linux-stable.git/drivers/media, branch v5.9.1

media: usbtv: Fix refcounting mixup

2020-10-17T06:31:21+00:00

commit bf65f8aabdb37bc1a785884374e919477fe13e10 upstream.

The premature free in the error path is blocked by V4L
refcounting, not USB refcounting. Thanks to
Ben Hutchings for review.

[v2] corrected attributions

Signed-off-by: Oliver Neukum 
Fixes: 50e704453553 ("media: usbtv: prevent double free in error case")
CC: stable@vger.kernel.org
Reported-by: Ben Hutchings 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'media/v5.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2020-09-24T16:05:04+00:00

Pull media fixes from Mauro Carvalho Chehab:

 - fix a regression at the CEC adapter core

 - two uAPI patches (one revert) for changes in this development cycle

* tag 'media/v5.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: dt-bindings: media: imx274: Convert to json-schema
  media: media/v4l2: remove V4L2_FLAG_MEMORY_NON_CONSISTENT flag
  media: cec-adap.c: don't use flush_scheduled_work()

media: media/v4l2: remove V4L2_FLAG_MEMORY_NON_CONSISTENT flag

2020-09-14T13:28:06+00:00

The patch partially reverts some of the UAPI bits of the buffer
cache management hints. Namely, the queue consistency (memory
coherency) user-space hint because, as it turned out, the kernel
implementation of this feature was misusing DMA_ATTR_NON_CONSISTENT.

The patch reverts both kernel and user space parts: removes the
DMA consistency attr functions, rolls back changes to v4l2_requestbuffers,
v4l2_create_buffers structures and corresponding UAPI functions
(plus compat32 layer) and cleans up the documentation.

[hverkuil: fixed a few typos in the commit log]
[hverkuil: fixed vb2_core_reqbufs call in drivers/media/dvb-core/dvb_vb2.c]
[mchehab: fixed a typo in the commit log: revers->reverts]

Signed-off-by: Christoph Hellwig 
Signed-off-by: Sergey Senozhatsky 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: cec-adap.c: don't use flush_scheduled_work()

2020-09-10T12:05:10+00:00

For some inexplicable reason I decided to call flush_scheduled_work()
instead of cancel_delayed_work_sync(). The problem with that is that
flush_scheduled_work() waits for *all* queued scheduled work to be
completed instead of just the work itself.

This can cause a deadlock if a CEC driver also schedules work that
takes the same lock. See the comments for flush_scheduled_work() in
linux/workqueue.h.

This is exactly what has been observed a few times.

This patch simply replaces flush_scheduled_work() by
cancel_delayed_work_sync().

Signed-off-by: Hans Verkuil 
Cc:       # for v5.8 and up
Signed-off-by: Mauro Carvalho Chehab

Merge tag 'media/v5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2020-09-03T15:22:16+00:00

Pull media fixes from Mauro Carvalho Chehab:

 - a compilation fix issue with ti-vpe on arm 32 bits

 - two Kconfig fixes for imx214 and max9286 drivers

 - a kernel information leak at v4l2-core on time32 compat ioctls

 - some fixes at rc core unbind logic

 - a fix at mceusb driver for it to not use GFP_ATOMIC

 - fixes at cedrus and vicodec drivers at the control handling logic

 - a fix at gpio-ir-tx to avoid disabling interruts on a spinlock

* tag 'media/v5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: mceusb: Avoid GFP_ATOMIC where it is not needed
  media: gpio-ir-tx: spinlock is not needed to disable interrupts
  media: rc: do not access device via sysfs after rc_unregister_device()
  media: rc: uevent sysfs file races with rc_unregister_device()
  media: max9286: Depend on OF_GPIO
  media: i2c: imx214: select V4L2_FWNODE
  media: cedrus: Add missing v4l2_ctrl_request_hdl_put()
  media: vicodec: add missing v4l2_ctrl_request_hdl_put()
  media: media/v4l2-core: Fix kernel-infoleak in video_put_user()
  media: ti-vpe: cal: Fix compilation on 32-bit ARM

media: mceusb: Avoid GFP_ATOMIC where it is not needed

2020-08-28T12:06:36+00:00

There is no point in using GFP_ATOMIC here.
It is a probe function, and GFP_KERNEL is already used the line before
and the line after.

Use GFP_KERNEL instead.

Signed-off-by: Christophe JAILLET 
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab

media: gpio-ir-tx: spinlock is not needed to disable interrupts

2020-08-28T12:06:36+00:00

During bit-banging the IR on a gpio pin, we cannot be scheduled or have
anything interrupt us, else the generated signal will be incorrect.
Therefore, we need to disable interrupts on the local cpu. This also
disables preemption.

local_irq_disable() does exactly what we need and does not require a
spinlock.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab

media: rc: do not access device via sysfs after rc_unregister_device()

2020-08-28T12:06:36+00:00

Device drivers do not expect to have change_protocol or wakeup
re-programming to be accesed after rc_unregister_device(). This can
cause the device driver to access deallocated resources.

Cc:  # 4.16+
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab

media: rc: uevent sysfs file races with rc_unregister_device()

2020-08-28T12:06:35+00:00

Only report uevent file contents if device still registered, else we
might read freed memory.

Reported-by: syzbot+ceef16277388d6f24898@syzkaller.appspotmail.com
Cc: Hillf Danton 
Cc:  # 4.16+
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab

media: max9286: Depend on OF_GPIO

2020-08-28T09:03:36+00:00

The driver expects struct gpio_chip has of_node field and that field is
only there if CONFIG_OF_GPIO is defined. Fix this by changing the OF
dependency to OF_GPIO.

Reported-by: kernel test robot 
Signed-off-by: Sakari Ailus 
Reviewed-by: Kieran Bingham 
Signed-off-by: Mauro Carvalho Chehab