--      if ((idx < 0) ||
--          (dev->devtype->product == CODA_DX6 && idx > CODADX6_MAX_INSTANCES))
--              return -EBUSY;
--
--      return idx;
--}
--
- /*
-  * File operations
-  */
-@@ -1663,7 +1653,8 @@ static int coda_open(struct file *file)
- {
-       struct video_device *vdev = video_devdata(file);
-       struct coda_dev *dev = video_get_drvdata(vdev);
--      struct coda_ctx *ctx = NULL;
-+      struct coda_ctx *ctx;
-+      unsigned int max = ~0;
-       char *name;
-       int ret;
-       int idx;
-@@ -1672,12 +1663,13 @@ static int coda_open(struct file *file)
-       if (!ctx)
-               return -ENOMEM;
- 
--      idx = coda_next_free_instance(dev);
-+      if (dev->devtype->product == CODA_DX6)
-+              max = CODADX6_MAX_INSTANCES - 1;
-+      idx = ida_alloc_max(&dev->ida, max, GFP_KERNEL);
-       if (idx < 0) {
-               ret = idx;
-               goto err_coda_max;
-       }
--      set_bit(idx, &dev->instance_mask);
- 
-       name = kasprintf(GFP_KERNEL, "context%d", idx);
-       if (!name) {
-@@ -1771,8 +1763,8 @@ err_clk_per:
- err_pm_get:
-       v4l2_fh_del(&ctx->fh);
-       v4l2_fh_exit(&ctx->fh);
--      clear_bit(ctx->idx, &dev->instance_mask);
- err_coda_name_init:
-+      ida_free(&dev->ida, ctx->idx);
- err_coda_max:
-       kfree(ctx);
-       return ret;
-@@ -1811,7 +1803,7 @@ static int coda_release(struct file *file)
-       pm_runtime_put_sync(&dev->plat_dev->dev);
-       v4l2_fh_del(&ctx->fh);
-       v4l2_fh_exit(&ctx->fh);
--      clear_bit(ctx->idx, &dev->instance_mask);
-+      ida_free(&dev->ida, ctx->idx);
-       if (ctx->ops->release)
-               ctx->ops->release(ctx);
-       debugfs_remove_recursive(ctx->debugfs_entry);
-@@ -2192,6 +2184,7 @@ static int coda_probe(struct platform_device *pdev)
- 
-       mutex_init(&dev->dev_mutex);
-       mutex_init(&dev->coda_mutex);
-+      ida_init(&dev->ida);
- 
-       dev->debugfs_root = debugfs_create_dir("coda", NULL);
-       if (!dev->debugfs_root)
-@@ -2276,6 +2269,7 @@ static int coda_remove(struct platform_device *pdev)
-       coda_free_aux_buf(dev, &dev->tempbuf);
-       coda_free_aux_buf(dev, &dev->workbuf);
-       debugfs_remove_recursive(dev->debugfs_root);
-+      ida_destroy(&dev->ida);
-       return 0;
- }
- 
-diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h
-index 96532b06bd9e1..239f6bb2fca42 100644
---- a/drivers/media/platform/coda/coda.h
-+++ b/drivers/media/platform/coda/coda.h
-@@ -16,6 +16,7 @@
- #define __CODA_H__
- 
- #include <linux/debugfs.h>
-+#include <linux/idr.h>
- #include <linux/irqreturn.h>
- #include <linux/mutex.h>
- #include <linux/kfifo.h>
-@@ -93,7 +94,7 @@ struct coda_dev {
-       struct v4l2_m2m_dev     *m2m_dev;
-       struct vb2_alloc_ctx    *alloc_ctx;
-       struct list_head        instances;
--      unsigned long           instance_mask;
-+      struct ida              ida;
-       struct dentry           *debugfs_root;
- };
- 
--- 
-2.20.1
-

diff --git a/queue-4.4/series b/queue-4.4/series
index 337c0395c6f42373025314253613cc2db6d8dc05..27f2f03c66c9a7eb0474766e707da03d9953274d 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -27,7 +27,6 @@ math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch
 rtc-max8997-fix-the-returned-value-in-case-of-error-.patch
 rtc-dt-binding-abx80x-fix-resistance-scale.patch
 arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch
-media-coda-fix-memory-corruption-in-case-more-than-3.patch
 dmaengine-coh901318-fix-a-double-lock-bug.patch
 dmaengine-coh901318-remove-unused-variable.patch
 acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch