- 12 Mar, 2020 21 commits
-
-
Marco Felsch authored
This patch adds the of_graph support to describe the tvp input connections. Physical the TVP5150 has three ports: AIP1A, AIP1B and YOUT. As result of discussion [1],[2] the device-tree maps these ports 1:1. Look at the Documentation for more information. Since the TVP5150 is a converter/bridge the device-tree must contain at least 1-input and 1-output port. The mc-connectors and mc-links are only created if the device-tree contains the corresponding connector nodes. If more than one connector is available the media_entity_operations.link_setup() callback ensures that only one connector is active. [1] https://www.spinics.net/lists/linux-media/msg138545.html [2] https://www.spinics.net/lists/linux-media/msg138546.htmlSigned-off-by:
Marco Felsch <m.felsch@pengutronix.de> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-
Javier Martinez Canillas authored
Commit f7b4b54e ("[media] tvp5150: add HW input connectors support") added input signals support for the tvp5150, but the approach was found to be incorrect so the corresponding DT binding commit 82c2ffeb ("[media] tvp5150: document input connectors DT bindings") was reverted. This left the driver with an undocumented (and wrong) DT parsing logic, so lets get rid of this code as well until the input connectors support is implemented properly. It's a partial revert due other patches added on top of mentioned commit not allowing the commit to be reverted cleanly anymore. But all the code related to the DT parsing logic and input entities creation are removed. Suggested-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
Javier Martinez Canillas <javierm@redhat.com> Acked-by:
Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Acked-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Marco Felsch authored
The patch adds the initial connector parsing code, so we can move from a driver specific parsing code to a generic one. Currently only the generic fields and the analog-connector specific fields are parsed. Parsing the other connector specific fields can be added by a simple callbacks. Signed-off-by:
-
Marco Felsch authored
Currently every driver needs to parse the connector endpoints by it self. This is the initial work to make this generic. A generic connector has common members and connector specific members. The common members are: - type - label (optional) - links - nr_of_links The specific members are stored within a union, since only one of them can be available at the time. Since this is the initial support the patch adds only the analog-connector specific ones. Signed-off-by:
-
Marco Felsch authored
A link is between two endpoints not between two ports to be more precise. Add the local_id/remote_id field which stores the endpoint reg/port property to the link. Now the link holds all necessary information about a link. Signed-off-by:
-
Marco Felsch authored
This helper was introduced before those helpers where awailable. Convert it to cleanup the code and improbe readability. Signed-off-by:
-
Marco Felsch authored
Currently the driver differentiate the port number property handling for ACPI and DT. This is wrong as because ACPI should use the "reg" val too [1]. [1] https://patchwork.kernel.org/patch/11421985/ Fixes: ca50c197 ("[media] v4l: fwnode: Support generic fwnode for parsing standardised properties") Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Marco Felsch authored
Since we expose the definition to the dt-bindings we need to keep those definitions in sync. To address this the patch adds a simple cross reference to the dt-bindings. Signed-off-by:
-
Marco Felsch authored
Add defines which can be included to easily describe the supported standard tv norms 'sdtv-standards' within the device tree. Signed-off-by:
-
Marco Felsch authored
Some connectors no matter if in- or output supports only a limited range of sdtv standards. It doesn't matter if the hardware behind that connector supports more than the listed formats since the users are restriced by a label e.g. to plug only a camera into this connector which uses the PAL format. This patch adds the capability to describe such limitation within the firmware. There are no format restrictions if the property isn't present, so it's completely backward compatible. Signed-off-by:
-
Changming Liu authored
When calling ccdc_data_size_max_bit() to validate data_sz in vpfe_ccdc_validate_param(), it's treated as an enumeration ranging from 0 to 7 while essentially it's an 32 bit unsigned integer directly from user space. This can make the return value of ccdc_data_size_max_bit() underflow and bypass the following check. To fix this, an additional check is added to the following if clause to keep this enumaration variable in range. And if its value is not legal, return -EINVAL properly. Signed-off-by:
Changming Liu <charley.ashbringer@gmail.com> Signed-off-by:
-
Benoit Parrot authored
After the switch to use v4l2_async_notifier_add_subdev() and v4l2_async_notifier_cleanup(), unloading the ti_cal module would cause a kernel oops. This was root cause to the fact that v4l2_async_notifier_cleanup() tries to kfree the asd pointer passed into v4l2_async_notifier_add_subdev(). In our case the asd reference was from a statically allocated struct. So in effect v4l2_async_notifier_cleanup() was trying to free a pointer that was not kalloc. So here we switch to using a kzalloc struct instead of a static one. To achieve this we re-order some of the calls to prevent asd allocation from leaking. Fixes: d079f94c ("media: platform: Switch to v4l2_async_notifier_add_subdev") Cc: stable@vger.kernel.org Signed-off-by:
Benoit Parrot <bparrot@ti.com> Reviewed-by:
Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by:
-
Hsin-Yi Wang authored
Previously, vpu->recv_buf and send_buf are forced cast from void __iomem *tcm. vpu->recv_buf->share_buf is passed to vpu_ipi_desc.handler(). It's not able to do unaligned access. Otherwise kernel would crash due to unable to handle kernel paging request. struct vpu_run { u32 signaled; char fw_ver[VPU_FW_VER_LEN]; unsigned int dec_capability; unsigned int enc_capability; wait_queue_head_t wq; }; fw_ver starts at 4 byte boundary. If system enables CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, strscpy() will do read_word_at_a_time(), which tries to read 8-byte: *(unsigned long *)addr vpu_init_ipi_handler() calls strscpy(), which would lead to crash. vpu_init_ipi_handler() and several other handlers (eg. vpu_dec_ipi_handler) only do read access to this data, so they can be const, and we can use memcpy_fromio() to copy the buf to another non iomem buffer then pass to handler. Fixes: 85709cbf ("media: replace strncpy() by strscpy()") Signed-off-by:Hsin-Yi Wang <hsinyi@chromium.org> Signed-off-by:
-
Jeffrey Kardatzke authored
Add encoder control for enabling/disabling frame rate control via V4L2_CID_MPEG_VIDEO_FRAME_RC_ENABLE. It is enabled by default. Signed-off-by:
Jeffrey Kardatzke <jkardatzke@google.com> Signed-off-by:
Stanimir Varbanov <stanimir.varbanov@linaro.org> Signed-off-by:
-
Stanimir Varbanov authored
This fixes the following smatch warning in the error path: drivers/media/platform/qcom/venus/vdec.c:968 vdec_start_streaming() warn: inconsistent returns 'mutex:&inst->lock'. Locked on: line 952 Unlocked on: line 963 line 968 by goto mutex unlock. Signed-off-by: -
Colin Ian King authored
The variable gate is being initialized and also checked and re-assigned with values that are never read as it is being re-assigned later in a for-loop with a new value. The assignments are redundant and can be removed. Addresses Coverity ("Unused value") Signed-off-by:Colin Ian King <colin.king@canonical.com> Signed-off-by:
Sean Young <sean@mess.org> Signed-off-by:
-
Colin Ian King authored
The shifting of buf[3] by 24 bits to the left will be promoted to a 32 bit signed int and then sign-extended to an unsigned long. In the unlikely event that the the top bit of buf[3] is set then all then all the upper bits end up as also being set because of the sign-extension and this affect the ev->post_bit_error sum. Fix this by using the temporary u32 variable bit_error to avoid the sign-extension promotion. This also removes the need to do the computation twice. Addresses-Coverity: ("Unintended sign extension") Fixes: 267897a4 ("[media] tda10071: implement DVBv5 statistics") Signed-off-by: -
Brad Love authored
This is required to support the Terratec S2 USB Box Revision 4, which reused usb vid:pid, but has a different demodulator (m88ds3103b) at i2c address 0x6a. [fixed checkpatch issues] Signed-off-by:
Michael Bunk <micha@freedict.org> Signed-off-by:
Brad Love <brad@nextdimension.cc> Signed-off-by:
-
Brad Love authored
Hauppauge 461e rev2 is a DVB-S/S2 usb device containing: - m88ds3103b demod - ts2022 tuner - A8293 SEC Device is the same as Hauppauge 461e, except it contains updated m88ds3103b demod. Signed-off-by:
-
Brad Love authored
The ds3103b demodulator identifies as an m88rs600, but requires different clock settings and firmware, along with differences in register settings. Changes were reverse engineered using an instrumented downstream GPLv2 driver to compare i2c traffic and clocking. The mclk functions are from the downstream GPLv2 driver. Signed-off-by:
-
Sean Young authored
There are many protocols that encode more than 32 bit. We want 64 bit support so that BPF IR decoders can decode more than 32 bit. None of the existing kernel IR decoders/encoders support 64 bit, for now. The MSC_SCAN event can only contain 32 bit scancodes, so we only generate MSC_SCAN events if the scancode fits into 32 bits. The full 64 bit scancode can be read from the lirc chardev. Signed-off-by:
-
- 05 Mar, 2020 19 commits
-
-
Maxime Jourdan authored
This adds VP9 decoding for the Amlogic GXL, G12A & SM1 SoCs, using the commong "HEVC" HW decoder. For G12A & SM1, it uses the IOMMU support from the firmware. For 10bit decoding, the firmware can only decode in the proprietary Amlogic Framebuffer Compression format, but can output in 8bit NV12 buffer while writing the decoded frame. Signed-off-by:
Maxime Jourdan <mjourdan@baylibre.com> Signed-off-by:
Neil Armstrong <narmstrong@baylibre.com> Tested-by:
Kevin Hilman <khilman@baylibre.com> Signed-off-by:
-
Maxime Jourdan authored
Amlogic VP9 decoder requires an additional 16-byte payload before every frame header. The source buffer is updated in-place, then given to the Parser FIFO DMA. The FIFO DMA copies the blocks into the 16MiB parser ring buffer, then parses and copies the slice into the decoder "workspace". Signed-off-by:
-
Maxime Jourdan authored
Add support for the HEVC & VP9 common decoder support, handling Amlogic GXBB, GXL, G12A and SM1 platforms. This handles the "HEVC" hw decoder used for HEVC and VP9, and will be using in the new H264 multi-instance decoder for G12A & SM1 platforms. Signed-off-by:
-
Maxime Jourdan authored
Add helpers to support the lossless framebuffer compression format that will be used in HEVC & VP9 decoders when decoding 10bit content for downsampling to 8bit NV12 and later proper compressed buffer support. Signed-off-by:
-
Neil Armstrong authored
The HEVC/VP9 aligns the plane stride on 32, so align the planes stride for all codecs to 32 to satisfy HEVC/VP9 decoding using the "HEVC" HW. This fixes VP9 decoding of streams with following (not limited) widths: - 264 -288 - 350 - 352 - 472 - 480 - 528 - 600 - 720 - 800 - 848 - 1440 Signed-off-by:
-
Maxime Jourdan authored
Add support for the H264 compressed format (V4L2_PIX_FMT_H264). Signed-off-by:
-
Maxime Jourdan authored
Add all the necessary bits to pass v4l2-compliance in stateful decoding mode. Mostly includes tracking the state of the decoder, allowing the OUTPUT queue to stream while the CAPTURE queue is inactive, handling resolution change events, draining with V4L2_DEC_CMD_STOP, copying more metadata from the src buffers to the dst buffers, etc. Signed-off-by:
-
Neil Armstrong authored
Use the previously introduced v4l2-mem2mem core APIs to handle the drainig, stopped and next-buf-is-last states. With these changes, the v4l2-compliance still passes with the following commands : >>>><><><><><><><><><><><><><><><><>< 15.53 fps 15.53 fps ><><><><><><><><><><><><>< 13.99 fps 13.99 fps ><><><><><><><><><><><>< 13.52 fps 13.52 fps ><><><><><><><><><><><><>< 13.41 fps 13.41 fps ><><><><><><><><><><><><>< 13.21 fps 13.21 fps ><><><><><><><><><><><>< 13.09 fps 13.09 fps ><><><><><><>< STOP ENCODER <<< EOS EVENT v4l2-compliance SHA: 7ead0e1856b89f2e19369af452bb03fd0cd16793, 64 bits [...] Total for vicodec device /dev/video0: 50, Succeeded: 50, Failed: 0, Warnings: 0 The full output is available at [1] v4l2-compliance SHA: 7ead0e1856b89f2e19369af452bb03fd0cd16793, 64 bits [...] Total for vicodec device /dev/video1: 50, Succeeded: 50, Failed: 0, Warnings: 0 The full output is available at [2] No functional changes should be noticed. [1] https://termbin.com/25nn [2] https://termbin.com/dza4Suggested-by:
-
Neil Armstrong authored
Since the draining and stop phase of the HW decoder mem2mem bahaviour is now clearly defined, we can move handling of the following states to the common v4l2-mem2mem core code: - draining - stopped - next-buf-is-last By introducing the following v4l2-mem2mem APIs: - v4l2_m2m_encoder_cmd/v4l2_m2m_ioctl_encoder_cmd to handle start/stop command - v4l2_m2m_decoder_cmd/v4l2_m2m_ioctl_decoder_cmd to handle start/stop command - v4l2_m2m_update_start_streaming_state to update state on start of streaming of the de/encoder queue - v4l2_m2m_update_stop_streaming_state to update state on stop of streaming of the de/encoder queue - v4l2_m2m_last_buffer_done to make the current dest buffer as the last one And inline helpers: - v4l2_m2m_mark_stopped to mark the de/encoding process as stopped - v4l2_m2m_clear_state to clear the de/encoding state - v4l2_m2m_dst_buf_is_last to detect the current dequeued dst_buf is the last - v4l2_m2m_has_stopped to detect the de/encoding stopped state - v4l2_m2m_is_last_draining_src_buf to detect the current source buffer should be the last processing before stopping the de/encoding process The special next-buf-is-last when min_buffers != 1 case is also handled in v4l2_m2m_qbuf() by reusing the other introduced APIs. This state management has been stolen from the vicodec implementation, and is no-op for drivers not calling the v4l2_m2m_encoder_cmd or v4l2_m2m_decoder_cmd and v4l2_m2m_update_start/stop_streaming_state. The vicodec will be the first one to be converted as an example. Signed-off-by:
-
Hans Verkuil authored
When the request is completed, all controls are copied to the request object. However, when VIDIOC_G_EXT_CTRLS attempts to read control values from the request it will read the current value instead for any control reference that has a NULL ref->req pointer. But that's wrong: after completing the request *all* controls should have a non-NULL ref->req pointer since they are after all copied to the request. So set ref->req if it wasn't set already. Signed-off-by:
Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by:
-
YueHaibing authored
VIDEO_USBVISION driver depends on MEDIA_USB_SUPPORT Fixes: 8fb12ce2 ("media: usbvision: deprecate driver") Reported-by:
Hulk Robot <hulkci@huawei.com> Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Signed-off-by:
-
Dmitry Osipenko authored
There is a new devm_platform_ioremap_resource_byname() helper in the kernel now, which helps to make code cleaner a tad by replacing few "boilerplate" lines of code with a single line. Let's utilize that new helper in the VDE driver. Signed-off-by:
Dmitry Osipenko <digetx@gmail.com> Reviewed-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
Benoit Parrot authored
disable_irqs() was mistakenly disabling all interrupts when called. This cause all port stream to stop even if only stopping one of them. Cc: stable <stable@vger.kernel.org> Signed-off-by:
-
Steve Longerbeam authored
Unlike the PRPENC and PRPVF subdevices, the CSI's cannot convert quantization from sink to source, or do any kind of Y'CbCr <-> RGB encoding. So the CSI's cannot allow quantization and ycbcr_enc to be selectable by the user and must be propagated from sink to source. Fixes: 4791bd7d ("media: imx: Try colorimetry at both sink and source pads") Reported-by:
Tim Harvey <tharvey@gateworks.com> Signed-off-by:
Steve Longerbeam <slongerbeam@gmail.com> Tested-by:
Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by:
-
Jonathan Neuschäfer authored
The new syntax is available since commit 43756e34 ("scripts/kernel-doc: Add support for named variable macro arguments"). The same HTML output is produced with and without this patch. Signed-off-by:
Jonathan Neuschäfer <j.neuschaefer@gmx.net> Signed-off-by:
-
Sergiu Cuciurean authored
In a recent change to the SPI subsystem [1], a new `delay` struct was added to replace the `delay_usecs`. This change replaces the current `delay_usecs` with `delay` for this driver. The `spi_transfer_delay_exec()` function [in the SPI framework] makes sure that both `delay_usecs` & `delay` are used (in this order to preserve backwards compatibility). [1] commit bebcfd27 ("spi: introduce `delay` field for `spi_transfer` + spi_transfer_delay_exec()") Signed-off-by:
Sergiu Cuciurean <sergiu.cuciurean@analog.com> Signed-off-by:
-
Eugen Hristev authored
The entity variable was being initialized in the wrong place, before the parameters have been checked. To solve this, completely removed the entity variable and replaced it with the initialization value : &sd->entity. This will avoid dereferencing 'sd' pointer before it's being checked if it's NULL. Fixes: 61f5db54 ("[media] v4l: Make v4l2_subdev inherit from media_entity") Signed-off-by:
Eugen Hristev <eugen.hristev@microchip.com> Acked-by:
-
Dafna Hirschfeld authored
sd->devnode is released after calling v4l2_subdev_release. Therefore it should be set to NULL so that the subdev won't hold a pointer to a released object. This fixes a reference after free bug in function v4l2_device_unregister_subdev Fixes: 0e43734d ("media: v4l2-subdev: add release() internal op") Cc: stable@vger.kernel.org Signed-off-by:
Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Reviewed-by:
Ezequiel Garcia <ezequiel@collabora.com> Signed-off-by:
-
Dafna Hirschfeld authored
A use-after-free bug occures when unbinding the device while it streams. The 'struct vimc_ent_device' allocated for the 'Sensor A' is freed when calling the sensor's 'rm' callback but the freed pointer is later accessed in the function 'vimc_streamer_pipeline_terminate'. To fix this bug, move the release callback of the vimc entities and vimc_device to the release callback of v4l2_device. The .rm callback of vimc_ent_config is replaced by two callbacks: .unregister - this is called upon removing the device and it unregisters the entity. This is an optional callback since subdevices don't need to implement it because they are already unregistered in v4l2_device_unregister. .release - this is called from the release callback of v4l2_device and it frees the entity. This ensures that the entities will be released when the last fh of any of the devices is closed. The commands that cause the crash and the KASAN report: media-ctl -d platform:vimc -V '"Sensor A":0[fmt:SBGGR8_1X8/640x480]' media-ctl -d platform:vimc -V '"Debayer A":0[fmt:SBGGR8_1X8/640x480]' v4l2-ctl -z platform:vimc -d "RGB/YUV Capture" -v width=1920,height=1440 v4l2-ctl -z platform:vimc -d "Raw Capture 0" -v pixelformat=BA81 v4l2-ctl --stream-mmap --stream-count=1000 -d /dev/video2 & sleep 1 echo -n vimc.0 >/sys/bus/platform/drivers/vimc/unbind [ 188.417934] BUG: KASAN: use-after-free in vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.420182] Read of size 8 at addr ffff8881e9c26008 by task bash/185 [ 188.421800] [ 188.422223] CPU: 0 PID: 185 Comm: bash Not tainted 5.5.0-rc1+ #1 [ 188.423681] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 188.425938] Call Trace: [ 188.426610] dump_stack+0x75/0xa0 [ 188.427519] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.429057] print_address_description.constprop.6+0x16/0x220 [ 188.430462] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.431979] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.433455] __kasan_report.cold.9+0x1a/0x40 [ 188.434518] ? vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.436010] kasan_report+0xe/0x20 [ 188.436859] vimc_streamer_pipeline_terminate+0x75/0x140 [vimc] [ 188.438339] vimc_streamer_s_stream+0x8b/0x3c0 [vimc] [ 188.439576] vimc_cap_stop_streaming+0x22/0x40 [vimc] [ 188.440863] __vb2_queue_cancel+0x65/0x560 [videobuf2_common] [ 188.442391] vb2_core_queue_release+0x19/0x50 [videobuf2_common] [ 188.443974] vimc_cap_rm+0x10/0x20 [vimc] [ 188.444986] vimc_rm_subdevs+0x9e/0xe0 [vimc] [ 188.446179] vimc_remove+0x19/0x70 [vimc] [ 188.447301] platform_drv_remove+0x2f/0x50 [ 188.448468] device_release_driver_internal+0x133/0x260 [ 188.449814] unbind_store+0x121/0x150 [ 188.450726] kernfs_fop_write+0x142/0x230 [ 188.451724] ? sysfs_kf_bin_read+0x100/0x100 [ 188.452826] vfs_write+0xdc/0x230 [ 188.453760] ksys_write+0xaf/0x140 [ 188.454702] ? __ia32_sys_read+0x40/0x40 [ 188.455773] ? __do_page_fault+0x473/0x620 [ 188.456780] do_syscall_64+0x5e/0x1a0 [ 188.457711] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 188.459079] RIP: 0033:0x7f80f1f13504 [ 188.459969] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 48 8d 05 f9 61 0d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53 [ 188.464445] RSP: 002b:00007ffd7e843b58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 188.466276] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f80f1f13504 [ 188.467999] RDX: 0000000000000006 RSI: 000055ef2eb21b10 RDI: 0000000000000001 [ 188.469708] RBP: 000055ef2eb21b10 R08: 00007f80f1fe68c0 R09: 00007f80f1e26740 [ 188.471407] R10: 000055ef2eade010 R11: 0000000000000246 R12: 00007f80f1fe5760 [ 188.473381] R13: 0000000000000006 R14: 00007f80f1fe0760 R15: 0000000000000006 [ 188.475107] [ 188.475500] Allocated by task 473: [ 188.476351] save_stack+0x19/0x80 [ 188.477201] __kasan_kmalloc.constprop.6+0xc1/0xd0 [ 188.478507] vimc_sen_add+0x36/0x309 [vimc] [ 188.479649] vimc_probe+0x1e2/0x530 [vimc] [ 188.480776] platform_drv_probe+0x46/0xa0 [ 188.481829] really_probe+0x16c/0x520 [ 188.482732] driver_probe_device+0x114/0x170 [ 188.483783] device_driver_attach+0x85/0x90 [ 188.484800] __driver_attach+0xa8/0x190 [ 188.485734] bus_for_each_dev+0xe4/0x140 [ 188.486702] bus_add_driver+0x223/0x2d0 [ 188.487715] driver_register+0xca/0x140 [ 188.488767] 0xffffffffc037003d [ 188.489635] do_one_initcall+0x86/0x28f [ 188.490702] do_init_module+0xf8/0x340 [ 188.491773] load_module+0x3766/0x3a10 [ 188.492811] __do_sys_finit_module+0x11a/0x1b0 [ 188.494059] do_syscall_64+0x5e/0x1a0 [ 188.495079] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 188.496481] [ 188.496893] Freed by task 185: [ 188.497670] save_stack+0x19/0x80 [ 188.498493] __kasan_slab_free+0x125/0x170 [ 188.499486] kfree+0x8c/0x230 [ 188.500254] v4l2_subdev_release+0x64/0x70 [videodev] [ 188.501498] v4l2_device_release_subdev_node+0x1c/0x30 [videodev] [ 188.502976] device_release+0x3c/0xd0 [ 188.503867] kobject_put+0xf4/0x240 [ 188.507802] vimc_rm_subdevs+0x9e/0xe0 [vimc] [ 188.508846] vimc_remove+0x19/0x70 [vimc] [ 188.509792] platform_drv_remove+0x2f/0x50 [ 188.510752] device_release_driver_internal+0x133/0x260 [ 188.512006] unbind_store+0x121/0x150 [ 188.512899] kernfs_fop_write+0x142/0x230 [ 188.513874] vfs_write+0xdc/0x230 [ 188.514698] ksys_write+0xaf/0x140 [ 188.515523] do_syscall_64+0x5e/0x1a0 [ 188.516543] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 188.517710] [ 188.518034] The buggy address belongs to the object at ffff8881e9c26000 [ 188.518034] which belongs to the cache kmalloc-4k of size 4096 [ 188.520528] The buggy address is located 8 bytes inside of [ 188.520528] 4096-byte region [ffff8881e9c26000, ffff8881e9c27000) [ 188.523015] The buggy address belongs to the page: [ 188.524357] page:ffffea0007a70800 refcount:1 mapcount:0 mapping:ffff8881f6402140 index:0x0 compound_mapcount: 0 [ 188.527058] raw: 0200000000010200 dead000000000100 dead000000000122 ffff8881f6402140 [ 188.528983] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 188.530883] page dumped because: kasan: bad access detected [ 188.532336] [ 188.532720] Memory state around the buggy address: [ 188.533871] ffff8881e9c25f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 188.535631] ffff8881e9c25f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 188.537370] >ffff8881e9c26000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 188.538996] ^ [ 188.539812] ffff8881e9c26080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 188.541549] ffff8881e9c26100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Signed-off-by:
-
