- 29 Mar, 2019 13 commits
-
-
Dan Carpenter authored
Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen" can copy up to 255 bytes and we only have room for two bytes. Even if this comes from the firmware and we trust it, the new policy generally is just to fix it as kernel hardenning. I can't test this code so I tried to be very conservative. I considered not allowing "evt_hdr->dlen == 1" because it doesn't initialize the whole variable but in the end I decided to allow it and manually initialized "asic_id" and "asic_ver" to zero. Fixes: e8454ff7 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
-
YueHaibing authored
'vb' null check should be done before dereferencing it in tw5864_handle_frame, otherwise a NULL pointer dereference may occur. Fixes: 34d1324e ("[media] pci: Add tw5864 driver") Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Signed-off-by:
-
Kangjie Lu authored
In case usb_alloc_coherent fails, the fix returns -ENOMEM to avoid a potential NULL pointer dereference. Signed-off-by:
Kangjie Lu <kjlu@umn.edu> Signed-off-by:
-
Kangjie Lu authored
devm_kcalloc may fail and return a null pointer. The fix returns -ENOMEM upon failures to avoid null pointer dereferences. Signed-off-by:
Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by:
-
Alexandre Courbot authored
This member is never read throughout the code, so remove it. Signed-off-by:
Alexandre Courbot <acourbot@chromium.org> Signed-off-by:
-
Alexandre Courbot authored
Commit 0650a914 ("media: mtk-vcodec: Correct return type for mem2mem buffer helpers") fixed the return types for mem2mem buffer helper functions by changing a few local variables from vb2_buffer to vb2_v4l2_buffer. However, it left a few accesses to vb2_buffer::planes as-is, accidentally turning them into accesses to vb2_v4l2_buffer::planes and resulting in values being read from/written to the wrong place. Fix this by inserting vb2_buf into these accesses so they mimic their original behavior. Fixes: 0650a914 ("media: mtk-vcodec: Correct return type for mem2mem buffer helpers") Signed-off-by:
Ezequiel Garcia <ezequiel@collabora.com> Signed-off-by:
-
Dan Carpenter authored
This code generates a static checker warning: drivers/media/v4l2-core/v4l2-ctrls.c:2921 v4l2_querymenu() warn: should '(1 << i)' be a 64 bit type? The problem is that "ctrl->menu_skip_mask" is a u64 and we're only testing the lower 32 bits. Signed-off-by:Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Arnd Bergmann authored
clang warns about a possible variable use that gcc never complained about: drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here [-Werror,-Wuninitialized] dm365_vpss_set_pg_frame_size(frame_size); ^~~~~~~~~~ drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here struct vpss_pg_frame_size frame_size; ^ 1 error generated. There is no initialization for this variable at all, and there has never been one in the mainline kernel, so we really should not put that stack data into an mmio register. On the other hand, I suspect that gcc checks the condition more closely and notices that the global isif_cfg.bayer.config_params.test_pat_gen flag is initialized to zero and never written to from any code path, so anything depending on it can be eliminated. To shut up the clang warning, just remove the dead code manually, it has probably never been used because any attempt to do so would have resulted in undefined behavior. Fixes: 63e3ab14 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365") Signed-off-by:Arnd Bergmann <arnd@arndb.de> Reviewed-by:
Nathan Chancellor <natechancellor@gmail.com> Acked-by:
Lad, Prabhakar <prabhakar.csengg@gmail.com> Signed-off-by:
-
Koen Vandeputte authored
Building tda1997x fails now unless V4L2_FWNODE is selected: drivers/media/i2c/tda1997x.o: in function `tda1997x_parse_dt' undefined reference to `v4l2_fwnode_endpoint_parse' While at it, also sort the selections alphabetically Fixes: 9ac0038d ("media: i2c: Add TDA1997x HDMI receiver driver") Signed-off-by:
Koen Vandeputte <koen.vandeputte@ncentric.com> Cc: stable@vger.kernel.org # v4.17+ Acked-by:
-
Arnd Bergmann authored
When CONFIG_DEBUGFS is enabled, we get a warning about an incorrect section annotation that can lead to undefined behavior: WARNING: vmlinux.o(.text+0xd3c7c4): Section mismatch in reference from the function mipi_csis_probe() to the function .init.text:mipi_csis_debugfs_init() The function mipi_csis_probe() references the function __init mipi_csis_debugfs_init(). This is often because mipi_csis_probe lacks a __init annotation or the annotation of mipi_csis_debugfs_init is wrong. The same function for an unknown reason has a different version for !CONFIG_DEBUGFS, which does not have this problem, but behaves the same way otherwise (it does nothing when debugfs is disabled). Consolidate the two versions, using the correct section from one version, and the implementation from the other. Signed-off-by:
Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by:
-
Arnd Bergmann authored
clang is unable to optimize the isif_ioctl() in the same way that gcc does, as it fails to prove that the local copy of the 'struct vpfe_isif_raw_config' argument is unnecessary: drivers/staging/media/davinci_vpfe/dm365_isif.c:622:13: error: stack frame size of 1344 bytes in function 'isif_ioctl' [-Werror,-Wframe-larger-than=] Marking it as 'const' while passing the data down clearly shows us that the copy is never modified, and we can skip copying it entirely, which reduces the stack usage to just eight bytes. Signed-off-by:
-
Lucas Leonardo Ciancaglini authored
Small readability changes to make the breaking of some lines cleaner. Signed-off-by:
Lucas Leonardo Ciancaglini <leociancalucas@gmail.com> Signed-off-by:
-
Ezequiel Garcia authored
In order to prevent ISOC URBs from being infinitely resubmitted, the driver's USB disconnect handler must kill all the in-flight URBs. While here, change the URB packet status message to a debug level, to avoid spamming the console too much. This commit fixes a lockup caused by an interrupt storm coming from the URB completion handler. Signed-off-by:
-
- 28 Mar, 2019 1 commit
-
-
Mauro Carvalho Chehab authored
As warned by smatch: drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:529 dvb_register_device() error: double unlock 'sem:&minor_rwsem' Reported-by:
Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by:
-
- 25 Mar, 2019 26 commits
-
-
Mauro Carvalho Chehab authored
Smatch warns about small size on two structs: drivers/media/platform/qcom/venus/hfi_parser.c:103 parse_profile_level() error: memcpy() 'proflevel' too small (8 vs 128) drivers/media/platform/qcom/venus/hfi_parser.c: drivers/media/platform/qcom/venus/hfi_parser.c:129 parse_caps() error: memcpy() 'cap' too small (16 vs 512) The reason is that the hfi_parser actually expects: - multiple data entries on hfi_capabilities - multiple profile_level on hfi_profile_level_supported However, the structs trick gcc, making it to believe that there's just one value for each. Signed-off-by: -
Mauro Carvalho Chehab authored
The only way for p_set to be NULL would be if vin_coef_set would be an empty array. On such case, the driver will OOPS, as it would try to de-reference a NULL value. So, the check if p_set is not NULL doesn't make any sense. Solves those two smatch warnings: drivers/media/platform/rcar-vin/rcar-dma.c:489 rvin_set_coeff() warn: variable dereferenced before check 'p_set' (see line 484) drivers/media/platform/rcar-vin/rcar-dma.c:494 rvin_set_coeff() error: we previously assumed 'p_set' could be null (see line 489) Signed-off-by: -
Mauro Carvalho Chehab authored
At the error logic, ipc_buf was already asigned to &ctx->ipc_buf_struct, with can't be null, as warned by smatch: drivers/media/platform/sti/delta/delta-ipc.c:223 delta_ipc_open() warn: variable dereferenced before check 'ctx->ipc_buf' (see line 183) So, remove the uneeded check. Signed-off-by: -
Mauro Carvalho Chehab authored
The way the code works, compression will be a valid value (less or equal to 3) on both set_video_mode_foo() calls at the beginning of the while() loop. So, the value for pChoose can't be NULL. Solves those smatch warnings: drivers/media/usb/pwc/pwc-ctrl.c: drivers/media/usb/pwc/pwc-ctrl.c:252 set_video_mode_Timon() warn: variable dereferenced before check 'pChoose' (see line 248) drivers/media/usb/pwc/pwc-ctrl.c: drivers/media/usb/pwc/pwc-ctrl.c:302 set_video_mode_Kiara() warn: variable dereferenced before check 'pChoose' (see line 298) and simplifies the code a little bit. Signed-off-by: -
Mauro Carvalho Chehab authored
There are some macros at cx2341x_update() with seemed to be introduced in order to ensure that lines would be less than 80 columns. Well, the thing is that they make the code harder to be analized, not only by humans, but also for static code analyzers: drivers/media/common/cx2341x.c:1116 cx2341x_update() error: we previously assumed 'old' could be null (see line 1047) So, remove the "force" var, and replace the NEQ macro to a better designed one that makes clearer about what it is doing. While here, also remove the "temporal" var, as it is just another way of doing the same type of check as the new CMP_FIELD() macro already does. Finally, fix coding style at the block code. remove such macros. Signed-off-by: -
Mauro Carvalho Chehab authored
As warned by smatch: drivers/media/i2c/imx214.c:591 imx214_set_format() warn: variable dereferenced before check 'format' (see line 589) It turns that the code at imx214_set_format() has support for being called with the format being NULL. I've no idea why, as it is only called internally with the pointer set, and via subdev API (with should also set it). Also, the entire logic there depends on having format != NULL, so just remove the bogus broken support for a null format. Signed-off-by:
Ricardo Ribalda Delgado <ricardo@ribalda.com> Signed-off-by:
-
Laurent Pinchart authored
Indentation is odd in several places, especially when printing messages to the kernel log. Fix it to match the usual coding style. Signed-off-by:
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by:
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
-
Dafna Hirschfeld authored
for stateless decoder, set the output pixelformat to V4L2_PIX_FMT_FWHT_STATELESS and the pix info to pixfmt_stateless_fwht Signed-off-by:
Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by:
-
Dafna Hirschfeld authored
Implement a stateless decoder for the new node. Signed-off-by:
-
Dafna Hirschfeld authored
Add stateless decoder instance field to the dev struct and register another node for the statelsess decoder. The stateless API for the node will be implemented in further patches. Signed-off-by:
-
Hans Verkuil authored
Add V4L2_PIX_FMT_FWHT_STATELESS to the list of pixelformats that v4l_fill_fmtdesc() understands. Signed-off-by:
-
Dafna Hirschfeld authored
Add structs and definitions needed to implement stateless decoder for fwht and add I/P-frames QP controls to the public api. Signed-off-by:
-
Dafna Hirschfeld authored
add documentation to V4L2_PIX_FMT_FWHT_STATELESS in pixfmt-compressed.rst Signed-off-by:
-
Dafna Hirschfeld authored
add documentation to V4L2_CID_MPEG_VIDEO_FWHT_PARAMS control and its related 'v4l2_ctrl_fwht_params' struct [mchehab+samsung@kernel.org: remove extra blank lines] Signed-off-by:
-
Dafna Hirschfeld authored
add documentation to V4L2_CID_FWHT_I/P_FRAME_QP controls in ext-ctrls-codec.rst [mchehab+samsung@kernel.org: remove extra blank lines] Signed-off-by:
-
Dafna Hirschfeld authored
Add struct 'vicodec_dev_instance' for the fields in vicodec_dev that have have both decoder and encoder versions. Signed-off-by:
-
Dafna Hirschfeld authored
In the stateless decoder the reference buffer is null if the frame is an I-frame (flagged with FWHT_FL_I_FRAME). Make sure not to dereference it in that case. Signed-off-by:
-
Dafna Hirschfeld authored
Rename 'v4l2_fwht_default_fmt' to 'v4l2_fwht_find_nth_fmt' and add a function 'v4l2_fwht_validate_fmt' to check if a format info matches the parameters. This function will also be used to validate the stateless params when adding support for stateless codecs. Signed-off-by:
-
Dafna Hirschfeld authored
Move the code that validates version dependent header values to a separate function 'validate_by_version' Signed-off-by:
-
Dafna Hirschfeld authored
In the decoder, save the inner reference frame in the same format as the capture buffer. The decoder writes directly to the capture buffer and then the capture buffer is copied to the reference buffer. This will simplify the stateless decoder. Signed-off-by:
-
Dafna Hirschfeld authored
Add the field 'buf' to fwht_raw_frame to indicate the start of the raw frame buffer. This field will be used to copy the capture buffer to the reference buffer in the next patch. Signed-off-by:
-
Dafna Hirschfeld authored
Introduce 'prepare_raw_frame' function that fills the values of a raw frame struct according to the format. Signed-off-by:
-
Dafna Hirschfeld authored
Free compressed_frame buffer upon device release. Signed-off-by:
-
Dafna Hirschfeld authored
The function 'v4l2_m2m_buf_copy_metadata' should be called even if decoding/encoding ends with status VB2_BUF_STATE_ERROR, so that the metadata is copied from the source buffer to the dest buffer. Signed-off-by:
-
Dafna Hirschfeld authored
v4l2_fwht_encode returns either an error code on failure or the size of the compressed frame on success. So change the var assigned to it from 'ret' to 'comp_sz_or_errcode' to clarify that. Signed-off-by:
-
Dafna Hirschfeld authored
If one of the controls fails to set, then 'v4l2_ctrl_request_setup' immediately returns with the error code. Signed-off-by:
Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by:
-
