summaryrefslogtreecommitdiffstats
path: root/drivers/media
AgeCommit message (Collapse)AuthorFilesLines
2022-12-06media: dvbdev: fix refcnt bugLin Ma1-1/+1
Previous commit initialize the dvbdev->ref before the template copy, which will overwrite the reference and cause refcnt bug. refcount_t: addition on 0; use-after-free. WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25 Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc6-next-20221128-syzkaller #0 ... RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25 RSP: 0000:ffffc900000678d0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88813ff58000 RSI: ffffffff81660e7c RDI: fffff5200000cf0c RBP: ffff888022a45010 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823ffff000 CR3: 000000000c48e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __refcount_add include/linux/refcount.h:199 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] kref_get include/linux/kref.h:45 [inline] dvb_device_get drivers/media/dvb-core/dvbdev.c:585 [inline] dvb_register_device+0xe83/0x16e0 drivers/media/dvb-core/dvbdev.c:517 ... Just place the kref_init at correct position. Reported-by: syzbot+fce48a3dd3368645bd6c@syzkaller.appspotmail.com Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") Signed-off-by: Lin Ma <linma@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-12-06media: sun6i-csi: clarify return value, fix uninited variable and add ↵Hans Verkuil1-4/+4
missing static This fixes three smatch warnings: drivers/media/platform/sunxi/sun6i-csi/sun6i_csi_bridge.c:629:15: warning: 'enabled' may be used uninitialized [-Wmaybe-uninitialized] drivers/media/platform/sunxi/sun6i-csi/sun6i_csi_bridge.c:439 sun6i_csi_bridge_s_stream() warn: missing error code 'ret' drivers/media/platform/sunxi/sun6i-csi/sun6i_csi_bridge.c:682 sun6i_csi_bridge_notifier_bound() error: uninitialized symbol 'enabled'. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-12-06media: i2c: tc358746: make DEFINE_RUNTIME_DEV_PM_OPS staticHans Verkuil1-2/+2
DEFINE_RUNTIME_DEV_PM_OPS should be static. This fixes this sparse warning: drivers/media/i2c/tc358746.c:1671:1: warning: symbol 'tc358746_pm_ops' was not declared. Should it be static? Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-12-06media: dvb-frontends: drx39xyj: set missing error codeHans Verkuil1-0/+1
The rc return code was never set in hi_command(). This fixes this smatch warning: drivers/media/dvb-frontends/drx39xyj/drxj.c:2351 hi_command() warn: missing error code 'rc' Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-12-06media: videobuf2: revert "get_userptr: buffers are always writable"Hans Verkuil5-8/+19
Commit 707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are always writable") caused problems in a corner case (passing read-only shmem memory as a userptr). So revert this patch. The original problem for which that commit was originally made is something that I could not reproduce after reverting it. So just go back to the way it was for many years, and if problems arise in the future, then another approach should be taken to resolve it. This patch is based on a patch from Hirokazu. Fixes: 707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are always writable") Signed-off-by: Hirokazu Honda <hiroh@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Acked-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-12-06media: rzg2l-cru: Remove unnecessary shadowing of ret in rzg2l_csi2_s_stream()Nathan Chancellor1-2/+0
Clang warns: drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:445:7: error: variable 'ret' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] if (ret) ^~~ drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:475:9: note: uninitialized use occurs here return ret; ^~~ drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:445:3: note: remove the 'if' if its condition is always false if (ret) ^~~~~~~~ drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:441:7: error: variable 'ret' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] if (ret) ^~~ drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:475:9: note: uninitialized use occurs here return ret; ^~~ drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:441:3: note: remove the 'if' if its condition is always false if (ret) ^~~~~~~~ drivers/media/platform/renesas/rzg2l-cru/rzg2l-csi2.c:431:9: note: initialize the variable 'ret' to silence this warning int ret; ^ = 0 2 errors generated. ret is unnecessarily shadowed, meaning the assignments to ret within the first 'if (enable)' block are only applied to the inner scope, not the outer one as intended. Remove the shadowing to fix the warnings and make everything work correctly. Link: https://github.com/ClangBuiltLinux/linux/issues/1764 Fixes: 51e8415e39a9 ("media: platform: Add Renesas RZ/G2L MIPI CSI-2 receiver driver") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-12-06media: saa7164: fix missing pci_disable_device()Liu Shixin1-1/+3
Add missing pci_disable_device() in the error path in saa7164_initdev(). Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") Signed-off-by: Liu Shixin <liushixin2@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-12-06media: ov5693: Add support for a privacy-led GPIOHans de Goede1-0/+10
Add support for a privacy-led GPIO. Making the privacy LED to controlable from userspace, as using the LED class subsystem would do, would make it too easy for spy-ware to disable the LED. To avoid this have the sensor driver directly control the LED. Link: https://lore.kernel.org/linux-media/20221129231149.697154-2-hdegoede@redhat.com Reviewed-by: Andy Shevchenko <andy@kernel.org> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-12-02v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() failsLinus Torvalds1-56/+12
The V4L2_MEMORY_USERPTR interface is long deprecated and shouldn't be used (and is discouraged for any modern v4l drivers). And Seth Jenkins points out that the fallback to VM_PFNMAP/VM_IO is fundamentally racy and dangerous. Note that it's not even a case that should trigger, since any normal user pointer logic ends up just using the pin_user_pages_fast() call that does the proper page reference counting. That's not the problem case, only if you try to use special device mappings do you have any issues. Normally I'd just remove this during the merge window, but since Seth pointed out the problem cases, we really want to know as soon as possible if there are actually any users of this odd special case of a legacy interface. Neither Hans nor Mauro seem to think that such mis-uses of the old legacy interface should exist. As Mauro says: "See, V4L2 has actually 4 streaming APIs: - Kernel-allocated mmap (usually referred simply as just mmap); - USERPTR mmap; - read(); - dmabuf; The USERPTR is one of the oldest way to use it, coming from V4L version 1 times, and by far the least used one" And Hans chimed in on the USERPTR interface: "To be honest, I wouldn't mind if it goes away completely, but that's a bit of a pipe dream right now" but while removing this legacy interface entirely may be a pipe dream we can at least try to remove the unlikely (and actively broken) case of using special device mappings for USERPTR accesses. This replaces it with a WARN_ONCE() that we can remove once we've hopefully confirmed that no actual users exist. NOTE! Longer term, this means that a 'struct frame_vector' only ever contains proper page pointers, and all the games we have with converting them to pages can go away (grep for 'frame_vector_to_pages()' and the uses of 'vec->is_pfns'). But this is just the first step, to verify that this code really is all dead, and do so as quickly as possible. Reported-by: Seth Jenkins <sethjenkins@google.com> Acked-by: Hans Verkuil <hverkuil@xs4all.nl> Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org> Cc: David Hildenbrand <david@redhat.com> Cc: Jan Kara <jack@suse.cz> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-12-02media: dvb-usb: m920x: make read-only arrays static constColin Ian King1-8/+8
Don't populate the arrays on the stack, instead make them static const. Also makes the object code smaller. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2022-11-30mm/frame-vector: remove FOLL_FORCE usageDavid Hildenbrand1-1/+1
FOLL_FORCE is really only for ptrace access. According to commit 707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are always writable"), get_vaddr_frames() currently pins all pages writable as a workaround for issues with read-only buffers. FOLL_FORCE, however, seems to be a legacy leftover as it predates commit 707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are always writable"). Let's just remove it. Once the read-only buffer issue has been resolved, FOLL_WRITE could again be set depending on the DMA direction. Link: https://lkml.kernel.org/r/20221116102659.70287-17-david@redhat.com Signed-off-by: David Hildenbrand <david@redhat.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Acked-by: Tomasz Figa <tfiga@chromium.org> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2022-11-30media: pci/ivtv: remove FOLL_FORCE usageDavid Hildenbrand2-4/+3
FOLL_FORCE is really only for ptrace access. R/O pinning a page is supposed to fail if the VMA misses proper access permissions (no VM_READ). Let's just remove FOLL_FORCE usage here; there would have to be a pretty good reason to allow arbitrary drivers to R/O pin pages in a PROT_NONE VMA. Most probably, FOLL_FORCE usage is just some legacy leftover. Link: https://lkml.kernel.org/r/20221116102659.70287-16-david@redhat.com Signed-off-by: David Hildenbrand <david@redhat.com> Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Cc: Andy Walls <awalls@md.metrocast.net> Cc: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2022-11-30media: videobuf-dma-sg: remove FOLL_FORCE usageDavid Hildenbrand1-9/+5
GUP now supports reliable R/O long-term pinning in COW mappings, such that we break COW early. MAP_SHARED VMAs only use the shared zeropage so far in one corner case (DAXFS file with holes), which can be ignored because GUP does not support long-term pinning in fsdax (see check_vma_flags()). Consequently, FOLL_FORCE | FOLL_WRITE | FOLL_LONGTERM is no longer required for reliable R/O long-term pinning: FOLL_LONGTERM is sufficient. So stop using FOLL_FORCE, which is really only for ptrace access. Link: https://lkml.kernel.org/r/20221116102659.70287-14-david@redhat.com Signed-off-by: David Hildenbrand <david@redhat.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Cc: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2022-11-26media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoCAakarsh Jain1-2/+15
Commit 5441e9dafdfc6dc40 ("[media] s5p-mfc: Core support for MFC v7") which adds mfc v7 support for Exynos3250 and use the same compatible string as used by Exynos5240 but both the IPs are a bit different in terms of IP clock. Add variant driver data based on the new compatible string "samsung,exynos3250-mfc" for Exynos3250 SoC. Suggested-by: Alim Akhtar <alim.akhtar@samsung.com> Fixes: 5441e9dafdfc ("[media] s5p-mfc: Core support for MFC v7") Signed-off-by: Aakarsh Jain <aakarsh.jain@samsung.com> Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: ipu3-cio2: make the bridge depend on i2cAdam Borowski1-0/+1
drivers/media/pci/intel/ipu3/cio2-bridge.c: In function ‘cio2_bridge_unregister_sensors’: drivers/media/pci/intel/ipu3/cio2-bridge.c:258:17: error: implicit declaration of function ‘i2c_unregister_device’; did you mean ‘spi_unregister_device’? [-Werror=implicit-function-declaration] 258 | i2c_unregister_device(sensor->vcm_i2c_client); | ^~~~~~~~~~~~~~~~~~~~~ | spi_unregister_device Link: https://lore.kernel.org/linux-media/S230142AbiJTWql/20221020224641Z+958@vger.kernel.org Signed-off-by: Adam Borowski <kilobyte@angband.pl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoCAakarsh Jain1-2/+15
Commit 5441e9dafdfc6dc40 ("[media] s5p-mfc: Core support for MFC v7") which adds mfc v7 support for Exynos3250 and use the same compatible string as used by Exynos5240 but both the IPs are a bit different in terms of IP clock. Add variant driver data based on the new compatible string "samsung,exynos3250-mfc" for Exynos3250 SoC. Suggested-by: Alim Akhtar <alim.akhtar@samsung.com> Fixes: 5441e9dafdfc ("[media] s5p-mfc: Core support for MFC v7") Signed-off-by: Aakarsh Jain <aakarsh.jain@samsung.com> Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: mediatek: vcodec: Core thread depends on core_listYunfei Dong1-1/+1
Core thread will continue to work when core_list is not empty, not depends on lat_list. Fixes: 365e4ba01df4 ("media: mtk-vcodec: Add work queue for core hardware decode") Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: mediatek: vcodec: Setting lat buf to lat_list when lat decode errorYunfei Dong1-5/+10
Need to set lat buf to lat_list when lat decode error, or lat buffer will be lost. Fixes: 5d418351ca8f ("media: mediatek: vcodec: support stateless VP9 decoding") Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: mediatek: vcodec: Fix h264 set lat buffer errorYunfei Dong1-11/+17
Will set lat buffer to lat_list two times when lat decode timeout for inner racing mode. If core thread can't get frame buffer, need to return error value. Fixes: 59fba9eed5a7 ("media: mediatek: vcodec: support stateless H.264 decoding for mt8192") Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: mediatek: vcodec: Can't set dst buffer to done when lat decode errorYunfei Dong1-1/+1
Core thread will call v4l2_m2m_buf_done to set dst buffer done for lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to free dst buffer when lat decode error, core thread will access kernel NULL pointer dereference, then crash. Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: mediatek: vcodec: Fix getting NULL pointer for dst bufferYunfei Dong1-4/+7
The driver may can't get v4l2 buffer when lat or core decode timeout, will lead to crash when call v4l2_m2m_buf_done to set dst buffer (NULL pointer) done. Fixes: 7b182b8d9c85 ("media: mediatek: vcodec: Refactor get and put capture buffer flow") Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: amphion: lock and check m2m_ctx in event handlerMing Qian2-2/+8
driver needs to cancel vpu before releasing the vpu instance, so call v4l2_m2m_ctx_release() first, to handle the redundant event triggered after m2m_ctx is released. lock and check m2m_ctx in the event handler. Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: amphion: cancel vpu before release instanceMing Qian1-4/+7
Revert "media: amphion: release m2m ctx when releasing vpu instance" This reverts commit d91d7bc85062309aae6d8064563ddf17947cb6bc. Call v4l2_m2m_ctx_release() to cancel vpu, afterwards release the vpu instance. Fixes: d91d7bc85062 ("media: amphion: release m2m ctx when releasing vpu instance") Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: amphion: try to wakeup vpu core to avoid failureMing Qian4-4/+38
firmware should be waked up by start or configure command, but there is a very small chance that firmware failed to wakeup. in such case, try to wakeup firmware again by sending a noop command Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver") Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: Add dependency on ARCH_ASPEEDPeter Robinson1-0/+1
The VIDEO_ASPEED is part of the Aspeed silicon so it makes sense to depend on ARCH_ASPEED and for compile testing. Signed-off-by: Peter Robinson <pbrobinson@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: sun8i-a83t-mipi-csi2: Register async subdev with no sensor attachedPaul Kocialkowski1-5/+12
This allows the device to probe and register its async subdev without a sensor attached. The rationale is that the parent driver might otherwise wait for the subdev to be registered when it should be available (from the fwnode graph endpoint perspective). This is generally not problematic when the MIPI CSI-2 bridge is the only device attached to the parent, but in the case of a CSI controller that can feed from both MIPI CSI-2 and parallel, it would prevent using the parallel sensor due to the parent waiting for the MIPI CSI-2 subdev to register. Fixes: 576d196c522b ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: sun6i-mipi-csi2: Register async subdev with no sensor attachedPaul Kocialkowski1-5/+12
This allows the device to probe and register its async subdev without a sensor attached. The rationale is that the parent driver might otherwise wait for the subdev to be registered when it should be available (from the fwnode graph endpoint perspective). This is generally not problematic when the MIPI CSI-2 bridge is the only device attached to the parent, but in the case of a CSI controller that can feed from both MIPI CSI-2 and parallel, it would prevent using the parallel sensor due to the parent waiting for the MIPI CSI-2 subdev to register. Fixes: af54b4f4c17f ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: sun8i-a83t-mipi-csi2: Require both pads to be connected for streamingPaul Kocialkowski1-2/+4
The bridge needs both its pads connected to be able to stream data. Enforcing this is useful to produce an error when no sensor is connected. Fixes: 576d196c522b ("media: sunxi: Add support for the A83T MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: sun6i-mipi-csi2: Require both pads to be connected for streamingPaul Kocialkowski1-2/+4
The bridge needs both its pads connected to be able to stream data. Enforcing this is useful to produce an error when no sensor is connected. Fixes: af54b4f4c17f ("media: sunxi: Add support for the A31 MIPI CSI-2 controller") Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: amphion: encoder add support for contiguous planesMing Qian1-0/+8
encoder add support for contiguous formats NV12 Signed-off-by: Ming Qian <ming.qian@nxp.com> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: amphion: decoder add support for contiguous planesMing Qian1-0/+16
decoder add support for contiguous formats V4L2_PIX_FMT_NV12_8L128 and V4L2_PIX_FMT_NV12_10BE_8L128 Signed-off-by: Ming Qian <ming.qian@nxp.com> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: amphion: tell and handle contiguous and non contiguous formatMing Qian10-165/+297
Driver should tell the number of memory planes and component planes. the amphion vpu support non contiguous planes, but for compatibility with other device that only support contiguous planes. driver can add support for contiguous planes in the same time. Then the mem_planes can be different from the comp_planes. driver need to handle buffer according mem_planes and comp_planes. So driver can support NV12 and NV12M. Signed-off-by: Ming Qian <ming.qian@nxp.com> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: add nv12_8l128 and nv12_10be_8l128 video format.Ming Qian1-0/+2
add contiguous nv12 tiled format nv12_8l128 and nv12_10be_8l128 Signed-off-by: Ming Qian <ming.qian@nxp.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: v4l: Use memset_after() helperXiu Jianfeng1-45/+39
The CLEAR_AFTER_FIELD defined here is functionally the same as memset_after() helper, so replace it with memset_after() to simplify the code, no functional change in this patch. Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: rcar-vin: Add support for Gen3 UDS (Up Down Scaler)Niklas Söderlund4-0/+83
Add support for the UDS (Up Down Scaler) found in some Gen3 SoCs. Not all Gen3 SoCs have scalers, and for those that do it's only available to the master node of each VIN group. The setup for which SoCs and nodes have access to a scaler are dealt with at probe time and then function transparently reusing the schema from the already present Gen2 scaler. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: rcar-vin: Store scaler in a function pointerNiklas Söderlund4-13/+46
The scaler implementation is different between the VIN generations, and not all SoCs have a scaler. Currently only Gen2 scalers are supported. Prepare to add support for more scalers by storing the setup in a function pointer initialized at probe time. While at it move call site to after, instead of before, the generic capture setup, this have no effect on the Gen2 scaler but will be leveraged by the Gen3 scaler. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: rcar-vin: Do not cache remote rectangleNiklas Söderlund2-21/+65
Prepare for scaling support in the media controller part of the driver by not caching the remote rectangle. Mimic the omap3isp and look it up each time it's needed. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()Baisong Zhong1-0/+4
Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer(). Link: https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpqV+p8mPLNg-Fok0gw8gZ=zemAfMGTzMg@mail.gmail.com/ Link: https://lore.kernel.org/linux-media/20221120065918.2160782-1-zhongbaisong@huawei.com Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver") Reported-by: Wei Chen <harperchen1110@gmail.com> Signed-off-by: Baisong Zhong <zhongbaisong@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-core: Fix ignored return value in dvb_register_frontend()Chen Zhongjin1-1/+7
In dvb_register_frontend(), dvb_register_device() is possible to fail but its return value is ignored. It will cause use-after-free when module is removed, because in dvb_unregister_frontend() it tries to unregister a not registered device. BUG: KASAN: use-after-free in dvb_remove_device+0x18b/0x1f0 [dvb_core] Read of size 4 at addr ffff88800dff4824 by task rmmod/428 CPU: 3 PID: 428 Comm: rmmod Call Trace: <TASK> ... dvb_remove_device+0x18b/0x1f0 [dvb_core] dvb_unregister_frontend+0x7b/0x130 [dvb_core] vidtv_bridge_remove+0x6e/0x160 [dvb_vidtv_bridge] ... Fix this by catching return value of dvb_register_device(). However the fe->refcount can't be put to zero immediately, because there are still modules calling dvb_frontend_detach() when dvb_register_frontend() fails. Link: https://lore.kernel.org/linux-media/20221108033005.169095-1-chenzhongjin@huawei.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-usb: dib0700_devices: Remove unused struct dibx090p_adcYuan Can1-7/+0
After commit 5e9c85d98337("[media] dib8096: enhancement"), no one use struct dibx090p_adc, so remove it. Link: https://lore.kernel.org/linux-media/20220927133827.99097-1-yuancan@huawei.com Signed-off-by: Yuan Can <yuancan@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dib0700: remove orphan dvb_usb_dib0700_ir_proto declarationGaosheng Cui1-1/+0
The dvb_usb_dib0700_ir_proto has been removed by commit 0ffd1ab34a00 ("V4L/DVB: dib0700: properly implement IR change_protocol"), so remove the orphan declaration. Link: https://lore.kernel.org/linux-media/20220920015902.785337-1-cuigaosheng1@huawei.com Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-usb: fix memory leak in dvb_usb_adapter_init()Mazin Al Haddad1-1/+3
Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapter->priv in case of an error. Currently if an error occurs, it will exit before incrementing "num_adapters_initalized", which is used as a reference counter to free all adap->priv in "dvb_usb_adapter_exit()". There are multiple error paths that can exit from before incrementing the counter. Including the error handling paths for "dvb_usb_adapter_stream_init()", "dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()" within "dvb_usb_adapter_init()". This means that in case of an error in any of these functions the current iteration is not accounted for and the current iteration's adap->priv is not freed. Fix this by freeing the current iteration's adap->priv in the "stream_init_err:" label in the error path. The rest of the (accounted for) adap->priv objects are freed in dvb_usb_adapter_exit() as expected using the num_adapters_initalized variable. Syzbot report: BUG: memory leak unreferenced object 0xffff8881172f1a00 (size 512): comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff844af012>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline] [<ffffffff844af012>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline] [<ffffffff844af012>] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308 [<ffffffff830db21d>] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883 [<ffffffff82d3fdc7>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 [<ffffffff8274af6a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782 [<ffffffff8274b786>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899 [<ffffffff82747c87>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [<ffffffff8274b352>] __device_attach+0x122/0x260 drivers/base/dd.c:970 [<ffffffff827498f6>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [<ffffffff82745cdb>] device_add+0x5fb/0xdf0 drivers/base/core.c:3405 [<ffffffff82d3d202>] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170 [<ffffffff82d4dbfc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<ffffffff82d3f49c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 Link: https://syzkaller.appspot.com/bug?extid=f66dd31987e6740657be Reported-and-tested-by: syzbot+f66dd31987e6740657be@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-media/20220824012152.539788-1-mazinalhaddad05@gmail.com Signed-off-by: Mazin Al Haddad <mazinalhaddad05@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvbdev: adopts refcnt to avoid UAFLin Ma3-9/+27
dvb_unregister_device() is known that prone to use-after-free. That is, the cleanup from dvb_unregister_device() releases the dvb_device even if there are pointers stored in file->private_data still refer to it. This patch adds a reference counter into struct dvb_device and delays its deallocation until no pointer refers to the object. Link: https://lore.kernel.org/linux-media/20220807145952.10368-1-linma@zju.edu.cn Signed-off-by: Lin Ma <linma@zju.edu.cn> Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: media/dvb-frontends: fix repeated words in commentswangjianli1-1/+1
Delete the redundant word 'in'. Link: https://lore.kernel.org/linux-media/20220724073242.15279-1-wangjianli@cdjrlc.com Signed-off-by: wangjianli <wangjianli@cdjrlc.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb_ringbuffer : Fix a bug in dvb_ringbuffer.cYongSu Yoo1-1/+3
The function dvb_ringbuffer_pkt_next in /linux-next/drviers/media/dvb-core/dvb_ringbuffer.c, which searches the idx of the next valid packet in the ring buffer of the ca->slot_info[slot].rx_buffer at /linux-next/drivers/media/dvb-core/dvb_ca_en50221.c, has the following problem. In calculating the amounts of the consumed address of the ring buffer, if the read address(rbuf->pread) of the ring buffer is smaller than the idx, the amounts of the searched address should be (idx - rbuf->pread), whereas if the read address(rbuf->pread) of the ring buffer is larger than the idx, the amounts of the consumed address should be (idx - rbuf->pread + rbug->size). But there exists an incorrect logic that the rbug-size was not properly added on (idx - rbug->pread) in the later case. With this commit, we fixed this bug. Link: https://lore.kernel.org/linux-media/20220623103543.4138-1-yongsuyoo0215@gmail.com Signed-off-by: Yongsu Yoo <yongsuyoo0215@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: mantis: Kconfig: add depends on DVB_CORE for MANTIS_CORELecopzer Chen1-1/+1
MANTIS_CORE needs DVB_CORE, set 'depends on' explicitly ERROR: modpost: "dvb_dmx_init" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_unregister_adapter" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_register_frontend" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_ca_en50221_camchange_irq" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_unregister_frontend" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_ca_en50221_camready_irq" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_frontend_detach" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_dmxdev_release" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_dmx_swfilter" [drivers/media/pci/mantis/mantis_core.ko] undefined! Link: https://lore.kernel.org/linux-media/20220516171515.16404-2-lecopzer.chen@mediatek.com Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-core: Fix double free in dvb_register_device()Keita Suzuki1-0/+1
In function dvb_register_device() -> dvb_register_media_device() -> dvb_create_media_entity(), dvb->entity is allocated and initialized. If the initialization fails, it frees the dvb->entity, and return an error code. The caller takes the error code and handles the error by calling dvb_media_device_free(), which unregisters the entity and frees the field again if it is not NULL. As dvb->entity may not NULLed in dvb_create_media_entity() when the allocation of dvbdev->pad fails, a double free may occur. This may also cause an Use After free in media_device_unregister_entity(). Fix this by storing NULL to dvb->entity when it is freed. Link: https://lore.kernel.org/linux-media/20220426052921.2088416-1-keitasuzuki.park@sslab.ics.keio.ac.jp Fixes: fcd5ce4b3936 ("media: dvb-core: fix a memory leak bug") Cc: stable@vger.kernel.org Cc: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvbdev: remove redundant initialization of variable retColin Ian King1-1/+2
Variable ret is being ininitialized with a value that is never read. The ininitializtion is redundant and can be removed. Move the variable to the scope it is required. Link: https://lore.kernel.org/linux-media/20220424154720.1356873-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-frontends: fix leak of memory fwYan Lei1-0/+1
Link: https://lore.kernel.org/linux-media/20220410061925.4107-1-chinayanlei2002@163.com Signed-off-by: Yan Lei <yan_lei@dahuatech.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-11-25media: dvb-frontends: clean up unneeded elseWan Jiabing1-2/+0
Clean up unneeded 'else'. Link: https://lore.kernel.org/linux-media/20220408092831.45755-1-wanjiabing@vivo.com Signed-off-by: Wan Jiabing <wanjiabing@vivo.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-28 20:38:40 +0000