- 19 Mar, 2019 40 commits
-
-
Hans Verkuil authored
When streaming is stopped all URBs are killed, but in fill_frame and in bulk_irq this results in an attempt to resubmit the killed URB. That is not what you want and causes spurious kernel messages. So check if streaming has stopped before resubmitting. Also check against gspca_dev->streaming rather than vb2_start_streaming_called() since vb2_start_streaming_called() will return true when in stop_streaming, but gspca_dev->streaming is set to false when stop_streaming is called. Fixes: 6992effe ("gspca: Kill all URBs before releasing any of them") Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
-
Shuah Khan authored
Fix a misleading comment in _close() and a spelling error. Reviewed-by:
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by:
Shuah Khan <shuah@kernel.org> Signed-off-by:
-
Shuah Khan authored
__media_pipeline_start() does WARN_ON() when active pipe doesn't match the input arg entity's pipe. Replace WARN_ON with a conditional and error message that includes names of both entities. Signed-off-by:
-
Arnd Bergmann authored
Clang-9 makes some different inlining decisions compared to gcc, which leads to a warning about a possible stack overflow problem when building with CONFIG_KASAN, including when setting asan-stack=0, which avoids most other frame overflow warnings: drivers/media/platform/vicodec/codec-fwht.c:673:12: error: stack frame size of 2224 bytes in function 'encode_plane' Manually adding noinline_for_stack annotations in those functions called by encode_plane() or decode_plane() that require a significant amount of kernel stack makes this impossible to happen with any compiler. Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
Dan Carpenter authored
We should be updating *pos. The current code is a no-op. Fixes: 1c1e45d1 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Dan Carpenter authored
We had intended to update *pos, but the current code is a no-op. Fixes: 1a0adaf3 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder") Signed-off-by:
-
Arnd Bergmann authored
clang-8 warns about one function here when KASAN is enabled, even without the 'asan-stack' option: drivers/media/usb/go7007/go7007-fw.c:1551:5: warning: stack frame size of 2656 bytes in function I have reported this issue in the llvm bugzilla, but to make it work with the clang-8 release, a small annotation is still needed. Link: https://bugs.llvm.org/show_bug.cgi?id=38809Signed-off-by:
-
Arnd Bergmann authored
Two saa7146/hexium files contain a construct that causes a warning when built with clang: drivers/media/pci/saa7146/hexium_orion.c:210:12: error: stack frame size of 2272 bytes in function 'hexium_probe' [-Werror,-Wframe-larger-than=] static int hexium_probe(struct saa7146_dev *dev) ^ drivers/media/pci/saa7146/hexium_gemini.c:257:12: error: stack frame size of 2304 bytes in function 'hexium_attach' [-Werror,-Wframe-larger-than=] static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info) ^ This one happens regardless of KASAN, and the problem is that a constructor to initialize a dynamically allocated structure leads to a copy of that structure on the stack, whereas gcc initializes it in place. Link: https://bugs.llvm.org/show_bug.cgi?id=40776Signed-off-by:Nick Desaulniers <ndesaulniers@google.com> Signed-off-by:
-
Ken Sloat authored
The ISC driver currently supports ITU-R 601 encoding which utilizes the external hsync and vsync signals. ITU-R 656 format removes the need for these pins by embedding the sync pulses within the data packet. To support this feature, enable necessary register bits when this feature is enabled via device tree. Signed-off-by:
Ken Sloat <ksloat@aampglobal.com> Signed-off-by:
-
Jernej Skrabec authored
H6 has improved VPU. It supports 10-bit HEVC decoding and AFBC output format for HEVC. Signed-off-by:
Jernej Skrabec <jernej.skrabec@siol.net> Acked-by:
Maxime Ripard <maxime.ripard@bootlin.com> Signed-off-by:
-
Jernej Skrabec authored
H6 VPU doesn't work if DMA offset is set. Add a quirk for it. Signed-off-by:
-
Jernej Skrabec authored
This adds a compatible for H6. H6 VPU supports 10-bit HEVC decoding and additional AFBC output format for HEVC. Signed-off-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Hans Verkuil authored
The last user of this state has been converted, so we can now drop this. Requeueing causes the queue to become unordered, which causes problems with requests and (in the future) fences. Since it is no longer needed, just get rid of this. Signed-off-by:
-
Hans Verkuil authored
The cobalt driver is the only driver that uses VB2_BUF_STATE_REQUEUEING. Replace it by VB2_BUF_STATE_ERROR so we can drop support for the REQUEUEING state. The requeueing state was used in the cobalt driver to optimize buffer handling while waiting for a valid signal: by requeueing buffers internally there was no need for userspace to handle and requeue buffers with the ERROR flag set. However, requeueing also makes the buffer handling unordered, which is generally a bad idea. Requeueing also does not work with requests and any future fence support. Since it is really a minor optimization in the cobalt driver it is best to just return the buffer in an ERROR state. With this change support for requeueing can now be removed in vb2. Signed-off-by:
-
Hugues Fruchet authored
Avoid call of dmaengine_terminate_all() between dmaengine_prep_slave_single() and dmaengine_submit() by locking the whole DMA submission sequence. Signed-off-by:
Hugues Fruchet <hugues.fruchet@st.com> Signed-off-by:
-
Hugues Fruchet authored
Start streaming was sometimes failing because of pm_runtime_get_sync() non-0 return value. In fact return value was not an error but a positive value (1), indicating that PM was already enabled. Fix this by going to error path only with negative return value. Signed-off-by:
-
Shaobo He authored
Function `sh_veu_find_fmt` returns an address that is an addition of a base pointer `sh_veu_fmt` and an offset. The base pointer refers to a global variable of which address cannot be NULL. Therefore, this commit removes the NULL pointer checks on the return values of function `sh_veu_find_fmt`. Signed-off-by:
Shaobo He <shaobo@cs.utah.edu> Signed-off-by:
-
YueHaibing authored
Syzkaller report this: BUG: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468 Read of size 8 at addr ffff8881f59a6b70 by task syz-executor.0/8363 CPU: 0 PID: 8363 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xfa/0x1ce lib/dump_stack.c:113 print_address_description+0x65/0x270 mm/kasan/report.c:187 kasan_report+0x149/0x18d mm/kasan/report.c:317 sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468 sysfs_remove_file include/linux/sysfs.h:519 [inline] driver_remove_file+0x40/0x50 drivers/base/driver.c:122 usb_remove_newid_files drivers/usb/core/driver.c:212 [inline] usb_deregister+0x12a/0x3b0 drivers/usb/core/driver.c:1005 cpia2_exit+0xa/0x16 [cpia2] __do_sys_delete_module kernel/module.c:1018 [inline] __se_sys_delete_module kernel/module.c:961 [inline] __x64_sys_delete_module+0x3dc/0x5e0 kernel/module.c:961 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462e99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f86f3754c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000300 RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f86f37556bc R13: 00000000004bcca9 R14: 00000000006f6b48 R15: 00000000ffffffff Allocated by task 8363: set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495 kmalloc include/linux/slab.h:545 [inline] kzalloc include/linux/slab.h:740 [inline] bus_add_driver+0xc0/0x610 drivers/base/bus.c:651 driver_register+0x1bb/0x3f0 drivers/base/driver.c:170 usb_register_driver+0x267/0x520 drivers/usb/core/driver.c:965 0xffffffffc1b4817c do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 8363: set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:457 slab_free_hook mm/slub.c:1430 [inline] slab_free_freelist_hook mm/slub.c:1457 [inline] slab_free mm/slub.c:3005 [inline] kfree+0xe1/0x270 mm/slub.c:3957 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:67 [inline] kobject_put+0x146/0x240 lib/kobject.c:708 bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732 driver_unregister+0x6c/0xa0 drivers/base/driver.c:197 usb_register_driver+0x341/0x520 drivers/usb/core/driver.c:980 0xffffffffc1b4817c do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881f59a6b40 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 48 bytes inside of 256-byte region [ffff8881f59a6b40, ffff8881f59a6c40) The buggy address belongs to the page: page:ffffea0007d66980 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0 flags: 0x2fffc0000000200(slab) raw: 02fffc0000000200 dead000000000100 dead000000000200 ffff8881f6c02e00 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881f59a6a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881f59a6a80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc >ffff8881f59a6b00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8881f59a6b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881f59a6c00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc cpia2_init does not check return value of cpia2_init, if it failed in usb_register_driver, there is already cleanup using driver_unregister. No need call cpia2_usb_cleanup on module exit. Reported-by:Hulk Robot <hulkci@huawei.com> Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Signed-off-by:
-
Alexandre Courbot authored
Commit 0650a914 ("media: mtk-vcodec: Correct return type for mem2mem buffer helpers") fixed the return types for mem2mem buffer helper functions, but omitted two occurrences that are accessed in the mtk_v4l2_debug() macro. These only trigger compiler errors when DEBUG is defined. Fixes: 0650a914 ("media: mtk-vcodec: Correct return type for mem2mem buffer helpers") Signed-off-by:
Alexandre Courbot <acourbot@chromium.org> Signed-off-by:
-
Biju Das authored
Add the SoC specific information for RZ/G2M(r8a774a1) SoC. The VIN module of RZ/G2M is similar to R-Car M3-W. Signed-off-by:
Biju Das <biju.das@bp.renesas.com> Reviewed-by:
Fabrizio Castro <fabrizio.castro@bp.renesas.com> Acked-by:
Simon Horman <horms+renesas@verge.net.au> Signed-off-by:
-
Biju Das authored
Document RZ/G2M (R8A774A1) SoC bindings. The RZ/G2M SoC is similar to R-Car M3-W (R8A7796). Signed-off-by:
-
Biju Das authored
Add the MIPI CSI-2 driver support for RZ/G2M(r8a774a1) SoC. The CSI-2 module of RZ/G2M is similar to R-Car M3-W. Signed-off-by:
-
Biju Das authored
Document RZ/G2M (R8A774A1) SoC bindings. The RZ/G2M SoC is similar to R-Car M3-W (R8A7796). Signed-off-by:
-
Geert Uytterhoeven authored
devm_ioremap_resource() already prints an error message on failure, so there is no need to repeat that. Signed-off-by:
Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by:
-
Rui Miguel Silva authored
if imx7_csi_try_fmt() fails, cc variable won't be initialized and csi->cc[sdformat->pad] would be pointing to a random location. Reported-by:
Rui Miguel Silva <rui.silva@linaro.org> Signed-off-by:
-
Dan Carpenter authored
We accidentally return IS_ERR(), which is 1, instead of the PTR_ERR() which is the negative error code. Fixes: 7807063b ("media: staging/imx7: add MIPI CSI-2 receiver subdev for i.MX7") Signed-off-by:
-
Steve Longerbeam authored
The second IPU internal sub-devices were being registered and links to them created even when the second IPU is not present. This is wrong for i.MX6 S/DL and i.MX53 which have only a single IPU. Fixes: e1302912 ("[media] media: Add i.MX media core driver") Signed-off-by:
Steve Longerbeam <slongerbeam@gmail.com> Reviewed-by:
Philipp Zabel <p.zabel@pengutronix.de> Cc: stable@vger.kernel.org Signed-off-by:
-
Steve Longerbeam authored
For the functions that add and remove the internal IPU subdevice descriptors, rename them to make clear they are the subdevs internal to the IPU. Also rename the platform data structure for the internal IPU subdevices. No functional changes. Signed-off-by:
-
Steve Longerbeam authored
In imx_media_create_csi_of_links(), the 'struct v4l2_fwnode_link' must be cleared for each endpoint iteration, otherwise if the remote port has no "reg" property, link.remote_port will not be reset to zero. This was discovered on the i.MX53 SMD board, since the OV5642 connects directly to ipu1_csi0 and has a single source port with no "reg" property. Fixes: 621b08ea ("media: staging/imx: remove static media link arrays") Signed-off-by:
-
Steve Longerbeam authored
On i.MX6, the nearest upstream entity to the CSI can only be the CSI video muxes or the Synopsys DW MIPI CSI-2 receiver. However the i.MX53 has no CSI video muxes or a MIPI CSI-2 receiver. So allow for the nearest upstream entity to the CSI to be something other than those. Fixes: bf3cfaa7 ("media: staging/imx: get CSI bus type from nearest upstream entity") Signed-off-by:
-
Hans Verkuil authored
Fixes this smatch error: drivers/staging/media/imx/imx7-mipi-csis.c:716 mipi_csis_set_fmt() error: we previously assumed 'fmt' could be null (see line 709) fmt is never NULL, so remove the 'fmt &&' condition. Signed-off-by:
Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by:
-
Steve Longerbeam authored
Restore a default case to prepare_vdi_in_buffers() to fix the following smatch errors: drivers/staging/media/imx/imx-media-vdic.c:236 prepare_vdi_in_buffers() error: uninitialized symbol 'prev_phys'. drivers/staging/media/imx/imx-media-vdic.c:237 prepare_vdi_in_buffers() error: uninitialized symbol 'curr_phys'. drivers/staging/media/imx/imx-media-vdic.c:238 prepare_vdi_in_buffers() error: uninitialized symbol 'next_phys'. Fixes: 6e537b58 ("media: imx: vdic: rely on VDIC for correct field order") Reported-by:
Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by:
-
Niklas Söderlund authored
Changes to v4l2-fwnode in commit [1] triggered a lockdep warning in rcar-vin. The first attempt to solve this warning in the rcar-vin driver was incomplete and only pushed the warning to happen at stream on time instead of at probe time. This change reverts the incomplete fix and properly fixes the warning by removing the need to hold the rcar-vin specific group lock when calling v4l2_async_notifier_parse_fwnode_endpoints_by_port(). And instead takes it in the callback where it's really needed. [1] commit eae2aed1 ("media: v4l2-fwnode: Switch to v4l2_async_notifier_add_subdev") Fixes: 6458afc8 ("media: rcar-vin: remove unneeded locking in async callbacks") Signed-off-by:
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
-
Hans Verkuil authored
Use the new v4l2_subdev_internal_ops release op to free the subdev memory only when the last user closed the file handle. Move v4l2_device_unregister_subdev() to the end of the vimc_ent_sd_unregister() function since now the unregister_subdev() call may free the vimc_ent_device struct which is used after the unregister_subdev() call. So this now has to be done last. Signed-off-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Hans Verkuil authored
Don't free vimc_cap_device immediately, instead do this in the video_device release function which is called when the last user closes the video device. Only then is it safe to free the memory. Signed-off-by:
-
Hans Verkuil authored
The media_device is part of a static global vimc_device struct. The media framework expects this to be zeroed before it is used, however, since this is a global this is not the case if vimc is unbound and then bound again. So call memset to ensure any left-over values are cleared. Signed-off-by:
-
Hans Verkuil authored
The module ownership refcounting was done in media_entity_get/put, but that was very confusing and it did not work either in case an application had a v4l-subdevX device open and the module was unbound. When the v4l-subdevX device was closed the media_entity_put was never called and the module refcount was left one too high, making it impossible to unload it. Since v4l2-subdev.c was the only place where media_entity_get/put was called, just move the functionality to v4l2-subdev.c and drop those confusing entity functions. Store the module in subdev_fh so module_put no longer depends on the media_entity struct. Signed-off-by:
-
Hans Verkuil authored
If the subdevice created a device node, then the v4l2_subdev cannot be freed until the last user of the device node closes it. This means that we need a release() callback in v4l2_subdev_internal_ops that is called from the video_device release function so the subdevice driver can postpone freeing memory until the that callback is called. If no video device node was created then the release callback can be called immediately when the subdev is unregistered. Signed-off-by:
-
Hans Verkuil authored
It is not possible to use devm_kzalloc since that memory is freed immediately when the device instance is unbound. Various objects like the video device may still be in use since someone has the device node open, and when that is closed it expects the memory to be around. So use kzalloc and release it at the appropriate time. Signed-off-by:
-
Hans Verkuil authored
When vivid is unloaded it used vfree to free dev->bitmap_out, but it was actually allocated using kmalloc. Use vzalloc instead, conform what vivid-vid-cap.c does. Signed-off-by:
-
