- 02 Jun, 2021 38 commits
-
-
Lv Yunlong authored
A use after free bug caused by the dangling pointer filp->privitate_data in v4l2_fh_release. See https://lore.kernel.org/patchwork/patch/1419058/. My patch sets the dangling pointer to NULL to provide robust. Signed-off-by:
Lv Yunlong <lyl2019@mail.ustc.edu.cn> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-
Lv Yunlong authored
In isp_video_release, file->private_data is freed via _vb2_fop_release()->v4l2_fh_release(). But the freed file->private_data is still used in v4l2_fh_is_singular_file() ->v4l2_fh_is_singular(file->private_data), which is a use after free bug. My patch uses a variable 'is_singular_file' to avoid the uaf. v3: https://lore.kernel.org/patchwork/patch/1419058/ Fixes: 34947b8a ("[media] exynos4-is: Add the FIMC-IS ISP capture DMA driver") Signed-off-by:
-
Christophe JAILLET authored
The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below and has been hand modified to replace GFP_ with a correct flag. It has been compile tested. When memory is allocated in 'ace_allocate_descriptors()' and 'ace_init()' GFP_KERNEL can be used because both functions are called from the probe function and no lock is acquired. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Signed-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by:
-
Hans Verkuil authored
The adv7842 driver didn't support EDIDs of 3 or 4 blocks, even though the hardware supports this. It is a bit more complicated due to the fact that the adv7842 can expose two EDIDs: one digital, one analog, for DVI-I connectors. In that case the VGA_EDID_ENABLE bit is set and blocks 0 and 1 of the EDID eeprom are used for the DVI-D part and block 2 is used for the DVI-A part of the DVI-I connector. Signed-off-by:
-
Andrzej Pietrasiewicz authored
The driver should only set the payload on .buf_prepare if the buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused set by userspace then v4l2-core will set it to buffer length. If we overwrite bytesused for OUTPUT buffers, too, then vb2_get_plane_payload() will return incorrect value which might be then written to hw registers by the driver in cedrus_h264.c or cedrus_vp8.c. Signed-off-by:
Andrzej Pietrasiewicz <andrzej.p@collabora.com> Signed-off-by:
-
Andrzej Pietrasiewicz authored
The driver should only set the payload on .buf_prepare if the buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused set by userspace then v4l2-core will set it to buffer length. If we overwrite bytesused for OUTPUT buffers, too, then vb2_get_plane_payload() will return incorrect value which might be then written to hw registers by the driver in hantro_g1_h264_dec.c. Signed-off-by:
-
Ezequiel Garcia authored
The driver should only set the payload on .buf_prepare if the buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused set by userspace then v4l2-core will set it to buffer length. If we overwrite bytesused for OUTPUT buffers, too, then vb2_get_plane_payload() will return incorrect value which might be then written to hw registers by the driver in rkvdec-h264.c. [Changed the comment and used V4L2_TYPE_IS_CAPTURE macro] Fixes: cd33c830 ("media: rkvdec: Add the rkvdec driver") Signed-off-by:
Ezequiel Garcia <ezequiel@collabora.com> Signed-off-by:
Adrian Ratiu <adrian.ratiu@collabora.com> Signed-off-by:
-
Igor Matheus Andrade Torrente authored
The em28xx struct kref isn't being decreased after an error in the em28xx_ir_init, leading to a possible memory leak. A kref_put and em28xx_shutdown_buttons is added to the error handler code. Signed-off-by:
Igor Matheus Andrade Torrente <igormtorrente@gmail.com> Signed-off-by:
-
Tong Zhang authored
There is a problem with the tasklet in bt878. bt->tasklet is set by dvb-bt8xx.ko, and bt878.ko can be loaded independently. In this case if interrupt comes it may cause null-ptr-dereference. To solve this issue, we check if the tasklet is actually set before calling tasklet_schedule. [ 1.750438] bt878(0): irq FDSR FBUS risc_pc= [ 1.750728] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 1.752969] RIP: 0010:0x0 [ 1.757526] Call Trace: [ 1.757659] <IRQ> [ 1.757770] tasklet_action_common.isra.0+0x107/0x110 [ 1.758041] tasklet_action+0x22/0x30 [ 1.758237] __do_softirq+0xe0/0x29b [ 1.758430] irq_exit_rcu+0xa4/0xb0 [ 1.758618] common_interrupt+0x8d/0xa0 [ 1.758824] </IRQ> Signed-off-by:
Tong Zhang <ztong0001@gmail.com> Signed-off-by:
-
Tian Tao authored
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable because of requesting. this patch is made base on "add IRQF_NO_AUTOEN for request_irq" which is being merged: https://lore.kernel.org/patchwork/patch/1388765/Signed-off-by:
Tian Tao <tiantao6@hisilicon.com> Reviewed-by:
Robert Foss <robert.foss@linaro.org> Signed-off-by:
-
Niklas Söderlund authored
Add the compatible string for M3-W+ (r8a77961) to the list of supported SoCs. Signed-off-by:
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Acked-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Niklas Söderlund authored
Add the compatible string for M3-W+ (r8a77961) to the list of supported SoCs. Signed-off-by:
-
Paul Cercueil authored
Add documentation for the devicetree bindings of the RDA5807 FM radio I2C chip from Unisoc. Signed-off-by:
Paul Cercueil <paul@crapouillou.net> Reviewed-by:
-
Zhen Lei authored
The result of an expression consisting of a single relational operator is already of the bool type and does not need to be evaluated explicitly. No functional change. Signed-off-by:
Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by:
-
Dikshita Agarwal authored
Set the FW to run in low power for encoder to accommodate more session without losing much on quality. Signed-off-by:
Dikshita Agarwal <dikshita@codeaurora.org> Signed-off-by:
Stanimir Varbanov <stanimir.varbanov@linaro.org> Signed-off-by:
-
Gustavo A. R. Silva authored
There is a regular need in the kernel to provide a way to declare having a dynamically sized set of trailing elements in a structure. Kernel code should always use “flexible array members”[1] for these cases. The older style of one-element or zero-length arrays should no longer be used[2]. Use flexible-array member in struct hfi_sys_set_property_pkt instead of one-element array. Also, this helps with the ongoing efforts to enable -Warray-bounds and fix the following warnings: drivers/media/platform/qcom/venus/hfi_cmds.c: In function ‘pkt_sys_coverage_config’: drivers/media/platform/qcom/venus/hfi_cmds.c:57:11: warning: array subscript 1 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds] 57 | pkt->data[1] = mode; | ~~~~~~~~~^~~ [1] https://en.wikipedia.org/wiki/Flexible_array_member [2] https://www.kernel.org/doc/html/v5.9/process/deprecated.html#zero-length-and-one-element-arrays Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/109Build-tested-by:kernel test robot <lkp@intel.com> Link: https://lore.kernel.org/lkml/602416da.iZqae7Dbk7nyl6OY%25lkp@intel.com/Signed-off-by:
Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by:
-
Yangtao Li authored
Use resource-managed OPP API to simplify code. Signed-off-by:
Yangtao Li <tiny.windzz@gmail.com> Signed-off-by:
Dmitry Osipenko <digetx@gmail.com> Signed-off-by:
-
Stanimir Varbanov authored
The conceal color property used for Venus v4 and v6 has the same payload structure. But currently v4 follow down to payload structure for v1. Correct this by moving set_property to v4. Fixes: 4ef6039f ("media: venus: vdec: Add support for conceal control") Signed-off-by:
-
Niklas Söderlund authored
Document support for the VIN module in the Renesas V3U (r8a779a0) SoC. The V3U is different from other SoCs as it have 32 instead of 8 (most of Gen3) or 16 (V3H) VIN instances. The VIN instances are also connected to a new IP the R-Car ISP Channel Selector. Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Niklas Söderlund authored
Add bindings for Renesas R-Car ISP Channel Selector IP. The ISP is responsible for filtering the MIPI CSI-2 bus and directing the different CSI-2 virtual channels to different R-Car VIN instances (DMA engines) for capture. Signed-off-by:
-
Christophe JAILLET authored
'ret' is known to be 0 here and printing -ENODEV wouldn't be really helpful. So remove it from the error message. Signed-off-by:
-
Christophe JAILLET authored
'ret' is known to be 0 here and printing -ENODEV wouldn't be really helpful. So remove it from the error message. Signed-off-by:
Lad Prabhakar <prabhakar.csengg@gmail.com> Signed-off-by:
-
Shawn Tu authored
Add a V4L2 sub-device driver for the Sony IMX208 image sensor. This is a camera sensor using the I2C bus for control and the CSI-2 bus for data. [Sakari Ailus: Rename sensor async register function to make it compile, use exposure_max and wrap a few long lines.] Signed-off-by:
Ping-Chung Chen <ping-chung.chen@intel.com> Signed-off-by:
Yeh, Andy <andy.yeh@intel.com> Signed-off-by:
Shawn Tu <shawnx.tu@intel.com> Reviewed-by:
Tomasz Figa <tfiga@chromium.org> Signed-off-by:
-
Paul Kocialkowski authored
The check on mode_index is sufficient to ensure that we have a valid mode. Remove the explicit mode check similarly to commit 38a50230 ("media: i2c: ov5648: remove unnecessary NULL check") Signed-off-by:
Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by:
-
Sakari Ailus authored
The pages field in struct imgu_css_map was missing. Document it. Reported-by:
-
Shawn Tu authored
Add V4L2 controls: horizontal/vertical flip, keep SGRBG10 Bayer order output (via change v/hflip) Signed-off-by:
-
Shawn Tu authored
The OV8856 sensor can output frames with 2/4 CSI2 data lanes. This commit adds support for 2 lane mode in addition to the 4 lane and also configuring the data lane settings in the driver based on system configuration. - Fix Bayer order output in 1640x1232 binning registers - supported data lanes + 3280x2464 on 2 & 4 lanes + 1640x1232 on 2 & 4 lanes + 3264x2448 on 4 lanes + 1632x1224 on 4 lanes Signed-off-by:
Andrey Konovalov <andrey.konovalov@linaro.org> Signed-off-by:
-
Dillon Min authored
On some platform(imx6q), xvclk might not switch on in advance, also for power save purpose, xvclk should not be always on. so, add clk_prepare_enable(), clk_disable_unprepare() in driver side to set xvclk on/off at proper stage. Add following changes: - add 'struct clk *clk;' in 'struct ov2659 {}' - enable xvclk in ov2659_power_on() - disable xvclk in ov2659_power_off() Signed-off-by:Dillon Min <dillon.minfei@gmail.com> Acked-by:
-
Andy Shevchenko authored
When we continue, due to device is disabled, loop we have to drop reference count. When we have an array full of devices we have to also drop the reference count. Note, in this case the cio2_bridge_unregister_sensors() is called by the caller. Fixes: 803abec6 ("media: ipu3-cio2: Add cio2-bridge to ipu3-cio2 driver") Signed-off-by:
Andy Shevchenko <andy.shevchenko@gmail.com> Reviewed-by:
Daniel Scally <djrscally@gmail.com> Signed-off-by:
-
Bernhard Wimmer authored
According to the CCS spec the op_pll_multiplier address is 0x030e, not 0x031e. Signed-off-by:
Bernhard Wimmer <be.wimm@gmail.com> Signed-off-by:
-
Bernhard Wimmer authored
According to the CCS spec the op_pll_multiplier address is 0x030e, not 0x031e. Signed-off-by:
-
Sakari Ailus authored
The header defines the user space interface but may be mistaken as kernel-only header due to its location. Add "uapi" directory under driver's include directory and move the header there. Suggested-by:
Greg KH <gregkh@linuxfoundation.org> Signed-off-by:
Bingbu Cao <bingbu.cao@intel.com> Signed-off-by:
-
Sakari Ailus authored
The V4L2 async framework is generally used with the V4L2 fwnode, which also depends on the former. There are a few exceptions but they are relatively few. At the same time there is a vast number of systems that need videodev module, but have no use for v4l2-async that's now part of videodev. In order to improve, split the v4l2-async into its own module. Selecting V4L2_FWNODE also selects V4L2_ASYNC. This also moves the initialisation of the debufs entries for async subdevs to loading of the v4l2-async module. The directory is named as "v4l2-async". Signed-off-by:
-
Hans Verkuil authored
If a request was queued without a control handler object, and a control handler object is then created and bound to the request when copying controls on request completion, then a WARN_ON in mc-request.c is triggered since at that time the request is in state QUEUED, and not UPDATING. But this is too strict, and in this case it must also allow binding objects when in state QUEUED. This patch was unfortunately lost when the "always copy the controls on completion" patch was posted, it should have been part of that commit. Signed-off-by:
-
Mauro Carvalho Chehab authored
This driver is used only by av7110, which is preparing for its retirement. So, move this ancillary driver to stay together with av7110. Signed-off-by: -
Mauro Carvalho Chehab authored
This driver is really old, from devices that aren't manufactured anymore for more than a decade. Also, the decoder supports only MPEG2, with is not compatible with several modern DVB streams. It is also the only upstream driver relying on the DVB "full-featured" API. Some changes at the frontend drivers seem to have broken it without anybody noticing. Due to that, it sounds it is time to retire the driver for good. Signed-off-by: -
Mauro Carvalho Chehab authored
The ttpci-eeprom is actually an independent driver that doesn't depend on the stuff under drivers/media/pci/ttpci/. Also, it is used by an USB driver (pctv452e). So, move it to the common directory. Signed-off-by: -
Mauro Carvalho Chehab authored
Linux 5.13-rc4 * tag 'v5.13-rc4': (976 commits) Linux 5.13-rc4 seccomp: Refactor notification handler to prepare for new semantics selftests: kvm: fix overlapping addresses in memslot_perf_test KVM: X86: Kill off ctxt->ud KVM: X86: Fix warning caused by stale emulation context KVM: X86: Use kvm_get_linear_rip() in single-step and #DB/#BP interception Documentation: seccomp: Fix user notification documentation MAINTAINERS: adjust to removing i2c designware platform data perf vendor events powerpc: Fix eventcode of power10 JSON events Revert "serial: 8250: 8250_omap: Fix possible interrupt storm" i2c: s3c2410: fix possible NULL pointer deref on read message after write i2c: mediatek: Disable i2c start_en and clear intr_stat brfore reset perf stat: Fix error check for bpf_program__attach cifs: change format of CIFS_FULL_KEY_DUMP ioctl i2c: i801: Don't generate an interrupt on bus reset i2c: mpc: implement erratum A-004447 workaround powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers dt-bindings: i2c: mpc: Add fsl,i2c-erratum-a004447 flag i2c: busses: i2c-stm32f4: Remove incorrectly placed ' ' from function name ...
-
- 30 May, 2021 2 commits
-
-
Linus Torvalds authored
-
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linuxLinus Torvalds authored
Pull i2c fixes from Wolfram Sang: "This is a bit larger than usual at rc4 time. The reason is due to Lee's work of fixing newly reported build warnings. The rest is fixes as usual" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (22 commits) MAINTAINERS: adjust to removing i2c designware platform data i2c: s3c2410: fix possible NULL pointer deref on read message after write i2c: mediatek: Disable i2c start_en and clear intr_stat brfore reset i2c: i801: Don't generate an interrupt on bus reset i2c: mpc: implement erratum A-004447 workaround powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers dt-bindings: i2c: mpc: Add fsl,i2c-erratum-a004447 flag i2c: busses: i2c-stm32f4: Remove incorrectly placed ' ' from function name i2c: busses: i2c-st: Fix copy/paste function misnaming issues i2c: busses: i2c-pnx: Provide descriptions for 'alg_data' data structure i2c: busses: i2c-ocores: Place the expected function names into the documentation headers i2c: busses: i2c-eg20t: Fix 'bad line' issue and provide description for 'msgs' param i2c: busses: i2c-designware-master: Fix misnaming of 'i2c_dw_init_master()' i2c: busses: i2c-cadence: Fix incorrectly documented 'enum cdns_i2c_slave_mode' i2c: busses: i2c-ali1563: File headers are not good candidates for kernel-doc i2c: muxes: i2c-arb-gpio-challenge: Demote non-conformant kernel-doc headers i2c: busses: i2c-nomadik: Fix formatting issue pertaining to 'timeout' i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E i2c: I2C_HISI should depend on ACPI ...
-
