1. 14 3月, 2014 2 次提交
  2. 06 3月, 2014 2 次提交
  3. 04 2月, 2014 3 次提交
  4. 03 1月, 2014 6 次提交
  5. 10 12月, 2013 1 次提交
  6. 09 12月, 2013 1 次提交
    • R
      [media] videobuf2: Add missing lock held on vb2_fop_release · 1380f575
      Ricardo Ribalda 提交于
      vb2_fop_release does not hold the lock although it is modifying the
      queue->owner field.
      This could lead to race conditions on the vb2_perform_io function
      when multiple applications are accessing the video device via
      read/write API:
      [ 308.297741] BUG: unable to handle kernel NULL pointer dereference at
      0000000000000260
      [ 308.297759] IP: [<ffffffffa07a9fd2>] vb2_perform_fileio+0x372/0x610
      [videobuf2_core]
      [ 308.297794] PGD 159719067 PUD 158119067 PMD 0
      [ 308.297812] Oops: 0000 #1 SMP
      [ 308.297826] Modules linked in: qt5023_video videobuf2_dma_sg
      qtec_xform videobuf2_vmalloc videobuf2_memops videobuf2_core
      qtec_white qtec_mem gpio_xilinx qtec_cmosis qtec_pcie fglrx(PO)
      spi_xilinx spi_bitbang qt5023
      [ 308.297888] CPU: 1 PID: 2189 Comm: java Tainted: P O 3.11.0-qtec-standard #1
      [ 308.297919] Hardware name: QTechnology QT5022/QT5022, BIOS
      PM_2.1.0.309 X64 05/23/2013
      [ 308.297952] task: ffff8801564e1690 ti: ffff88014dc02000 task.ti:
      ffff88014dc02000
      [ 308.297962] RIP: 0010:[<ffffffffa07a9fd2>] [<ffffffffa07a9fd2>]
      vb2_perform_fileio+0x372/0x610 [videobuf2_core]
      [ 308.297985] RSP: 0018:ffff88014dc03df8 EFLAGS: 00010202
      [ 308.297995] RAX: 0000000000000000 RBX: ffff880158a23000 RCX: dead000000100100
      [ 308.298003] RDX: 0000000000000000 RSI: dead000000200200 RDI: 0000000000000000
      [ 308.298012] RBP: ffff88014dc03e58 R08: 0000000000000000 R09: 0000000000000001
      [ 308.298020] R10: ffffea00051e8380 R11: ffff88014dc03fd8 R12: ffff880158a23070
      [ 308.298029] R13: ffff8801549040b8 R14: 0000000000198000 R15: 0000000001887e60
      [ 308.298040] FS: 00007f65130d5700(0000) GS:ffff88015ed00000(0000)
      knlGS:0000000000000000
      [ 308.298049] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 308.298057] CR2: 0000000000000260 CR3: 0000000159630000 CR4: 00000000000007e0
      [ 308.298064] Stack:
      [ 308.298071] ffff880156416c00 0000000000198000 0000000000000000
      ffff880100000001
      [ 308.298087] ffff88014dc03f50 00000000810a79ca 0002000000000001
      ffff880154904718
      [ 308.298101] ffff880156416c00 0000000000198000 ffff880154904338
      ffff88014dc03f50
      [ 308.298116] Call Trace:
      [ 308.298143] [<ffffffffa07aa3c4>] vb2_read+0x14/0x20 [videobuf2_core]
      [ 308.298198] [<ffffffffa07aa494>] vb2_fop_read+0xc4/0x120 [videobuf2_core]
      [ 308.298252] [<ffffffff8154ee9e>] v4l2_read+0x7e/0xc0
      [ 308.298296] [<ffffffff8116e639>] vfs_read+0xa9/0x160
      [ 308.298312] [<ffffffff8116e882>] SyS_read+0x52/0xb0
      [ 308.298328] [<ffffffff81784179>] tracesys+0xd0/0xd5
      [ 308.298335] Code: e5 d6 ff ff 83 3d be 24 00 00 04 89 c2 4c 8b 45 b0
      44 8b 4d b8 0f 8f 20 02 00 00 85 d2 75 32 83 83 78 03 00 00 01 4b 8b
      44 c5 48 <8b> 88 60 02 00 00 85 c9 0f 84 b0 00 00 00 8b 40 58 89 c2 41
      89
      [ 308.298487] RIP [<ffffffffa07a9fd2>] vb2_perform_fileio+0x372/0x610
      [videobuf2_core]
      [ 308.298507] RSP <ffff88014dc03df8>
      [ 308.298514] CR2: 0000000000000260
      [ 308.298526] ---[ end trace e8f01717c96d1e41 ]---
      Signed-off-by: NRicardo Ribalda <ricardo.ribalda@gmail.com>
      Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
      Acked-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
      Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>
      1380f575
  7. 05 12月, 2013 4 次提交
  8. 30 11月, 2013 1 次提交
  9. 17 10月, 2013 2 次提交
  10. 04 10月, 2013 1 次提交
  11. 03 9月, 2013 2 次提交
    • S
      [media] exynos4-is: Fix entity unregistration on error path · d2b903b4
      Sylwester Nawrocki 提交于
      This patch corrects media entities unregistration order to make sure
      the fimc.N.capture and fimc-lite video nodes are unregistered with
      fimc->lock mutex held. This prevents races between video device open()
      and defered probing and NULL pointer dereference in open() callback
      as follows:
      [   77.645000] Unable to handle kernel NULL pointer dereference at virtual address 00000290t
      [   77.655000] pgd = ee7a8000
      [   77.660000] [00000290] *pgd=6e13c831, *pte=00000000, *ppte=00000000
      [   77.665000] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
      [   77.670000] Modules linked in: s5p_fimc ipv6 exynos_fimc_is exynos_fimc_lite
       s5p_csis v4l2_mem2mem videobuf2_dma_contig videobuf2_memops exynos4_is_common videobuf2_core [last unloaded: s5p_fimc]
      [   77.685000] CPU: 0 PID : 2998 Comm: v4l_id Tainted: G        W   3.10.0-next-20130709-00039-g39f491b-dirty #1548
      [   77.695000] task: ee084000 ti: ee46e000 task.ti: ee46e000
      [   77.700000] PC is at __mutex_lock_slowpath+0x54/0x368
      [   77.705000] LR is at __mutex_lock_slowpath+0x24/0x368
      [   77.710000] pc : [<c038dc10>]    lr : [<c038dbe0>]    psr: 60000093
      [   77.710000] sp : ee46fd70  ip : 000008c8  fp : c054e34c
      [   77.725000] r10: ee084000  r9 : 00000000  r8 : ee439480
      [   77.730000] r7 : ee46e000  r6 : 60000013  r5 : 00000290  r4 : 0000028c
      [   77.735000] r3 : 00000000  r2 : 00000000  r1 : 20000093  r0 : 00000001
      [   77.740000] Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM Segment user
      [   77.750000] Control: 10c5387d  Table: 6e7a804a  DAC: 00000015
      [   77.755000] Process v4l_id (pid: 2998, stack limit = 0xee46e238)
      [   77.760000] Stack: (0xee46fd70 to 0xee470000)
          	       ...
      [   77.935000] [<c038dc10>] (__mutex_lock_slowpath+0x54/0x368) from [<c038df30>] (mutex_lock+0xc/0x24)
      [   77.945000] [<c038df30>] (mutex_lock+0xc/0x24) from [<bf03fa90>] (fimc_lite_open+0x12c/0x2bc [exynos_fimc_lite])
      [   77.955000] [<bf03fa90>] (fimc_lite_open+0x12c/0x2bc [exynos_fimc_lite]) from [<c02ab11c>] (v4l2_open+0xa0/0xe0)
      [   77.965000] [<c02ab11c>] (v4l2_open+0xa0/0xe0) from [<c00b1de4>] (chrdev_open+0x88/0x170)
      [   77.975000] [<c00b1de4>] (chrdev_open+0x88/0x170) from [<c00ac710>] (do_dentry_open.isra.14+0x1d8/0x258)
      [   77.985000] [<c00ac710>] (do_dentry_open.isra.14+0x1d8/0x258) from [<c00ac860>] (finish_open+0x20/0x38)
      [   77.995000] [<c00ac860>] (finish_open+0x20/0x38) from [<c00ba658>] (do_last.isra.43+0x538/0xb1c)
      [   78.000000] [<c00ba658>] (do_last.isra.43+0x538/0xb1c) from [<c00bacf0>] (path_openat+0xb4/0x5c4)
      [   78.010000] [<c00bacf0>] (path_openat+0xb4/0x5c4) from [<c00bb4b4>] (do_filp_open+0x2c/0x80)
      [   78.020000] [<c00bb4b4>] (do_filp_open+0x2c/0x80) from [<c00ad744>] (do_sys_open+0xf4/0x1a8)
      [   78.025000] [<c00ad744>] (do_sys_open+0xf4/0x1a8) from [<c000e320>] (ret_fast_syscall+0x0/0x30)
      [   78.035000] Code: 1a000093 e10f6000 f10c0080 e2845004 (e1953f9f)
      Reported-by: NAndrzej Hajda <a.hajda@samsung.com>
      Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
      Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
      Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>
      Cc: stable@vger.kernel.org
      d2b903b4
    • A
      [media] exynos4-is: Fix fimc-lite bayer formats · 3396b096
      Arun Kumar K 提交于
      The 10-bit and 12-bit Bayer output formats supported by FIMC-LITE
      actually use 16 bits where the extra bits are padded with zeros.
      The patch corrects buffer allocation for these two formats by
      modifying the depth field. This prevents memory corruption by the
      output DMA due to insufficient buffer size.
      Signed-off-by: NArun Kumar K <arun.kk@samsung.com>
      Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
      Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>
      Cc: stable@vger.kernel.org
      3396b096
  12. 24 8月, 2013 8 次提交
  13. 23 8月, 2013 1 次提交
    • W
      i2c: move OF helpers into the core · 687b81d0
      Wolfram Sang 提交于
      I2C of helpers used to live in of_i2c.c but experience (from SPI) shows
      that it is much cleaner to have this in the core. This also removes a
      circular dependency between the helpers and the core, and so we can
      finally register child nodes in the core instead of doing this manually
      in each driver. So, fix the drivers and documentation, too.
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      687b81d0
  14. 18 8月, 2013 2 次提交
  15. 29 6月, 2013 4 次提交