- 05 Mar, 2020 6 commits
-
-
Sergiu Cuciurean authored
In a recent change to the SPI subsystem [1], a new `delay` struct was added to replace the `delay_usecs`. This change replaces the current `delay_usecs` with `delay` for this driver. The `spi_transfer_delay_exec()` function [in the SPI framework] makes sure that both `delay_usecs` & `delay` are used (in this order to preserve backwards compatibility). [1] commit bebcfd27 ("spi: introduce `delay` field for `spi_transfer` + spi_transfer_delay_exec()") Signed-off-by:
Sergiu Cuciurean <sergiu.cuciurean@analog.com> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-
Eugen Hristev authored
The entity variable was being initialized in the wrong place, before the parameters have been checked. To solve this, completely removed the entity variable and replaced it with the initialization value : &sd->entity. This will avoid dereferencing 'sd' pointer before it's being checked if it's NULL. Fixes: 61f5db54 ("[media] v4l: Make v4l2_subdev inherit from media_entity") Signed-off-by:
Eugen Hristev <eugen.hristev@microchip.com> Acked-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Dafna Hirschfeld authored
sd->devnode is released after calling v4l2_subdev_release. Therefore it should be set to NULL so that the subdev won't hold a pointer to a released object. This fixes a reference after free bug in function v4l2_device_unregister_subdev Fixes: 0e43734d ("media: v4l2-subdev: add release() internal op") Cc: stable@vger.kernel.org Signed-off-by:
Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Reviewed-by:
Ezequiel Garcia <ezequiel@collabora.com> Signed-off-by:
-
Dafna Hirschfeld authored
A use-after-free bug occures when unbinding the device while it streams. The 'struct vimc_ent_device' allocated for the 'Sensor A' is freed when calling the sensor's 'rm' callback but the freed pointer is later accessed in the function 'vimc_streamer_pipeline_terminate'. To fix this bug, move the release callback of the vimc entities and vimc_device to the release callback of v4l2_device. The .rm callback of vimc_ent_config is replaced by two callbacks: .unregister - this is called upon removing the device and it unregisters the entity. This is an optional callback since subdevices don't need to implement it because they are already unregistered in v4l2_device_unregister. .release - this is called from the release callback of v4l2_device and it frees the entity. This ensures that the entities will be released when the last fh of any of the devices is closed. The commands that cause the crash and the KASAN report: media-ctl -d platform:vimc -V '"Sensor A":0[fmt:SBGGR8_1X8/640x480]' media-ctl -d platform:vimc -V '"Debayer A":0[fmt:SBGGR8_1X8/640x480]' v4l2-ctl -z platform:vimc -d "RGB/YUV Capture" -v width=1920,height=1440 v4l2-ctl -z platform:vimc -d "Raw Capture 0" -v pixelformat=BA81 v4l2-ctl --stream-mmap --stream-count=1000 -d /dev/video2 & sleep 1 echo -n vimc.0 >/sys/bus/platform/drivers/vimc/unbind [ 188.417934] BUG: KASAN: use-after-free in vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.420182] Read of size 8 at addr ffff8881e9c26008 by task bash/185 [ 188.421800] [ 188.422223] CPU: 0 PID: 185 Comm: bash Not tainted 5.5.0-rc1+ #1 [ 188.423681] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 188.425938] Call Trace: [ 188.426610] dump_stack+0x75/0xa0 [ 188.427519] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.429057] print_address_description.constprop.6+0x16/0x220 [ 188.430462] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.431979] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.433455] __kasan_report.cold.9+0x1a/0x40 [ 188.434518] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.436010] kasan_report+0xe/0x20 [ 188.436859] vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.438339] vimc_streamer_s_stream+0x8b/0x3c0 [vimc] [ 188.439576] vimc_cap_stop_streaming+0x22/0x40 [vimc] [ 188.440863] __vb2_queue_cancel+0x65/0x560 [videobuf2_common] [ 188.442391] vb2_core_queue_release+0x19/0x50 [videobuf2_common] [ 188.443974] vimc_cap_rm+0x10/0x20 [vimc] [ 188.444986] vimc_rm_subdevs+0x9e/0xe0 [vimc] [ 188.446179] vimc_remove+0x19/0x70 [vimc] [ 188.447301] platform_drv_remove+0x2f/0x50 [ 188.448468] device_release_driver_internal+0x133/0x260 [ 188.449814] unbind_store+0x121/0x150 [ 188.450726] kernfs_fop_write+0x142/0x230 [ 188.451724] ? sysfs_kf_bin_read+0x100/0x100 [ 188.452826] vfs_write+0xdc/0x230 [ 188.453760] ksys_write+0xaf/0x140 [ 188.454702] ? __ia32_sys_read+0x40/0x40 [ 188.455773] ? __do_page_fault+0x473/0x620 [ 188.456780] do_syscall_64+0x5e/0x1a0 [ 188.457711] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 188.459079] RIP: 0033:0x7f80f1f13504 [ 188.459969] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 48 8d 05 f9 61 0d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53 [ 188.464445] RSP: 002b:00007ffd7e843b58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 188.466276] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f80f1f13504 [ 188.467999] RDX: 0000000000000006 RSI: 000055ef2eb21b10 RDI: 0000000000000001 [ 188.469708] RBP: 000055ef2eb21b10 R08: 00007f80f1fe68c0 R09: 00007f80f1e26740 [ 188.471407] R10: 000055ef2eade010 R11: 0000000000000246 R12: 00007f80f1fe5760 [ 188.473381] R13: 0000000000000006 R14: 00007f80f1fe0760 R15: 0000000000000006 [ 188.475107] [ 188.475500] Allocated by task 473: [ 188.476351] save_stack+0x19/0x80 [ 188.477201] __kasan_kmalloc.constprop.6+0xc1/0xd0 [ 188.478507] vimc_sen_add+0x36/0x309 [vimc] [ 188.479649] vimc_probe+0x1e2/0x530 [vimc] [ 188.480776] platform_drv_probe+0x46/0xa0 [ 188.481829] really_probe+0x16c/0x520 [ 188.482732] driver_probe_device+0x114/0x170 [ 188.483783] device_driver_attach+0x85/0x90 [ 188.484800] __driver_attach+0xa8/0x190 [ 188.485734] bus_for_each_dev+0xe4/0x140 [ 188.486702] bus_add_driver+0x223/0x2d0 [ 188.487715] driver_register+0xca/0x140 [ 188.488767] 0xffffffffc037003d [ 188.489635] do_one_initcall+0x86/0x28f [ 188.490702] do_init_module+0xf8/0x340 [ 188.491773] load_module+0x3766/0x3a10 [ 188.492811] __do_sys_finit_module+0x11a/0x1b0 [ 188.494059] do_syscall_64+0x5e/0x1a0 [ 188.495079] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 188.496481] [ 188.496893] Freed by task 185: [ 188.497670] save_stack+0x19/0x80 [ 188.498493] __kasan_slab_free+0x125/0x170 [ 188.499486] kfree+0x8c/0x230 [ 188.500254] v4l2_subdev_release+0x64/0x70 [videodev] [ 188.501498] v4l2_device_release_subdev_node+0x1c/0x30 [videodev] [ 188.502976] device_release+0x3c/0xd0 [ 188.503867] kobject_put+0xf4/0x240 [ 188.507802] vimc_rm_subdevs+0x9e/0xe0 [vimc] [ 188.508846] vimc_remove+0x19/0x70 [vimc] [ 188.509792] platform_drv_remove+0x2f/0x50 [ 188.510752] device_release_driver_internal+0x133/0x260 [ 188.512006] unbind_store+0x121/0x150 [ 188.512899] kernfs_fop_write+0x142/0x230 [ 188.513874] vfs_write+0xdc/0x230 [ 188.514698] ksys_write+0xaf/0x140 [ 188.515523] do_syscall_64+0x5e/0x1a0 [ 188.516543] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 188.517710] [ 188.518034] The buggy address belongs to the object at ffff8881e9c26000 [ 188.518034] which belongs to the cache kmalloc-4k of size 4096 [ 188.520528] The buggy address is located 8 bytes inside of [ 188.520528] 4096-byte region [ffff8881e9c26000, ffff8881e9c27000) [ 188.523015] The buggy address belongs to the page: [ 188.524357] page:ffffea0007a70800 refcount:1 mapcount:0 mapping:ffff8881f6402140 index:0x0 compound_mapcount: 0 [ 188.527058] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881f6402140 [ 188.528983] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 188.530883] page dumped because: kasan: bad access detected [ 188.532336] [ 188.532720] Memory state around the buggy address: [ 188.533871] ffff8881e9c25f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 188.535631] ffff8881e9c25f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 188.537370] >ffff8881e9c26000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 188.538996] ^ [ 188.539812] ffff8881e9c26080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 188.541549] ffff8881e9c26100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Signed-off-by:
-
Dafna Hirschfeld authored
In future patch, the release of the device will move to the release callback of v4l2_device. Therefore the device will be released only when the last fh will be closed. Dynamic allocation will then be needed since when the device is unbounded and then bounded again, it might be that the probe callback will run before the release of the last device is finished. In that case both operations will run on the same memory concurrently and cause memory corruption. This patch also removes the pdev field of vimc_device since it is not needed anymore. Signed-off-by:
-
Dafna Hirschfeld authored
replace 'vimc->pdev.dev' with 'vimc->mdev.dev' in debug prints and in assignment to vimc_ent_device.dev. This helps to unify the debug statements. This will also eliminate the need to use the pdev field in vimc_device in future patch. Signed-off-by:
-
- 02 Mar, 2020 20 commits
-
-
Vandana BN authored
Add metadata capture/output and v4l-touch support in vivid documentation. Signed-off-by:
Vandana BN <bnvandana@gmail.com> [hverkuil-cisco@xs4all.nl: fixed some typos, made some small tweaks of the text] Signed-off-by:
-
Peter Ujfalusi authored
If the dma channel request error code is EPROBE_DEFER there is no need to print error message. Signed-off-by:
Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by:
-
Jae Hyun Yoo authored
Video engine in AST2600 has the exactly same register set with AST2500 except VR084 register which provides more precise JPEG size read back. This commit adds support for the difference and adds 'aspeed,ast2600-video-engine' compatible OF string. Signed-off-by:
Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com> Reviewed-by:
Joel Stanley <joel@jms.id.au> Reviewed-by:
Eddie James <eajames@linux.ibm.com> Signed-off-by:
-
Dafna Hirschfeld authored
VB2_USERPTR support doesn't make sense for drivers based on vb2_dma_contig, so just drop it. Otherwise, queues using vb2_dma_contig_memops causes v4l2-compliance to fail for VB2_USERPTR mode, due to buffer misalignment. Signed-off-by:
Helen Koike <helen.koike@collabora.com> [hverkuil-cisco@xs4all.nl: replaced commit log with Helen's suggestion] Signed-off-by:
-
Hans Verkuil authored
Explicitly document that the driver-specific buffer structure must start with the subsystem-specific struct (vb2_v4l2_buffer in the case of V4L2). Signed-off-by:
-
Dafna Hirschfeld authored
The item 'Fix serialization on subdev ops.' was solved, so remove it from the TODO file. Signed-off-by:
-
Hans Verkuil authored
Remove a spurious 'b' in the "contiguous chunk is too small %lu/%lu b" message. Signed-off-by:
-
Rui Wang authored
VP9 bitstream specification indicate segment data should reset to default when meet key frames, intra only frames or enable error resilience mode. So memset segmentation map buffer before every decode process is not appropriate. Reset segment data only when needed, then start decoder hardware Signed-off-by:
Rui Wang <gtk_ruiwang@mediatek.com> Signed-off-by:
-
Jernej Skrabec authored
Allwinner A64 SoC also contains deinterlace core, compatible to H3. Add compatible string for it. Acked-by:
Rob Herring <robh@kernel.org> Signed-off-by:
Jernej Skrabec <jernej.skrabec@siol.net> Signed-off-by:
-
Takashi Iwai authored
Josef reported that his old-and-good Plextor ConvertX M402U video converter spews lots of WARNINGs on the recent kernels, and it turned out that the device uses a bulk endpoint for interrupt handling just like 2250 board. For fixing it, generalize the check with the proper verification of the endpoint instead of hard-coded board type check. Fixes: 7e5219d1 ("[media] go7007: Fix 2250 urb type") Reported-and-tested-by:
Josef Möllers <josef.moellers@suse.com> BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1162583 BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206427Signed-off-by:
Takashi Iwai <tiwai@suse.de> Signed-off-by:
-
Jernej Skrabec authored
Allwinner A83T contains rotation core which can rotate and flip images. Add a driver for it. Signed-off-by:
-
Jernej Skrabec authored
Some Allwinner SoCs like A83T and A64 contain rotate core which can rotate and flip images. Add a binding for it. Signed-off-by:
-
Ezequiel Garcia authored
Currently, v4l2_pipeline_pm_use() prototype is: int v4l2_pipeline_pm_use(struct media_entity *entity, int use) Where the 'use' argument shall only be set to '1' for enable/power-on, or to '0' for disable/power-off. The integer return is specified as only meaningful when 'use' is set to '1'. Let's enforce this semantic by splitting the function in two: v4l2_pipeline_pm_get and v4l2_pipeline_pm_put. This is done for several reasons. It makes the API easier to use (or harder to misuse). It removes the constraint on the values the 'use' argument shall take. Also, it removes the need to constraint the return value, by making v4l2_pipeline_pm_put void return. And last, it's more consistent with other kernel APIs, such as the runtime pm APIs, which makes the code more symmetric. Signed-off-by:
-
Hans Verkuil authored
The driver is deprecated and scheduled for removal by the end of 2020. The reason is that this driver is for old and obsolete hardware, and it produces a continuous stream of syzbot errors due to poor code. In order to prevent removal the following actions would have to be taken: - clean up the code - convert to the vb2 framework - fix the disconnect and free-on-last-user handling (i.e., add a release callback for struct v4l2_device and rework the code to use that correctly). Signed-off-by:
-
Jonas Karlman authored
Using the field information attached to v4l2 buffers is not enough to determine the type of field referenced by a DPB entry: the decoded frame might contain the full picture (both top and bottom fields) but the reference only point to one of them. Let's add new V4L2_H264_DPB_ENTRY_FLAG_ flags to express that. [Keep only 2 flags and add some details about they mean] Signed-off-by:
Jonas Karlman <jonas@kwiboo.se> Signed-off-by:
Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by:
-
Mario Hros authored
Slave demod needs some time to wake up otherwise it may not respond to the following probe commands. This problem manifested randomly on my Astrometa DVB-T2 dongle. Signed-off-by:
Mario Hros <git@reversity.org> Signed-off-by:
Sean Young <sean@mess.org> Signed-off-by:
-
Mohammad Rasim authored
videostrong kii pro comes with a nec rc, add the keymap to the dts Signed-off-by:
Mohammad Rasim <mohammad.rasim96@gmail.com> Reviewed-by:
Neil Armstrong <narmstrong@baylibre.com> Signed-off-by:
-
Mohammad Rasim authored
Add new entry for rc-videostrong-kii-pro in linux,rc-map-name Signed-off-by:
-
Gustavo A. R. Silva authored
The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732 ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by:Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by:
-
Colin Ian King authored
There is a spelling mistake in a dev_dbg message. Fix it. Signed-off-by:
Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
- 27 Feb, 2020 14 commits
-
-
Kuninori Morimoto authored
The address of VSP2_VI6_HGT_LBx_H are VSP2_VI6_HGT_LB0_H : 0x3428 VSP2_VI6_HGT_LB1_H : 0x3430 VSP2_VI6_HGT_LB2_H : 0x3438 VSP2_VI6_HGT_LB3_H : 0x3440 Thus, VI6_HGT_LBn_H() macro should start from 0x3420 instead of 0x3430. This patch fixes it. Fixes: 26e0ca22 ("[media] v4l: Renesas R-Car VSP1 driver") Reported-by:
Koji Matsuoka <koji.matsuoka.xm@renesas.com> Signed-off-by:
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by:
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by:
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
-
Sakari Ailus authored
include/media/i2c/smiapp.h was meant to serve systems where the sensor is enumerated through platform data. That's no longer necessary, hopefully not even in out-of-tree use cases. Move the definitions to the appropriate headers. Signed-off-by:
-
Sakari Ailus authored
Combine the two trivial functions reading limits into one. Also rename smiapp_get_all_limits() as smiapp_read_all_smia_limits(). Signed-off-by:
-
Sakari Ailus authored
Move SMIA limit reading up, where other limit and capability handling takes place. Signed-off-by:
-
Sakari Ailus authored
Instead of direct array access, turn accessing limit information into a function. Going forward, more elaborate CCS limits will replace most SMIA limits, and conversion will be less complicated this way. Signed-off-by:
-
Sakari Ailus authored
Use get_unaligned_be* and put_unaligned_be* functions to convert register values to CPU endianness. Consequently, two instances of BUG() are removed. Signed-off-by:
-
Sakari Ailus authored
Use the only8 boolean to determine whether 8-bit access is required for reading. Signed-off-by:
-
Sakari Ailus authored
Commit ... prevented restarting CCDC through its interrupt handler when it's about to be disabled. It missed to address the case when CCDC might be enabled due to queueing a buffer. Do that now. Fixes: dd12ed17 ("omap3isp: Don't restart CCDC if we're about to stop") Signed-off-by:
-
Andy Shevchenko authored
Run parse-maintainers.pl and choose TI VPE/CAL record. Fix it accordingly. Note, this is urgent fix, without which parse-maintainers.pl throws an exception: Odd non-pattern line ' Documentation/devicetree/bindings/media/ti,cal.yaml ' for 'TI VPE/CAL DRIVERS' at scripts/parse-maintainers.pl line 147, <$file> line 16770. Signed-off-by:
Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by:
Benoit Parrot <bparrot@ti.com> Signed-off-by:
-
Jean-Baptiste Jouband authored
This patch fixes the checkpatch.pl warning: WARNING: Prefer 'unsigned long' over 'unsigned long int' as the int is unnecessary Signed-off-by:
Jean-Baptiste Jouband <jj.jouband@gmail.com> Signed-off-by:
-
Dave Stevenson authored
Adds a driver for the 8MPix Sony IMX219 CSI2 sensor. Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver currently only supports 2 lanes. 8MPix @ 15fps, 1080P @ 30fps (cropped FOV), and 1640x1232 (2x2 binned) @ 30fps are currently supported. [Sakari Ailus: make imx219_check_hwcfg static] Signed-off-by:
Dave Stevenson <dave.stevenson@raspberrypi.com> Signed-off-by:
Andrey Konovalov <andrey.konovalov@linaro.org> Signed-off-by:
-
Andrey Konovalov authored
Add YAML device tree binding for IMX219 CMOS image sensor, and the relevant MAINTAINERS entries. Signed-off-by:
-
Bingbu Cao authored
A specific tool which can be used to generate imgu intermedia resolutions now is public on github, this patch adds this information into ipu3.rst. Signed-off-by:
Bingbu Cao <bingbu.cao@intel.com> Signed-off-by:
-
Shawn Tu authored
- Add V4L2 controls: horizontal/vertical flip, keep SGRBG10 Bayer order output (via change v/hflip) - Fix Bayer order output in 1296x972 binning registers Signed-off-by:
Shawn Tu <shawnx.tu@intel.com> Signed-off-by:
-
