media: sun6i-isp: capture: Fix uninitialized variable use
While the stride_chroma variable was previously initialized to zero,
it's actually stride_chroma_div4 that is set to hardware registers.
Initialize it to zero instead to avoid an uninitialized variable use
and get rid of the associated smatch warning.
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: sun6i-isp: proc: Declare subdev ops as static
The static keyword is missing in the v4l2 subdev ops definition for the
proc.
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: sun6i-isp: proc: Error out on invalid port to fix warning
The enabled variable is only set for a valid port and used later,
which triggers an uninitialized use smatch warning. Explicitly error
out in that case to fix the warning.
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: sun6i-isp: proc: Fix return code handling in stream off path
Explicitly set ret to zero on disable path to avoid a related smatch
warning. This makes initialization at declaration useless.
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: sun8i-a83t-mipi-csi2: Clarify return code handling in stream off path
Explicitly set ret to zero instead of assigning it and overwriting it
later, which is a bit confusing to understand.
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: sun6i-mipi-csi2: Clarify return code handling in stream off path
Explicitly set ret to zero instead of assigning it and overwriting it
later, which is a bit confusing to understand.
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: sun6i-csi: capture: Remove useless ret initialization
There is no particular need to assign ret when declaring it as
it will be assigned before there is any chance to return it.
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: sun6i-csi: bridge: Error out on invalid port to fix warning
The enabled variable is only set for a valid port and used later,
which triggers an uninitialized use smatch warning. Explicitly error
out in that case to fix the warning.
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Fixes: 0d2b746b1bef ("media: sun6i-csi: Add bridge v4l2 subdev with port management") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Merge tag 'br-v6.2i' of git://linuxtv.org/hverkuil/media_tree into media_stage
Tag branch
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* tag 'br-v6.2i' of git://linuxtv.org/hverkuil/media_tree: (31 commits)
media: s5c73m3: Switch to GPIO descriptors
media: i2c: s5k5baf: switch to using gpiod API
media: i2c: s5k6a3: switch to using gpiod API
media: imx: remove code for non-existing config IMX_GPT_ICAP
media: si470x: Fix use-after-free in si470x_int_in_callback()
media: staging: stkwebcam: Restore MEDIA_{USB,CAMERA}_SUPPORT dependencies
media: coda: Add check for kmalloc
media: coda: Add check for dcoda_iram_alloc
dt-bindings: media: s5c73m3: Fix reset-gpio descriptor
media: dt-bindings: allwinner: h6-vpu-g2: Add IOMMU reference property
media: s5k4ecgx: Delete driver
media: s5k4ecgx: Switch to GPIO descriptors
media: Switch to use dev_err_probe() helper
headers: Remove some left-over license text in include/uapi/linux/v4l2-*
headers: Remove some left-over license text in include/uapi/linux/dvb/
media: usb: pwc-uncompress: Use flex array destination for memcpy()
media: s5p-mfc: Fix to handle reference queue during finishing
media: s5p-mfc: Clear workbit to handle error condition
media: s5p-mfc: Fix in register read and write for H264
media: imx: Use get_mbus_config instead of parsing upstream DT endpoints
...
Linus Walleij [Tue, 8 Nov 2022 10:06:04 +0000 (11:06 +0100)]
media: s5c73m3: Switch to GPIO descriptors
The driver has an option to pass in GPIO numbers from platform
data but this is not used in the kernel so delete this. Get
GPIO descriptors using the standard API and simplify the code,
gpiolib will handle any inversions.
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: Andrzej Hajda <andrzej.hajda@intel.com> Cc: Alim Akhtar <alim.akhtar@samsung.com> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Dmitry Torokhov [Tue, 15 Nov 2022 22:11:43 +0000 (14:11 -0800)]
media: i2c: s5k5baf: switch to using gpiod API
This patch switches the driver away from legacy gpio/of_gpio API to
gpiod API, and removes use of of_get_named_gpio_flags() which I want to
make private to gpiolib.
Lukas Bulwahn [Wed, 23 Nov 2022 07:52:16 +0000 (08:52 +0100)]
media: imx: remove code for non-existing config IMX_GPT_ICAP
There never was a config IMX_GPT_ICAP in the repository. So remove the code
conditional on this config and simplify the callers that just called empty
functions.
Shigeru Yoshida [Tue, 22 Nov 2022 18:51:59 +0000 (03:51 +0900)]
media: si470x: Fix use-after-free in si470x_int_in_callback()
syzbot reported use-after-free in si470x_int_in_callback() [1]. This
indicates that urb->context, which contains struct si470x_device
object, is freed when si470x_int_in_callback() is called.
The cause of this issue is that si470x_int_in_callback() is called for
freed urb.
si470x_usb_driver_probe() calls si470x_start_usb(), which then calls
usb_submit_urb() and si470x_start(). If si470x_start_usb() fails,
si470x_usb_driver_probe() doesn't kill urb, but it just frees struct
si470x_device object, as depicted below:
This patch fixes this issue by killing urb when si470x_start_usb()
fails and urb is submitted. If si470x_start_usb() fails and urb is
not submitted, i.e. submitting usb fails, it just frees struct
si470x_device object.
Jiasheng Jiang [Thu, 17 Nov 2022 06:56:52 +0000 (14:56 +0800)]
media: coda: Add check for dcoda_iram_alloc
As the coda_iram_alloc may return NULL pointer,
it should be better to check the return value
in order to avoid NULL poineter dereference,
same as the others.
The reset-gpios is described as xshutdown-gpios on the required
properties, as it is on the driver. Despite that, the device tree
example set the property 'reset-gpios' instead of the property
'xshutdown-gpios'.
Therefore, this patch updates the example to match the property specified
on the driver.
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Maíra Canal <mairacanal@riseup.net> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
The Hantro G2 video decoder block sits behind an IOMMU. The device tree
binding needs a property to reference it. Without a reference for the
implementation to properly configure the IOMMU, it will fault and cause
the video decoder to fail.
Add an "iommus" property for referring to the IOMMU port. The master ID
in the example is taken from the IOMMU fault error message on Linux,
and the number seems to match the order in the user manual's IOMMU
diagram.
Linus Walleij [Tue, 8 Nov 2022 19:53:28 +0000 (20:53 +0100)]
media: s5k4ecgx: Delete driver
This driver was until the previous patch unused in the kernel
and depended on platform data that no board was defining.
As no users can be proven to exist, delete the driver.
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: Andrzej Hajda <andrzej.hajda@intel.com> Cc: Krzysztof Kozlowski <krzk@kernel.org> Cc: Alim Akhtar <alim.akhtar@samsung.com> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Linus Walleij [Tue, 8 Nov 2022 19:53:27 +0000 (20:53 +0100)]
media: s5k4ecgx: Switch to GPIO descriptors
The driver has an option to pass in GPIO numbers from platform
data but this is not used in the kernel so delete this and the
whole platform data mechanism.
Get GPIO descriptors using the standard API and simplify the code,
gpiolib will handle any inversions.
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com> Cc: Andrzej Hajda <andrzej.hajda@intel.com> Cc: Krzysztof Kozlowski <krzk@kernel.org> Cc: Alim Akhtar <alim.akhtar@samsung.com> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Yang Yingliang [Mon, 19 Sep 2022 15:58:43 +0000 (23:58 +0800)]
media: Switch to use dev_err_probe() helper
In the probe path, dev_err() can be replaced with dev_err_probe()
which will check if error code is -EPROBE_DEFER.
Reviewed-by: Sean Young <sean@mess.org> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: usb: pwc-uncompress: Use flex array destination for memcpy()
In preparation for FORTIFY_SOURCE performing run-time destination buffer
bounds checking for memcpy(), specify the destination output buffer
explicitly, instead of asking memcpy() to write past the end of what looked
like a fixed-size object.
Notice that raw_frame is a pointer to a structure that contains
flexible-array member rawframe[]:
drivers/media/usb/pwc/pwc.h:
190 struct pwc_raw_frame {
191 __le16 type; /* type of the webcam */
192 __le16 vbandlength; /* Size of 4 lines compressed (used by the
193 decompressor) */
194 __u8 cmd[4]; /* the four byte of the command (in case of
195 nala, only the first 3 bytes is filled) */
196 __u8 rawframe[]; /* frame_size = H / 4 * vbandlength */
197 } __packed;
Link: https://github.com/KSPP/linux/issues/200 Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: s5p-mfc: Fix to handle reference queue during finishing
On receiving last buffer driver puts MFC to MFCINST_FINISHING state which
in turn skips transferring of frame from SRC to REF queue. This causes
driver to stop MFC encoding and last frame is lost.
This patch guarantees safe handling of frames during MFCINST_FINISHING and
correct clearing of workbit to avoid early stopping of encoding.
media: s5p-mfc: Clear workbit to handle error condition
During error on CLOSE_INSTANCE command, ctx_work_bits was not getting
cleared. During consequent mfc execution NULL pointer dereferencing of
this context led to kernel panic. This patch fixes this issue by making
sure to clear ctx_work_bits always.
Philipp Zabel [Wed, 24 Aug 2022 10:32:10 +0000 (12:32 +0200)]
media: imx: Use get_mbus_config instead of parsing upstream DT endpoints
Stop parsing upstream neighbors' device-tree endpoints to retrieve the
media bus configuration. Instead use the get_mbus_config op and throw an
error if the upstream subdevice does not implement it.
Also drop the corresponding TODO entry and the now unused
imx_media_get_pad_fwnode() function.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Reviewed-by: Jacopo Mondi <jacopo@jmondi.org> Tested-by: Marco Felsch <m.felsch@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Liang He [Tue, 19 Jul 2022 14:10:23 +0000 (22:10 +0800)]
media: c8sectpfe: Add of_node_put() when breaking out of loop
In configure_channels(), we should call of_node_put() when breaking
out of for_each_child_of_node() which will automatically increase
and decrease the refcount.
Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support") Signed-off-by: Liang He <windhl@126.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Lecopzer Chen [Mon, 16 May 2022 17:15:15 +0000 (01:15 +0800)]
media: Kconfig: Make DVB_CORE=m possible when MEDIA_SUPPORT=y
A case that CONFIG_MEDIA_SUPPORT is y but we need DVB_CORE=m, and
this doesn't work since DVB_CORE is default MEDIA_DIGITAL_TV_SUPPORT
and then follows MEDIA_SUPPORT.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
Michael Riesch [Fri, 14 Jan 2022 10:57:55 +0000 (11:57 +0100)]
media: v4l2-mediabus: add support for dual edge sampling
Some devices support sampling of the parallel data at both edges of the
interface pixel clock in order to reduce the pixel clock by two.
Add a mediabus flag that represents this feature.
Signed-off-by: Michael Riesch <michael.riesch@wolfvision.net> Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Michael Riesch [Fri, 14 Jan 2022 10:57:54 +0000 (11:57 +0100)]
dt-bindings: media: video-interfaces: add support for dual edge sampling
Some devices support sampling of the parallel data at both edges of the
interface pixel clock in order to reduce the pixel clock by two.
Use the pclk-sample property to reflect this feature in the device tree.
Signed-off-by: Michael Riesch <michael.riesch@wolfvision.net> Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: pt3: Use dma_set_mask_and_coherent() and simplify code
Use dma_set_mask_and_coherent() instead of unrolling it with some
dma_set_mask()+dma_set_coherent_mask().
Moreover, as stated in [1], dma_set_mask() with a 64-bit mask will never
fail if dev->dma_mask is non-NULL.
So, if it fails, the 32 bits case will also fail for the same reason.
Simplify code and remove some dead code accordingly.
Adam Borowski [Thu, 15 Sep 2022 23:33:18 +0000 (00:33 +0100)]
media: ipu3-cio2: make the bridge depend on i2c
drivers/media/pci/intel/ipu3/cio2-bridge.c: In function ‘cio2_bridge_unregister_sensors’:
drivers/media/pci/intel/ipu3/cio2-bridge.c:258:17: error: implicit declaration of function ‘i2c_unregister_device’; did you mean ‘spi_unregister_device’? [-Werror=implicit-function-declaration]
258 | i2c_unregister_device(sensor->vcm_i2c_client);
| ^~~~~~~~~~~~~~~~~~~~~
| spi_unregister_device
Dave Stevenson [Mon, 28 Nov 2022 16:22:48 +0000 (16:22 +0000)]
media: i2c: ov9282: Make common_regs_list static
common_regs_list is only used within this file, so should
be static. Make it so.
Fixes: 7195aabf8f8b ("media: i2c: ov9282: Split registers into common and mode specific") Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Guoniu.zhou [Fri, 2 Dec 2022 13:00:00 +0000 (13:00 +0000)]
media: ov5640: report correct frame rate to user
In commit 3145efcdb4d0 ("media: ov5640: Rework timings programming"),
it defines max_fps field in ov5640_mode_info structure to store maximum
frame rate supported by each mode. But in ov5640_try_frame_interval(), it
assumes the maximum frame rate supported by all modes is 60. But actually,
only VGA support it. For others, the maximum frame rate supported is 30.
So correct it by taking the maximum frame rate supported by each mode as
the initialization value of the local variable maxfps.
Alexander Stein [Thu, 24 Nov 2022 10:29:59 +0000 (10:29 +0000)]
media: i2c: ov9282: Add ov9281 compatible
According to product brief they are identical from software point of view.
Differences are a different chief ray angle (CRA) and the package.
To distinguish ov9281 & ov9282 in userspace the name has to be explicitly
set. Provide a fixed string using platform data.
Hans Verkuil [Mon, 28 Nov 2022 08:23:56 +0000 (08:23 +0000)]
media: videobuf2: revert "get_userptr: buffers are always writable"
Commit 707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are
always writable") caused problems in a corner case (passing read-only
shmem memory as a userptr). So revert this patch.
The original problem for which that commit was originally made is
something that I could not reproduce after reverting it. So just go
back to the way it was for many years, and if problems arise in
the future, then another approach should be taken to resolve it.
This patch is based on a patch from Hirokazu.
Fixes: 707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are always writable") Signed-off-by: Hirokazu Honda <hiroh@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Acked-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
media: rzg2l-cru: Remove unnecessary shadowing of ret in rzg2l_csi2_s_stream()
Clang warns:
drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:445:7: error: variable 'ret' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
if (ret)
^~~
drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:475:9: note: uninitialized use occurs here
return ret;
^~~
drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:445:3: note: remove the 'if' if its condition is always false
if (ret)
^~~~~~~~
drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:441:7: error: variable 'ret' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
if (ret)
^~~
drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:475:9: note: uninitialized use occurs here
return ret;
^~~
drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:441:3: note: remove the 'if' if its condition is always false
if (ret)
^~~~~~~~
drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:431:9: note: initialize the variable 'ret' to silence this warning
int ret;
^
= 0
2 errors generated.
ret is unnecessarily shadowed, meaning the assignments to ret within the
first 'if (enable)' block are only applied to the inner scope, not the
outer one as intended. Remove the shadowing to fix the warnings and make
everything work correctly.
Randy Dunlap [Mon, 28 Nov 2022 05:43:03 +0000 (05:43 +0000)]
media: dvb/frontend.h: fix kernel-doc warnings
scripts/kernel-doc spouts multiple warnings, so fix them:
include/uapi/linux/dvb/frontend.h:399: warning: Enum value 'QAM_1024' not described in enum 'fe_modulation'
include/uapi/linux/dvb/frontend.h:399: warning: Enum value 'QAM_4096' not described in enum 'fe_modulation'
frontend.h:286: warning: contents before sections
frontend.h:780: warning: missing initial short description on line:
* enum atscmh_rs_code_mode
Fixes: 8220ead805b6 ("media: dvb/frontend.h: document the uAPI file") Fixes: 6508a50fe84f ("media: dvb: add DVB-C2 and DVB-S2X parameter values") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Robert Schlabbach <robert_s@gmx.net> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Liu Shixin [Sat, 26 Nov 2022 11:31:26 +0000 (11:31 +0000)]
media: saa7164: fix missing pci_disable_device()
Add missing pci_disable_device() in the error path in saa7164_initdev().
Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") Signed-off-by: Liu Shixin <liushixin2@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Hans de Goede [Tue, 29 Nov 2022 23:11:44 +0000 (23:11 +0000)]
media: ov5693: Add support for a privacy-led GPIO
Add support for a privacy-led GPIO.
Making the privacy LED to controlable from userspace, as using the LED
class subsystem would do, would make it too easy for spy-ware to disable
the LED.
To avoid this have the sensor driver directly control the LED.
Colin Ian King [Wed, 30 Nov 2022 18:04:58 +0000 (18:04 +0000)]
media: dvb-usb: m920x: make read-only arrays static const
Don't populate the arrays on the stack, instead make them static
const. Also makes the object code smaller.
Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Aakarsh Jain [Mon, 14 Nov 2022 11:50:23 +0000 (11:50 +0000)]
media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
Commit 5441e9dafdfc6dc40 ("[media] s5p-mfc: Core support for MFC v7")
which adds mfc v7 support for Exynos3250 and use the same compatible
string as used by Exynos5240 but both the IPs are a bit different in
terms of IP clock.
Add variant driver data based on the new compatible string
"samsung,exynos3250-mfc" for Exynos3250 SoC.
Suggested-by: Alim Akhtar <alim.akhtar@samsung.com> Fixes: 5441e9dafdfc ("[media] s5p-mfc: Core support for MFC v7") Signed-off-by: Aakarsh Jain <aakarsh.jain@samsung.com> Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Adam Borowski [Thu, 15 Sep 2022 23:33:18 +0000 (00:33 +0100)]
media: ipu3-cio2: make the bridge depend on i2c
drivers/media/pci/intel/ipu3/cio2-bridge.c: In function ‘cio2_bridge_unregister_sensors’:
drivers/media/pci/intel/ipu3/cio2-bridge.c:258:17: error: implicit declaration of function ‘i2c_unregister_device’; did you mean ‘spi_unregister_device’? [-Werror=implicit-function-declaration]
258 | i2c_unregister_device(sensor->vcm_i2c_client);
| ^~~~~~~~~~~~~~~~~~~~~
| spi_unregister_device
Aakarsh Jain [Mon, 14 Nov 2022 11:50:23 +0000 (11:50 +0000)]
media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
Commit 5441e9dafdfc6dc40 ("[media] s5p-mfc: Core support for MFC v7")
which adds mfc v7 support for Exynos3250 and use the same compatible
string as used by Exynos5240 but both the IPs are a bit different in
terms of IP clock.
Add variant driver data based on the new compatible string
"samsung,exynos3250-mfc" for Exynos3250 SoC.
Suggested-by: Alim Akhtar <alim.akhtar@samsung.com> Fixes: 5441e9dafdfc ("[media] s5p-mfc: Core support for MFC v7") Signed-off-by: Aakarsh Jain <aakarsh.jain@samsung.com> Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Aakarsh Jain [Mon, 14 Nov 2022 11:50:22 +0000 (11:50 +0000)]
media: dt-bindings: s5p-mfc: Add new compatible string for Exynos3250 SoC
Since MFC v7 support was present for both Exynos5420 and Exynos3250
SoC with same compatible string "samsung,mfc-v7". As both SoCs
having different hardware properties and having same compatible
string for both SoCs doesn't seems to be correct.
Add new compatible for Exynos3250 SoC followed by mfc-v7 fallback
which will differentiate the node properties for both SoCs which
support MFC v7.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Suggested-by: Alim Akhtar <alim.akhtar@samsung.com> Signed-off-by: Aakarsh Jain <aakarsh.jain@samsung.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Yunfei Dong [Thu, 17 Nov 2022 09:24:50 +0000 (09:24 +0000)]
media: mediatek: vcodec: Can't set dst buffer to done when lat decode error
Core thread will call v4l2_m2m_buf_done to set dst buffer done for
lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to
free dst buffer when lat decode error, core thread will access kernel
NULL pointer dereference, then crash.
Yunfei Dong [Thu, 17 Nov 2022 09:24:49 +0000 (09:24 +0000)]
media: mediatek: vcodec: Fix getting NULL pointer for dst buffer
The driver may can't get v4l2 buffer when lat or core decode timeout,
will lead to crash when call v4l2_m2m_buf_done to set dst buffer
(NULL pointer) done.
Fixes: 7b182b8d9c85 ("media: mediatek: vcodec: Refactor get and put capture buffer flow") Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Ming Qian [Mon, 21 Nov 2022 06:34:42 +0000 (06:34 +0000)]
media: amphion: lock and check m2m_ctx in event handler
driver needs to cancel vpu before releasing the vpu instance,
so call v4l2_m2m_ctx_release() first,
to handle the redundant event triggered after m2m_ctx is released.
Ming Qian [Fri, 18 Nov 2022 08:51:29 +0000 (08:51 +0000)]
media: amphion: try to wakeup vpu core to avoid failure
firmware should be waked up by start or configure command,
but there is a very small chance that firmware failed to wakeup.
in such case, try to wakeup firmware again by sending a noop command
Irui Wang [Sat, 1 Oct 2022 03:07:52 +0000 (04:07 +0100)]
media: dt-bindings: mediatek: vcodec: Add the platform compatible to schema
There are venc node warnings when running dtbs_check, the clock-names
was unexpected, missing properties '#address-cells' and '#size-cells'.
Add the corresponding platform compatible to schema.
Signed-off-by: Irui Wang <irui.wang@mediatek.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
media: sun8i-a83t-mipi-csi2: Register async subdev with no sensor attached
This allows the device to probe and register its async subdev without
a sensor attached.
The rationale is that the parent driver might otherwise wait for the
subdev to be registered when it should be available (from the fwnode
graph endpoint perspective). This is generally not problematic when
the MIPI CSI-2 bridge is the only device attached to the parent, but
in the case of a CSI controller that can feed from both MIPI CSI-2
and parallel, it would prevent using the parallel sensor due to the
parent waiting for the MIPI CSI-2 subdev to register.
Fixes: 576d196c522b ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
media: sun6i-mipi-csi2: Register async subdev with no sensor attached
This allows the device to probe and register its async subdev without
a sensor attached.
The rationale is that the parent driver might otherwise wait for the
subdev to be registered when it should be available (from the fwnode
graph endpoint perspective). This is generally not problematic when
the MIPI CSI-2 bridge is the only device attached to the parent, but
in the case of a CSI controller that can feed from both MIPI CSI-2
and parallel, it would prevent using the parallel sensor due to the
parent waiting for the MIPI CSI-2 subdev to register.
Fixes: af54b4f4c17f ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
media: sun8i-a83t-mipi-csi2: Require both pads to be connected for streaming
The bridge needs both its pads connected to be able to stream data.
Enforcing this is useful to produce an error when no sensor is
connected.
Fixes: 576d196c522b ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
media: sun6i-mipi-csi2: Require both pads to be connected for streaming
The bridge needs both its pads connected to be able to stream data.
Enforcing this is useful to produce an error when no sensor is
connected.
Fixes: af54b4f4c17f ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Ming Qian [Thu, 25 Aug 2022 01:38:30 +0000 (02:38 +0100)]
media: amphion: tell and handle contiguous and non contiguous format
Driver should tell the number of memory planes and component planes.
the amphion vpu support non contiguous planes,
but for compatibility with other device
that only support contiguous planes.
driver can add support for contiguous planes in the same time.
Then the mem_planes can be different from the comp_planes.
driver need to handle buffer according mem_planes and comp_planes.
So driver can support NV12 and NV12M.
Signed-off-by: Ming Qian <ming.qian@nxp.com> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Xiu Jianfeng [Mon, 13 Jun 2022 13:08:45 +0000 (14:08 +0100)]
media: v4l: Use memset_after() helper
The CLEAR_AFTER_FIELD defined here is functionally the same as
memset_after() helper, so replace it with memset_after() to simplify the
code, no functional change in this patch.
media: rcar-vin: Add support for Gen3 UDS (Up Down Scaler)
Add support for the UDS (Up Down Scaler) found in some Gen3 SoCs.
Not all Gen3 SoCs have scalers, and for those that do it's only
available to the master node of each VIN group. The setup for which SoCs
and nodes have access to a scaler are dealt with at probe time and then
function transparently reusing the schema from the already present Gen2
scaler.
media: rcar-vin: Store scaler in a function pointer
The scaler implementation is different between the VIN generations, and
not all SoCs have a scaler. Currently only Gen2 scalers are supported.
Prepare to add support for more scalers by storing the setup in a
function pointer initialized at probe time. While at it move call site
to after, instead of before, the generic capture setup, this have no
effect on the Gen2 scaler but will be leveraged by the Gen3 scaler.
Prepare for scaling support in the media controller part of the driver
by not caching the remote rectangle. Mimic the omap3isp and look it up
each time it's needed.
Chen Zhongjin [Tue, 8 Nov 2022 03:30:05 +0000 (03:30 +0000)]
media: dvb-core: Fix ignored return value in dvb_register_frontend()
In dvb_register_frontend(), dvb_register_device() is possible to fail
but its return value is ignored.
It will cause use-after-free when module is removed, because in
dvb_unregister_frontend() it tries to unregister a not registered
device.
BUG: KASAN: use-after-free in dvb_remove_device+0x18b/0x1f0 [dvb_core]
Read of size 4 at addr ffff88800dff4824 by task rmmod/428
CPU: 3 PID: 428 Comm: rmmod
Call Trace:
<TASK>
...
dvb_remove_device+0x18b/0x1f0 [dvb_core]
dvb_unregister_frontend+0x7b/0x130 [dvb_core]
vidtv_bridge_remove+0x6e/0x160 [dvb_vidtv_bridge]
...
Fix this by catching return value of dvb_register_device().
However the fe->refcount can't be put to zero immediately, because
there are still modules calling dvb_frontend_detach() when
dvb_register_frontend() fails.
The dvb_usb_dib0700_ir_proto has been removed by
commit 0ffd1ab34a00 ("V4L/DVB: dib0700: properly implement IR
change_protocol"), so remove the orphan declaration.
Mazin Al Haddad [Wed, 24 Aug 2022 01:21:52 +0000 (02:21 +0100)]
media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
Syzbot reports a memory leak in "dvb_usb_adapter_init()".
The leak is due to not accounting for and freeing current iteration's
adapter->priv in case of an error. Currently if an error occurs,
it will exit before incrementing "num_adapters_initalized",
which is used as a reference counter to free all adap->priv
in "dvb_usb_adapter_exit()". There are multiple error paths that
can exit from before incrementing the counter. Including the
error handling paths for "dvb_usb_adapter_stream_init()",
"dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()"
within "dvb_usb_adapter_init()".
This means that in case of an error in any of these functions the
current iteration is not accounted for and the current iteration's
adap->priv is not freed.
Fix this by freeing the current iteration's adap->priv in the
"stream_init_err:" label in the error path. The rest of the
(accounted for) adap->priv objects are freed in dvb_usb_adapter_exit()
as expected using the num_adapters_initalized variable.
Lin Ma [Sun, 7 Aug 2022 14:59:52 +0000 (15:59 +0100)]
media: dvbdev: adopts refcnt to avoid UAF
dvb_unregister_device() is known that prone to use-after-free.
That is, the cleanup from dvb_unregister_device() releases the dvb_device
even if there are pointers stored in file->private_data still refer to it.
This patch adds a reference counter into struct dvb_device and delays its
deallocation until no pointer refers to the object.
projects / thirdparty / kernel / linux.git / log
