- 04 Jul, 2020 6 commits
-
-
Dan Carpenter authored
If fw_csr_string() returns -ENOENT, then "name" is uninitialized. So then the "strlen(model_names[i]) <= name_len" is true because strlen() is unsigned and -ENOENT is type promoted to a very high positive value. Then the "strncmp(name, model_names[i], name_len)" uses uninitialized data because "name" is uninitialized. Fixes: 92374e88 ("[media] firedtv: drop obsolete backend abstraction") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-
Chen Zhou authored
Fixes coccicheck warning: ./drivers/media/platform/coda/coda-jpeg.c:331:3-31: alloc with no test, possible model on line 354 Add NULL check after kmalloc. Signed-off-by:
Chen Zhou <chenzhou10@huawei.com> Signed-off-by:
-
Eugen Hristev authored
All warnings (new ones prefixed by >>, old ones prefixed by <<): >> drivers/media/platform/atmel/atmel-sama5d2-isc.c:323:34: warning: unused variable 'atmel_isc_of_match' [-Wunused-const-variable] static const struct of_device_id atmel_isc_of_match[] = { ^ 1 warning generated. vim +/atmel_isc_of_match +323 drivers/media/platform/atmel/atmel-sama5d2-isc.c 322 > 323 static const struct of_device_id atmel_isc_of_match[] = { 324 { .compatible = "atmel,sama5d2-isc" }, 325 { } 326 }; 327 MODULE_DEVICE_TABLE(of, atmel_isc_of_match); 328 Fixed warning by guarding the atmel_isc_of_match by CONFIG_OF. Reported-by:kernel test robot <lkp@intel.com> Signed-off-by:
Eugen Hristev <eugen.hristev@microchip.com> Signed-off-by:
-
Gustavo A. R. Silva authored
The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732 ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by:Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by:
-
Andrey Konovalov authored
Currently for msm_csiphy, msm_csid, and msm_ispif subdevices the media entity function field is set to MEDIA_ENT_F_IO_V4L. This is incorrect as MEDIA_ENT_F_IO_V4L implies V4L2 video node. Change it to MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER as this is the best fit from the functions defined in include/uapi/linux/media.h. Signed-off-by:
Andrey Konovalov <andrey.konovalov@linaro.org> Tested-by:
Robert Foss <robert.foss@linaro.org> Reviewed-by:
-
Dafna Hirschfeld authored
The rkisp1 supports RGB encoding with 6 bits per color with the following format: - - b5 b4 b3 b2 b1 b0 - - g5 g4 g3 g2 g1 g0 - - r5 r4 r3 r2 r1 r0 - - - - - - - - This is not how V4L2_PIX_FMT_BGR666 is defined, so remove this format from the driver's formats list. Signed-off-by:
Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by:
Helen Koike <helen.koike@collabora.com> Signed-off-by:
-
- 23 Jun, 2020 34 commits
-
-
Tuomas Tynkkynen authored
Syzbot reports a NULL-ptr deref in the kref_put() call: BUG: KASAN: null-ptr-deref in media_request_put drivers/media/mc/mc-request.c:81 [inline] kref_put include/linux/kref.h:64 [inline] media_request_put drivers/media/mc/mc-request.c:81 [inline] media_request_close+0x4d/0x170 drivers/media/mc/mc-request.c:89 __fput+0x2ed/0x750 fs/file_table.c:281 task_work_run+0x147/0x1d0 kernel/task_work.c:123 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:165 [inline] prepare_exit_to_usermode+0x48e/0x600 arch/x86/entry/common.c:196 What led to this crash was an injected memory allocation failure in media_request_alloc(): FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 should_failslab+0x5/0x20 kmem_cache_alloc_trace+0x57/0x300 ? anon_inode_getfile+0xe5/0x170 media_request_alloc+0x339/0x440 media_device_request_alloc+0x94/0xc0 media_device_ioctl+0x1fb/0x330 ? do_vfs_ioctl+0x6ea/0x1a00 ? media_ioctl+0x101/0x120 ? __media_device_usb_init+0x430/0x430 ? media_poll+0x110/0x110 __se_sys_ioctl+0xf9/0x160 do_syscall_64+0xf3/0x1b0 When that allocation fails, filp->private_data is left uninitialized which media_request_close() does not expect and crashes. To avoid this, reorder media_request_alloc() such that allocating the struct file happens as the last step thus media_request_close() will no longer get called for a partially created media request. Reported-by: syzbot+6bed2d543cf7e48b822b@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by:
Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> Fixes: 10905d70 ("media: media-request: implement media requests") Reviewed-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Qingwu Zhang authored
ov2740 includes 512bytes of one-time programmable memory and 256 bytes are reserved for customers which can be used to store customized information. This patch provide an NVMEM interface to support read out the customized data in OTP. Signed-off-by:
Bingbu Cao <bingbu.cao@intel.com> Signed-off-by:
Qingwu Zhang <qingwu.zhang@intel.com> Signed-off-by:
-
Andrey Konovalov authored
The bus_type field of v4l2_fwnode_endpoint structure passed as the argument to v4l2_fwnode_endpoint_alloc_parse() function must be initiaized. Set it to V4L2_MBUS_CSI2_DPHY, and check for -ENXIO which is returned when the requested media bus type doesn't match the fwnode. Also remove v4l2_fwnode_endpoint field from struct imx290 as it is only needed in the probe function: use the local variable for this purpose. Signed-off-by:
-
Manivannan Sadhasivam authored
The 10ms settle time is needed only at the end of all consecutive register writes. So move the delay to outside of the for loop of imx290_set_register_array(). Signed-off-by:
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by:
-
Manivannan Sadhasivam authored
Add support to enumerate all frame sizes supported by IMX290. This is required for using with userspace tools such as libcamera. Signed-off-by:
-
Manivannan Sadhasivam authored
IMX290 is capable of outputting frames in both Raw Bayer (packed) 10 and 12 bit formats. Since the driver already supports RAW10 mode, let's add the missing RAW12 mode as well. Signed-off-by:
-
Manivannan Sadhasivam authored
Add support for generating following test patterns by IMX290: * Sequence Pattern 1 * Horizontal Color-bar Chart * Vertical Color-bar Chart * Sequence Pattern 2 * Gradation Pattern 1 * Gradation Pattern 2 * 000/555h Toggle Pattern Signed-off-by:
-
Manivannan Sadhasivam authored
IMX290 operates with multiple link frequency and pixel rate combinations. The initial driver used a single setting for both but since we now have the lane count support in place, let's add configurable link frequency and pixel rate. Signed-off-by:
-
Manivannan Sadhasivam authored
The IMX290 sensor can output frames with 2/4 CSI2 data lanes. This commit adds support for 2 lane mode in addition to the 4 lane and also configuring the data lane settings in the driver based on system configuration. Signed-off-by:
-
Andrey Konovalov authored
According to https://www.kernel.org/doc/Documentation/gpio/consumer.txt, - all of the gpiod_set_value_xxx() functions operate with the *logical* value. So in imx290_power_on() the reset signal should be cleared (de-asserted) with gpiod_set_value_cansleep(imx290->rst_gpio, 0), and in imx290_power_off() the value of 1 must be used to apply/assert the reset to the sensor. In the device tree the reset pin is described as GPIO_ACTIVE_LOW, and gpiod_set_value_xxx() functions take this into account, - when devm_gpiod_get_optional() is called with GPIOD_ASIS, the GPIO is not initialized, and the direction must be set later; using a GPIO without setting its direction first is illegal and will result in undefined behavior. Fix this by using GPIOD_OUT_HIGH instead of GPIOD_ASIS (this asserts the reset signal to the sensor initially). Signed-off-by:
-
Andrey Konovalov authored
The macro is defined as SET_RUNTIME_PM_OPS(suspend_fn, resume_fn, idle_fn), so imx290_power_off must be the 1st arg, and imx290_power_on the 2nd. Signed-off-by:
-
Andrey Konovalov authored
With the current driver 'media-ctl -p' issued right after the imx290 driver is loaded prints: pad0: Source [fmt:unknown/0x0] The format value of zero is due to the current_format field of the imx290 struct not being initialized yet. As imx290_entity_init_cfg() calls imx290_set_fmt(), the current_mode field is also initialized, so the line which set current_mode to a default value in driver's probe() function is no longer needed. Signed-off-by: -
Chuhong Yuan authored
preview_init_entities() does not call v4l2_ctrl_handler_free() when it fails. Add the missed function to fix it. Fixes: de1135d4 ("[media] omap3isp: CCDC, preview engine and resizer") Signed-off-by:
Chuhong Yuan <hslester96@gmail.com> Reviewed-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Chuhong Yuan authored
mccic_register() forgets to cleanup the notifier in its error handler. mccic_shutdown() also misses calling v4l2_async_notifier_cleanup(). Add the missed calls to fix them. Fixes: 3eefe36c ("media: marvell-ccic: use async notifier to get the sensor") Signed-off-by:
-
Bingbu Cao authored
As the ACPI id of ov2740 camera sensor was registered as "INT3474", current ov2740 driver is supposed to be working with ACPI only. Signed-off-by:
Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by:
-
Sakari Ailus authored
Use the convenience function pm_runtime_get_if_active() instead of a number of calls to runtime PM to figure out if the device was already powered up. Signed-off-by:
-
Dinghao Liu authored
When v4l2_async_register_subdev_sensor_common() returns an error code, a pairing runtime PM usage counter decrement is needed to keep the counter balanced. Signed-off-by:
Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by:
-
Hans Verkuil authored
Document this core CEC structure. Signed-off-by:
-
Hans Verkuil authored
The cec_adapter struct contained a waitq field that isn't used anywhere, so drop this. It also contained a phys_addrs array to store any reported physical addresses. However, this was never actually used, so this field is removed as well. The original idea was to let the core keep track of this information, but nothing was ever done with this. Should this be needed in the future then it is easy enough to resurrect this. Signed-off-by:
-
Hans Verkuil authored
The CEC_ADAP_G_CAPS documentation of the cec_caps struct was missing the available_log_addrs field. Add this. Signed-off-by:
-
Chuhong Yuan authored
budget_register() has no error handling after its failure. Add the missed undo functions for error handling to fix it. Signed-off-by:
Sean Young <sean@mess.org> Signed-off-by:
-
Jia-Ju Bai authored
The value av7110->debi_virt is stored in DMA memory, and it is assigned to data, and thus data[0] can be modified at any time by malicious hardware. In this case, "if (data[0] < 2)" can be passed, but then data[0] can be changed into a large number, which may cause buffer overflow when the code "av7110->ci_slot[data[0]]" is used. To fix this possible bug, data[0] is assigned to a local variable, which replaces the use of data[0]. Signed-off-by:
Jia-Ju Bai <baijiaju@tsinghua.edu.cn> Signed-off-by:
-
Jan Pieter van Woerkom authored
MyGica T230* receivers also do DVB-C and DVB-T: change their names. Signed-off-by:
Jan Pieter van Woerkom <jp@jpvw.nl> Signed-off-by:
-
Arnd Bergmann authored
CONFIG_DVB_USB_CXUSB_ANALOG is a 'bool' symbol with a dependency on the tristate CONFIG_VIDEO_V4L2, which means it can be enabled as =y even when its dependency is =m. This leads to a link failure: drivers/media/usb/dvb-usb/cxusb-analog.o: In function `cxusb_medion_analog_init': cxusb-analog.c:(.text+0x92): undefined reference to `v4l2_subdev_call_wrappers' drivers/media/usb/dvb-usb/cxusb-analog.o: In function `cxusb_medion_register_analog': cxusb-analog.c:(.text+0x466): undefined reference to `v4l2_device_register' cxusb-analog.c:(.text+0x4c3): undefined reference to `v4l2_i2c_new_subdev' cxusb-analog.c:(.text+0x4fb): undefined reference to `v4l2_subdev_call_wrappers' ... Change the dependency only disallow the analog portion of the driver in that configuration. Fixes: e478d405 ("media: cxusb: add analog mode support for Medion MD95700") Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
Sean Young authored
This has been maintained for some time, update MAINTAINERS to reflect. Signed-off-by:
-
Sean Young authored
The IR Droid / IR Toy device used custom protocol over serial line, so it is presenting itself as CDC ACM device. Now that we have proper in-kernel driver for it we need to black-list the device in cdc-acm driver. http://dangerousprototypes.com/docs/USB_Infrared_Toy https://www.irdroid.com/irdroid-usb-ir-transceiver/Acked-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
-
Sean Young authored
http://dangerousprototypes.com/docs/USB_Infrared_Toy https://www.irdroid.com/irdroid-usb-ir-transceiver/Reviewed-by:
-
Mauro Carvalho Chehab authored
The media documents under the uAPI should be GFDL compatible. So, make this one dual-licensed GPL-2.0 or GFDL-1.1+ with no-invariant sections. Signed-off-by:
Tomasz Figa <tfiga@chromium.org> Signed-off-by:
-
Hans Verkuil authored
Setting the stateful encoder capture frame interval is only supported if this flag is set. Document this. Signed-off-by:
Michael Tretter <m.tretter@pengutronix.de> Acked-by:
-
Hans Verkuil authored
Add the V4L2_FMT_FLAG_ENC_CAP_FRAME_INTERVAL flag to signal that the coded frame interval can be set separately from the raw frame interval for stateful encoders. Signed-off-by:
-
Hans Verkuil authored
Add missing periods at the end of two sentences. Although mandatory -> Although not mandatory Signed-off-by:
-
Hans Verkuil authored
This documentation is very outdated. In particular, it is not obvious at all that this is used to change the framerate of sensors. Fix it, and include references to the stateful encoder API where this works slightly different. Signed-off-by:
-
Tomasz Figa authored
Due to complexity of the video encoding process, the V4L2 drivers of stateful encoder hardware require specific sequences of V4L2 API calls to be followed. These include capability enumeration, initialization, encoding, encode parameters change, drain and reset. Specifics of the above have been discussed during Media Workshops at LinuxCon Europe 2012 in Barcelona and then later Embedded Linux Conference Europe 2014 in Düsseldorf. The de facto Codec API that originated at those events was later implemented by the drivers we already have merged in mainline, such as s5p-mfc or coda. The only thing missing was the real specification included as a part of Linux Media documentation. Fix it now and document the encoder part of the Codec API. Signed-off-by:
-
Sergey Senozhatsky authored
Add a cache_hints module param to control per-queue user space cache hints support. Signed-off-by:
Sergey Senozhatsky <senozhatsky@chromium.org> Signed-off-by:
-
