From: Greg Kroah-Hartman Date: Sat, 2 Apr 2022 12:53:16 +0000 (+0200) Subject: 5.17-stable patches X-Git-Tag: v5.17.2~182 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1ca7cf8a51a98692a9c7d0b4b647124856330dad;p=thirdparty%2Fkernel%2Fstable-queue.git 5.17-stable patches added patches: media-davinci-vpif-fix-unbalanced-runtime-pm-enable.patch media-davinci-vpif-fix-unbalanced-runtime-pm-get.patch media-davinci-vpif-fix-use-after-free-on-driver-unbind.patch media-venus-hfi_cmds-list-hdr10-property-as-unsupported-for-v1-and-v3.patch media-venus-venc-fix-h264-8x8-transform-control.patch --- diff --git a/queue-5.17/media-davinci-vpif-fix-unbalanced-runtime-pm-enable.patch b/queue-5.17/media-davinci-vpif-fix-unbalanced-runtime-pm-enable.patch new file mode 100644 index 00000000000..bd83500a317 --- /dev/null +++ b/queue-5.17/media-davinci-vpif-fix-unbalanced-runtime-pm-enable.patch @@ -0,0 +1,56 @@ +From d42b3ad105b5d3481f6a56bc789aa2b27aa09325 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 22 Dec 2021 15:20:23 +0100 +Subject: media: davinci: vpif: fix unbalanced runtime PM enable + +From: Johan Hovold + +commit d42b3ad105b5d3481f6a56bc789aa2b27aa09325 upstream. + +Make sure to disable runtime PM before returning on probe errors. + +Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support") +Cc: stable@vger.kernel.org +Cc: Kevin Hilman +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/davinci/vpif.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/davinci/vpif.c ++++ b/drivers/media/platform/davinci/vpif.c +@@ -428,6 +428,7 @@ static int vpif_probe(struct platform_de + static struct resource *res_irq; + struct platform_device *pdev_capture, *pdev_display; + struct device_node *endpoint = NULL; ++ int ret; + + vpif_base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(vpif_base)) +@@ -456,8 +457,8 @@ static int vpif_probe(struct platform_de + res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); + if (!res_irq) { + dev_warn(&pdev->dev, "Missing IRQ resource.\n"); +- pm_runtime_put(&pdev->dev); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_put_rpm; + } + + pdev_capture = devm_kzalloc(&pdev->dev, sizeof(*pdev_capture), +@@ -491,6 +492,12 @@ static int vpif_probe(struct platform_de + } + + return 0; ++ ++err_put_rpm: ++ pm_runtime_put(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); ++ ++ return ret; + } + + static int vpif_remove(struct platform_device *pdev) diff --git a/queue-5.17/media-davinci-vpif-fix-unbalanced-runtime-pm-get.patch b/queue-5.17/media-davinci-vpif-fix-unbalanced-runtime-pm-get.patch new file mode 100644 index 00000000000..143ee4bd748 --- /dev/null +++ b/queue-5.17/media-davinci-vpif-fix-unbalanced-runtime-pm-get.patch @@ -0,0 +1,33 @@ +From 4a321de239213300a714fa0353a5f1272d381a44 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 22 Dec 2021 15:20:22 +0100 +Subject: media: davinci: vpif: fix unbalanced runtime PM get + +From: Johan Hovold + +commit 4a321de239213300a714fa0353a5f1272d381a44 upstream. + +Make sure to balance the runtime PM usage counter on driver unbind. + +Fixes: 407ccc65bfd2 ("[media] davinci: vpif: add pm_runtime support") +Cc: stable@vger.kernel.org # 3.9 +Cc: Lad, Prabhakar +Signed-off-by: Johan Hovold +Reviewed-by: Lad Prabhakar +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/davinci/vpif.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/davinci/vpif.c ++++ b/drivers/media/platform/davinci/vpif.c +@@ -495,6 +495,7 @@ static int vpif_probe(struct platform_de + + static int vpif_remove(struct platform_device *pdev) + { ++ pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + return 0; + } diff --git a/queue-5.17/media-davinci-vpif-fix-use-after-free-on-driver-unbind.patch b/queue-5.17/media-davinci-vpif-fix-use-after-free-on-driver-unbind.patch new file mode 100644 index 00000000000..ffe09132145 --- /dev/null +++ b/queue-5.17/media-davinci-vpif-fix-use-after-free-on-driver-unbind.patch @@ -0,0 +1,183 @@ +From 43acb728bbc40169d2e2425e84a80068270974be Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 22 Dec 2021 15:20:24 +0100 +Subject: media: davinci: vpif: fix use-after-free on driver unbind + +From: Johan Hovold + +commit 43acb728bbc40169d2e2425e84a80068270974be upstream. + +The driver allocates and registers two platform device structures during +probe, but the devices were never deregistered on driver unbind. + +This results in a use-after-free on driver unbind as the device +structures were allocated using devres and would be freed by driver +core when remove() returns. + +Fix this by adding the missing deregistration calls to the remove() +callback and failing probe on registration errors. + +Note that the platform device structures must be freed using a proper +release callback to avoid leaking associated resources like device +names. + +Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support") +Cc: stable@vger.kernel.org # 4.12 +Cc: Kevin Hilman +Signed-off-by: Johan Hovold +Reviewed-by: Lad Prabhakar +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/davinci/vpif.c | 97 ++++++++++++++++++++++++---------- + 1 file changed, 71 insertions(+), 26 deletions(-) + +--- a/drivers/media/platform/davinci/vpif.c ++++ b/drivers/media/platform/davinci/vpif.c +@@ -41,6 +41,11 @@ MODULE_ALIAS("platform:" VPIF_DRIVER_NAM + #define VPIF_CH2_MAX_MODES 15 + #define VPIF_CH3_MAX_MODES 2 + ++struct vpif_data { ++ struct platform_device *capture; ++ struct platform_device *display; ++}; ++ + DEFINE_SPINLOCK(vpif_lock); + EXPORT_SYMBOL_GPL(vpif_lock); + +@@ -423,17 +428,31 @@ int vpif_channel_getfid(u8 channel_id) + } + EXPORT_SYMBOL(vpif_channel_getfid); + ++static void vpif_pdev_release(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ ++ kfree(pdev); ++} ++ + static int vpif_probe(struct platform_device *pdev) + { + static struct resource *res_irq; + struct platform_device *pdev_capture, *pdev_display; + struct device_node *endpoint = NULL; ++ struct vpif_data *data; + int ret; + + vpif_base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(vpif_base)) + return PTR_ERR(vpif_base); + ++ data = kzalloc(sizeof(*data), GFP_KERNEL); ++ if (!data) ++ return -ENOMEM; ++ ++ platform_set_drvdata(pdev, data); ++ + pm_runtime_enable(&pdev->dev); + pm_runtime_get(&pdev->dev); + +@@ -461,49 +480,75 @@ static int vpif_probe(struct platform_de + goto err_put_rpm; + } + +- pdev_capture = devm_kzalloc(&pdev->dev, sizeof(*pdev_capture), +- GFP_KERNEL); +- if (pdev_capture) { +- pdev_capture->name = "vpif_capture"; +- pdev_capture->id = -1; +- pdev_capture->resource = res_irq; +- pdev_capture->num_resources = 1; +- pdev_capture->dev.dma_mask = pdev->dev.dma_mask; +- pdev_capture->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; +- pdev_capture->dev.parent = &pdev->dev; +- platform_device_register(pdev_capture); +- } else { +- dev_warn(&pdev->dev, "Unable to allocate memory for pdev_capture.\n"); ++ pdev_capture = kzalloc(sizeof(*pdev_capture), GFP_KERNEL); ++ if (!pdev_capture) { ++ ret = -ENOMEM; ++ goto err_put_rpm; + } + +- pdev_display = devm_kzalloc(&pdev->dev, sizeof(*pdev_display), +- GFP_KERNEL); +- if (pdev_display) { +- pdev_display->name = "vpif_display"; +- pdev_display->id = -1; +- pdev_display->resource = res_irq; +- pdev_display->num_resources = 1; +- pdev_display->dev.dma_mask = pdev->dev.dma_mask; +- pdev_display->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; +- pdev_display->dev.parent = &pdev->dev; +- platform_device_register(pdev_display); +- } else { +- dev_warn(&pdev->dev, "Unable to allocate memory for pdev_display.\n"); ++ pdev_capture->name = "vpif_capture"; ++ pdev_capture->id = -1; ++ pdev_capture->resource = res_irq; ++ pdev_capture->num_resources = 1; ++ pdev_capture->dev.dma_mask = pdev->dev.dma_mask; ++ pdev_capture->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; ++ pdev_capture->dev.parent = &pdev->dev; ++ pdev_capture->dev.release = vpif_pdev_release; ++ ++ ret = platform_device_register(pdev_capture); ++ if (ret) ++ goto err_put_pdev_capture; ++ ++ pdev_display = kzalloc(sizeof(*pdev_display), GFP_KERNEL); ++ if (!pdev_display) { ++ ret = -ENOMEM; ++ goto err_put_pdev_capture; + } + ++ pdev_display->name = "vpif_display"; ++ pdev_display->id = -1; ++ pdev_display->resource = res_irq; ++ pdev_display->num_resources = 1; ++ pdev_display->dev.dma_mask = pdev->dev.dma_mask; ++ pdev_display->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask; ++ pdev_display->dev.parent = &pdev->dev; ++ pdev_display->dev.release = vpif_pdev_release; ++ ++ ret = platform_device_register(pdev_display); ++ if (ret) ++ goto err_put_pdev_display; ++ ++ data->capture = pdev_capture; ++ data->display = pdev_display; ++ + return 0; + ++err_put_pdev_display: ++ platform_device_put(pdev_display); ++err_put_pdev_capture: ++ platform_device_put(pdev_capture); + err_put_rpm: + pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ kfree(data); + + return ret; + } + + static int vpif_remove(struct platform_device *pdev) + { ++ struct vpif_data *data = platform_get_drvdata(pdev); ++ ++ if (data->capture) ++ platform_device_unregister(data->capture); ++ if (data->display) ++ platform_device_unregister(data->display); ++ + pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ ++ kfree(data); ++ + return 0; + } + diff --git a/queue-5.17/media-venus-hfi_cmds-list-hdr10-property-as-unsupported-for-v1-and-v3.patch b/queue-5.17/media-venus-hfi_cmds-list-hdr10-property-as-unsupported-for-v1-and-v3.patch new file mode 100644 index 00000000000..dfaef89065e --- /dev/null +++ b/queue-5.17/media-venus-hfi_cmds-list-hdr10-property-as-unsupported-for-v1-and-v3.patch @@ -0,0 +1,32 @@ +From 22beb839f48d841ec75974872863dc253d37c21c Mon Sep 17 00:00:00 2001 +From: Stanimir Varbanov +Date: Tue, 1 Feb 2022 16:51:29 +0100 +Subject: media: venus: hfi_cmds: List HDR10 property as unsupported for v1 and v3 + +From: Stanimir Varbanov + +commit 22beb839f48d841ec75974872863dc253d37c21c upstream. + +The HFI_PROPERTY_PARAM_VENC_HDR10_PQ_SEI HFI property is not supported +on Venus v1 and v3. + +cc: stable@vger.kernel.org # 5.13+ +Fixes: 9172652d72f8 ("media: venus: venc: Add support for CLL and Mastering display controls") +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/hfi_cmds.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/platform/qcom/venus/hfi_cmds.c ++++ b/drivers/media/platform/qcom/venus/hfi_cmds.c +@@ -1054,6 +1054,8 @@ static int pkt_session_set_property_1x(s + pkt->shdr.hdr.size += sizeof(u32) + sizeof(*info); + break; + } ++ case HFI_PROPERTY_PARAM_VENC_HDR10_PQ_SEI: ++ return -ENOTSUPP; + + /* FOLLOWING PROPERTIES ARE NOT IMPLEMENTED IN CORE YET */ + case HFI_PROPERTY_CONFIG_BUFFER_REQUIREMENTS: diff --git a/queue-5.17/media-venus-venc-fix-h264-8x8-transform-control.patch b/queue-5.17/media-venus-venc-fix-h264-8x8-transform-control.patch new file mode 100644 index 00000000000..cebffe4b136 --- /dev/null +++ b/queue-5.17/media-venus-venc-fix-h264-8x8-transform-control.patch @@ -0,0 +1,66 @@ +From 61b3317dd424a3488b6754d7ff8301944d9d17d7 Mon Sep 17 00:00:00 2001 +From: Stanimir Varbanov +Date: Tue, 8 Feb 2022 02:18:16 +0100 +Subject: media: venus: venc: Fix h264 8x8 transform control + +From: Stanimir Varbanov + +commit 61b3317dd424a3488b6754d7ff8301944d9d17d7 upstream. + +During encoder driver open controls are initialized via a call +to v4l2_ctrl_handler_setup which returns EINVAL error for +V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM v4l2 control. The control +default value is disabled and because of firmware limitations +8x8 transform cannot be disabled for the supported HIGH and +CONSTRAINED_HIGH profiles. + +To fix the issue change the control default value to enabled +(this is fine because the firmware enables 8x8 transform for +high and constrained_high profiles by default). Also, correct +the checking of profile ids in s_ctrl from hfi to v4l2 ids. + +cc: stable@vger.kernel.org # 5.15+ +Fixes: bfee75f73c37 ("media: venus: venc: add support for V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM control") +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/venc.c | 4 ++-- + drivers/media/platform/qcom/venus/venc_ctrls.c | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/media/platform/qcom/venus/venc.c ++++ b/drivers/media/platform/qcom/venus/venc.c +@@ -662,8 +662,8 @@ static int venc_set_properties(struct ve + + ptype = HFI_PROPERTY_PARAM_VENC_H264_TRANSFORM_8X8; + h264_transform.enable_type = 0; +- if (ctr->profile.h264 == HFI_H264_PROFILE_HIGH || +- ctr->profile.h264 == HFI_H264_PROFILE_CONSTRAINED_HIGH) ++ if (ctr->profile.h264 == V4L2_MPEG_VIDEO_H264_PROFILE_HIGH || ++ ctr->profile.h264 == V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH) + h264_transform.enable_type = ctr->h264_8x8_transform; + + ret = hfi_session_set_property(inst, ptype, &h264_transform); +--- a/drivers/media/platform/qcom/venus/venc_ctrls.c ++++ b/drivers/media/platform/qcom/venus/venc_ctrls.c +@@ -320,8 +320,8 @@ static int venc_op_s_ctrl(struct v4l2_ct + ctr->intra_refresh_period = ctrl->val; + break; + case V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM: +- if (ctr->profile.h264 != HFI_H264_PROFILE_HIGH && +- ctr->profile.h264 != HFI_H264_PROFILE_CONSTRAINED_HIGH) ++ if (ctr->profile.h264 != V4L2_MPEG_VIDEO_H264_PROFILE_HIGH && ++ ctr->profile.h264 != V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_HIGH) + return -EINVAL; + + /* +@@ -457,7 +457,7 @@ int venc_ctrl_init(struct venus_inst *in + V4L2_CID_MPEG_VIDEO_H264_I_FRAME_MIN_QP, 1, 51, 1, 1); + + v4l2_ctrl_new_std(&inst->ctrl_handler, &venc_ctrl_ops, +- V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM, 0, 1, 1, 0); ++ V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM, 0, 1, 1, 1); + + v4l2_ctrl_new_std(&inst->ctrl_handler, &venc_ctrl_ops, + V4L2_CID_MPEG_VIDEO_H264_P_FRAME_MIN_QP, 1, 51, 1, 1); diff --git a/queue-5.17/series b/queue-5.17/series index 1b1acafa8f1..f8a4ba07386 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -168,3 +168,8 @@ dec-limit-pmax-memory-probing-to-r3k-systems.patch media-gpio-ir-tx-fix-transmit-with-long-spaces-on-orange-pi-pc.patch media-omap3isp-use-struct_group-for-memcpy-region.patch media-venus-vdec-fixed-possible-memory-leak-issue.patch +media-venus-hfi_cmds-list-hdr10-property-as-unsupported-for-v1-and-v3.patch +media-venus-venc-fix-h264-8x8-transform-control.patch +media-davinci-vpif-fix-unbalanced-runtime-pm-get.patch +media-davinci-vpif-fix-unbalanced-runtime-pm-enable.patch +media-davinci-vpif-fix-use-after-free-on-driver-unbind.patch