linux-stable.git/drivers/media/platform, branch v5.4.2

media: vivid: Fix wrong locking that causes race conditions on streaming stop

2019-11-29T09:10:04+00:00

commit 6dcd5d7a7a29c1e4b8016a06aed78cd650cd8c27 upstream.

There is the same incorrect approach to locking implemented in
vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out() and
sdr_cap_stop_streaming().

These functions are called during streaming stopping with vivid_dev.mutex
locked. And they all do the same mistake while stopping their kthreads,
which need to lock this mutex as well. See the example from
vivid_stop_generating_vid_cap():
  /* shutdown control thread */
  vivid_grab_controls(dev, false);
  mutex_unlock(&dev->mutex);
  kthread_stop(dev->kthread_vid_cap);
  dev->kthread_vid_cap = NULL;
  mutex_lock(&dev->mutex);

But when this mutex is unlocked, another vb2_fop_read() can lock it
instead of vivid_thread_vid_cap() and manipulate the buffer queue.
That causes a use-after-free access later.

To fix those issues let's:
  1. avoid unlocking the mutex in vivid_stop_generating_vid_cap(),
vivid_stop_generating_vid_out() and sdr_cap_stop_streaming();
  2. use mutex_trylock() with schedule_timeout_uninterruptible() in
the loops of the vivid kthread handlers.

Signed-off-by: Alexander Popov 
Acked-by: Linus Torvalds 
Tested-by: Hans Verkuil 
Signed-off-by: Hans Verkuil 
Cc:       # for v3.18 and up
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: vivid: Set vid_cap_streaming and vid_out_streaming to true

2019-11-29T09:10:03+00:00

commit b4add02d2236fd5f568db141cfd8eb4290972eb3 upstream.

When vbi stream is started, followed by video streaming,
the vid_cap_streaming and vid_out_streaming were not being set to true,
which would cause the video stream to stop when vbi stream is stopped.
This patch allows to set vid_cap_streaming and vid_out_streaming to true.
According to Hans Verkuil it appears that these 'if (dev->kthread_vid_cap)'
checks are a left-over from the original vivid development and should never
have been there.

Signed-off-by: Vandana BN 
Cc:       # for v3.18 and up
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'tag-chrome-platform-for-v5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux

2019-09-19T21:14:28+00:00

Pull chrome platform updates from Benson Leung:
 "CrOS EC / MFD Migration:
    - Move cros_ec core driver from mfd into chrome platform.

  Wilco EC:
    - Add batt_ppid_info command to Wilco telemetry driver.

  CrOS EC:
    - cros_ec_rpmsg : Add support to inform EC of suspend/resume status
    - cros_ec_rpmsg : Fix race condition on probe failed
    - cros_ec_chardev : Add a poll handler to receive MKBP events

  Misc:
    - bugfixes in cros_usbpd_logger and cros_ec_ishtp"

* tag 'tag-chrome-platform-for-v5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
  platform/chrome: cros_usbpd_logger: null check create_singlethread_workqueue
  platform/chrome: cros_ec_chardev: Add a poll handler to receive MKBP events
  platform/chrome: cros_ec_rpmsg: Fix race with host command when probe failed
  platform/chrome: chromeos_tbmc: Report wake events
  mfd: cros_ec: Use mfd_add_hotplug_devices() helper
  mfd: cros_ec: Add convenience struct to define autodetectable CrOS EC subdevices
  mfd: cros_ec: Add convenience struct to define dedicated CrOS EC MCUs
  mfd: cros_ec: Use kzalloc and cros_ec_cmd_xfer_status helper
  mfd / platform: cros_ec: Reorganize platform and mfd includes
  mfd / platform: cros_ec: Rename config to a better name
  mfd: cros_ec: Switch to use the new cros-ec-chardev driver
  mfd / platform: cros_ec: Miscellaneous character device to talk with the EC
  mfd / platform: cros_ec: Move cros-ec core driver out from MFD
  mfd / platform: cros_ec: Handle chained ECs as platform devices
  platform/chrome: cros_ec_rpmsg: Add host command AP sleep state support
  platform/chrome: chromeos_laptop: drop checks of NULL-safe functions
  platform/chrome: wilco_ec: Add batt_ppid_info command to telemetry driver

Merge tag 'media/v5.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2019-09-18T00:55:23+00:00

Pull media updates from Mauro Carvalho Chehab:

 - a new sensor driver for ov5675

 - a new platform driver for Allwinner A10 sensor interface

 - some new remote controller keymaps

 - some cosmetic changes at V4L2 core in order to avoid #ifdefs and to
   merge two core modules into one

 - removal of bcm2048 radio driver from staging

 - removal of davinci_vpfe video driver from staging

 - regression fix since Kernel 5.1 at the legacy VideoBuffer version 1
   core

 - added some documentation for remote controller protocols

 - pixel format documentation was split on two files

 - lots of other driver improvements and cleanups

* tag 'media/v5.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (321 commits)
  media: videobuf-core.c: poll_wait needs a non-NULL buf pointer
  media: sun4i: Make sun4i_csi_formats static
  media: imx: remove unused including 
  media: stm32-dcmi: Delete an unnecessary of_node_put() call in dcmi_probe()
  media: pvrusb2: qctrl.flag will be uninitlaized if cx2341x_ctrl_query() returns error code
  media: em28xx: Fix exception handling in em28xx_alloc_urbs()
  media: don't do a 31 bit shift on a signed int
  media: use the BIT() macro
  media: ov9650: add a sanity check
  media: aspeed-video: address a protential usage of an unitialized var
  media: vicodec: make life easier for static analyzers
  media: remove include stdarg.h from some drivers
  v4l2-core: fix coding style for the two new c files
  media: v4l2-core: Remove BUG() from i2c and spi helpers
  media: v4l2-core: introduce a helper to unregister a i2c subdev
  media: v4l2-core: introduce a helper to unregister a spi subdev
  media: v4l2-core: move i2c helpers out of v4l2-common.c
  media: v4l2-core: move spi helpers out of v4l2-common.c
  media: v4l2-core: Module re-organization
  media: usbvision: Remove dead code
  ...

mfd / platform: cros_ec: Reorganize platform and mfd includes

2019-09-02T10:33:42+00:00

There is a bit of mess between cros-ec mfd includes and platform
includes. For example, we have a linux/mfd/cros_ec.h include that
exports the interface implemented in platform/chrome/cros_ec_proto.c. Or
we have a linux/mfd/cros_ec_commands.h file that is non related to the
multifunction device (in the sense that is not exporting any function of
the mfd device). This causes crossed includes between mfd and
platform/chrome subsystems and makes the code difficult to read, apart
from creating 'curious' situations where a platform/chrome driver includes
a linux/mfd/cros_ec.h file just to get the exported functions that are
implemented in another platform/chrome driver.

In order to have a better separation on what the cros-ec multifunction
driver does and what the cros-ec core provides move and rework the
affected includes doing:

 - Move cros_ec_commands.h to include/linux/platform_data/cros_ec_commands.h
 - Get rid of the parts that are implemented in the platform/chrome/cros_ec_proto.c
   driver from include/linux/mfd/cros_ec.h to a new file
   include/linux/platform_data/cros_ec_proto.h
 - Update all the drivers with the new includes, so
   - Drivers that only need to know about the protocol include
     - linux/platform_data/cros_ec_proto.h
     - linux/platform_data/cros_ec_commands.h
   - Drivers that need to know about the cros-ec mfd device also include
     - linux/mfd/cros_ec.h

Signed-off-by: Enric Balletbo i Serra 
Acked-by: Andy Shevchenko 
Acked-by: Mark Brown 
Acked-by: Wolfram Sang 
Acked-by: Neil Armstrong 
Acked-by: Alexandre Belloni 
Acked-by: Jonathan Cameron 
Acked-by: Benjamin Tissoires 
Acked-by: Dmitry Torokhov 
Acked-by: Sebastian Reichel 
Acked-by: Chanwoo Choi 
Reviewed-by: Gwendal Grignou 
Tested-by: Gwendal Grignou 
Series changes: 3
- Fix dereferencing pointer to incomplete type 'struct cros_ec_dev' (lkp)
Signed-off-by: Lee Jones

mfd / platform: cros_ec: Move cros-ec core driver out from MFD

2019-09-02T10:33:12+00:00

Now, the ChromeOS EC core driver has nothing related to an MFD device, so
move that driver from the MFD subsystem to the platform/chrome subsystem.

Signed-off-by: Enric Balletbo i Serra 
Acked-by: Andy Shevchenko 
Acked-by: Thierry Reding 
Acked-by: Mark Brown 
Acked-by: Wolfram Sang 
Acked-by: Neil Armstrong 
Acked-by: Alexandre Belloni 
Acked-by: Jonathan Cameron 
Acked-by: Benjamin Tissoires 
Acked-by: Dmitry Torokhov 
Acked-by: Sebastian Reichel 
Acked-by: Chanwoo Choi 
Reviewed-by: Gwendal Grignou 
Tested-by: Gwendal Grignou 
Signed-off-by: Lee Jones

media: sun4i: Make sun4i_csi_formats static

2019-08-30T17:44:17+00:00

The sun4i_csi_formats array is only used in sun4i_v4l2.c, so it doesn't
make any sense to have it !static.

[Sakari Ailus: const static -> static const]

Reported-by: Hans Verkuil 
Signed-off-by: Maxime Ripard 
Signed-off-by: Sakari Ailus 
Signed-off-by: Mauro Carvalho Chehab

media: stm32-dcmi: Delete an unnecessary of_node_put() call in dcmi_probe()

2019-08-29T13:23:02+00:00

A null pointer would be passed to a call of the function “of_node_put”
immediately after a call of the function “of_graph_get_next_endpoint”
failed at one place.
Remove this superfluous function call.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: don't do a 31 bit shift on a signed int

2019-08-26T17:11:10+00:00

On 32-bits archs, a signed integer has 31 bits plus on extra
bit for signal. Due to that, touching the 32th bit with something
like:

	int bar = 1 << 31;

has an undefined behavior in C on 32 bit architectures, as it
touches the signal bit. This is warned by cppcheck.

Instead, force the numbers to be unsigned, in order to solve this
issue.

Signed-off-by: Mauro Carvalho Chehab

media: use the BIT() macro

2019-08-26T17:08:50+00:00

As warned by cppcheck:

	[drivers/media/dvb-frontends/cx24123.c:434]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour
	[drivers/media/pci/bt8xx/bttv-input.c:87]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour
	[drivers/media/pci/bt8xx/bttv-input.c:98]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour
			...
	[drivers/media/v4l2-core/v4l2-ioctl.c:1391]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour

There are lots of places where we're doing 1 << 31. That's bad,
as, depending on the architecture, this has an undefined behavior.

The BIT() macro is already prepared to handle this, so, let's
just switch all "1 << number" macros by BIT(number) at the header files
with has 1 << 31.

Reviewed-by: Sylwester Nawrocki  # exynos4-is and s3c-camif
Reviewed-by: Laurent Pinchart  # omap3isp, vsp1, xilinx, wl128x and ipu3
Reviewed-by: Benoit Parrot  # am437x and ti-vpe
Signed-off-by: Mauro Carvalho Chehab