The cec pin timer overruns are measured in microseconds, but the variable
names include the millisecond symbol "ms". To avoid confusion, replace
"ms" with "us" in the variable names and printed status message.
Krzysztof Hałasa [Mon, 26 Jul 2021 10:49:30 +0000 (12:49 +0200)]
media: TDA1997x: report -ENOLINK after disconnecting HDMI source
The TD1997x chip retains vper, hper and hsper register values when the
HDMI source is disconnected. Use a different means of checking if the
link is still valid.
Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Hans Verkuil [Fri, 23 Jul 2021 08:22:59 +0000 (10:22 +0200)]
media: v4l2-dv-timings.c: fix wrong condition in two for-loops
These for-loops should test against v4l2_dv_timings_presets[i].bt.width,
not if i < v4l2_dv_timings_presets[i].bt.width. Luckily nothing ever broke,
since the smallest width is still a lot higher than the total number of
presets, but it is wrong.
The last item in the presets array is all 0, so the for-loop must stop
when it reaches that sentinel.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reported-by: Krzysztof Hałasa <khalasa@piap.pl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: imx: add a driver for i.MX8MQ mipi csi rx phy and controller
Add a driver to support the i.MX8MQ MIPI CSI receiver. The hardware side
is based on
https://source.codeaurora.org/external/imx/linux-imx/tree/drivers/media/platform/imx8/mxc-mipi-csi2_yav.c?h=imx_5.4.70_2.3.0
It's built as part of VIDEO_IMX7_CSI because that's documented to support
i.MX8M platforms. This driver adds i.MX8MQ support where currently only the
i.MX8MM platform has been supported.
Laurent Pinchart [Tue, 11 May 2021 23:44:40 +0000 (01:44 +0200)]
media: imx: imx7-media-csi: Fix buffer return upon stream start failure
When the stream fails to start, the first two buffers in the queue have
been moved to the active_vb2_buf array and are returned to vb2 by
imx7_csi_dma_unsetup_vb2_buf(). The function is called with the buffer
state set to VB2_BUF_STATE_ERROR unconditionally, which is correct when
stopping the stream, but not when the start operation fails. In that
case, the state should be set to VB2_BUF_STATE_QUEUED. Fix it.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm> Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: imx: imx7-media-csi: Don't set PIXEL_BIT in CSICR1
The PIXEL_BIT field of the CSICR1 register is documented as setting the
Bayer data width to 10 bits, and is set by the driver for all non-YUV
pixel formats. Test code from NXP showed that the bit shouldn't be set
for Bayer formats, and this was confirmed by experimentation with RAW8
capture (which doesn't work when setting the field) and RAW10 capture
(for which setting the field doesn't seem to make a difference) on
i.MX8MM with an OV5640 sensor connected over CSI-2. Don't set it.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: imx: imx7-media-csi: Set TWO_8BIT_SENSOR for >= 10-bit formats
Sample code from NXP, as well as experiments on i.MX8MM with RAW10
capture with an OV5640 sensor connected over CSI-2, showed that the
TWO_8BIT_SENSOR field of the CSICR3 register needs to be set for formats
larger than 8 bits. Do so, even if the reference manual doesn't clearly
describe the effect of the field.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm> Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: dt-bindings: media: nxp,imx7-csi: Add i.MX8MM support
The i.MX8MM integrates a CSI bridge IP core, as the i.MX7. There seems
to be no difference between the two SoCs according to the reference
manual, but as documentation may not be accurate, add a compatible
string for the i.MX8MM, with a fallback on the compatible i.MX7.
The range for analog gain mentioned in the datasheet is [0, 480].
The real gain formula mentioned in the datasheet is:
Gain = 512 / (512 – X)
Hence, values larger than 511 clearly makes no sense. The gain
register field is also documented to be of 9-bits in the datasheet.
Certainly, it is enough to infer that, the kernel driver currently
advertises an arbitrary analog gain max. Fix it by rectifying the
value as per the data sheet i.e. 480.
The frame_length_lines (0x0340) registers are hard-coded as follows:
- 4208x3118
frame_length_lines = 0x0c50
- 2104x1560
frame_length_lines = 0x0638
- 1048x780
frame_length_lines = 0x034c
The driver exposes the V4L2_CID_VBLANK control in read-only mode and
sets its value to vts_def - height, where vts_def is a mode-dependent
value coming from the supported_modes array. It is set using one of
the following macros defined in the driver:
There's a clear mismatch in the value for the full resolution mode i.e.
IMX258_VTS_30FPS. Fix it by rectifying the macro with the value set for
the frame_length_lines register as stated above.
Bingbu Cao [Tue, 6 Jul 2021 09:18:49 +0000 (11:18 +0200)]
media: ov8856: ignore gpio and regulator for ov8856 with ACPI
For ov8856 working with ACPI, it does not depend on the reset gpio
and regulator to do reset and power control, so should get the gpio
and regulator for non-ACPI cases only, otherwise it will break ov8856
with ACPI.
[Sakari Ailus: Wrap a line over 80 chars.]
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Tianshu Qiu <tian.shu.qiu@intel.com> Cc: Robert Foss <robert.foss@linaro.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Bingbu Cao [Mon, 5 Jul 2021 07:14:15 +0000 (09:14 +0200)]
media: ov9734: use group write for digital gain
As the RGB digital gains of ov9734 were not applied as group, some
artifacts were observed in low light environment, use group write for
digital gain can make the RGB digital can be guaranteed to applied
together at frame boundary.
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Bingbu Cao [Mon, 5 Jul 2021 06:50:59 +0000 (08:50 +0200)]
media: ov2740: use group write for digital gain
As the RGB digital gains of ov2740 were not applied as group, some
artifacts were observed in low light environment, use group write for
digital gain can make the RGB digital can be guaranteed to applied
together at frame boundary.
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Sakari Ailus [Thu, 24 Jun 2021 12:05:24 +0000 (14:05 +0200)]
media: v4l2-flash: Add sanity checks for flash and indicator controls
The V4L2 flash API supports combinations of indicator and flash LEDs. Due
to this, there's a fair amount of code that deals with all the possible
options and just reading one part of the file doesn't really tell which
combinations are really possible.
Make the checks more explicit to keep static analysers happy and to make
the code more resilient to future mishaps.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Sakari Ailus [Wed, 23 Jun 2021 12:44:28 +0000 (14:44 +0200)]
media: v4l: subdev: Add pre_streamon and post_streamoff callbacks
Add pre_streamon and post_streamoff callbacks that can be used to set a
CSI-2 transmitter to LP-11 or LP-111 mode. This can be used by receiver
drivers to reliably initialise the receiver when its initialisation
requires software involvement.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Rework LP-11 and LP-111 mode documentation to make it more understandable
and useful. This involves adding pre_streamon and post_streamon callbacks
that make it possible to explicitly transition the transmitter to either
mode.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
The V4L2_CID_PIXEL_RATE is nowadays used to tell pixel sampling rate in
the sub-device's pixel array, not the pixel rate over a link (for which it
also becomes unfit with the addition of multiplexed streams later on). Fix
this.
Sakari Ailus [Mon, 1 Feb 2021 09:16:03 +0000 (10:16 +0100)]
media: Documentation: media: Improve camera sensor documentation
Modernise the documentation to make it more precise and update the use of
pixel rate control and various other changes. In particular:
- Use non-proportional font for file names, properties as well as
controls.
- The unit of the HBLANK control is pixels, not lines.
- The unit of PIXEL_RATE control is pixels per second, not Hz.
- Merge common requirements for CSI-2 and parallel busses.
- Include all DT properties needed for assigned clocks.
- Fix referencing the link rate control.
- SMIA driver's new name is CCS driver.
- The PIXEL_RATE control denotes pixel rate on the pixel array on camera
sensors. Do not suggest it is used to tell the maximum pixel rate on the
bus anymore.
- Improve ReST syntax (plain struct and function names).
- Remove the suggestion to use s_power() in receiver drivers.
- Make MIPI website URL use HTTPS, add Wikipedia links to BT.601 and
BT.656.
Fixes: e4cf8c58af75 ("media: Documentation: media: Document how to write camera sensor drivers") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Jacopo Mondi <jacopo@jmondi.org> Reviewed-by: Andrey Konovalov <andrey.konovalov@linaro.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
"The media bus pixel codes document parallel formats. Should the pixel
data be transported over a serial bus, the media bus pixel code that
describes a parallel format that transfers a sample on a single clock
cycle is used. For instance, both MEDIA_BUS_FMT_BGR888_1X24 and
MEDIA_BUS_FMT_BGR888_3X8 are used on parallel busses for transferring an
8 bits per sample BGR data, whereas on serial busses the data in this
format is only referred to using MEDIA_BUS_FMT_BGR888_1X24. This is
because there is effectively only a single way to transport that
format on the serial busses."
Some MIPI CSI receivers strictly obey this definition and declare
support for only *1X_* formats.
Hence, complement the supported media bus formats with their 1X16 versions
(currently applicable to yuyv, uyvy) to enhance interoperability with CSI
receivers.
Martina Krasteva [Thu, 27 May 2021 14:21:45 +0000 (16:21 +0200)]
media: i2c: Add ov9282 camera sensor driver
Add a v4l2 sub-device driver for the OmniVisison ov9282
black&white image sensor.
The camera sensor uses the i2c bus for control and the
csi-2 bus for data.
The following features are supported:
- manual exposure and analog gain control support
- vblank/hblank/pixel rate/link freq control support
- supported resolution:
- 1280x720 @ 30fps
Martina Krasteva [Thu, 27 May 2021 14:21:43 +0000 (16:21 +0200)]
media: i2c: Add imx412 camera sensor driver
Add a v4l2 sub-device driver for the Sony imx412 image sensor.
This is a camera sensor using the i2c bus for control and the
csi-2 bus for data.
The following features are supported:
- manual exposure and analog gain control support
- vblank/hblank/pixel rate/link freq control support
- supported resolution:
- 4056x3040 @ 30fps
- supported bayer order output:
- SRGGB10
Martina Krasteva [Thu, 27 May 2021 14:21:41 +0000 (16:21 +0200)]
media: i2c: Add imx335 camera sensor driver
Add a v4l2 sub-device driver for the Sony imx335 image sensor.
ThE camera sensor uses the i2c bus for control and the csi-2
bus for data.
The following features are supported:
- manual exposure and analog gain control support
- vblank/hblank/pixel rate/link freq control support
- supported resolution:
- 2592x1940 @ 30fps
- supported bayer order output:
- SRGGB12
Dongliang Mu [Wed, 7 Jul 2021 09:34:09 +0000 (11:34 +0200)]
media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
If em28xx_ir_init fails, it would decrease the refcount of dev. However,
in the em28xx_ir_fini, when ir is NULL, it goes to ref_put and decrease
the refcount of dev. This will lead to a refcount bug.
Fix this bug by removing the kref_put in the error handling code
of em28xx_ir_init.
Reported-by: Dongliang Mu <mudongliangabcd@gmail.com> Fixes: ac5688637144 ("media: em28xx: Fix possible memory leak of em28xx struct") Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Viktor Prutyanov [Mon, 19 Jul 2021 17:05:06 +0000 (19:05 +0200)]
media: rc: introduce Meson IR TX driver
This patch adds the driver for Amlogic Meson IR transmitter.
Some Amlogic SoCs such as A311D and T950D4 have IR transmitter
(also called blaster) controller onboard. It is capable of sending
IR signals with arbitrary carrier frequency and duty cycle.
The driver supports 2 modulation clock sources:
- xtal3 clock (xtal divided by 3)
- 1us clock
Signed-off-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Viktor Prutyanov [Mon, 19 Jul 2021 17:05:05 +0000 (19:05 +0200)]
media: rc: meson-ir-tx: document device tree bindings
This patch adds binding documentation for the IR transmitter
available in Amlogic Meson SoCs.
Signed-off-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu> Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* commit 'c3cdc019a6bf':
media: atomisp: pci: reposition braces as per coding style
media: atomisp: i2c: Remove a superfluous else clause in atomisp-mt9m114.c
media: atomisp: Move MIPI_PORT_LANES to the only user
media: atomisp: Perform a single memset() for union
media: atomisp: pci: fix error return code in atomisp_pci_probe()
media: atomisp: pci: Remove unnecessary (void *) cast
media: atomisp: pci: Remove checks before kfree/kvfree
media: atomisp: Remove unused port_enabled variable
media: atomisp: Annotate a couple of definitions with __maybe_unused
media: atomisp: Remove unused declarations
media: atomisp: remove the repeated declaration
media: atomisp: improve error handling in gc2235_detect()
media: atomisp: Fix whitespace at the beginning of line
media: atomisp: Align block comments
media: atomisp: Use sysfs_emit() instead of sprintf() where appropriate
media: atomisp: Fix line continuation style issue in sh_css.c
media: atomisp: Use kcalloc instead of kzalloc with multiply in sh_css.c
media: atomisp: Remove unnecessary parens in sh_css.c
media: atomisp: Resolve goto style issue in sh_css.c
media: atomisp: fix the uninitialized use and rename "retvalue"
media: atomisp: pci: reposition braces as per coding style
Misplaced braces makes it difficult to follow the code easily. This also
goes against the code style guidelines. This resolved following checkpatch
complaints:
ERROR: open brace '{' following function definitions go on the next line
ERROR: that open brace { should be on the previous line
Link: https://lore.kernel.org/linux-media/YIwk3KbVGRPJwKa4@dU2104
[mchehab: dropped a hunk with a merge conflict] Cc: linux-media@vger.kernel.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, drv@mailo.com # X-LSpam-Score: -7.3 (-------) Signed-off-by: Deepak R Varma <drv@mailo.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: Perform a single memset() for union
There is no need to memset() both dvs_grid_info and dvs_stat_grid_info
separately: they are part of the same union. Instead, just zero the
union itself. This additionally avoids a false positive (due to a
gcc optimization bug[1]) when building with the coming FORTIFY_SOURCE
improvements:
In function 'fortify_memset_chk',
inlined from 'sh_css_pipe_get_grid_info' at drivers/staging/media/atomisp/pci/sh_css.c:5186:3,
inlined from 'ia_css_stream_create' at drivers/staging/media/atomisp/pci/sh_css.c:9442:10:
./include/linux/fortify-string.h:199:4: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
199 | __write_overflow_field();
| ^~~~~~~~~~~~~~~~~~~~~~~~
media: atomisp: pci: Remove checks before kfree/kvfree
Removed checks for pointers != NULL before freeing memory. If kvfree()
and kfree() are given NULL pointers no operations are performed, so
there is no need for the above-mentioned checks. Coccinelle detected the
second of the two unnecessary checks.
Tom Rix [Fri, 21 May 2021 19:48:05 +0000 (21:48 +0200)]
media: atomisp: improve error handling in gc2235_detect()
Static analysis reports this representative problem
atomisp-gc2235.c:867:20: warning: The right operand
of '|' is a garbage value
id = ((high << 8) | low);
^ ~~~
When gc2235_read_reg() fails, its return val is never written.
For gc2235_detect(), high and low are or-ed and compared
with GC2235_ID, 0x2235. Initialize both to 0 and skip
checking the read returns, it's errors are not passed up, only
-ENODEV is.
media: atomisp: Fix whitespace at the beginning of line
This patch fixes whitespace at the beginning of line by wrapping after
the type name and aligning the arguments with the open parenthesis.
Identified by checkpatch: WARNING: please, no spaces at the start of a
line.
Yizhuo [Fri, 25 Jun 2021 05:38:56 +0000 (07:38 +0200)]
media: atomisp: fix the uninitialized use and rename "retvalue"
Inside function mt9m114_detect(), variable "retvalue" could
be uninitialized if mt9m114_read_reg() returns error, however, it
is used in the later if statement, which is potentially unsafe.
The local variable "retvalue" is renamed to "model" to avoid
confusion.
media: atomisp: pci: reposition braces as per coding style
Misplaced braces makes it difficult to follow the code easily. This also
goes against the code style guidelines. This resolved following checkpatch
complaints:
ERROR: open brace '{' following function definitions go on the next line
ERROR: that open brace { should be on the previous line
Link: https://lore.kernel.org/linux-media/YIwk3KbVGRPJwKa4@dU2104
[mchehab: dropped a hunk with a merge conflict] Cc: linux-media@vger.kernel.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, drv@mailo.com # X-LSpam-Score: -7.3 (-------) Signed-off-by: Deepak R Varma <drv@mailo.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: Perform a single memset() for union
There is no need to memset() both dvs_grid_info and dvs_stat_grid_info
separately: they are part of the same union. Instead, just zero the
union itself. This additionally avoids a false positive (due to a
gcc optimization bug[1]) when building with the coming FORTIFY_SOURCE
improvements:
In function 'fortify_memset_chk',
inlined from 'sh_css_pipe_get_grid_info' at drivers/staging/media/atomisp/pci/sh_css.c:5186:3,
inlined from 'ia_css_stream_create' at drivers/staging/media/atomisp/pci/sh_css.c:9442:10:
./include/linux/fortify-string.h:199:4: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
199 | __write_overflow_field();
| ^~~~~~~~~~~~~~~~~~~~~~~~
media: atomisp: pci: Remove checks before kfree/kvfree
Removed checks for pointers != NULL before freeing memory. If kvfree()
and kfree() are given NULL pointers no operations are performed, so
there is no need for the above-mentioned checks. Coccinelle detected the
second of the two unnecessary checks.
Tom Rix [Fri, 21 May 2021 19:48:05 +0000 (21:48 +0200)]
media: atomisp: improve error handling in gc2235_detect()
Static analysis reports this representative problem
atomisp-gc2235.c:867:20: warning: The right operand
of '|' is a garbage value
id = ((high << 8) | low);
^ ~~~
When gc2235_read_reg() fails, its return val is never written.
For gc2235_detect(), high and low are or-ed and compared
with GC2235_ID, 0x2235. Initialize both to 0 and skip
checking the read returns, it's errors are not passed up, only
-ENODEV is.
media: atomisp: Fix whitespace at the beginning of line
This patch fixes whitespace at the beginning of line by wrapping after
the type name and aligning the arguments with the open parenthesis.
Identified by checkpatch: WARNING: please, no spaces at the start of a
line.
Yizhuo [Fri, 25 Jun 2021 05:38:56 +0000 (07:38 +0200)]
media: atomisp: fix the uninitialized use and rename "retvalue"
Inside function mt9m114_detect(), variable "retvalue" could
be uninitialized if mt9m114_read_reg() returns error, however, it
is used in the later if statement, which is potentially unsafe.
The local variable "retvalue" is renamed to "model" to avoid
confusion.
Dinghao Liu [Thu, 8 Apr 2021 08:18:43 +0000 (10:18 +0200)]
media: atomisp: Fix runtime PM imbalance in atomisp_pci_probe
When hmm_pool_register() fails, a pairing PM usage counter
increment is needed to keep the counter balanced. It's the
same for the following error paths.
Philipp Zabel [Mon, 19 Jul 2021 14:57:08 +0000 (16:57 +0200)]
media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
The frame memory control register value is currently determined
before userspace selects the final capture format and never corrected.
Update ctx->frame_mem_ctrl in __coda_start_decoding() to fix decoding
into YUV420 or YVU420 capture buffers.
Reported-by: Andrej Picej <andrej.picej@norik.com> Fixes: 497e6b8559a6 ("media: coda: add sequence initialization work") Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tom Rix [Fri, 16 Jul 2021 19:17:33 +0000 (21:17 +0200)]
media: ti-vpe: cal: fix indexing of cal->ctx[] in cal_probe()
cal->ctx[i] is allocated with this loop
for (i = 0; i < cal->data->num_csi2_phy; ++i) {
and accessed in the error handler and else where with this loop
for (i = 0; i < cal->num_contexts; i++)
Because the first loop contains a continue statement
before cal->num_contexts is incremented, using i as the
indexer will leave gaps in the cal->ctx[].
So use cal->num_contexts as the indexer.
Fixes: 75e7e58bfac1 ("media: ti-vpe: cal: support 8 DMA contexts") Signed-off-by: Tom Rix <trix@redhat.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Dan Carpenter [Tue, 13 Jul 2021 09:24:10 +0000 (11:24 +0200)]
media: rockchip/rga: fix error handling in probe
There are a few bugs in this code. 1) No checks for whether
dma_alloc_attrs() or __get_free_pages() failed. 2) If
video_register_device() fails it doesn't clean up the dma attrs or the
free pages. 3) The video_device_release() function frees "vfd" which
leads to a use after free on the next line. The call to
video_unregister_device() is not required so I have just removed that.
Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support") Reported-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Pavel Skripkin [Wed, 7 Jul 2021 17:54:30 +0000 (19:54 +0200)]
media: stkwebcam: fix memory leak in stk_camera_probe
My local syzbot instance hit memory leak in usb_set_configuration().
The problem was in unputted usb interface. In case of errors after
usb_get_intf() the reference should be putted to correclty free memory
allocated for this interface.
Fixes: ec16dae5453e ("V4L/DVB (7019): V4L: add support for Syntek DC1125 webcams") Cc: stable@vger.kernel.org Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Dafna Hirschfeld [Fri, 25 Jun 2021 08:23:09 +0000 (10:23 +0200)]
media: rkisp1: cap: initialize dma buf address in 'buf_init' cb
Initializing the dma addresses of the capture buffers can
move to the 'buf_init' callback, since it is enough to do
it once for each buffer and not every time it is queued.
projects / thirdparty / kernel / linux.git / log
