summaryrefslogtreecommitdiff
path: root/drivers/media
Commit message (Collapse)AuthorAgeFilesLines
* media: venus: core,pm: fix potential infinite loopColin Ian King2021-04-151-2/+2
| | | | | | | | | | | | | | | The for-loop iterates with a u8 loop counter i and compares this with the loop upper limit of res->resets_num which is an unsigned int type. There is a potential infinite loop if res->resets_num is larger than the u8 loop counter i. Fix this by making the loop counter the same type as res->resets_num. Addresses-Coverity: ("Infinite loop") Fixes: 3bca43585e22 ("media: venus: core,pm: Add handling for resets") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: venus: core: Fix kerneldoc warningsStanimir Varbanov2021-04-151-9/+31
| | | | | | | | Fix kerneldoc warnings in description of venus_core and venus_inst structures Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: gscpa/stv06xx: fix memory leakHans Verkuil2021-04-093-0/+12
| | | | | | | | | | | | | | | | | For two of the supported sensors the stv06xx driver allocates memory which is stored in sd->sensor_priv. This memory is freed on a disconnect, but if the probe() fails, then it isn't freed and so this leaks memory. Add a new probe_error() op that drivers can use to free any allocated memory in case there was a probe failure. Thanks to Pavel Skripkin <paskripkin@gmail.com> for discovering the cause of the memory leak. Reported-and-tested-by: syzbot+e7f4c64a4248a0340c37@syzkaller.appspotmail.com Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: cx25821: remove unused including <linux/version.h>Tian Tao2021-04-091-1/+0
| | | | | | | | | Remove including <linux/version.h> that don't need it. Signed-off-by: Tian Tao <tiantao6@hisilicon.com> Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: adv7842: support 1 block EDIDs, fix clearing EDIDHans Verkuil2021-04-091-28/+43
| | | | | | | | | | | | Add support for EDIDs consisting of one EDID block. Related to this, improve CEC physical address handling. Clearing the EDID caused a bug since v4l2_calc_aspect_ratio() was called with a NULL pointer. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: adv7842: configure all padsHans Verkuil2021-04-091-3/+7
| | | | | | | | | | Only the first pad was configured, but there are 4. This causes set_fmt to fail with -EINVAL since the passed pad is > 0. Configure all three sink pads and the source pad. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: allegro: change kernel-doc comment blocks to normal commentsHans Verkuil2021-04-092-7/+7
| | | | | | | | | | | The /** at the start indicates that these are kernel-doc comments, but really these are just regular comments. Replace /** by /* to avoid a large number of warnings from kernel-doc. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Suggested-by: Michael Tretter <m.tretter@pengutronix.de> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: camss: ispif: Remove redundant dev_err call in msm_ispif_subdev_init()Yang Yingliang2021-04-091-6/+2
| | | | | | | | | | | | There is a error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Robert Foss <robert.foss@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: i2c: rdamc21: Fix warning on u8 castJacopo Mondi2021-04-091-1/+1
| | | | | | | | | | | | | | | | | | Sparse reports a warning on a cast to u8 of a 16 bits constant. drivers/media/i2c/rdacm21.c:348:62: warning: cast truncates bits from constant value (300a becomes a) Even if the behaviour is intended, silence the sparse warning replacing the cast with a bitwise & operation. Fixes: a59f853b3b4b ("media: i2c: Add driver for RDACM21 camera module") Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: mxl692: remove impossible conditionJiapeng Chong2021-04-091-1/+1
| | | | | | | | | | | | Fix the following coverity warning: This greater-than-or-equal-to-zero comparison of an unsigned value is always true. "opcode >= 0". Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: dvb-usb: avoid -Wempty-body warningsArnd Bergmann2021-04-091-6/+7
| | | | | | | | | | | | | | | | | | | | | Building with 'make W=1' shows many warnings -Wempty-body warnings like drivers/media/usb/dvb-usb/vp702x-fe.c: In function 'vp702x_fe_set_frontend': drivers/media/usb/dvb-usb/vp702x-fe.c:190:46: error: suggest braces around empty body in an 'else' statement [-Werror=empty-body] 190 | deb_fe("tuning succeeded.\n"); drivers/media/usb/dvb-usb/dtt200u.c: In function 'dtt200u_rc_query': drivers/media/usb/dvb-usb/dtt200u.c:124:58: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 124 | deb_info("st->data: %*ph\n", 5, st->data); drivers/media/usb/dvb-usb/m920x.c: In function 'm920x_rc_query': drivers/media/usb/dvb-usb/m920x.c:207:58: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] 207 | deb("Unknown rc key %02x\n", rc_state[1]); Change the empty dprintk() macros to no_printk(), which avoids this warning and adds format string checking. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: flexcop: avoid -Wempty-body warningArnd Bergmann2021-04-093-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | Building with 'make W=1' shows many warnings -Wempty-body warnings like drivers/media/common/b2c2/flexcop-misc.c: In function 'flexcop_determine_revision': drivers/media/common/b2c2/flexcop-misc.c:35:85: error: suggest braces around empty body in an 'else' statement [-Werror=empty-body] 35 | deb_info("this FlexCop has the 6 basic main hardware pid filter.\n"); drivers/media/usb/b2c2/flexcop-usb.c: In function 'flexcop_usb_process_frame': drivers/media/usb/b2c2/flexcop-usb.c:357:79: error: suggest braces around empty body in an 'else' statement [-Werror=empty-body] 357 | deb_ts("not ts packet %*ph\n", 4, b+2); | ^ drivers/media/common/b2c2/flexcop-misc.c: In function 'flexcop_determine_revision': drivers/media/common/b2c2/flexcop-misc.c:35:85: error: suggest braces around empty body in an 'else' statement [-Werror=empty-body] 35 | deb_info("this FlexCop has the 6 basic main hardware pid filter.\n"); | ^ Change the empty dprintk() macros to no_printk(), which avoids this warning and adds format string checking. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: ite-cir: probe of ITE8708 on ASUS PN50 failsSean Young2021-04-091-1/+1
| | | | | | | | | | | | The Asus PN50 has 16 byte io region for the ITE8708 in its DSDT, which causes the probe fail. So, accept larger regions. Link: https://www.spinics.net/lists/linux-media/msg177725.html Cc: Nikolaos Beredimas <beredim@gmail.com> Reported-by: Michael Zimmermann <sigmaepsilon92@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: rc: ir-hix5hd2: use the correct HiSilicon copyrightHao Fang2021-04-091-1/+1
| | | | | | | | | | s/Hisilicon/HiSilicon/g. It should use capital S, according to https://www.hisilicon.com/en/terms-of-use. Signed-off-by: Hao Fang <fanghao11@huawei.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: rc: remove zte zx ir driverArnd Bergmann2021-04-093-193/+0
| | | | | | | | | | | The zte zx platform is getting removed, so this driver is no longer needed. Cc: Jun Nie <jun.nie@linaro.org> Cc: Shawn Guo <shawnguo@kernel.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: dvb-usb: fix memory leak in dvb_usb_adapter_initPavel Skripkin2021-04-091-4/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | syzbot reported memory leak in dvb-usb. The problem was in invalid error handling in dvb_usb_adapter_init(). for (n = 0; n < d->props.num_adapters; n++) { .... if ((ret = dvb_usb_adapter_stream_init(adap)) || (ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) || (ret = dvb_usb_adapter_frontend_init(adap))) { return ret; } ... d->num_adapters_initialized++; ... } In case of error in dvb_usb_adapter_dvb_init() or dvb_usb_adapter_dvb_init() d->num_adapters_initialized won't be incremented, but dvb_usb_adapter_exit() relies on it: for (n = 0; n < d->num_adapters_initialized; n++) So, allocated objects won't be freed. Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Reported-by: syzbot+3c2be7424cea3b932b0e@syzkaller.appspotmail.com Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: rc: add keymaps for mecool-kii-pro/kiii-pro remotesChristian Hewitt2021-04-093-0/+181
| | | | | | | | | | Add keymaps and bindings for the simple IR (NEC) remotes used with the MeCool KII-Pro and MeCool KIII-Pro Android STB devices. Tested-by: Drazen Spio <drazsp@gmail.com> Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: dvb-usb-remote: fix dvb_usb_nec_rc_key_to_event type mismatchArnd Bergmann2021-04-091-1/+2
| | | | | | | | | | | | | | | | | | | gcc-11 warns about the prototype not exactly matching the function definition: drivers/media/usb/dvb-usb/dvb-usb-remote.c:363:20: error: argument 2 of type ‘u8[5]’ {aka ‘unsigned char[5]’} with mismatched bound [-Werror=array-parameter=] 363 | u8 keybuf[5], u32 *event, int *state) | ~~~^~~~~~~~~ In file included from drivers/media/usb/dvb-usb/dvb-usb-common.h:13, from drivers/media/usb/dvb-usb/dvb-usb-remote.c:9: drivers/media/usb/dvb-usb/dvb-usb.h:490:65: note: previously declared as ‘u8[]’ {aka ‘unsigned char[]’} 490 | extern int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *, u8[], u32 *, int *); | ^~~~ Fixes: 776338e121b9 ("[PATCH] dvb: Add generalized dvb-usb driver") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: dvb-frontends: Remove redundant error check on variable retColin Ian King2021-04-091-3/+0
| | | | | | | | | | | | | An earlier commit removed a call to lgdt3306a_spectral_inversion and omitted to remove the error return check. The check on ret is now redundant and can be removed. Addresses-Coverity: ("Logically dead code") Fixes: d4a3fa6652e3 ("media: dvb-frontends: lgdt3306a.c: remove dead code") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: cobalt: drop static for sd_fmtHans Verkuil2021-04-091-1/+1
| | | | | | | | The struct v4l2_subdev_format sd_fmt cannot be static since it can be written back by the subdev. Just have it on the stack. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: sun8i-di: Fix runtime PM imbalance in deinterlace_start_streamingDinghao Liu2021-04-091-1/+1
| | | | | | | | | | | | pm_runtime_get_sync() will increase the runtime PM counter even it returns an error. Thus a pairing decrement is needed to prevent refcount leak. Fix this by replacing this API with pm_runtime_resume_and_get(), which will not change the runtime PM counter on error. Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: platform: sti: Fix runtime PM imbalance in regs_showDinghao Liu2021-04-091-1/+1
| | | | | | | | | | | | pm_runtime_get_sync() will increase the runtime PM counter even it returns an error. Thus a pairing decrement is needed to prevent refcount leak. Fix this by replacing this API with pm_runtime_resume_and_get(), which will not change the runtime PM counter on error. Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: imx-jpeg: Fix double free in mxc_jpeg_removeMirela Rabulea2021-04-091-1/+0
| | | | | | | | | | The video_unregister_device already calls video_device_release, so remove video_device_release, to avoid a double free, when removing the module. This showed up in a repeated rmmod/insmod scenario. Signed-off-by: Mirela Rabulea <mirela.rabulea@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: i2c: adv7842: fix possible use-after-free in adv7842_remove()Yang Yingliang2021-04-091-1/+1
| | | | | | | | | | | | | | | | This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove()Yang Yingliang2021-04-091-1/+1
| | | | | | | | | | | | | | | | This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove()Yang Yingliang2021-04-091-1/+1
| | | | | | | | | | | | | | | | This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: adv7604: fix possible use-after-free in adv76xx_remove()Yang Yingliang2021-04-091-1/+1
| | | | | | | | | | | | | | | | This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: tc358743: fix possible use-after-free in tc358743_remove()Yang Yingliang2021-04-091-1/+1
| | | | | | | | | | | | | | | | This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: venus: don't de-reference NULL pointers at IRQ timeMauro Carvalho Chehab2021-04-081-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Smatch is warning that: drivers/media/platform/qcom/venus/hfi_venus.c:1100 venus_isr() warn: variable dereferenced before check 'hdev' (see line 1097) The logic basically does: hdev = to_hfi_priv(core); with is translated to: hdev = core->priv; If the IRQ code can receive a NULL pointer for hdev, there's a bug there, as it will first try to de-reference the pointer, and then check if it is null. After looking at the code, it seems that this indeed can happen: Basically, the venus IRQ thread is started with: devm_request_threaded_irq() So, it will only be freed after the driver unbinds. In order to prevent the IRQ code to work with freed data, the logic at venus_hfi_destroy() sets core->priv to NULL, which would make the IRQ code to ignore any pending IRQs. There is, however a race condition, as core->priv is set to NULL only after being freed. So, we need also to move the core->priv = NULL to happen earlier. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: venus: use NULL instead of zero for pointersMauro Carvalho Chehab2021-04-081-2/+2
| | | | | | | | | | | | | As reported by sparse: drivers/media/platform/qcom/venus/core.c:227:41: warning: Using plain integer as NULL pointer drivers/media/platform/qcom/venus/core.c:228:34: warning: Using plain integer as NULL pointer Two vars are using zero instead of NULL for pointers. Not really an issue, but using NULL makes it clearer that the init data is expecting a pointer. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: s5p-mfc: Fix kernel-doc entries in s5p_mfc_common.hSylwester Nawrocki2021-04-061-7/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes scripts/kernel-doc warnings: s5p_mfc_common.h:343: warning: Function parameter or member 'fw_buf' not described in 's5p_mfc_dev' s5p_mfc_common.h:343: warning: Function parameter or member 'mem_size' not described in 's5p_mfc_dev' s5p_mfc_common.h:343: warning: Function parameter or member 'mem_base' not described in 's5p_mfc_dev' s5p_mfc_common.h:343: warning: Function parameter or member 'mem_bitmap' not described in 's5p_mfc_dev' s5p_mfc_common.h:343: warning: Function parameter or member 'mem_virt' not described in 's5p_mfc_dev' s5p_mfc_common.h:343: warning: Function parameter or member 'dma_base' not described in 's5p_mfc_dev' s5p_mfc_common.h:343: warning: Function parameter or member 'watchdog_timer' not described in 's5p_mfc_dev' s5p_mfc_common.h:343: warning: Function parameter or member 'fw_get_done' not described in 's5p_mfc_dev' s5p_mfc_common.h:343: warning: Function parameter or member 'risc_on' not described in 's5p_mfc_dev' s5p_mfc_common.h:714: warning: Function parameter or member 'src_bufs_cnt' not described in 's5p_mfc_ctx' s5p_mfc_common.h:714: warning: Function parameter or member 'dst_bufs_cnt' not described in 's5p_mfc_ctx' s5p_mfc_common.h:714: warning: Function parameter or member 'pb_count' not described in 's5p_mfc_ctx' s5p_mfc_common.h:714: warning: Function parameter or member 'force_frame_type' not described in 's5p_mfc_ctx' s5p_mfc_common.h:714: warning: Function parameter or member 'slice_mode' not described in 's5p_mfc_ctx' s5p_mfc_common.h:714: warning: Function parameter or member 'slice_size' not described in 's5p_mfc_ctx' s5p_mfc_common.h:714: warning: Function parameter or member 'frame_tag' not described in 's5p_mfc_ctx' s5p_mfc_common.h:714: warning: Function parameter or member 'scratch_buf_size' not described in 's5p_mfc_ctx' Reported-by: Hans verkuil <hverkuil@xs4all.nl> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: exynos4-is: Fix kernel-doc entries in fimc-is.hSylwester Nawrocki2021-04-061-2/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes scripts/kernel-doc warnings: fimc-is.h:286: warning: Function parameter or member 'fw' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'memory' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'f_w' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'isp' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'sensor' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'setfile' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'ctrl_handler' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'irq' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'sensor_index' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'i2h_cmd' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'h2i_cmd' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'fd_header' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'config' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'config_index' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'is_p_region' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'is_dma_p_region' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'is_shared_region' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'af' not described in 'fimc_is' fimc-is.h:286: warning: Function parameter or member 'debugfs_entry' not described in 'fimc_is' The f_w field is unused so remove it. Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: adv7511-v4l2: correctly report EDIDs of 1 blockHans Verkuil2021-04-061-6/+6
| | | | | | | | | If the EDID has an odd number of blocks (usually just 1, but the same problem occurs with 3 blocks), then VIDIOC_G_EDID reported 2 (or 4) blocks. Fix this. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: adv7604: support EDIDs up to 4 blocksHans Verkuil2021-04-061-28/+61
| | | | | | | | | | | | | | | While the adv7604/11/12 hardware supported EDIDs up to 4 blocks, the driver didn't. This patch adds support for this. It also improves support for EDIDs that do not have a Source Physical Address: in that case the spa location is set to the first byte of the second block, and the 'physical address' is just the two bytes at that location. This is per the suggestion in the adv76xx documentation for such EDIDs. Tested with an adv7604 and adv7612. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: adv7604: fix HPD support for adv7611/12Hans Verkuil2021-04-061-2/+21
| | | | | | | | | | | | | | | For the adv7604 the hotplug detect pin is controlled through gpio pins from the SoC, but the adv7611 and adv7612 control the hotplug detect pin themselves. But the driver had no support for this, so the HPD was always high, even when changing the EDID. Add proper support for this to the driver. Tested with an adv7612. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: VIDEO_IMX8_JPEG should depend on ARCH_MXC and not default to mGeert Uytterhoeven2021-04-061-1/+1
| | | | | | | | | | | | | | | | The i.MX8 QXP/QM integrated JPEG encoder/decoder is only present on Freescale/NXP i.MX8 QXP and QM SoCs. Hence add a dependency on ARCH_MXC, to prevent asking the user about this driver when configuring a kernel without i.MX8 support. Drop the "default m" (which means "default y" if CONFIG_MODULES is not enabled), as merely enabling CONFIG_COMPILE_TEST should not enable additional code. Fixes: 2db16c6ed72ce644 ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: em28xx/em28xx.h: Remove duplicate struct declarationWan Jiabing2021-04-061-2/+0
| | | | | | | | | struct em28xx is declared at 219th line. The declaration here is unnecessary. Remove it. Signed-off-by: Wan Jiabing <wanjiabing@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: cx231xx/cx231xx.h: Remove repeated struct declarationWan Jiabing2021-04-061-2/+0
| | | | | | | | | struct cx231xx is declared at 146th line. The declaration here is unnecessary. Remove it. Signed-off-by: Wan Jiabing <wanjiabing@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: camss: csid: Remove redundant dev_err call in msm_csid_subdev_init()Yang Yingliang2021-04-061-3/+1
| | | | | | | | | | | | There is a error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Robert Foss <robert.foss@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: camss: csiphy: Remove redundant dev_err call in msm_csiphy_subdev_init()Yang Yingliang2021-04-061-6/+2
| | | | | | | | | | | | There is an error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Robert Foss <robert.foss@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: ti-vpe: sc: remove redundant dev_err call in sc_create()Yang Yingliang2021-04-061-3/+1
| | | | | | | | | | | | There is an error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Benoit Parrot <bparrot@ti.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: ti-vpe: csc: remove redundant dev_err call in csc_create()Yang Yingliang2021-04-061-3/+1
| | | | | | | | | | | | There is an error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Benoit Parrot <bparrot@ti.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: imx-pxp: remove redundant dev_err call in pxp_probe()Yang Yingliang2021-04-061-5/+2
| | | | | | | | | | | | There is an error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: cec/core: clarify rx-arb-lost usage messageHans Verkuil2021-04-061-1/+1
| | | | | | | | | | The rx-arb-lost error injection command only works with <op> set to 'any'. Explicitly say so in the usage message. Also use [] to indicate that the <poll> argument is optional. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: imx-pxp: Remove unneeded of_match_ptr()Fabio Estevam2021-04-061-1/+1
| | | | | | | | | | | i.MX is a DT-only platform, so of_match_ptr() can be safely removed. Remove the unneeded of_match_ptr(). Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: tw68: switch from 'pci_' to 'dma_' APIChristophe JAILLET2021-04-063-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below and has been hand modified to replace GFP_ with a correct flag. It has been compile tested. When memory is allocated in 'tw68_risc_buffer()' (tw68-risc.c) GFP_KERNEL can be used because this function is only called from a vb2_ops buf_prepare function. The call chain is: tw68_video_qops.buf_prepare (tw68-video.c) --> tw68_buf_prepare (tw68-video.c) --> tw68_risc_buffer @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: tw686x: switch from 'pci_' to 'dma_' APIChristophe JAILLET2021-04-063-16/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below and has been hand modified to replace GFP_ with a correct flag. It has been compile tested. When memory is allocated in 'tw686x_audio_dma_alloc()' (tw686x-audio.c) GFP_KERNEL can be used because it is only called from a probe function and no spinlock is taken in the between. The call chain is: tw686x_probe (tw686x-core.c) --> tw686x_audio_init (tw686x-audio.c) --> tw686x_audio_dma_alloc (tw686x-audio.c) When memory is allocated in 'tw686x_memcpy_dma_alloc()' and in 'tw686x_sg_dma_alloc()' (tw686x-video.c) GFP_KERNEL can be used because these functions are .alloc functions from a tw686x_dma_ops structure. @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: cx23885: switch from 'pci_' to 'dma_' APIChristophe JAILLET2021-04-062-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The wrappers in include/linux/pci-dma-compat.h should go away. The patch has been generated with the coccinelle script below and has been hand modified to replace GFP_ with a correct flag. It has been compile tested. When memory is allocated in 'cx23885_risc_buffer()' GFP_KERNEL can be used because this function is only called from a vb2_ops buf_prepare function. The call chain is: cx23885_video_qops.buf_prepare (cx23885-video.c) --> buffer_prepare (cx23885-video.c) --> cx23885_risc_buffer When memory is allocated in 'cx23885_risc_databuffer()' GFP_KERNEL can be used because this function is only called from a function that already uses GFP_KERNEL or from a vb2_ops buf_prepare function. The call chains are: snd_cx23885_hw_params (cx23885-alsa.c) --> use GFP_KERNEL --> cx23885_risc_databuffer cx23885_qops.buffer_prepare (cx23885-417.c) or dvb_qops.buffer_prepare (cx23885-dvb.c) --> cx23885_buf_prepare --> cx23885_risc_databuffer When memory is allocated in 'cx23885_risc_vbibuffer()' GFP_KERNEL can be used because this function is only called from a vb2_ops buf_prepare function. The call chains are: cx23885_vbi_qops.buffer_prepare (cx23885-vbi.c) --> cx23885_risc_vbibuffer @@ @@ - PCI_DMA_BIDIRECTIONAL + DMA_BIDIRECTIONAL @@ @@ - PCI_DMA_TODEVICE + DMA_TO_DEVICE @@ @@ - PCI_DMA_FROMDEVICE + DMA_FROM_DEVICE @@ @@ - PCI_DMA_NONE + DMA_NONE @@ expression e1, e2, e3; @@ - pci_alloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3; @@ - pci_zalloc_consistent(e1, e2, e3) + dma_alloc_coherent(&e1->dev, e2, e3, GFP_) @@ expression e1, e2, e3, e4; @@ - pci_free_consistent(e1, e2, e3, e4) + dma_free_coherent(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_single(e1, e2, e3, e4) + dma_map_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_single(e1, e2, e3, e4) + dma_unmap_single(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4, e5; @@ - pci_map_page(e1, e2, e3, e4, e5) + dma_map_page(&e1->dev, e2, e3, e4, e5) @@ expression e1, e2, e3, e4; @@ - pci_unmap_page(e1, e2, e3, e4) + dma_unmap_page(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_map_sg(e1, e2, e3, e4) + dma_map_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_unmap_sg(e1, e2, e3, e4) + dma_unmap_sg(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_cpu(e1, e2, e3, e4) + dma_sync_single_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_single_for_device(e1, e2, e3, e4) + dma_sync_single_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_cpu(e1, e2, e3, e4) + dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4) @@ expression e1, e2, e3, e4; @@ - pci_dma_sync_sg_for_device(e1, e2, e3, e4) + dma_sync_sg_for_device(&e1->dev, e2, e3, e4) @@ expression e1, e2; @@ - pci_dma_mapping_error(e1, e2) + dma_mapping_error(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_dma_mask(e1, e2) + dma_set_mask(&e1->dev, e2) @@ expression e1, e2; @@ - pci_set_consistent_dma_mask(e1, e2) + dma_set_coherent_mask(&e1->dev, e2) Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: mtk-vcodec: Separating mtk encoder driverIrui Wang2021-04-065-110/+67
| | | | | | | | | | | | | | | | | | MTK H264 Encoder(VENC_SYS) and VP8 Encoder(VENC_LT_SYS) are two independent hardware instance. They have their owner interrupt, register mapping, and special clocks. This patch separates them into two devices. This is a preparing patch for adding device_link between the larbs and venc-device. It's mainly for fixing the problem: https://lkml.org/lkml/2019/9/3/316 Acked-by: Tiffany Lin <tiffany.lin@mediatek.com> Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org> Signed-off-by: Maoguang Meng <maoguang.meng@mediatek.com> Signed-off-by: Irui Wang <irui.wang@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
* media: v4l2-ctrls.c: fix race condition in hdl->requests listHans Verkuil2021-04-061-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a request is re-inited it will release all control handler objects that are still in the request. It does that by unbinding and putting all those objects. When the object is unbound the obj->req pointer is set to NULL, and the object's unbind op is called. When the object it put the object's release op is called to free the memory. For a request object that contains a control handler that means that v4l2_ctrl_handler_free() is called in the release op. A control handler used in a request has a pointer to the main control handler that is created by the driver and contains the current state of all controls. If the device is unbound (due to rmmod or a forced unbind), then that main handler is freed, again by calling v4l2_ctrl_handler_free(), and any outstanding request objects that refer to that main handler have to be unbound and put as well. It does that by this test: if (!hdl->req_obj.req && !list_empty(&hdl->requests)) { I.e. the handler has no pointer to a request, so is the main handler, and one or more request objects refer to this main handler. However, this test is wrong since hdl->req_obj.req is actually NULL when re-initing a request (the object unbind will set req to NULL), and the only reason this seemingly worked is that the requests list is typically empty since the request's unbind op will remove the handler from the requests list. But if another thread is at the same time adding a new control to a request, then there is a race condition where one thread is removing a control handler object from the requests list and another thread is adding one. The result is that hdl->requests is no longer empty and the code thinks that a main handler is being freed instead of a control handler that is part of a request. There are two bugs here: first the test for hdl->req_obj.req: this should be hdl->req_obj.ops since only the main control handler will have a NULL pointer there. The second is that adding or deleting request objects from the requests list of the main handler isn't protected by taking the main handler's lock. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reported-by: John Cox <jc@kynesim.co.uk> Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support") Tested-by: John Cox <jc@kynesim.co.uk> Reported-by: John Cox <jc@kynesim.co.uk> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
View Lorry Controller Status