- 25 Nov, 2022 40 commits
-
-
Baisong Zhong authored
Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer(). Link: https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpqV+p8mPLNg-Fok0gw8gZ=zemAfMGTzMg@mail.gmail.com/ Link: https://lore.kernel.org/linux-media/20221120065918.2160782-1-zhongbaisong@huawei.com Fixes: 76f9a820 ("V4L/DVB: AZ6027: Initial import of the driver") Reported-by:
Wei Chen <harperchen1110@gmail.com> Signed-off-by:
Baisong Zhong <zhongbaisong@huawei.com> Signed-off-by:
Mauro Carvalho Chehab <mchehab@kernel.org>
-
Chen Zhongjin authored
In dvb_register_frontend(), dvb_register_device() is possible to fail but its return value is ignored. It will cause use-after-free when module is removed, because in dvb_unregister_frontend() it tries to unregister a not registered device. BUG: KASAN: use-after-free in dvb_remove_device+0x18b/0x1f0 [dvb_core] Read of size 4 at addr ffff88800dff4824 by task rmmod/428 CPU: 3 PID: 428 Comm: rmmod Call Trace: <TASK> ... dvb_remove_device+0x18b/0x1f0 [dvb_core] dvb_unregister_frontend+0x7b/0x130 [dvb_core] vidtv_bridge_remove+0x6e/0x160 [dvb_vidtv_bridge] ... Fix this by catching return value of dvb_register_device(). However the fe->refcount can't be put to zero immediately, because there are still modules calling dvb_frontend_detach() when dvb_register_frontend() fails. Link: https://lore.kernel.org/linux-media/20221108033005.169095-1-chenzhongjin@huawei.com Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:
Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by:
-
Yuan Can authored
After commit 5e9c85d9("[media] dib8096: enhancement"), no one use struct dibx090p_adc, so remove it. Link: https://lore.kernel.org/linux-media/20220927133827.99097-1-yuancan@huawei.comSigned-off-by:
Yuan Can <yuancan@huawei.com> Signed-off-by:
-
Gaosheng Cui authored
The dvb_usb_dib0700_ir_proto has been removed by commit 0ffd1ab3 ("V4L/DVB: dib0700: properly implement IR change_protocol"), so remove the orphan declaration. Link: https://lore.kernel.org/linux-media/20220920015902.785337-1-cuigaosheng1@huawei.comSigned-off-by:
Gaosheng Cui <cuigaosheng1@huawei.com> Signed-off-by:
-
Mazin Al Haddad authored
Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapter->priv in case of an error. Currently if an error occurs, it will exit before incrementing "num_adapters_initalized", which is used as a reference counter to free all adap->priv in "dvb_usb_adapter_exit()". There are multiple error paths that can exit from before incrementing the counter. Including the error handling paths for "dvb_usb_adapter_stream_init()", "dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()" within "dvb_usb_adapter_init()". This means that in case of an error in any of these functions the current iteration is not accounted for and the current iteration's adap->priv is not freed. Fix this by freeing the current iteration's adap->priv in the "stream_init_err:" label in the error path. The rest of the (accounted for) adap->priv objects are freed in dvb_usb_adapter_exit() as expected using the num_adapters_initalized variable. Syzbot report: BUG: memory leak unreferenced object 0xffff8881172f1a00 (size 512): comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff844af012>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline] [<ffffffff844af012>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline] [<ffffffff844af012>] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308 [<ffffffff830db21d>] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883 [<ffffffff82d3fdc7>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 [<ffffffff8274af6a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782 [<ffffffff8274b786>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899 [<ffffffff82747c87>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [<ffffffff8274b352>] __device_attach+0x122/0x260 drivers/base/dd.c:970 [<ffffffff827498f6>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [<ffffffff82745cdb>] device_add+0x5fb/0xdf0 drivers/base/core.c:3405 [<ffffffff82d3d202>] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170 [<ffffffff82d4dbfc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<ffffffff82d3f49c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 Link: https://syzkaller.appspot.com/bug?extid=f66dd31987e6740657be Reported-and-tested-by: syzbot+f66dd31987e6740657be@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-media/20220824012152.539788-1-mazinalhaddad05@gmail.comSigned-off-by:Mazin Al Haddad <mazinalhaddad05@gmail.com> Signed-off-by:
-
Lin Ma authored
dvb_unregister_device() is known that prone to use-after-free. That is, the cleanup from dvb_unregister_device() releases the dvb_device even if there are pointers stored in file->private_data still refer to it. This patch adds a reference counter into struct dvb_device and delays its deallocation until no pointer refers to the object. Link: https://lore.kernel.org/linux-media/20220807145952.10368-1-linma@zju.edu.cnSigned-off-by:
Lin Ma <linma@zju.edu.cn> Reported-by:
kernel test robot <lkp@intel.com> Signed-off-by:
-
wangjianli authored
Delete the redundant word 'in'. Link: https://lore.kernel.org/linux-media/20220724073242.15279-1-wangjianli@cdjrlc.comSigned-off-by:
wangjianli <wangjianli@cdjrlc.com> Signed-off-by:
-
YongSu Yoo authored
The function dvb_ringbuffer_pkt_next in /linux-next/drviers/media/dvb-core/dvb_ringbuffer.c, which searches the idx of the next valid packet in the ring buffer of the ca->slot_info[slot].rx_buffer at /linux-next/drivers/media/dvb-core/dvb_ca_en50221.c, has the following problem. In calculating the amounts of the consumed address of the ring buffer, if the read address(rbuf->pread) of the ring buffer is smaller than the idx, the amounts of the searched address should be (idx - rbuf->pread), whereas if the read address(rbuf->pread) of the ring buffer is larger than the idx, the amounts of the consumed address should be (idx - rbuf->pread + rbug->size). But there exists an incorrect logic that the rbug-size was not properly added on (idx - rbug->pread) in the later case. With this commit, we fixed this bug. Link: https://lore.kernel.org/linux-media/20220623103543.4138-1-yongsuyoo0215@gmail.comSigned-off-by:
Yongsu Yoo <yongsuyoo0215@gmail.com> Signed-off-by:
-
Lecopzer Chen authored
MANTIS_CORE needs DVB_CORE, set 'depends on' explicitly ERROR: modpost: "dvb_dmx_init" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_unregister_adapter" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_register_frontend" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_ca_en50221_camchange_irq" [drivers/media/pci/mantis/mantis_core.ko] undefined! ERROR: modpost: "dvb_unregister_frontend" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_ca_en50221_camready_irq" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_frontend_detach" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_dmxdev_release" [drivers/media/pci/mantis/mantis_core.ko] undefined! >> ERROR: modpost: "dvb_dmx_swfilter" [drivers/media/pci/mantis/mantis_core.ko] undefined! Link: https://lore.kernel.org/linux-media/20220516171515.16404-2-lecopzer.chen@mediatek.comReported-by:
Lecopzer Chen <lecopzer.chen@mediatek.com> Signed-off-by:
-
Keita Suzuki authored
In function dvb_register_device() -> dvb_register_media_device() -> dvb_create_media_entity(), dvb->entity is allocated and initialized. If the initialization fails, it frees the dvb->entity, and return an error code. The caller takes the error code and handles the error by calling dvb_media_device_free(), which unregisters the entity and frees the field again if it is not NULL. As dvb->entity may not NULLed in dvb_create_media_entity() when the allocation of dvbdev->pad fails, a double free may occur. This may also cause an Use After free in media_device_unregister_entity(). Fix this by storing NULL to dvb->entity when it is freed. Link: https://lore.kernel.org/linux-media/20220426052921.2088416-1-keitasuzuki.park@sslab.ics.keio.ac.jp Fixes: fcd5ce4b ("media: dvb-core: fix a memory leak bug") Cc: stable@vger.kernel.org Cc: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by:
Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp> Signed-off-by:
-
Colin Ian King authored
Variable ret is being ininitialized with a value that is never read. The ininitializtion is redundant and can be removed. Move the variable to the scope it is required. Link: https://lore.kernel.org/linux-media/20220424154720.1356873-1-colin.i.king@gmail.comSigned-off-by:
Colin Ian King <colin.i.king@gmail.com> Signed-off-by:
-
Yan Lei authored
Link: https://lore.kernel.org/linux-media/20220410061925.4107-1-chinayanlei2002@163.comSigned-off-by:
Yan Lei <yan_lei@dahuatech.com> Signed-off-by:
-
Wan Jiabing authored
Clean up unneeded 'else'. Link: https://lore.kernel.org/linux-media/20220408092831.45755-1-wanjiabing@vivo.comSigned-off-by:
Wan Jiabing <wanjiabing@vivo.com> Signed-off-by:
-
Robert Schlabbach authored
Drivers for devices with multiple frontends which cannot be used concurrently due to hardware limitations which enforce that restriction by setting the mfe_shared field to 1 exhibit rather unfriendly behavior towards applications: The unavailable frontend devices cannot be opened at all, not even for read-only access to query information. Even worse, any open call is blocked for 5 seconds by default. Allow drivers for such devices to behave like regular busy frontend devices instead, i.e. still allowing concurrent read access to the unavailable frontend and denying concurrent write access with -EBUSY without delay. This patch does not alter the behavior of any existing driver to avoid regressions. Driver developers who wish to take advantage of this must ensure their driver can handle all read-only accesses to the unavailable frontend, and indicate the capability by setting the mfe_shared field to 2 instead of 1. Add a check to dvb-usb-init.c when automatically setting the mfe_shared field that when a driver has already set the field to 2, it is not overwritten. Document the additional capability in the code comment about mfe_shared. Link: https://lore.kernel.org/linux-media/trinity-22c77578-26b0-4867-9ff7-2668e5d22c64-1642799929896@3c-app-gmx-bap04Signed-off-by:
Robert Schlabbach <robert_s@gmx.net> Tested-by:
-
Robert Schlabbach authored
Extend the DVB frontend parameter enums with additional values specified by the DVB-C2 (ETSI EN 302 769) and DVB-S2X (ETSI EN 302 307-2) standards to be ready for frontend drivers for such receivers. While most parameters will be "read-only" due to being autodetected by the receiver and only being reported back for informational purposes, the addition of SYS_DVBC2 to the delivery systems enum is required, because there are DVB-C2 capable receivers which are not capable of DVB-C/C2 autodetection and thus need this enum value to be explicitly instructed to search for a DVB-C2 signal. As for DVB-S2X, as that is an extension to DVB-S2, the same delivery system enum as for DVB-S2 can be used. Add the additional enum values and comments to the documentation. Link: https://lore.kernel.org/linux-media/trinity-1b7c5a66-85d4-4595-a690-0fde965d49b3-1642146228587@3c-app-gmx-bap69Signed-off-by:
-
Robert Schlabbach authored
While the documentation mentions the delivery system DSS as a satellite system, it was missing from all but one switch statement in the DVB frontend code, leading to tuning failures, because the frequency was not correctly handled as being in kHz rather than Hz. Add the missing switch cases so that DSS is handled like the other satellite systems. For the rolloff, assume 0.20 as per one publication found via Internet search. Link: https://lore.kernel.org/linux-media/trinity-5f5afda9-657a-4a91-bf15-842f4f249535-1641958421391@3c-app-gmx-bap21Signed-off-by:
-
Chuck Ritola authored
Fixes a8293 failure to raise LNB voltage in PCTV 461e DVB-S2 Stick affecting multiple users over several years as found here: http://www.linuxquestions.org/questions/linux-hardware-18/pctv-dvb-s2-stick-461e-not-feeding-lnb-4175529374/ https://www.linuxtv.org/wiki/index.php/Pinnacle_PCTV_DVB-S2_Stick_(461e) https://github.com/OpenELEC/OpenELEC.tv/issues/3731 Caused by vIN undervoltage lockout (status register bit 7) when raising LNB to 18V. Addressed by using the higher-precision voltages available on the a8293 to gradually increase (slew) the voltage when voltage increases are requested. Adds volt_slew_nanos_per_mv to a8293_platform_data struct for specifying slew rate. If value is <1 or non-sane (>1600), the original no-slew version for a8293_set_voltage is used. Link: https://lore.kernel.org/linux-media/20211231035326.6759-1-cjritola@gmail.com [mchehab: fixed some coding style issues] Signed-off-by:
Chuck Ritola <cjritola@gmail.com> Signed-off-by:
-
Geert Uytterhoeven authored
There is no such error code EVINAL. Link: https://lore.kernel.org/linux-media/270f5b7f79a24dc1a3e81d94f6f54fc0f08daf56.1639732105.git.geert+renesas@glider.beSigned-off-by:
Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by:
-
Lukas Bulwahn authored
Commit 9958d30f ("media: Kconfig: cleanup VIDEO_DEV dependencies") removes the config VIDEO_V4L2 as it is merged with config VIDEO_DEV. Long after this change, commit 38fc5136 ("media: i2c: Add ov08x40 image sensor driver") introduces and refers to the removed config VIDEO_V4L2, basically making this driver impossible to build, test and use due to dependencies that cannot be met. Refer to config VIDEO_DEV instead to make this driver usable. Signed-off-by:
Lukas Bulwahn <lukas.bulwahn@gmail.com> Fixes: 38fc5136 ("media: i2c: Add ov08x40 image sensor driver") Reviewed-by:
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
-
Kieran Bingham authored
In commit ed5c2f5f ("i2c: Make remove callback return void") drivers were updated to remove the return value of the remove callback, and return void. The OV08x40 was added after this commit but was not compile tested at the time due to a KConfig issue, and this warning was missed. Reported-by:
-
Benjamin Mugnier authored
Fix some 'vgxy61_write_reg' return vars not being signed int. Fix 'expo_long_max' not being initialized. Handle 'pm_runtime_get_sync' call that can return 1. Reported-by:
Dan Carpenter <error27@gmail.com> Signed-off-by:
Benjamin Mugnier <benjamin.mugnier@foss.st.com> Signed-off-by:
-
Benjamin Mugnier authored
Fixes: 2378be89 ("media: Documentation: Add ST VGXY61 driver documentation") Reported-by:
-
Benjamin Mugnier authored
Signed-off-by:
-
Benjamin Mugnier authored
Signed-off-by:
-
Lad Prabhakar authored
Add v4l driver for Renesas RZ/G2L Camera data Receiving Unit. Based on a patch in the BSP by Hien Huynh <hien.huynh.px@renesas.com> Signed-off-by:
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Signed-off-by:
-
Lad Prabhakar authored
Add MIPI CSI-2 receiver driver for Renesas RZ/G2L. The MIPI CSI-2 is part of the CRU module found on RZ/G2L family. Based on a patch in the BSP by Hien Huynh <hien.huynh.px@renesas.com> Signed-off-by:
-
Lad Prabhakar authored
Document the CRU block found on Renesas RZ/G2L (and alike) SoCs. Signed-off-by:
Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by:
Rob Herring <robh@kernel.org> Signed-off-by:
-
Lad Prabhakar authored
Document the CSI-2 block which is part of CRU found in Renesas RZ/G2L (and alike) SoCs. Signed-off-by:
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by:
-
Jacopo Mondi authored
Align some register and constant definitions using tab in place of mixed tab+spaces. Cosmetic change only. Signed-off-by:
Jacopo Mondi <jacopo@jmondi.org> Reviewed-by:
Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Jacopo Mondi authored
The ar0521_write_mode() function explicitly programs the exposure time register and the test pattern register, which are now setup by the call to __v4l2_ctrl_handler_setup() in ar0521_set_stream(). Removing those register writes from ar0521_write_mode() reduces the function to two operations: geometry configuration and pll configuration. Move geomerty configuration in the ar0521_set_stream() caller and rename ar0521_write_mode() to ar0521_pll_config(). Signed-off-by:
-
Jacopo Mondi authored
Setup all the registered controls at s_stream(1) time instead of manually configure gains. Signed-off-by:
-
Jacopo Mondi authored
Adjust the control limits for V4L2_CID_VBLANK, V4L2_CID_HBLANK and V4L2_CID_EXPOSURE when a new format is applied to the sensor. Update the exposure control limits when a new blanking value is applied and change the controls initialization to use valid values for the default format. The exposure control default value is changed to report the default value of register 0x3012. Signed-off-by:
-
Jacopo Mondi authored
Add support for V4L2_CID_LINK_FREQ which currently reports a single hard-coded frequency which depends on the fixed pixel clock. Signed-off-by:
-
Jacopo Mondi authored
Refuse unsupported controls by returning -EINVAL in the s_ctrl operation. While at it, remove a the default switch case in the first switch as it effectively is now a no-op. Signed-off-by:
-
Jacopo Mondi authored
Rework the PLL computation procedure to take into account the currently configured format bpp and the number of data lanes. Comment the PLL configuration procedure with information provided by the sensor chip manual and remove the hardcoded divider from the pixel clock calculation. Signed-off-by:
-
Jacopo Mondi authored
Change the largest visibile resolution to 2592x1944, which corresponds to the active pixel array area size. Take into account the horizontal and vertical limits when programming the visible sizes to skip dummy/inactive pixels. Signed-off-by:
-
Jacopo Mondi authored
Add support for V4L2_CID_ANALOG_GAIN. The control programs the global gain register which applies to all color channels. Signed-off-by:
-
Jacopo Mondi authored
Implement the enum_frame_size pad operation. The sensor supports a continuous size range of resolutions. Signed-off-by:
-
Marek Vasut authored
The MT9P006 sensor driver sporadically fails to probe because the sensor responds with a NACK condition to I2C address on the bus during an attempt to read the sensor MT9P031_CHIP_VERSION register in mt9p031_registered(). Neither the MT9P006 nor MT9P031 datasheets are clear on reset signal timing. Older MT9M034 [1] datasheet provides those timing figures in Appendix-A and indicates it is necessary to wait 850000 EXTCLK cycles before starting any I2C communication. Add such a delay, which does make the sporadic I2C NACK go away, so it is likely similar constraint applies to this sensor. [1] https://www.onsemi.com/pdf/datasheet/mt9m034-d.pdfSigned-off-by:
Marek Vasut <marex@denx.de> Reviewed-by:
-
Laurent Pinchart authored
Now that a header exists with macros for the media interface bus-type values, replace hardcoding numerical constants with the corresponding macros in the DT binding examples. Signed-off-by:
-
