- 08 Nov, 2019 10 commits
-
-
Seung-Woo Kim authored
When driver is built as module and probe during insmod is deferred because of sensor subdevs, there is NULL pointer deference because mdev is cleaned up and then access it from v4l2_device_unregister(). Fix the wrong mdev and v4l2 dev order in error path of probe. This fixes below null pointer deference: Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = ca026f68 [00000000] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM [...] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) PC is at ida_free+0x7c/0x160 LR is at xas_start+0x44/0x204 [...] [<c0dafd60>] (ida_free) from [<c083c20c>] (__media_device_unregister_entity+0x18/0xc0) [<c083c20c>] (__media_device_unregister_entity) from [<c083c2e0>] (media_device_unregister_entity+0x2c/0x38) [<c083c2e0>] (media_device_unregister_entity) from [<c0843404>] (v4l2_device_release+0xd0/0x104) [<c0843404>] (v4l2_device_release) from [<c0632558>] (device_release+0x28/0x98) [<c0632558>] (device_release) from [<c0db1204>] (kobject_put+0xa4/0x208) [<c0db1204>] (kct_put) from [<bf00bac4>] (fimc_capture_subdev_unregistered+0x58/0x6c [s5p_fimc]) [<bf00bac4>] (fimc_capture_subdev_unregistered [s5p_fimc]) from [<c084a1cc>] (v4l2_device_unregister_subdev+0x6c/0xa8) [<c084a1cc>] (v4l2_device_unregister_subdev) from [<c084a350>] (v4l2_device_unregister+0x64/0x94) [<c084a350>] (v4l2_device_unregister) from [<bf0101ac>] (fimc_md_probe+0x4ec/0xaf8 [s5p_fimc]) [...] Signed-off-by:
Seung-Woo Kim <sw0312.kim@samsung.com> Reviewed-by:
Sylwester Nawrocki <s.nawrocki@samsung.com> Fixes: 9832e155 ("[media] media-device: split media initialization and registration") Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab@kernel.org>
-
Alexander Popov authored
There is the same incorrect approach to locking implemented in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out() and sdr_cap_stop_streaming(). These functions are called during streaming stopping with vivid_dev.mutex locked. And they all do the same mistake while stopping their kthreads, which need to lock this mutex as well. See the example from vivid_stop_generating_vid_cap(): /* shutdown control thread */ vivid_grab_controls(dev, false); mutex_unlock(&dev->mutex); kthread_stop(dev->kthread_vid_cap); dev->kthread_vid_cap = NULL; mutex_lock(&dev->mutex); But when this mutex is unlocked, another vb2_fop_read() can lock it instead of vivid_thread_vid_cap() and manipulate the buffer queue. That causes a use-after-free access later. To fix those issues let's: 1. avoid unlocking the mutex in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out() and sdr_cap_stop_streaming(); 2. use mutex_trylock() with schedule_timeout_uninterruptible() in the loops of the vivid kthread handlers. Signed-off-by:
Alexander Popov <alex.popov@linux.com> Acked-by:
Linus Torvalds <torvalds@linux-foundation.org> Tested-by:
-
Hans Verkuil authored
Refactor some of the vivid_create_instance code by using a new vivid_create_queue() helper function. Also add some sanity checks for the node_types vs input/output_types module options. This patch resolves these two smatch parse errors: drivers/media/platform/vivid/vivid-core.c:1679 vivid_create_instance() parse error: OOM: 3002600Kb sm_state_count = 6160113 drivers/media/platform/vivid/vivid-core.c: drivers/media/platform/vivid/vivid-core.c:1679 vivid_create_instance() parse error: __split_smt: function too hairy. Giving up after 33 seconds Signed-off-by:
-
Colin Ian King authored
Macros MSG_SMS_ENBALE_TS_INTERFACE_REQ and MSG_SMS_ENBALE_TS_INTERFACE_RES contain a spelling mistake. Fix these by replacing ENBALE with ENABLE. Signed-off-by:
Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
Hans Verkuil authored
Drop two dprintk's that relied on a non-NULL mantis pointer when it was in fact a NULL pointer. Fix those warnings: drivers/media/pci/mantis/mantis_cards.c:73 mantis_irq_handler() error: we previously assumed 'mantis' could be null (see line 72) drivers/media/pci/mantis/hopper_cards.c:64 hopper_irq_handler() error: we previously assumed 'mantis' could be null (see line 63) Signed-off-by:
-
Hans Verkuil authored
Initialize ret to 0 to fix this smatch error: drivers/media/i2c/ov6650.c:853 ov6650_video_probe() error: uninitialized symbol 'ret'. Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Hans Verkuil authored
This patch fixes this error: drivers/media/platform/ti-vpe/vpdma.c:767 dump_dtd() error: '%pad' expects argument of type 'dma_addr_t*', argument 2 has type 'uint*' dtd->start_addr is a u32, so no need for %pad. Signed-off-by:
Benoit Parrot <bparrot@ti.com> Signed-off-by:
-
Hans Verkuil authored
Use sizeof instead of ARRAY_SIZE to fix this smatch warning: drivers/media/usb/em28xx/em28xx-i2c.c:952 em28xx_do_i2c_scan() warn: calling memset(x, y, ARRAY_SIZE()); Do the same for the em28xx_hash_mem() call in the same function. smatch didn't pick that up, but there too it should use sizeof instead of ARRAY_SIZE. Signed-off-by:
-
Hans Verkuil authored
Use sizeof instead of ARRAY_SIZE to fix this smatch warning: drivers/media/rc/ite-cir.c:385 ite_tx_ir() warn: calling memset(x, y, ARRAY_SIZE()); Signed-off-by:
Sean Young <sean@mess.org> Signed-off-by:
-
Hans Verkuil authored
Drop the "id >= 0" test in two conditions to fix these warnings: drivers/media/platform/mtk-vpu/mtk_vpu.c:276 vpu_ipi_register() warn: always true condition '(id >= 0) => (0-u32max >= 0)' drivers/media/platform/mtk-vpu/mtk_vpu.c:401 vpu_wdt_reg_handler() warn: always true condition '(id >= 0) => (0-u32max >= 0)' Signed-off-by:
-
- 05 Nov, 2019 30 commits
-
-
Hans Verkuil authored
Fixes this warning: drivers/media/platform/am437x/am437x-vpfe.c:288 vpfe_ccdc_validate_param() warn: unsigned 'ccdcparam->alaw.gamma_wd' is never less than zero. by dropping the gamma_wd < VPFE_CCDC_GAMMA_BITS_15_6 check since VPFE_CCDC_GAMMA_BITS_15_6 is 0. Signed-off-by:
-
Hans Verkuil authored
Running the contrib/test/test-media script in v4l-utils with the vivid argument will cause this kernel warning: [ 104.748720] videodev: v4l2_release [ 104.748731] ------------[ cut here ]------------ [ 104.748750] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 104.748790] WARNING: CPU: 6 PID: 1823 at kernel/locking/mutex.c:938 __mutex_lock+0x919/0xc10 [ 104.748800] Modules linked in: rc_cec vivid v4l2_tpg videobuf2_dma_contig cec rc_core v4l2_dv_timings videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc vmw_balloon vmw_vmci button vmwgfx [ 104.748845] CPU: 6 PID: 1823 Comm: sleep Not tainted 5.4.0-rc1-test-no #150 [ 104.748853] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 [ 104.748867] RIP: 0010:__mutex_lock+0x919/0xc10 [ 104.748878] Code: 59 83 e8 9a fc 16 ff 44 8b 05 23 61 38 01 45 85 c0 0f 85 ef f7 ff ff 48 c7 c6 a0 1f 87 82 48 c7 c7 a0 1e 87 82 e8 cd bb f7 fe <0f> 0b e9 d5 f7 ff ff f6 c3 04 0f 84 3b fd ff ff 49 89 df 41 83 e7 [ 104.748886] RSP: 0018:ffff88811a357b80 EFLAGS: 00010286 [ 104.748895] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 104.748902] RDX: 0000000000000003 RSI: 0000000000000004 RDI: ffffed102346af62 [ 104.748910] RBP: ffff88811a357cf0 R08: ffffffff81217c91 R09: fffffbfff061c271 [ 104.748917] R10: fffffbfff061c270 R11: ffffffff830e1383 R12: ffff8881a46103c0 [ 104.748924] R13: 0000000000000000 R14: ffff8881a4614f90 R15: ffff8881a46153d0 [ 104.748933] FS: 0000000000000000(0000) GS:ffff8881b6780000(0000) knlGS:0000000000000000 [ 104.748940] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.748949] CR2: 00007f163fc9ca20 CR3: 0000000003013004 CR4: 00000000001606e0 [ 104.749036] Call Trace: [ 104.749051] ? _raw_spin_unlock+0x1f/0x30 [ 104.749067] ? llist_add_batch+0x33/0x50 [ 104.749081] ? tick_nohz_tick_stopped+0x19/0x30 [ 104.749130] ? v4l2_release.cold+0x6c/0xd6 [videodev] [ 104.749143] ? mutex_lock_io_nested+0xb80/0xb80 [ 104.749153] ? vprintk_emit+0xf2/0x220 [ 104.749191] ? vivid_req_validate+0x40/0x40 [vivid] [ 104.749201] ? printk+0xad/0xde [ 104.749211] ? kmsg_dump_rewind_nolock+0x54/0x54 [ 104.749226] ? locks_remove_file+0x78/0x2b0 [ 104.749248] ? __fsnotify_update_child_dentry_flags.part.0+0x170/0x170 [ 104.749281] ? vivid_req_validate+0x40/0x40 [vivid] [ 104.749321] ? v4l2_release.cold+0x6c/0xd6 [videodev] [ 104.749361] v4l2_release.cold+0x6c/0xd6 [videodev] [ 104.749378] __fput+0x15a/0x390 [ 104.749393] task_work_run+0xb2/0xe0 [ 104.749407] do_exit+0x4d0/0x1200 [ 104.749422] ? do_user_addr_fault+0x367/0x610 [ 104.749431] ? release_task+0x990/0x990 [ 104.749449] ? rwsem_spin_on_owner+0x170/0x170 [ 104.749463] ? vmacache_find+0xb2/0x100 [ 104.749476] do_group_exit+0x85/0x130 [ 104.749487] __x64_sys_exit_group+0x23/0x30 [ 104.749500] do_syscall_64+0x5e/0x1c0 [ 104.749511] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 104.749520] RIP: 0033:0x7f163fc5c9d6 [ 104.749536] Code: Bad RIP value. [ 104.749543] RSP: 002b:00007ffe6f3bec58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 104.749553] RAX: ffffffffffffffda RBX: 00007f163fd4d760 RCX: 00007f163fc5c9d6 [ 104.749560] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 104.749567] RBP: 0000000000000000 R08: 00000000000000e7 R09: ffffffffffffff80 [ 104.749574] R10: 00007ffe6f3beb24 R11: 0000000000000246 R12: 00007f163fd4d760 [ 104.749581] R13: 0000000000000002 R14: 00007f163fd56428 R15: 0000000000000000 [ 104.749597] ---[ end trace 66f20f73fc0daf79 ]--- This is caused by media_device_cleanup() which destroys v4l2_dev->mdev->req_queue_mutex. But v4l2_release() tries to lock that mutex after media_device_cleanup() is called. By moving media_device_cleanup() to the v4l2_device's release function it is guaranteed that the mutex is valid whenever v4l2_release is called. Signed-off-by:
-
Nícolas F. R. A. Prado authored
Instead of validating the links to capture devices and subdevices with the same function, use the default v4l function for links between subdevices and only use a different function for validating between capture device and subdevice. This change should also ease future work to associate multiple mbus codes for the same pixelformat in vimc_pix_map. These changes were tested with v4l2-compliance SHA: 3f806630e2ecbcebe31872b865c5c4b42f111a99, 64 bits and passed all tests: Grand Total for vimc device /dev/media0: 451, Succeeded: 451, Failed: 0, Warnings: 0 Signed-off-by:
Nícolas F. R. A. Prado <nfraprado@protonmail.com> Acked-by:
Helen Koike <helen.koike@collabora.com> Signed-off-by:
-
Shawn Tu authored
Add a V4L2 sub-device driver for Hynix Hi-556 image sensor. This is a camera sensor using the I2C bus for control and the CSI-2 bus for data. This driver supports following features: - manual exposure and analog/digital gain control support - vblank/hblank control support - test pattern support - media controller support - runtime PM support - support following resolutions: + 2592x1944 at 30FPS + 1296x972 at 30FPS [sakari.ailus@linux.intel.com: Remove MEDIA_CAMERA_SUPPORT from Kconfig dependencies] Signed-off-by:
Shawn Tu <shawnx.tu@intel.com> Signed-off-by:
-
Fabio Estevam authored
Currently v4l2-compliance tool returns the following output: Compliance test for imx-media-captu device /dev/video0: Driver Info: Driver name : imx-media-captu Card type : imx-media-capture ... The driver name string is limited to 16 characters, so provide a shorter name so that we can have a better output. While at it, use the same shorter name for driver and card. Signed-off-by:Fabio Estevam <festevam@gmail.com> Signed-off-by:
-
Cristiane Naves authored
Bool tests don't need comparisons. Issue found by coccicheck. Signed-off-by:
Cristiane Naves <cristianenavescardoso09@gmail.com> Signed-off-by:
-
Philipp Zabel authored
The number of components are only set, and never used. Signed-off-by:
Philipp Zabel <p.zabel@pengutronix.de> Reviewed-by:
Jacek Anaszewski <jacek.anaszewski@gmail.com> Signed-off-by:
-
Geert Uytterhoeven authored
The R-Car Gen2 per-board settings apply to RZ/G1, too. Fixes: 1d14a5ea ("media: dt-bindings: media: rcar_vin: add device tree support for r8a774[35]") Signed-off-by:
Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by:
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Acked-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Geert Uytterhoeven authored
The official name is "R-Car M3-N", not "R-Car M3N". Fixes: 4e8c120d ("media: fdp1: Support M3N and E3 platforms") Signed-off-by:
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
-
Andy Shevchenko authored
Replace F* word with something less offensive. [hverkuil: dropped 'Fixes: 1da177e4 ("Linux-2.6.12-rc2")' tag since nothing was broken] Signed-off-by:
Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by:
-
Lucas Stach authored
The kernel driver never touches the decoded buffers with the CPU. All accesses are either done by hardware DMA masters or userspace mapping the buffers. This means we don't need a kernel virtual address mapping for those buffers at all. As those buffers are usually quite large, we can save a good deal of kernel vmalloc space by requesting to not have a kernel mapping set up for them. Signed-off-by:
Lucas Stach <l.stach@pengutronix.de> Signed-off-by:
-
Philipp Zabel authored
The BIT decoder picture run temporarily locks the bitstream mutex while the coda device mutex is locked, to refill the bitstream ring buffer. Consequently, the decoder start command, which locks both mutexes when flushing the bitstream ring buffer, must lock the coda device mutex first as well, to avoid an ABBA deadlock. Fixes: e7fd9584 ("media: coda: flush bitstream ring buffer on decoder restart") Signed-off-by:
-
Vandana BN authored
v4l_s_fmt, for VFL_TYPE_TOUCH, sets unneeded members of the v4l2_pix_format structure to default values.This was missing in v4l_g_fmt, which would lead to failures in v4l2-compliance tests. Signed-off-by:
Vandana BN <bnvandana@gmail.com> Signed-off-by:
-
Janusz Krzysztofik authored
Commit a8fa5507 ("media: v4l2-subdev: Verify arguments in v4l2_subdev_call()") and commit 374d62e7 ("media: v4l2-subdev: Verify v4l2_subdev_call() pad config argument") introduced a few local functions, unfortunately with arguments of type __u32, reserved for use in Linux uAPI. Use u32 instead. Suggested-by:
Janusz Krzysztofik <jmkrzyszt@gmail.com> Acked-by:
-
Seung-Woo Kim authored
>From isp_video_release(), &isp->video_lock is held and subsequent vb2_fop_release() tries to lock vdev->lock which is same with the previous one. Replace vb2_fop_release() with _vb2_fop_release() to fix the recursive locking. Fixes: 1380f575 ("[media] videobuf2: Add missing lock held on vb2_fop_release") Signed-off-by:
-
Kangjie Lu authored
"f->fmt.sdr.reserved" is uninitialized. As other peer drivers like msi2500 and airspy do, the fix initializes it to avoid memory disclosures. Signed-off-by:
Kangjie Lu <kjlu@umn.edu> Reviewed-by:
-
YueHaibing authored
Use devm_platform_ioremap_resource() to simplify the code a bit. This is detected by coccinelle. Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Acked-by:
Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by:
-
Biju Das authored
Add the MIPI CSI-2 driver support for RZ/G2N(R8A774B1) SoC. The CSI-2 module of RZ/G2N is similar to R-Car M3-N. Signed-off-by:
Biju Das <biju.das@bp.renesas.com> Reviewed-by:
-
Biju Das authored
Add the SoC specific information for RZ/G2N(R8A774B1) SoC. The VIN module of RZ/G2N is similar to R-Car M3-N. Signed-off-by:
-
Biju Das authored
Add the compatible string for RZ/G2N (R8A774B1) to the list of supported SoCs. Signed-off-by:
-
Biju Das authored
Document support for the VIN module in the Renesas RZ/G2N (R8A774B1) SoC. Signed-off-by:
-
Niklas Söderlund authored
Most Gen3 boards can output frames in NV12 format, add support for this with a runtime check that the running hardware supports it. Signed-off-by:
Simon Horman <horms+renesas@verge.net.au> Signed-off-by:
-
Niklas Söderlund authored
Most but not all Gen3 hardware support outputting NV12, add a flag to indicate which SoCs do support it. Signed-off-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Niklas Söderlund authored
If a pixel format is not supported by the hardware NULL is returned by rvin_format_from_pixel() for that fourcc. Verify that the pixel format is supported using this or skip it when enumerating. Signed-off-by:
-
Johan Hovold authored
If a process is interrupted while accessing the radio device and the core lock is contended, release() could return early and fail to update the interrupt mask. Note that the return value of the v4l2 release file operation is ignored. Fixes: 87d1a50c ("[media] V4L2: WL1273 FM Radio: TI WL1273 FM radio driver") Cc: stable <stable@vger.kernel.org> # 2.6.38 Cc: Matti Aaltonen <matti.j.aaltonen@nokia.com> Signed-off-by:
Johan Hovold <johan@kernel.org> Signed-off-by:
-
Johan Hovold authored
If a process is interrupted while accessing the video device and the device lock is contended, release() could return early and fail to free related resources. Note that the return value of the v4l2 release file operation is ignored. Fixes: 28ffeebb ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework") Cc: stable <stable@vger.kernel.org> # 4.2 Signed-off-by:
Fabien Dessenne <fabien.dessenne@st.com> Signed-off-by:
-
zhong jiang authored
The kernel.h macro DIV_ROUND_CLOSEST performs the computation (x + d/2)/d but is perhaps more readable. Signed-off-by:
zhong jiang <zhongjiang@huawei.com> Signed-off-by:
-
Colin Ian King authored
Don't populate the array input_vals on the stack but instead make it static. Makes the object code smaller by 106 bytes. Before: text data bss dec hex filename 11744 3536 128 15408 3c30 drivers/media/i2c/vpx3220.o After: text data bss dec hex filename 11574 3600 128 15302 3bc6 drivers/media/i2c/vpx3220.o (gcc version 9.2.1, amd64) Signed-off-by:
-
Chris Paterson authored
Ramesh is now using a new email address. Update the maintainer entry for the MAX2175 SDR tuner and the Renesas R-Car DRIF drivers. Signed-off-by:
Chris Paterson <chris.paterson2@renesas.com> Acked-by:
Ramesh Shanmugasundaram <rashanmu@gmail.com> Signed-off-by:
-
Nishad Kamdar authored
This patch corrects the SPDX License Identifier style in header files related to Video drivers for Xilinx devices. For C header files Documentation/process/license-rules.rst mandates C-like comments (opposed to C source files where C++ style should be used) Changes made by using a script provided by Joe Perches here: https://lkml.org/lkml/2019/2/7/46. Suggested-by:
Joe Perches <joe@perches.com> Signed-off-by:
Nishad Kamdar <nishadkamdar@gmail.com> Signed-off-by:
-
