- 11 Apr, 2023 40 commits
-
-
Luca Weiss authored
Convert the text-based dt-bindings to yaml. Changes from original txt: * Take wording for various properties from other yaml bindings, this removes e.g. volt amount from schema since it isn't really relevant and the datasheet is a better source. * Don't make reset-gpios a required property since it can be tied to DOVDD instead. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Luca Weiss <luca@z3ntu.xyz> [Sakari Ailus: bump the maxItems for data-lanes to two] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Luca Weiss authored
With the upcoming conversion of ov2685 to dt-schema let's complete the example so validation succeeds. At the same time fix the indentation of the port node in this example. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Luca Weiss <luca@z3ntu.xyz> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Jason Kim authored
In the file mc-device.c, the function media_device_register_entity_notify() does not need to have the __must_check attribute since it returns only a value of 0. Therefore, we can remove this attribute and change the function's return type. Signed-off-by: Jason Kim <sukbeom.kim@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Wei Chen authored
hi846_init_controls doesn't clean the allocated ctrl_hdlr in case there is a failure, which causes memleak. Add v4l2_ctrl_handler_free to free the resource properly. Fixes: e8c08826 ("media: i2c: add driver for the SK Hynix Hi-846 8M pixel camera") Signed-off-by: Wei Chen <harperchen1110@gmail.com> Reviewed-by: Martin Kepplinger <martin.kepplinger@puri.sm> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Ricardo Ribalda authored
It the device is probed in non-zero ACPI D state, the module identification is delayed until the first streamon. The module identification has two parts: deviceID and version. To rea the version we have to enable OTP read. This cannot be done during streamon, becase it modifies REG_MODE_SELECT. Since the driver has the same behaviour for all the module versions, do not read the module version from the sensor's OTP. Cc: stable@vger.kernel.org Fixes: 0e014f1a ("media: ov8856: support device probe in non-zero ACPI D state") Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Rob Herring authored
Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by: Rob Herring <robh@kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by: Joe Tessler <jrt@google.com> Reviewed-by: Heiko Stuebner <heiko@sntech.de> #rockchip Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> [Sakari Ailus: Drop changes for files in which they had been done already] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Christophe JAILLET authored
Use devm_clk_get_optional() instead of hand writing it. This saves some loC and improves the semantic. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Sakari Ailus authored
When an async notifier is unregistered, the async sub-devices in the notifier's done list will disappear with the notifier. However this is currently also done to the sub-notifiers that remain registered. Their sub-devices only need to be unbound while the async sub-devices themselves need to be returned to the sub-notifier's waiting list. Do this now. Fixes: 2cab00bb ("media: v4l: async: Allow binding notifiers to sub-devices") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Laurent Pinchart authored
The imx_media_of_add_csi() function is only called in its compilation unit. Make it static and don't export it. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Laurent Pinchart authored
The imx_media_find_subdev_by_fwnode(), imx_media_find_subdev_by_devname(), imx_media_pipeline_csi2_channel() and imx_media_pipeline_video_device() helper functions are not used. Drop them. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Laurent Pinchart authored
The IMX_MEDIA_GRP_ID_CSI group ID isn't used anymore. Drop it. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Laurent Pinchart authored
The imx_media_subdev_bound() function is a no-op, and the async notifier .bound() operation is optional. Drop it. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Martin Kepplinger authored
Clean up the driver a bit by inlining the imx8mq_mipi_csi_system_enable() function to the callsites and removing the hs_settle variable from the driver state. Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Martin Kepplinger authored
Simplify the driver by using the V4L2 subdev active state API to store the active format. Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Alexander Stein authored
This device only supports video capture, so bail out if invalid selection type is passed. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Alexander Stein authored
'field' is zero-initialized to V4L2_FIELD_ANY, which is an invalid value to return to userspace. Instead default to non-interleaving. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Frieder Schrempf authored
The CSI requires a connected source subdev to operate. If fwnode_graph_get_endpoint_by_id() fails and returns NULL, there is no point in going on. Print an error message and abort instead. Also we don't need to check for an existing asd. Any failure of v4l2_async_nf_add_fwnode_remote() should abort the probe. Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Paul Elder authored
Implement VIDIOC_ENUM_FRAMESIZES for the rkisp1 capture devices. Signed-off-by: Paul Elder <paul.elder@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Dafna Hirschfeld <dafna@fastmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Paul Elder authored
Add support for NV16M and NV61M as output formats. As NV16, NV61, NV12M and NV21M are already supported, the infrastructure is already in place to support NV16M and NV61M, so it is sufficient to simply add relevant entries to the list of output formats. Signed-off-by: Paul Elder <paul.elder@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Dafna Hirschfeld <dafna@fastmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Miaoqian Lin authored
rcar_fcp_get() take reference, which should be balanced with rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and the error paths of fdp1_probe() to fix this. Fixes: 4710b752 ("[media] v4l: Add Renesas R-Car FDP1 Driver") Signed-off-by: Miaoqian Lin <linmq006@gmail.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> [hverkuil: resolve merge conflict, remove() is now void] Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Tomi Valkeinen authored
Print underrun interrupts with ratelimited print. Note that we don't enable the underrun interrupt. If we have underruns, we don't want to get flooded with interrupts about them. It's enough to see that an underrun happened at the end of a frame. Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Laurent Pinchart authored
The vsp1 driver uses the vb2_is_streaming() function in its .buf_queue() handler to check if the .start_streaming() operation has been called, and decide whether to just add the buffer to an internal queue, or also trigger a hardware run. vb2_is_streaming() relies on the vb2_queue structure's streaming field, which used to be set only after calling the .start_streaming() operation. Commit a10b2153 ("media: vb2: add (un)prepare_streaming queue ops") changed this, setting the .streaming field in vb2_core_streamon() before enqueuing buffers to the driver and calling .start_streaming(). This broke the vsp1 driver which now believes that .start_streaming() has been called when it hasn't, leading to a crash: [ 881.058705] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 [ 881.067495] Mem abort info: [ 881.070290] ESR = 0x0000000096000006 [ 881.074042] EC = 0x25: DABT (current EL), IL = 32 bits [ 881.079358] SET = 0, FnV = 0 [ 881.082414] EA = 0, S1PTW = 0 [ 881.085558] FSC = 0x06: level 2 translation fault [ 881.090439] Data abort info: [ 881.093320] ISV = 0, ISS = 0x00000006 [ 881.097157] CM = 0, WnR = 0 [ 881.100126] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004fa51000 [ 881.106573] [0000000000000020] pgd=080000004f36e003, p4d=080000004f36e003, pud=080000004f7ec003, pmd=0000000000000000 [ 881.117217] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP [ 881.123494] Modules linked in: rcar_fdp1 v4l2_mem2mem [ 881.128572] CPU: 0 PID: 1271 Comm: yavta Tainted: G B 6.2.0-rc1-00023-g6c94e2e99343 #556 [ 881.138061] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) [ 881.145981] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 881.152951] pc : vsp1_dl_list_add_body+0xa8/0xe0 [ 881.157580] lr : vsp1_dl_list_add_body+0x34/0xe0 [ 881.162206] sp : ffff80000c267710 [ 881.165522] x29: ffff80000c267710 x28: ffff000010938ae8 x27: ffff000013a8dd98 [ 881.172683] x26: ffff000010938098 x25: ffff000013a8dc00 x24: ffff000010ed6ba8 [ 881.179841] x23: ffff00000faa4000 x22: 0000000000000000 x21: 0000000000000020 [ 881.186998] x20: ffff00000faa4000 x19: 0000000000000000 x18: 0000000000000000 [ 881.194154] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 881.201309] x14: 0000000000000000 x13: 746e696174206c65 x12: ffff70000157043d [ 881.208465] x11: 1ffff0000157043c x10: ffff70000157043c x9 : dfff800000000000 [ 881.215622] x8 : ffff80000ab821e7 x7 : 00008ffffea8fbc4 x6 : 0000000000000001 [ 881.222779] x5 : ffff80000ab821e0 x4 : ffff70000157043d x3 : 0000000000000020 [ 881.229936] x2 : 0000000000000020 x1 : ffff00000e4f6400 x0 : 0000000000000000 [ 881.237092] Call trace: [ 881.239542] vsp1_dl_list_add_body+0xa8/0xe0 [ 881.243822] vsp1_video_pipeline_run+0x270/0x2a0 [ 881.248449] vsp1_video_buffer_queue+0x1c0/0x1d0 [ 881.253076] __enqueue_in_driver+0xbc/0x260 [ 881.257269] vb2_start_streaming+0x48/0x200 [ 881.261461] vb2_core_streamon+0x13c/0x280 [ 881.265565] vb2_streamon+0x3c/0x90 [ 881.269064] vsp1_video_streamon+0x2fc/0x3e0 [ 881.273344] v4l_streamon+0x50/0x70 [ 881.276844] __video_do_ioctl+0x2bc/0x5d0 [ 881.280861] video_usercopy+0x2a8/0xc80 [ 881.284704] video_ioctl2+0x20/0x40 [ 881.288201] v4l2_ioctl+0xa4/0xc0 [ 881.291525] __arm64_sys_ioctl+0xe8/0x110 [ 881.295543] invoke_syscall+0x68/0x190 [ 881.299303] el0_svc_common.constprop.0+0x88/0x170 [ 881.304105] do_el0_svc+0x4c/0xf0 [ 881.307430] el0_svc+0x4c/0xa0 [ 881.310494] el0t_64_sync_handler+0xbc/0x140 [ 881.314773] el0t_64_sync+0x190/0x194 [ 881.318450] Code: d50323bf d65f03c0 91008263 f9800071 (885f7c60) [ 881.324551] ---[ end trace 0000000000000000 ]--- [ 881.329173] note: yavta[1271] exited with preempt_count 1 A different regression report sent to the linux-media mailing list ([1]) was answered with a claim that the vb2_is_streaming() function has never been meant for this purpose. The document of the function, as well as of the struct vb2_queue streaming field, is sparse, so this claim may be hard to verify. The information needed by the vsp1 driver to decide how to process queued buffers is also available from the vb2_start_streaming_called() function. Use it instead of vb2_is_streaming() to fix the problem. [1] https://lore.kernel.org/linux-media/545610e7-3446-2b82-60dc-7385fea3774f@redhat.com/ Fixes: a10b2153 ("media: vb2: add (un)prepare_streaming queue ops") Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Tested-by: Duy Nguyen <duy.nguyen.rh@renesas.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Gaosheng Cui authored
vsp1_subdev_internal_ops has been removed since commit 0efdf0f5 ("[media] v4l: vsp1: Implement and use the subdev pad::init_cfg configuration"), so remove it. Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
For performance and multi-chip support, use dynamic layout instead of statically configured pools. Divide the shared memory into the 3 64-bit aligned layouts listed below: vpu->param_addr -> +-----------------------------------------+ | | | To SCP : Input frame parameters | | (struct img_ipi_frameparam) | | | +-----------------------------------------+ vpu->work_addr -> +-----------------------------------------+ | | | In SCP : Reserve for SCP calculation | | | +-----------------------------------------+ vpu->config_addr -> +-----------------------------------------+ | | | From SCP : Output component config | | (struct img_config) | | | +-----------------------------------------+ Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
The communication between the MDP3 kernel driver and SCP is to pass a shared memory through the cooperation of "mtk-mdp3-vpu.c" and remoteproc driver. The data structure of this shared memory is defined in "mtk-img-ipi.h", as shown below: vpu->work_addr -> +-----------------------------------------+ | | | To SCP : Input frame parameters | | (struct img_ipi_frameparam) | | | vpu->pool -> +-----------------------------------------+ | | | From SCP : Output component config pool | | (struct img_config) | | | | *struct img_config 1 | | | | | | | | v | | *struct img_config N | | (N = MDP_CONFIG_POOL_SIZE) | +-----------------------------------------+ One output component configuration contains the components currently used by the pipeline, and has the register settings that each component needs to set. Since the quantity, type and function of components on each chip will vary, the effect is that the size of the "struct img_config" and its substructures will be different on each chip. In addition, all chips will have to update their SCP firmware for every change if the output component config structure is defined and shared by a common header. Therefore, all functions that operate on "struct img_config" and its substructures must be separated by chips and so are the relevant definations. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
Separate the generic definitions used in MDP3 to avoid recursive includes when splitting chip-related definitions in further. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
For extensibility of adding more MDP3 components in the further, the magic number is removed by dynamically allocating component clocks. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
Due to future support for hardware compression formats, the MDP3 internal color format expression needs to be extended. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
In MDP3, a pipe is used to represent a data path which consisting of different components and MUTEX, as shown in the following diagram: +----------------------------+ | MUTEX [*1] | +----------------------------+ S ^ S ^ S ^ S ^ S ^ | | | | | | | | | | | | | | | | | | | | +--------------+ | | | | | | | | +-------------+ | +--------------+ | | | | | | +-------------+ | | | +------+ | | | | +------+ | | | | | +------+ | | +------+ | | | | | | | | | | | | | | | | | | | | | | | v E v E v E v E v E +-------+ +-----+ +-------+ +-----+ +-------+ B>--->| RDMA0 |>-->| PQ |>-->| RSZ0 |>-->| PQ |>-->| WROT0 |>-->B +-------+ +-----+ +-------+ +-----+ +-------+ [*1] MUTEX is SOF/EOF signal controller [*2] S = Start of frame (SOF) [*3] E = End of frame (EOF) [*4] B = frame buffer More pipes will be introduced in future chips for applications such as higher frame rate frequency, which should integrate and reorder related information into specific chip config file. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
Due to differences in hardware design, the supported max and min resolutions and scaling capabilities will vary, and should be integrated into specific config file. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
Due to differences in hardware design, the supported color formats will vary and should be integrated into specific config file. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
Integrate subcomponent related information into specific config file for further multi-chip compatibility. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
For different chips, different types and numbers of components are configured in the MDP3 to achieve the desired application, which will cause ID compatibility problems in the same driver. Subdivide the component ID into two kinds: 1. public_id (compatible with other chips) 2. inner_id (what the current chip actually owns) In addition, the chip configuration related structures of MDP3 components are integrated into specific file. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
In order to be compatible with more MDP3 chip settings in further, integrate and separate chip-related configurations into specific files. Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Moudy Ho authored
Fix overflow risk when setting certain formats whose frame size exceeds a RGB24 with 7723x7723 resolution. For example, a 7723x7724 RGB24 frame: 1. bpl (byte per line) = 7723 * 3. 2. Overflow occurs when bpl * 7724 * depth. Fixes: 61890cca ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Signed-off-by: Moudy Ho <moudy.ho@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Yu Zhe authored
Pointer variables of void * type do not require type cast. Signed-off-by: Yu Zhe <yuzhe@nfschina.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Zheng Wang authored
In saa7134_initdev, it will call saa7134_hwinit1. There are three function invoking here: saa7134_video_init1, saa7134_ts_init1 and saa7134_vbi_init1. All of them will init a timer with same function. Take saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout with saa7134_buffer_timeout. In buffer_activate, the timer funtcion is started. If we remove the module or device which will call saa7134_finidev to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the timer works accordingly before cleanup in saa7134_finidev. CPU0 CPU1 |saa7134_buffer_timeout saa7134_finidev | kfree(dev); | | | saa7134_buffer_next | //use dev Fixes: 1e7126b4 ("media: saa7134: Convert timers to use timer_setup()") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Zheng Wang authored
In dm1105_probe, it called dm1105_ir_init and bound &dm1105->ir.work with dm1105_emit_key. When it handles IRQ request with dm1105_irq, it may call schedule_work to start the work. When we call dm1105_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in dm1105_remove CPU0 CPU1 |dm1105_emit_key dm1105_remove | dm1105_ir_exit | rc_unregister_device | rc_free_device | rc_dev_release | kfree(dev); | | | rc_keydown | //use Fixes: 34d2f9bf ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Oliver Neukum authored
We are setting a value. That is output and the pipe has to match that. Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Yang Li authored
According to commit 7945f929 ("drivers: provide devm_platform_ioremap_resource()"), convert platform_get_resource(), devm_ioremap_resource() to a single call to use devm_platform_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-