linux.git/drivers/media, branch v3.2-rc2

Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2011-11-12T02:03:50+00:00

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] v4l2-ctrl: Send change events to all fh for auto cluster slave controls
  [media] v4l2-event: Don't set sev->fh to NULL on unsubscribe
  [media] v4l2-event: Remove pending events from fh event queue when unsubscribing
  [media] v4l2-event: Deny subscribing with a type of V4L2_EVENT_ALL
  [media] MAINTAINERS: add a maintainer for s5p-mfc driver
  [media] v4l: s5p-mfc: fix reported capabilities
  [media] media: vb2: reset queued list on REQBUFS(0) call
  [media] media: vb2: set buffer length correctly for all buffer types
  [media] media: vb2: add a check for uninitialized buffer
  [media] mxl111sf: fix build warning
  [media] mxl111sf: remove pointless if condition in mxl111sf_config_spi
  [media] mxl111sf: check for errors after mxl111sf_write_reg in mxl111sf_idac_config
  [media] mxl111sf: fix return value of mxl111sf_idac_config
  [media] uvcvideo: GET_RES should only be checked for BITMAP type menu controls

drivers/media: video/a5k6aa is a module and so needs module.h

2011-11-08T19:56:50+00:00

This file uses core functions like module_init() and module_exit()
and so it explicitly needs to include the module.h header.

Signed-off-by: Paul Gortmaker

[media] v4l2-ctrl: Send change events to all fh for auto cluster slave controls

2011-11-08T12:30:33+00:00

Otherwise the fh changing the master control won't get the inactive state
change event for the slave controls.

Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab

[media] v4l2-event: Don't set sev->fh to NULL on unsubscribe

2011-11-08T12:29:51+00:00

Setting sev->fh to NULL causes problems for the del op added in the next
patch of this series, since this op needs a way to get to its own data
structures, and typically this will be done by using container_of on an
embedded v4l2_fh struct.

The reason the original code is setting sev->fh to NULL is to signal
to users of the event framework that the unsubscription has happened,
but since their is no shared lock between the event framework and users
of it, this is inherently racy, and it also turns out to be unnecessary
as long as both the event framework and the user of the framework do their
own locking properly and the user guarantees that it holds no references
to the subcribed_event structure after its del operation has been called.

This is best explained by looking at the only code currently checking for
sev->fh being set to NULL on unsubscribe, which is the v4l2-ctrls.c send_event
function. Here is the relevant code from v4l2-ctrls: send_event():

	if (sev->fh && (sev->fh != fh ||
			(sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK)))
		v4l2_event_queue_fh(sev->fh, &ev);

Now lets say that v4l2_event_unsubscribe and v4l2-ctrls: send_event() race
on the same sev, then the following could happens:

1) send_event checks sev->fh, finds it is not NULL

2) v4l2_event_unsubscribe sets sev->fh NULL
3) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
   as the thread calling send_event holds the ctrl_lock

4) send_event calls v4l2_event_queue_fh(sev->fh, &ev) which not is equivalent
   to calling: v4l2_event_queue_fh(NULL, &ev)
5) oops, NULL pointer deref.

Now again without setting sev->fh to NULL in v4l2_event_unsubscribe and
without the (now senseless since always true) sev->fh != NULL check in

1) send_event is about to call v4l2_event_queue_fh(sev->fh, &ev)

2) v4l2_event_unsubscribe removes sev->list from the fh->subscribed list

3) send_event calls v4l2_event_queue_fh(sev->fh, &ev)
4) v4l2_event_queue_fh blocks on the fh_lock spinlock

5) v4l2_event_unsubscribe unlocks the fh_lock spinlock
6) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
   as the thread calling send_event holds the ctrl_lock

8) v4l2_event_queue_fh takes the fh_lock
7) v4l2_event_queue_fh calls v4l2_event_subscribed, does not find it since
   sev->list has been removed from fh->subscribed already -> does nothing
9) v4l2_event_queue_fh releases the fh_lock
10) the caller of send_event releases the ctrl lock (mutex)

11) v4l2_ctrls del_event takes the ctrl lock
12) v4l2_ctrls del_event removes sev->node from the ev_subs list
13) v4l2_ctrls del_event releases the ctrl lock
14) v4l2_event_unsubscribe frees the sev, to which no references are being
    held anymore

Signed-off-by: Hans de Goede 
Acked-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

[media] v4l2-event: Remove pending events from fh event queue when unsubscribing

2011-11-08T12:29:29+00:00

The kev pointers inside the pending events queue (the available queue) of the
fh point to data inside the sev, unsubscribing frees the sev, thus making these
pointers point to freed memory!

This patch fixes these dangling pointers in the available queue by removing
all matching pending events on unsubscription.

Signed-off-by: Hans de Goede 
Acked-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

[media] v4l2-event: Deny subscribing with a type of V4L2_EVENT_ALL

2011-11-08T12:29:05+00:00

Signed-off-by: Hans de Goede 
Acked-by: Laurent Pinchart 
Acked-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

[media] v4l: s5p-mfc: fix reported capabilities

2011-11-08T11:06:09+00:00

MFC uses the multi-plane API, but it reported single-plane
when querying capabilities.

Signed-off-by: Kamil Debski 
Signed-off-by: Kyungmin Park 
Signed-off-by: Marek Szyprowski 
Signed-off-by: Mauro Carvalho Chehab

[media] media: vb2: reset queued list on REQBUFS(0) call

2011-11-08T11:05:41+00:00

Queued list was not reset on REQBUFS(0) call. This caused to enqueue a
freed buffer to the driver.

Reported-by: Angela Wan 
Signed-off-by: Marek Szyprowski 
Signed-off-by: Kyungmin Park 
Signed-off-by: Mauro Carvalho Chehab

[media] media: vb2: set buffer length correctly for all buffer types

2011-11-08T11:05:23+00:00

v4l2_planes[plane].length field was not initialized for userptr buffers.
This patch fixes this issue.

Signed-off-by: Marek Szyprowski 
Signed-off-by: Kyungmin Park 
CC: Pawel Osciak 
Signed-off-by: Mauro Carvalho Chehab

[media] media: vb2: add a check for uninitialized buffer

2011-11-08T10:59:33+00:00

__buffer_in_use() might be called for empty/uninitialized buffer in the
following scenario: REQBUF(n, USER_PTR), QUERYBUF(). This patch fixes
kernel ops in such case.

Signed-off-by: Marek Szyprowski 
Signed-off-by: Kyungmin Park 
CC: Pawel Osciak 
Signed-off-by: Mauro Carvalho Chehab