Those are useful formats that should be handled.
Signed-off-by: NThibault Saunier <thibault.saunier@osg.samsung.com>
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Acked-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

In the case of semi planar formats cb and cr are in the same plane
in memory, meaning that will be set to 'cb' whatever the format is,
and whatever the (packed) order of those components are.
Suggested-by: NNicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: NThibault Saunier <thibault.saunier@osg.samsung.com>
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Acked-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

tveeprom_hauppauge_analog() used to need the I2C adapter in
order to print debug messages. As it now uses pr_foo() facilities
since commit 6037b3ca ("[media] tveeprom: print log messages
using pr_foo()"), the first argument of the function is not
needed anymore.

So, get rid of it.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The device driver platform is actually written to during registration,
for setting the owner field, so platform_driver_register() does not
take a const pointer:

drivers/media/platform/coda/imx-vdoa.c: In function 'vdoa_driver_init':
drivers/media/platform/coda/imx-vdoa.c:333:213: error: passing argument 1 of '__platform_driver_register' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
 module_platform_driver(vdoa_driver);
In file included from drivers/media/platform/coda/imx-vdoa.c:22:0:
include/linux/platform_device.h:199:12: note: expected 'struct platform_driver *' but argument is of type 'const struct platform_driver *'
 extern int __platform_driver_register(struct platform_driver *,
            ^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/media/platform/coda/imx-vdoa.c: In function 'vdoa_driver_exit':
drivers/media/platform/coda/imx-vdoa.c:333:626: error: passing argument 1 of 'platform_driver_unregister' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]

Remove the modifier again.

Fixes: d2fe28fe ("[media] coda/imx-vdoa: constify structs")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

While testing with CONFIG_UBSAN, I got this warning:

drivers/media/i2c/tc358743.c: In function 'tc358743_probe':
drivers/media/i2c/tc358743.c:1930:1: error: the frame size of 2480 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]

The problem is that the i2c_rd8/wr8/rd16/... functions in this driver pass
a pointer to a local variable into a common function, and each call to one
of them adds another variable plus redzone to the stack.

I also noticed that the way this is done is broken on big-endian machines,
as we copy the registers in CPU byte order.

To address both those problems, I'm adding two helper functions for reading
a register of up to 32 bits with correct endianess and change all other
functions to use that instead. Just to be sure we don't get the problem
back with changed optimizations in gcc, I'm also marking the new functions
as 'noinline', although my tests with gcc-7 don't require that.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

mxl111sf uses a lot of kernel stack memory as it puts an i2c_client
structure on the stack:

drivers/media/usb/dvb-usb-v2/mxl111sf.c: In function 'mxl111sf_init':
drivers/media/usb/dvb-usb-v2/mxl111sf.c:953:1: error: the frame size of 1248 bytes is larger than 1152 bytes [-Werror=frame-larger-than=]

We can avoid doing this by open-coding the call to i2c_transfer()
instead of calling tveeprom_read(), and not passing an i2c_client
pointer to tveeprom_hauppauge_analog(), which would ignore that
anyway.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The cx231xx_do_i2c_scan function needs a lot of stack because
it puts an i2c_client structure on it:

drivers/media/usb/cx231xx/cx231xx-i2c.c: In function 'cx231xx_do_i2c_scan':
drivers/media/usb/cx231xx/cx231xx-i2c.c:518:1: error: the frame size of 1248 bytes is larger than 1152 bytes [-Werror=frame-larger-than=]

This changes it to call i2c_transfer() directly instead, avoiding the
need for the structure.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The driver uses a relatively large data structure on the stack, which
showed up on my radar as we get a warning with the "latent entropy"
GCC plugin:

drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:153:1: error: the frame size of 1376 bytes is larger than 1152 bytes [-Werror=frame-larger-than=]

The warning is usually hidden as we raise the warning limit to 2048
when the plugin is enabled, but I'd like to lower that again in the
future, and making this function smaller helps to do that without
build regressions.

Further analysis shows that putting an 'i2c_client' structure on
the stack is not really supported, as the embedded 'struct device'
is not initialized here, and we are only saved by the fact that
the function that is called here does not use the pointer at all.

Fixes: d855497e ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

It allows to simulate the behavior of hardware with such limitations or
to connect vivid to real hardware with such limitations.

Add the "allocators" module parameter option to let vivid use the
dma-contig instead of vmalloc.
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NVincent Abriou <vincent.abriou@st.com>
Reviewed-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Tested-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Image Sensor Controller has an internal image processor.
It can convert raw format to the other formats, like
RGB565, YUV420P. A module parameter 'sensor_preferred'
is used to enable or disable the pipeline function.
Some v4l2 controls are added to tuning the image when
the pipeline function is enabled.
Signed-off-by: NSongjun Wu <songjun.wu@microchip.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The File handle is not yet added in the vdev list.So no need to call
v4l2_fh_del(&ctx->fh)if it fails to create control.
Signed-off-by: NShailendra Verma <shailendra.v@samsung.com>
Reviewed-by: NFabien Dessenne <fabien.dessenne@st.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Reported as a Kaffeine bug:
	https://bugs.kde.org/show_bug.cgi?id=375811

The USB control messages require DMA to work. We cannot pass
a stack-allocated buffer, as it is not warranted that the
stack would be into a DMA enabled area.

On Kernel 4.9, the default is to not accept DMA on stack anymore
on x86 architecture. On other architectures, this has been a
requirement since Kernel 2.2. So, after this patch, this driver
should likely work fine on all archs.

Tested with USB ID 2040:5510: Hauppauge Windham

Cc: stable@vger.kernel.org
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Poll messages that are used to allocate a logical address should
use the same initiator as the destination. Instead, it expected that
the initiator was 0xf which is not according to the standard.

This also had consequences for the message checks in cec_transmit_msg_fh
that incorrectly rejected poll messages with the same initiator and
destination.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

After removing DEBUG from mtk_vcodec_util.h, some build warnings are
generated as the following:
.../drivers/media/platform/mtk-vcodec/vdec_vpu_if.c: In function 'vcodec_vpu_send_msg':
.../drivers/media/platform/mtk-vcodec/vdec_vpu_if.c:73:11: warning: unused variable 'msg_id' [-Wunused-variable]
  uint32_t msg_id = *(uint32_t *)msg;
           ^
.../drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c: In function 'vb2ops_vdec_buf_queue':
.../drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c:1129:7: warning: unused variable 'log_level' [-Wunused-variable]
   int log_level = ret ? 0 : 1;
       ^
.../drivers/media/platform/mtk-vcodec/venc_vpu_if.c: In function 'vpu_enc_send_msg':
.../drivers/media/platform/mtk-vcodec/venc_vpu_if.c:82:12: warning: unused variable 'msg_id' [-Wunused-variable]
   uint32_t msg_id = *(uint32_t *)msg;
            ^

It is because mtk_vcodec_debug() and mtk_vcodec_err() are defined as empty
macros. Without DEBUG definition, the variable for debugging is not used
anymore. Fixing build warnings by moving the assignment of the
variable to the argument of mtk_vcodec_debug() and mtk_vcodec_err().
Within the patch, build pass with/without DEBUG definition, and functions
still work fine.
Signed-off-by: NMinghsiu Tsai <minghsiu.tsai@mediatek.com>
Reviewed-by: NDaniel Kurtz <djkurtz@chromium.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

If the USB driver is enabled but the demodulator is not, we get a link error:

ERROR: "zd1301_demod_get_dvb_frontend" [drivers/media/usb/dvb-usb-v2/zd1301.ko] undefined!
ERROR: "zd1301_demod_get_i2c_adapter" [drivers/media/usb/dvb-usb-v2/zd1301.ko] undefined!

Such a configuration obviously makes no sense, but we should not fail
the build.  This tries to mimic what we have for other drivers by turning
the build failure into a runtime failure.

Alternatively we could use an unconditional 'select' or 'depends on' to enforce
a sane configuration.

Fixes: 47d65372 ("[media] zd1301_demod: ZyDAS ZD1301 DVB-T demodulator driver")
Fixes: 992b3987 ("[media] zd1301: ZyDAS ZD1301 DVB USB interface driver")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Signed-off-by: NLubomir Rintel <lkundrak@v3.sk>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Commit 17ce039b ("[media] cxusb: don't do DMA on stack")
added a kmalloc'ed bounce buffer for writes, but missed to do the same
for reads. As the read only happens after the write is finished, we can
reuse the same buffer.

As dvb_usb_generic_rw handles a read length of 0 by itself, avoid calling
it using the dvb_usb_generic_read wrapper function.
Signed-off-by: NStefan Brüns <stefan.bruens@rwth-aachen.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

gcc-7.0.1 warns about old code in ttpci:

In file included from drivers/media/pci/ttpci/av7110.c:63:0:
In function 'irdebi.isra.2',
    inlined from 'start_debi_dma' at drivers/media/pci/ttpci/av7110.c:376:3,
    inlined from 'gpioirq' at drivers/media/pci/ttpci/av7110.c:659:3:
drivers/media/pci/ttpci/av7110_hw.h:406:3: warning: 'memcpy': specified size between 18446744071562067968 and 18446744073709551615 exceeds maximum object size 9223372036854775807 [-Wstringop-overflow=]
   memcpy(av7110->debi_virt, (char *) &res, count);
In function 'irdebi.isra.2',
    inlined from 'start_debi_dma' at drivers/media/pci/ttpci/av7110.c:376:3,
    inlined from 'gpioirq' at drivers/media/pci/ttpci/av7110.c:668:3:
drivers/media/pci/ttpci/av7110_hw.h:406:3: warning: 'memcpy': specified size between 18446744071562067968 and 18446744073709551615 exceeds maximum object size 9223372036854775807 [-Wstringop-overflow=]
   memcpy(av7110->debi_virt, (char *) &res, count);

Apparently, 'count' can be negative here, which will then get turned
into a giant size argument for memcpy. Changing the sizes to 'unsigned
int' instead seems safe as we already check for maximum sizes, and it
also simplifies the code a bit.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:

drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.

This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Adding Hama Hybrid DVB-T Stick support. Technically it's the same
device what Terratec Cinergy HT USB XE is.
Signed-off-by: NPiotr Oleszczyk <piotr.oleszczyk@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fix a compiler warning due to an unused but assigned variable.
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

drivers/media/i2c/et8ek8/et8ek8_driver.c:1112:3-4: Unneeded semicolon

 Remove unneeded semicolon.

Generated by: scripts/coccinelle/misc/semicolon.cocci

CC: Pavel Machek <pavel@ucw.cz>
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Acked-by: NPavel Machek <pavel@ucw.cz>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add simple 'functionality' member to dummy Exynos IS i2c adapter to make
i2c core happy and get rid of NULL pointer dereference during Exynos4 IS
probe since v4.10-rc1:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 80000005 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 100 Comm: kworker/1:2 Not tainted 4.10.0-rc6-next-20170131-00054-g39e6e4233de6 #1921
Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
Workqueue: events deferred_probe_work_func
task: ef2e0000 task.stack: ef2ec000
PC is at 0x0
LR is at i2c_register_adapter+0x98/0x5cc
...
[<c05040bc>] (i2c_register_adapter) from [<c05379d4>] (fimc_is_i2c_probe+0x84/0xe4)
[<c05379d4>] (fimc_is_i2c_probe) from [<c041b5c8>] (platform_drv_probe+0x50/0xb0)
[<c041b5c8>] (platform_drv_probe) from [<c0419f48>] (driver_probe_device+0x234/0x2dc)
[<c0419f48>] (driver_probe_device) from [<c04184e0>] (bus_for_each_drv+0x44/0x8c)
[<c04184e0>] (bus_for_each_drv) from [<c0419c8c>] (__device_attach+0x9c/0x100)
[<c0419c8c>] (__device_attach) from [<c0419374>] (bus_probe_device+0x84/0x8c)
[<c0419374>] (bus_probe_device) from [<c04178d4>] (device_add+0x380/0x528)
[<c04178d4>] (device_add) from [<c05aceb4>] (of_platform_device_create_pdata+0x70/0xa4)
[<c05aceb4>] (of_platform_device_create_pdata) from [<c05acfd4>] (of_platform_bus_create+0xec/0x320)
[<c05acfd4>] (of_platform_bus_create) from [<c05ad264>] (of_platform_populate+0x5c/0xac)
[<c05ad264>] (of_platform_populate) from [<c0533420>] (fimc_is_probe+0x1c0/0x4cc)
[<c0533420>] (fimc_is_probe) from [<c041b5c8>] (platform_drv_probe+0x50/0xb0)
[<c041b5c8>] (platform_drv_probe) from [<c0419f48>] (driver_probe_device+0x234/0x2dc)
[<c0419f48>] (driver_probe_device) from [<c04184e0>] (bus_for_each_drv+0x44/0x8c)
[<c04184e0>] (bus_for_each_drv) from [<c0419c8c>] (__device_attach+0x9c/0x100)
[<c0419c8c>] (__device_attach) from [<c0419374>] (bus_probe_device+0x84/0x8c)
[<c0419374>] (bus_probe_device) from [<c04197a8>] (deferred_probe_work_func+0x60/0x8c)
[<c04197a8>] (deferred_probe_work_func) from [<c01329a4>] (process_one_work+0x120/0x31c)
[<c01329a4>] (process_one_work) from [<c0132bc8>] (process_scheduled_works+0x28/0x38)
[<c0132bc8>] (process_scheduled_works) from [<c0132ddc>] (worker_thread+0x204/0x4ac)
[<c0132ddc>] (worker_thread) from [<c01381b8>] (kthread+0xfc/0x134)
[<c01381b8>] (kthread) from [<c01078b8>] (ret_from_fork+0x14/0x3c)
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

All lanes in data-lanes and clock-lanes properties should be unique. Add
a check for this in v4l2_of_parse_csi_bus() and print a warning if
duplicated lanes are found.
Signed-off-by: NNiklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

As warned by checkpatch:

	WARNING: struct of_device_id should normally be const
	#318: FILE: drivers/media/platform/coda/imx-vdoa.c:318:
	+static struct of_device_id vdoa_dt_ids[] = {

So, constify structs.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Adds some trace points showing input compressed stream or
output decoded frame information.
Adds an unconditional trace point when streaming starts showing
the compressed stream and the decoded frame information.
Adds an unconditional trace point at instance closure summarizing
into a single line the decoding process (stream information, decoded
and output frames number, potential errors observed).
Acked-by: NPeter Griffin <peter.griffin@linaro.org>
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Adds support of DELTA MJPEG video decoder back-end,
implemented by calling JPEG_DECODER_HW0 firmware
using RPMSG IPC communication layer.
Acked-by: NPeter Griffin <peter.griffin@linaro.org>
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

EOS (End Of Stream) support allows user to get
all the potential decoded frames remaining in decoder
pipeline after having reached the end of video bitstream.
To do so, user calls VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP)
which will drain the decoder and get the drained frames
that are then returned to user.
User is informed of EOS completion in two ways:
 - dequeue of an empty frame flagged to V4L2_BUF_FLAG_LAST
 - reception of a V4L2_EVENT_EOS event.
If, unfortunately, no buffer is available on CAPTURE queue
to return the empty frame, EOS is delayed till user queue
one CAPTURE buffer.
Acked-by: NPeter Griffin <peter.griffin@linaro.org>
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

IPC (Inter Process Communication) support for communication with
DELTA coprocessor firmware using rpmsg kernel framework.
Based on 4 services open/set_stream/decode/close and their associated
rpmsg messages.
The messages structures are duplicated on both host and firmware
side and are packed (use only of 32 bits size fields in messages
structures to ensure packing).
Each service is synchronous; service returns only when firmware
acknowledges the associated command message.
Due to significant parameters size exchanged from host to copro,
parameters are not inserted in rpmsg messages. Instead, parameters are
stored in physical memory shared between host and coprocessor.
Memory is non-cacheable, so no special operation is required
to ensure memory coherency on host and on coprocessor side.
Multi-instance support and re-entrance are ensured using host_hdl and
copro_hdl in message header exchanged between both host and coprocessor.
This avoids to manage tables on both sides to get back the running context
of each instance.
Acked-by: NPeter Griffin <peter.griffin@linaro.org>
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Helper functions used by decoder back-ends to allocate
physically contiguous memory required by hardware video
decoder.
Acked-by: NPeter Griffin <peter.griffin@linaro.org>
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This V4L2 driver enables DELTA multi-format video decoder
of STMicroelectronics STiH4xx SoC series.
Acked-by: NPeter Griffin <peter.griffin@linaro.org>
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Internal Master 3 Bus can send and receive only 4 bytes per time.
Signed-off-by: NOleh Kravchenko <oleg@kaa.org.ua>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch provide only digital support.
The device is based on Si2168 30-demodulator,
Si2158-20 tuner and CX23102-11Z chipset;
USB id: 1b80:d3b2.

Status:
- DVB-T2 works fine;
- Composite and SVideo works fine;
- Analog not implemented.
Signed-off-by: NOleh Kravchenko <oleg@kaa.org.ua>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

v4l2-async had several functions doing some operations and then
not undoing the operations in a failure situation. For example,
v4l2_async_test_notify() moved a subdev into notifier's done list
even if registering the subdev (v4l2_device_register_subdev) failed.
If the subdev was allocated and v4l2_async_register_subdev() called
from the driver's probe() function, as usually, the probe()
function freed the allocated subdev and returned a failure.
Nevertheless, the subdev was still left into the notifier's done
list, causing an access to already freed memory when the notifier
was later unregistered.

A hand-edited call trace leaving freed subdevs into the notifier:

v4l2_async_register_notifier(notifier, asd)
cameradrv_probe
 sd = devm_kzalloc()
 v4l2_async_register_subdev(sd)
  v4l2_async_test_notify(notifier, sd, asd)
   list_move(sd, &notifier->done)
   v4l2_device_register_subdev(notifier->v4l2_dev, sd)
    cameradrv_registered(sd) -> fails
->v4l2_async_register_subdev returns failure
->cameradrv_probe returns failure
->devres frees the allocated sd
->sd was freed but it still remains in the notifier's list.

This patch fixes this and several other cases where a failing
function could leave nodes into a linked list while the caller
might free the node due to a failure.
Signed-off-by: NTuukka Toivonen <tuukka.toivonen@intel.com>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

We should be returning negative error codes here or it leads to a crash.
This also silences a static checker warning.

	drivers/media/pci/mantis/mantis_cards.c:250 mantis_pci_probe()
	warn: 'mantis->dmxdev.dvbdev->fops' double freed
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

There isn't an ioctl to enum the supported field orders, so a user-space
application can call VIDIOC_TRY_FMT using different field orders to know
if one is supported. For example, GStreamer does this so during playback
dozens of the following messages appear in the kernel log buffer:

[ 442.143393] Not supported field order(4)

Instead of printing this as an error, just keep it as debug information.
Signed-off-by: NJavier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

As reported by Marc Duponcheel <marc@offline.be>, firmware load on
dvb-usb is using the stack, with is not allowed anymore on default
Kernel configurations:

[ 1025.958836] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in cold state, will try to load a firmware
[ 1025.958853] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[ 1025.958855] dvb-usb: could not stop the USB controller CPU.
[ 1025.958856] dvb-usb: error while transferring firmware (transferred size: -11, block size: 3)
[ 1025.958856] dvb-usb: firmware download failed at 8 with -22
[ 1025.958867] usbcore: registered new interface driver dvb_usb_dtt200u

[    2.789902] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[    2.789905] ------------[ cut here ]------------
[    2.789911] WARNING: CPU: 3 PID: 2196 at drivers/usb/core/hcd.c:1584 usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789912] transfer buffer not dma capable
[    2.789912] Modules linked in: btusb dvb_usb_dtt200u(+) dvb_usb_af9035(+) btrtl btbcm dvb_usb dvb_usb_v2 btintel dvb_core bluetooth rc_core rfkill x86_pkg_temp_thermal intel_powerclamp coretemp crc32_pclmul aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd drm_kms_helper syscopyarea sysfillrect pcspkr i2c_i801 sysimgblt fb_sys_fops drm i2c_smbus i2c_core r8169 lpc_ich mfd_core mii thermal fan rtc_cmos video button acpi_cpufreq processor snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd crc32c_intel ahci libahci libata xhci_pci ehci_pci xhci_hcd ehci_hcd usbcore usb_common dm_mirror dm_region_hash dm_log dm_mod
[    2.789936] CPU: 3 PID: 2196 Comm: systemd-udevd Not tainted 4.9.0-gentoo #1
[    2.789937] Hardware name: ASUS All Series/H81I-PLUS, BIOS 0401 07/23/2013
[    2.789938]  ffffc9000339b690 ffffffff812bd397 ffffc9000339b6e0 0000000000000000
[    2.789939]  ffffc9000339b6d0 ffffffff81055c86 000006300339b6a0 ffff880116c0c000
[    2.789941]  0000000000000000 0000000000000000 0000000000000001 ffff880116c08000
[    2.789942] Call Trace:
[    2.789945]  [<ffffffff812bd397>] dump_stack+0x4d/0x66
[    2.789947]  [<ffffffff81055c86>] __warn+0xc6/0xe0
[    2.789948]  [<ffffffff81055cea>] warn_slowpath_fmt+0x4a/0x50
[    2.789952]  [<ffffffffa006d460>] usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[    2.789954]  [<ffffffff814ed5a8>] ? io_schedule_timeout+0xd8/0x110
[    2.789956]  [<ffffffffa006e09c>] usb_hcd_submit_urb+0x9c/0x980 [usbcore]
[    2.789958]  [<ffffffff812d0ebf>] ? copy_page_to_iter+0x14f/0x2b0
[    2.789960]  [<ffffffff81126818>] ? pagecache_get_page+0x28/0x240
[    2.789962]  [<ffffffff8118c2a0>] ? touch_atime+0x20/0xa0
[    2.789964]  [<ffffffffa006f7c4>] usb_submit_urb+0x2c4/0x520 [usbcore]
[    2.789967]  [<ffffffffa006feca>] usb_start_wait_urb+0x5a/0xe0 [usbcore]
[    2.789969]  [<ffffffffa007000c>] usb_control_msg+0xbc/0xf0 [usbcore]
[    2.789970]  [<ffffffffa067903d>] usb_cypress_writemem+0x3d/0x40 [dvb_usb]
[    2.789972]  [<ffffffffa06791cf>] usb_cypress_load_firmware+0x4f/0x130 [dvb_usb]
[    2.789973]  [<ffffffff8109dbbe>] ? console_unlock+0x2fe/0x5d0
[    2.789974]  [<ffffffff8109e10c>] ? vprintk_emit+0x27c/0x410
[    2.789975]  [<ffffffff8109e40a>] ? vprintk_default+0x1a/0x20
[    2.789976]  [<ffffffff81124d76>] ? printk+0x43/0x4b
[    2.789977]  [<ffffffffa0679310>] dvb_usb_download_firmware+0x60/0xd0 [dvb_usb]
[    2.789979]  [<ffffffffa0679898>] dvb_usb_device_init+0x3d8/0x610 [dvb_usb]
[    2.789981]  [<ffffffffa069e302>] dtt200u_usb_probe+0x92/0xd0 [dvb_usb_dtt200u]
[    2.789984]  [<ffffffffa007420c>] usb_probe_interface+0xfc/0x270 [usbcore]
[    2.789985]  [<ffffffff8138bf95>] driver_probe_device+0x215/0x2d0
[    2.789986]  [<ffffffff8138c0e6>] __driver_attach+0x96/0xa0
[    2.789987]  [<ffffffff8138c050>] ? driver_probe_device+0x2d0/0x2d0
[    2.789988]  [<ffffffff81389ffb>] bus_for_each_dev+0x5b/0x90
[    2.789989]  [<ffffffff8138b7b9>] driver_attach+0x19/0x20
[    2.789990]  [<ffffffff8138b33c>] bus_add_driver+0x11c/0x220
[    2.789991]  [<ffffffff8138c91b>] driver_register+0x5b/0xd0
[    2.789994]  [<ffffffffa0072f6c>] usb_register_driver+0x7c/0x130 [usbcore]
[    2.789994]  [<ffffffffa06a5000>] ? 0xffffffffa06a5000
[    2.789996]  [<ffffffffa06a501e>] dtt200u_usb_driver_init+0x1e/0x20 [dvb_usb_dtt200u]
[    2.789997]  [<ffffffff81000408>] do_one_initcall+0x38/0x140
[    2.789998]  [<ffffffff8116001c>] ? __vunmap+0x7c/0xc0
[    2.789999]  [<ffffffff81124fb0>] ? do_init_module+0x22/0x1d2
[    2.790000]  [<ffffffff81124fe8>] do_init_module+0x5a/0x1d2
[    2.790002]  [<ffffffff810c96b1>] load_module+0x1e11/0x2580
[    2.790003]  [<ffffffff810c68b0>] ? show_taint+0x30/0x30
[    2.790004]  [<ffffffff81177250>] ? kernel_read_file+0x100/0x190
[    2.790005]  [<ffffffff810c9ffa>] SyS_finit_module+0xba/0xc0
[    2.790007]  [<ffffffff814f13e0>] entry_SYSCALL_64_fastpath+0x13/0x94
[    2.790008] ---[ end trace c78a74e78baec6fc ]---

So, allocate the structure dynamically.

Cc: stable@vger.kernel.org # Kernel 4.9+
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

It is likely that a "of_node_put(ep)" is missing here.
There is one in the previous error handling code, and one a few lines
below in the normal case as well.
Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Declare vb2_ops structure as const as it is only stored in
the ops field of a vb2_queue structure. This field is of type
const, so vb2_ops structures having same properties can be made
const too.
Done using Coccinelle:

@r1 disable optional_qualifier@
identifier i;
position p;
@@
static struct vb2_ops i@p={...};

@ok1@
identifier r1.i;
position p;
struct sta2x11_vip vip;
struct vb2_queue q;
@@
(
vip.vb_vidq.ops=&i@p
|
q.ops=&i@p
)

@bad@
position p!={r1.p,ok1.p};
identifier r1.i;
@@
i@p

@depends on !bad disable optional_qualifier@
identifier r1.i;
@@
+const
struct vb2_ops i;

File size details of media/dvb-frontends/rtl2832_sdr.o file remains the
same before and after applying the patch.
Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Declare vb2_ops structure as const as it is only stored in
the ops field of a vb2_queue structure. This field is of type
const, so vb2_ops structures having same properties can be made
const too.
Done using Coccinelle:

@r1 disable optional_qualifier@
identifier i;
position p;
@@
static struct vb2_ops i@p={...};

@ok1@
identifier r1.i;
position p;
struct sta2x11_vip vip;
struct vb2_queue q;
@@
(
vip.vb_vidq.ops=&i@p
|
q.ops=&i@p
)

@bad@
position p!={r1.p,ok1.p};
identifier r1.i;
@@
i@p

@depends on !bad disable optional_qualifier@
identifier r1.i;
@@
+const
struct vb2_ops i;

File size before:
   text	   data	    bss	    dec	    hex	filename
   8448	    440	      0	   8888	   22b8	media/pci/sta2x11/sta2x11_vip.o

File size after:
   text	   data	    bss	    dec	    hex	filename
   8552	    352	      0	   8904	   22c8	media/pci/sta2x11/sta2x11_vip.o
Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>