1. 18 7月, 2016 3 次提交
  2. 28 6月, 2016 4 次提交
  3. 22 6月, 2016 1 次提交
  4. 16 6月, 2016 4 次提交
    • M
      [media] media-devnode.h: Fix documentation · 0db5c799
      Mauro Carvalho Chehab 提交于
      Two parameters were documented with a wrong name, and a struct
      device pointer description was missing.
      
      That caused the following warnings, when building documentation:
      
      include/media/media-devnode.h:102: warning: No description found for parameter 'media_dev'
      include/media/media-devnode.h:126: warning: No description found for parameter 'mdev'
      include/media/media-devnode.h:126: warning: Excess function parameter 'media_dev' description in 'media_devnode_register'
      
      Rename the description, to match the function parameter and fix
      Documentation.
      
      No funcional changes.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      0db5c799
    • S
      [media] media: fix media devnode ioctl/syscall and unregister race · 6f0dd24a
      Shuah Khan 提交于
      Media devnode open/ioctl could be in progress when media device unregister
      is initiated. System calls and ioctls check media device registered status
      at the beginning, however, there is a window where unregister could be in
      progress without changing the media devnode status to unregistered.
      
      process 1				process 2
      fd = open(/dev/media0)
      media_devnode_is_registered()
      	(returns true here)
      
      					media_device_unregister()
      						(unregister is in progress
      						and devnode isn't
      						unregistered yet)
      					...
      ioctl(fd, ...)
      __media_ioctl()
      media_devnode_is_registered()
      	(returns true here)
      					...
      					media_devnode_unregister()
      					...
      					(driver releases the media device
      					memory)
      
      media_device_ioctl()
      	(By this point
      	devnode->media_dev does not
      	point to allocated memory.
      	use-after free in in mutex_lock_nested)
      
      BUG: KASAN: use-after-free in mutex_lock_nested+0x79c/0x800 at addr
      ffff8801ebe914f0
      
      Fix it by clearing register bit when unregister starts to avoid the race.
      
      process 1                               process 2
      fd = open(/dev/media0)
      media_devnode_is_registered()
              (could return true here)
      
                                              media_device_unregister()
                                                      (clear the register bit,
      						 then start unregister.)
                                              ...
      ioctl(fd, ...)
      __media_ioctl()
      media_devnode_is_registered()
              (return false here, ioctl
      	 returns I/O error, and
      	 will not access media
      	 device memory)
                                              ...
                                              media_devnode_unregister()
                                              ...
                                              (driver releases the media device
      					 memory)
      Signed-off-by: NShuah Khan <shuahkh@osg.samsung.com>
      Suggested-by: NSakari Ailus <sakari.ailus@linux.intel.com>
      Reported-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Tested-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      6f0dd24a
    • M
      [media] media-device: dynamically allocate struct media_devnode · a087ce70
      Mauro Carvalho Chehab 提交于
      struct media_devnode is currently embedded at struct media_device.
      
      While this works fine during normal usage, it leads to a race
      condition during devnode unregister. the problem is that drivers
      assume that, after calling media_device_unregister(), the struct
      that contains media_device can be freed. This is not true, as it
      can't be freed until userspace closes all opened /dev/media devnodes.
      
      In other words, if the media devnode is still open, and media_device
      gets freed, any call to an ioctl will make the core to try to access
      struct media_device, with will cause an use-after-free and even GPF.
      
      Fix this by dynamically allocating the struct media_devnode and only
      freeing it when it is safe.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      a087ce70
    • M
      [media] media-devnode: fix namespace mess · 163f1e93
      Mauro Carvalho Chehab 提交于
      Along all media controller code, "mdev" is used to represent
      a pointer to struct media_device, and "devnode" for a pointer
      to struct media_devnode.
      
      However, inside media-devnode.[ch], "mdev" is used to represent
      a pointer to struct media_devnode.
      
      This is very confusing and may lead to development errors.
      
      So, let's change all occurrences at media-devnode.[ch] to
      also use "devnode" for such pointers.
      
      This patch doesn't make any functional changes.
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
      163f1e93
  5. 15 6月, 2016 1 次提交
  6. 03 6月, 2016 1 次提交
    • M
      media: vb2-dma-contig: add helper for setting dma max seg size · 3f033969
      Marek Szyprowski 提交于
      Add a helper function for device drivers to set DMA's max_seg_size.
      Setting it to largest possible value lets DMA-mapping API always create
      contiguous mappings in DMA address space. This is essential for all
      devices, which use dma-contig videobuf2 memory allocator and shared
      buffers.
      
      Till now, the only case when vb2-dma-contig really 'worked' was a case
      where userspace provided USERPTR buffer, which was in fact mmaped
      contiguous buffer from the other v4l2/drm device. Also DMABUF made of
      contiguous buffer worked only when its exporter did not split it into
      several chunks in the scatter-list. Any other buffer failed, regardless
      of the arch/platform used and the presence of the IOMMU of the device bus.
      
      This patch provides interface to fix this issue.
      Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
      3f033969
  7. 07 5月, 2016 1 次提交
  8. 25 4月, 2016 1 次提交
  9. 21 4月, 2016 5 次提交
  10. 14 4月, 2016 8 次提交
  11. 06 4月, 2016 2 次提交
  12. 04 3月, 2016 2 次提交
    • H
      [media] v4l2-mc.h: fix yet more compiler errors · 1e89f584
      Hans Verkuil 提交于
      The newly added functions have an extra semicolon, which
      prevents compilation, and they need to be marked inline:
      
      In file included from ../include/media/tuner.h:23:0,
                       from ../drivers/media/tuners/tuner-simple.c:10:
      ../include/media/v4l2-mc.h:233:1: error: expected identifier or '(' before '{' token
      
      Remove spurious return, remove copy-and-pasted semi-colons, add static
      inline.
      
      Fixes: a77bf704 ("v4l2-mc.h: Add stubs for the V4L2 PM/pipeline routines")
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      1e89f584
    • H
      [media] v4l2-mc.h: fix compiler warnings · 9532e6bb
      Hans Verkuil 提交于
      Fix these warnings when CONFIG_MEDIA_CONTROLLER is not defined:
      
      In file included from drivers/media/v4l2-core/v4l2-fh.c:32:0:
      include/media/v4l2-mc.h:173:12: warning: 'v4l_enable_media_source' defined but not used [-Wunused-function]
       static int v4l_enable_media_source(struct video_device *vdev)
                  ^
      include/media/v4l2-mc.h:183:12: warning: 'v4l_vb2q_enable_media_source' defined but not used [-Wunused-function]
       static int v4l_vb2q_enable_media_source(struct vb2_queue *q)
                  ^
      In file included from include/media/tuner.h:23:0,
                       from drivers/media/tuners/tuner-types.c:9:
      include/media/v4l2-mc.h:173:12: warning: 'v4l_enable_media_source' defined but not used [-Wunused-function]
       static int v4l_enable_media_source(struct video_device *vdev)
                  ^
      include/media/v4l2-mc.h:178:13: warning: 'v4l_disable_media_source' defined but not used [-Wunused-function]
       static void v4l_disable_media_source(struct video_device *vdev)
                   ^
      Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
      9532e6bb
  13. 03 3月, 2016 7 次提交