Sakari Ailus [Tue, 18 Apr 2023 12:00:54 +0000 (14:00 +0200)]
media: v4l: async: Rework internal lists
This patch re-arranges internal V4L2 async lists for preparation of
supporting multiple connections per sub-device as well as cleaning up used
lists.
The list of unbound V4L2 sub-devices shall be maintained for the purpose of
listing those sub-devices only, not for their bindin status. Also, the V4L2
async connections now have, instead of two list entries, a single list
entry in the notifier's list, be that either waiting or done lists, while
the notifier's asc_list is removed.
The one-to-one relation between a sub-device and a connection is still
maintained in this patch.
Sakari Ailus [Tue, 18 Apr 2023 09:54:32 +0000 (11:54 +0200)]
media: v4l: async: Drop duplicate handling when adding connections
The connections are checked for duplicates already when the notifier is
registered. This is effectively a sanity check for driver (and possibly
obscure firmware) bugs. Don't do this when adding the connection.
Retain the int return type for now. It'll be needed very soon again.
Sakari Ailus [Thu, 16 Feb 2023 13:54:53 +0000 (14:54 +0100)]
media: v4l: async: Rename v4l2_async_subdev as v4l2_async_connection
Rename v4l2_async_subdev as v4l2_async_connection, in order to
differentiate between the sub-devices and their connections: one
sub-device can have many connections but the V4L2 async framework has so
far allowed just a single one. Connections in this context will later
translate into either MC ancillary or data links.
This patch prepares changing that relation by changing existing users of
v4l2_async_subdev to switch to v4l2_async_connection. Async sub-devices
themselves will not be needed anymore
Additionally, __v4l2_async_nf_add_subdev() has been renamed
__v4l2_async_nf_add_connection().
V4L2 async sub-device matching originally used the device nodes only.
Endpoint nodes were taken into use instead as using the device nodes was
problematic for it was in some cases ambiguous which link might have been
in question.
There is however no need to use endpoint nodes on both sides, as the async
sub-device's fwnode can always be trivially obtained using
fwnode_graph_get_remote_endpoint() when needed while what counts is
whether or not the link is between two device nodes, i.e. the device nodes
match.
This will briefly break the adv748x driver but it will be fixed later in
the set, by patch "media: adv748x: Return to endpoint matching".
Sakari Ailus [Sun, 19 Feb 2023 12:24:41 +0000 (13:24 +0100)]
media: v4l: async: Only pass match information for async subdev validation
Pass only information required for sub-device matching to functions
checking whether the async sub-device already exists. Do the same for
debug message printing. This makes further changes to other aspects of
async sub-devices easier.
Accordingly, also perform further renames:
asd_equal as v4l2_async_match_equal,
v4l2_async_nf_has_async_subdev as v4l2_async_nf_has_async_match,
__v4l2_async_nf_has_async_subdev as
v4l2_async_nf_has_async_subdev_entry and
v4l2_async_nf_asd_valid as v4l2_async_nf_match_valid.
Sakari Ailus [Mon, 20 Feb 2023 11:14:19 +0000 (12:14 +0100)]
media: v4l: async: Clean up testing for duplicate async subdevs
There's a need to verify that a single async sub-device isn't being added
multiple times, this would be an error. This takes place at the time of
adding the async sub-device to the notifier's list as well as when the
notifier is added to the global notifier's list.
Use the pointer to the sub-device for testing this instead of an index to
an array that is long gone. (There was an array of async sub-devices in
the notifier before it was converted to a linked list by commit 66beb323e4a0 ("media: v4l2: async: Remove notifier subdevs array").)
Document v4l2_async_nf_cleanup() which must be called before releasing an
unregistered notifier's memory. Also remove the sentence regarding
v4l2_async_nf_init() arguments --- those are documented in kerneldoc which
is referred here.
Sakari Ailus [Tue, 20 Jun 2023 12:03:02 +0000 (14:03 +0200)]
media: Documentation: v4l: Add section titles for async
Add section titles for async documentation. While the documentation is
mostly fine as-is, it has grown from its original state but remains
without internal structure. Add it now.
Sakari Ailus [Fri, 19 May 2023 11:56:33 +0000 (13:56 +0200)]
media: omap3isp: Move link creation to bound callback
Move the creation of the links between external sub-devices and ISP
sub-devices to the bound callback. This way we can also remove the need to
access the sub-device's notifier field that will soon be removed.
Sakari Ailus [Tue, 18 Apr 2023 11:07:28 +0000 (13:07 +0200)]
media: xilinx-vipp: Clean up bound async notifier callback
The async notifier bound callback does a lot of checks that have probably
been always unnecessary. Remove the lookup of the async subev that we
already have, as well as the debug print that is already printed by the
framework.
media: v4l: async: Drop v4l2_async_nf_parse_fwnode_endpoints()
The v4l2_async_nf_parse_fwnode_endpoints() function, part of
v4l2-fwnode.c, was a helper meant to register one async sub-dev for each
fwnode endpoint of a device.
The function is marked as deprecated in the documentation and is actually
not used anywhere anymore. Drop it and remove the helper function
v4l2_async_nf_fwnode_parse_endpoint() from v4l2-fwnode.c.
This change allows to make the helper function
__v4l2_async_nf_add_connection() visibility private to v4l2-async.c so
that there is no risk drivers can mistakenly use it.
media: mediatek: vcodec: Consider vdecsys presence in reg range check
Commit fe8a33978383 ("media: mediatek: vcodec: Read HW active status
from syscon") allowed the driver to read the VDEC_SYS io space from a
syscon instead of from the reg property when reg-names are supplied.
However as part of that change, a smatch warning was introduced:
With a correct Devicetree, that is, one that follows the dt-binding, it
wouldn't be possible to trigger such a buffer overflow. Even so, update
the range validation of the reg property, so that the smatch warning is
fixed and if an incorrect Devicetree is ever supplied the code errors
out instead of causing memory corruption.
Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Closes: https://lore.kernel.org/all/b5fd2dff-14a5-3ad8-9698-d1a50f4516fa@xs4all.nl Fixes: fe8a33978383 ("media: mediatek: vcodec: Read HW active status from syscon") Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Hans Verkuil [Thu, 20 Jul 2023 07:19:04 +0000 (09:19 +0200)]
media: venus: core.h: update kerneldoc
Document missing fields. This resolves two warnings:
drivers/media/platform/qcom/venus/core.h:226: warning: Function parameter or member 'venus_ver' not described in 'venus_core'
drivers/media/platform/qcom/venus/core.h:501: warning: Function parameter or member 'enc_state' not described in 'venus_inst'
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Dan Carpenter [Wed, 14 Jun 2023 13:06:47 +0000 (16:06 +0300)]
media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init()
If we encounter any error in the vdec_msg_queue_init() then we need
to set "msg_queue->wdma_addr.size = 0;". Normally, this is done
inside the vdec_msg_queue_deinit() function. However, if the
first call to allocate &msg_queue->wdma_addr fails, then the
vdec_msg_queue_deinit() function is a no-op. For that situation, just
set the size to zero explicitly and return.
There were two other error paths which did not clean up before returning.
Change those error paths to goto mem_alloc_err.
Fixes: b199fe46f35c ("media: mtk-vcodec: Add msg queue feature for lat and core architecture") Fixes: 2f5d0aef37c6 ("media: mediatek: vcodec: support stateless AV1 decoder") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
The "lat_buf->private_data" needs to be set to NULL to prevent a
double free. How this would happen is if vdec_msg_queue_init() failed
twice in a row and on the second time it failed earlier than on the
first time.
The vdec_msg_queue_init() function has a loop which does:
for (i = 0; i < NUM_BUFFER_COUNT; i++) {
Each iteration initializes one element in the msg_queue->lat_buf[] array
and then the clean up function vdec_msg_queue_deinit() frees each
element of the msg_queue->lat_buf[] array. This clean up code relies
on the assumption that every element is either initialized or zeroed.
Leaving a freed pointer which is non-zero breaks the assumption.
Fixes: b199fe46f35c ("media: mtk-vcodec: Add msg queue feature for lat and core architecture") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Irui Wang [Wed, 5 Jul 2023 09:14:41 +0000 (17:14 +0800)]
media: mediatek: vcodec: Return NULL if no vdec_fb is found
"fb_use_list" is used to store used or referenced frame buffers for
vp9 stateful decoder. "NULL" should be returned when getting target
frame buffer failed from "fb_use_list", not a random unexpected one.
Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver") Signed-off-by: Irui Wang <irui.wang@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: mediatek: vcodec: Read HW active status from syscon
Remove the requirement of a VDEC_SYS reg iospace for both MT8173 and
MT8183. To achieve that, rely on a vdecsys syscon to be passed through
the DT, and use it to directly read the VDEC_HW_ACTIVE bit during IRQ
handling to check whether the HW is active. Also update the VP8 stateful
decoder to use the syscon, if present, for writes to VDEC_SYS.
The old behavior is still present when reg-names aren't supplied, as
to keep backward compatibility.
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: added vdecsys_regmap kerneldoc line provided by Nicolas]
media: mediatek: vcodec: Define address for VDEC_HW_ACTIVE
The VDEC_HW_ACTIVE bit is located at offset 0, bit 4 of the VDECSYS
iospace. Only the mask was previously defined, with the address being
implicit. Explicitly define the address, and append a '_MASK' suffix to
the mask, to make accesses to this bit clearer.
This commit brings no functional change.
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: dt-bindings: mediatek,vcodec: Remove VDEC_SYS register space
The binding expects the first register space to be VDEC_SYS. However
this register space is already assigned to a different node on both
MT8173 and MT8183: a clock-controller node called 'vdecsys' which is
also a syscon.
In order to resolve the overlapping address ranges, remove the VDEC_SYS
register space from the video decoder, and add a new property to hold
the phandle to the syscon, so that iospace can still be handled.
Also add reg-names to be able to tell that this new register schema is
used, so the driver can keep backward compatibility.
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
On MT8183 it's not necessary to configure the parent for the clocks.
Remove the assigned-clocks and assigned-clock-parents from the required
list.
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: dt-bindings: mediatek,vcodec: Allow single clock for mt8183
MT8173 and MT8183 have different clocks, and consequently clock-names.
Relax the number of clocks and set clock-names based on compatible.
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Dan Carpenter [Wed, 14 Jun 2023 13:19:41 +0000 (16:19 +0300)]
media: mediatek: vcodec: Improve an error message
This is intended to print the error code but there is a typo so it
prints IS_ERR() instead of PTR_ERR().
Fixes: 77f3b023f452 ("media: mediatek: vcodec: Add debugfs interface to get debug information") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Dan Carpenter [Wed, 14 Jun 2023 13:07:15 +0000 (16:07 +0300)]
media: mediatek: vcodec: Fix potential crash in mtk_vcodec_dbgfs_remove()
The list iterator "dbgfs_inst" is always non-NULL. This means that the
test for NULL inside the loop is unnecessary and it also means that the
test for NULL outside the loop will not work. If we do not find the item
on the list with the correct the ctx_id then it will free invalid memory
leading to a crash.
Fixes: cd403a6a0419 ("media: mediatek: vcodec: Add a debugfs file to get different useful information") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Ming Qian [Tue, 18 Jul 2023 09:50:13 +0000 (17:50 +0800)]
media: amphion: ensure the bitops don't cross boundaries
the supported_instance_count determine the instance index range,
it shouldn't exceed the bits number of instance_mask,
otherwise the bitops of instance_mask may cross boundaries
Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: rkvdec: increase max supported height for H.264
After testing it is possible for the hardware to decode H264
bistream with a height up to 2560.
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver") Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Ming Qian [Mon, 10 Jul 2023 07:44:11 +0000 (15:44 +0800)]
media: amphion: decoder support display delay for all formats
the firmware only support low latency mode for h264,
but firmware will notify an event to driver
when one frame is decoded,
if V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE is enabled,
and V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY is set to 0,
driver can display the decoded frame immediately.
Fixes: ffa331d9bf94 ("media: amphion: decoder implement display delay enable") Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Zheng Wang [Fri, 7 Jul 2023 09:24:14 +0000 (17:24 +0800)]
media: mtk-jpeg: Fix use after free bug due to uncanceled work
In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with
mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run
and mtk_jpeg_enc_device_run may be called to start the
work.
If we remove the module which will call mtk_jpeg_remove
to make cleanup, there may be a unfinished work. The
possible sequence is as follows, which will cause a
typical UAF bug.
Fix it by canceling the work before cleanup in the mtk_jpeg_remove
Michael Tretter [Thu, 6 Jul 2023 07:15:10 +0000 (09:15 +0200)]
media: verisilicon: Fix TRY_FMT on encoder OUTPUT
Commit f100ce3bbd6a ("media: verisilicon: Fix crash when probing
encoder") removed vpu_fmt from hantro_try_fmt(), since it was
initialized from vpu_dst_fmt, which may not be initialized, when TRY_FMT
is called. It was replaced by fmt, which is found using the pixelformat.
For the encoder, this changed the fmt to contain the raw format instead
of the coded format. The format constraints as of fmt->frmsize are only
valid for the coded format and are 0 for the raw formats. Therefore, the
size of a encoder OUTPUT device is constrained to 0 and the
v4l2-compliance tests for G_FMT, TRY_FMT, and SET_FMT fail.
Bring back vpu_fmt to use the coded format on an encoder OUTPUT device,
but initialize it using the currently set pixelformat on dst_fmt, which
is the coded format on an encoder.
Fixes: f100ce3bbd6a ("media: verisilicon: Fix crash when probing encoder") Signed-off-by: Michael Tretter <m.tretter@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Ming Qian [Tue, 13 Jun 2023 07:48:46 +0000 (15:48 +0800)]
media: amphion: reinit vpu if reqbufs output 0
according to v4l2 stateful decoder document 4.5.1.3. State Machine,
the state should change from seek to initialization
if call VIDIOC_REQBUFS(OUTPUT, 0).
so reinit the vpu decoder if reqbufs output 0
Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver") Signed-off-by: Ming Qian <ming.qian@nxp.com> Tested-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Hans Verkuil [Thu, 20 Jul 2023 07:20:03 +0000 (09:20 +0200)]
staging: media: tegra-video: include video.h header
This tells sparse that tegra_vip_driver is actually used,
and so avoids this warning:
drivers/staging/media/tegra-video/vip.c:280:31: warning: 'tegra_vip_driver' defined but not used [-Wunused-variable]
280 | static struct platform_driver tegra_vip_driver = {
| ^~~~~~~~~~~~~~~~
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Hans Verkuil [Thu, 20 Jul 2023 07:18:22 +0000 (09:18 +0200)]
staging: media: sun6i-isp: drop of_match_ptr for ID table
The driver can match only via the DT table so the table should be always
used and the of_match_ptr does not make any sense.
This also fixes this !CONFIG_OF error:
drivers/staging/media/sunxi/sun6i-isp/sun6i_isp.c:529:34: warning: 'sun6i_isp_of_match' defined but not used [-Wunused-const-variable=]
529 | static const struct of_device_id sun6i_isp_of_match[] = {
| ^~~~~~~~~~~~~~~~~
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Ming Qian [Thu, 20 Jul 2023 03:09:52 +0000 (11:09 +0800)]
MAINTAINERS: update amphion vpu driver entry
Shijie has not been actively working on the driver,
his e-mail address is bouncing for quite awhile now.
remove him from the maintainer list here.
I do want to thank him for his work on the driver.
Signed-off-by: Zhou Peng <eagle.zhou@nxp.com> Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Tomi Valkeinen [Wed, 19 Jul 2023 14:31:37 +0000 (17:31 +0300)]
media: i2c: ds90ub913: Fix a warning about use of uninitialized variable
Fix the following warning:
drivers/media/i2c/ds90ub913.c:488:9: warning: 'v' may be used uninitialized [-Wmaybe-uninitialized]
488 | ub913_write(priv, UB913_REG_GENERAL_CFG,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
489 | v | UB913_REG_GENERAL_CFG_CRC_ERR_RESET);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/media/i2c/ds90ub913.c:477:12: note: 'v' was declared here
477 | u8 v, v1, v2;
| ^
Fix the warning by initializing the variable to 0. Proper error handling
here would be somewhat pointless, as we are just printing register
values, and the user will see an error about the failed i2c transaction.
Fixes: c158d0d4ff15 ("media: i2c: add DS90UB913 driver") Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Closes: https://lore.kernel.org/all/a0180488-f7f5-8538-a8bb-52ae52912835@xs4all.nl/ Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: Remove flag FBINFO_FLAG_DEFAULT from fbdev drivers
The flag FBINFO_FLAG_DEFAULT is 0 and has no effect, as struct
fbinfo.flags has been allocated to zero by kzalloc(). So do not
set it.
Flags should signal differences from the default values. After cleaning
up all occurrences of FBINFO_DEFAULT, the token will be removed.
v2:
* fix commit message (Miguel)
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Sam Ravnborg <sam@ravnborg.org> Cc: Andy Walls <awalls@md.metrocast.net> Cc: Mauro Carvalho Chehab <mchehab@kernel.org> Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Tomi Valkeinen [Mon, 19 Jun 2023 11:40:07 +0000 (14:40 +0300)]
media: ti: cal: Implement get_frame_desc for camera-rx
CAL uses get_frame_desc to get the VC and DT for the incoming CSI-2
stream, but does it in a bit hacky way. Clean this up by implementing
.get_frame_desc to camera-rx, and calling that from cal.c.
No functional change intended.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
The imx8mq-mipi-csi2 MIPI CSI-2 receiver driver is used and maintained.
There is no reason to keep it in staging. The accompanying CSI bridge
driver that uses it is in drivers/media/platform/nxp as well.
One TODO is to get rid of csi_state's "state" and "lock" variables.
Especially make sure suspend/resume is working without them. That can
very well be worked on from the new location.
Also add a MAINTAINERS section for the imx8mq-mipi-csi2 mipi receiver
driver.
Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: aspeed: Fix memory overwrite if timing is 1600x900
When capturing 1600x900, system could crash when system memory usage is
tight.
The way to reproduce this issue:
1. Use 1600x900 to display on host
2. Mount ISO through 'Virtual media' on OpenBMC's web
3. Run script as below on host to do sha continuously
#!/bin/bash
while [ [1] ];
do
find /media -type f -printf '"%h/%f"\n' | xargs sha256sum
done
4. Open KVM on OpenBMC's web
The size of macro block captured is 8x8. Therefore, we should make sure
the height of src-buf is 8 aligned to fix this issue.
Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: ds90ub9xx: switch three more drivers back to use struct i2c_driver::probe()
struct i2c_driver::probe_new() is about to go away. Since I converted
all drivers below drivers/media use struct i2c_driver::probe, three more
drivers were added in the following commits that use .probe_new():
Yang Li [Tue, 18 Jul 2023 01:01:54 +0000 (09:01 +0800)]
media: i2c: ds90ub953: No need to set device_driver owner
Remove .owner field if calls are used which set it automatically.
to silence the warning:
./drivers/media/i2c/ds90ub953.c:1390:3-8: No need to set .owner here. The core will do it.
Reported-by: Abaci Robot <abaci@linux.alibaba.com> Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5902 Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Rob Herring [Fri, 14 Jul 2023 17:47:08 +0000 (11:47 -0600)]
media: Explicitly include correct DT includes
The DT of_device.h and of_platform.h date back to the separate
of_platform_bus_type before it as merged into the regular platform bus.
As part of that merge prepping Arm DT support 13 years ago, they
"temporarily" include each other. They also include platform_device.h
and of.h. As a result, there's a pretty much random mix of those include
files used throughout the tree. In order to detangle these headers and
replace the implicit includes with struct declarations, users need to
explicitly include the correct includes.
Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: dvb-usb: opera1: fix uninit-value in dvb_usb_adapter_dvb_init
If opera1_xilinx_rw fails, the mac address is not initialized.
And opera1_read_mac_address does not handle this failure, which leads to
the uninit-value in dvb_usb_adapter_dvb_init.
Fix this by handling the failure of opera1_xilinx_rw.
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach az6007_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: anysee: fix null-ptr-deref in anysee_master_xfer
In anysee_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach anysee_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: add spaces around +]
media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach af9005_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach dw2102_i2c_transfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 950e252cb469
("[media] dw2102: limit messages to buffer size")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Yangtao Li [Thu, 6 Jul 2023 10:10:57 +0000 (18:10 +0800)]
media: platform: ti: Use devm_platform_get_and_ioremap_resource()
Convert platform_get_resource(), devm_ioremap_resource() to a single
call to devm_platform_get_and_ioremap_resource(), as this is exactly
what this function does.
Signed-off-by: Yangtao Li <frank.li@vivo.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: retained the line wrap]
Yangtao Li [Thu, 6 Jul 2023 10:10:56 +0000 (18:10 +0800)]
media: stm32-dcmi: Use devm_platform_get_and_ioremap_resource()
Convert platform_get_resource(), devm_ioremap_resource() to a single
call to devm_platform_get_and_ioremap_resource(), as this is exactly
what this function does.
Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Yangtao Li [Thu, 6 Jul 2023 10:10:51 +0000 (18:10 +0800)]
media: marvell: Use devm_platform_get_and_ioremap_resource()
Convert platform_get_resource(), devm_ioremap_resource() to a single
call to devm_platform_get_and_ioremap_resource(), as this is exactly
what this function does.
Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Yangtao Li [Thu, 6 Jul 2023 10:10:50 +0000 (18:10 +0800)]
media: pxa_camera: Use devm_platform_get_and_ioremap_resource()
Convert platform_get_resource(), devm_ioremap_resource() to a single
call to devm_platform_get_and_ioremap_resource(), as this is exactly
what this function does.
Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
There is a spelling mistake in a fmdbg message. Fix it.
Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: split overly long line over two lines]
source.codeaurora.org is no longer accessible and so the reference links
in the documentation are not useful. The content was mirrored over to
Code Linaro so lets update the references to point there instead.
Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
'read' is freed when it is known to be NULL, but not when a read error
occurs.
Revert the logic to avoid a small leak, should a m920x_read() call fail.
Fixes: a2ab06d7c4d6 ("media: m920x: don't use stack on USB reads") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Dongliang Mu [Mon, 27 Feb 2023 10:24:08 +0000 (18:24 +0800)]
drivers: usb: smsusb: fix error handling code in smsusb_init_device
The previous commit 4b208f8b561f ("[media] siano: register media controller
earlier")moves siano_media_device_register before smscore_register_device,
and adds corresponding error handling code if smscore_register_device
fails. However, it misses the following error handling code of
smsusb_init_device.
Fix this by moving error handling code at the end of smsusb_init_device
and adding a goto statement in the following error handling parts.
Fixes: 4b208f8b561f ("[media] siano: register media controller earlier") Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
projects / thirdparty / linux.git / log
