Cleanup patches for various ARM platforms and some of their associated
drivers, the bulk of these is for mach-91.
I ended up pulling in the restart branch from Russell in order to
fix up some simple but annoying merge conflicts.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIVAwUATwtcbmCrR//JCVInAQLONg/+PnaGQ9gt+dRQD1kzvOl1uE4veBD4KJ3j
k3ew36OpcbkjKbcZjkN42tXbM5nBAC5A9w+iKy0RZvvxO+iay8A3IdYhlnpJhMCY
LLvv8bUltR3iB5BPJO8MXgUAkHbec/8yGZ+Zu9LfQOC8LvaXW4ARiy7RLuA01MAM
EUyL0cSAS5iztlJ1j9qwaQ+k6kReLSVkG1MRcTjPwHu75zWA2ADdQmkfb1jo6v9o
3NF4QX2aw2tpPWn7B443irVLiZFG01gBugktl2z4VcNEHLHaU7eJUddh9146FVFd
WZPz6y4qJHXJkAsL2QdEHwCet2yphf32XXAGJVVOSsr5EEqfAawPLQCt8qPaN6Un
M+BLVlf3Wtv6JmGC+ECYvHEKdu04Zw1ia43cG7VOCgpoZjdo2HgaHIjL2t96Zj7N
OpESMNiSp8++G7Gw+TxovDG93nBT459A12i3xhf/ljz2X1ADDSc6S0h+Vfi17201
XcLH9ctJn17TfO8+KBwSYM3W3V1I6APHoKRN41q4u+fHnxu93jLnMeGDqRyscxRq
BWvH1XmbkLBEb0HPtN30rTkVEnOMx4ZozM6/htVrdSRLKO+ss7XCRXLbWZxx3mWb
sCvc1E5A1GmPmhOE8P+DqFVZlZXsIVHPsnp/nLjzCZFsIv0x2RdGjd7wXK605z0Z
d+u3fNUEiHA=
=9q+1
-----END PGP SIGNATURE-----
Merge tag 'cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Cleanups on various subarchitectures
Cleanup patches for various ARM platforms and some of their associated
drivers, the bulk of these is for mach-91.
Arnd ended up pulling in the restart branch from Russell in order to
fix up some simple but annoying merge conflicts.
* tag 'cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (44 commits)
arm/at91: fix build of stamp9g20
ARM: u300: delete memory.h
MAINTAINERS: add maintainer entry for Picochip picoxcell
ARM: picoxcell: move io mappings to common.c
ARM: picoxcell: don't reserve irq_descs
ARM: picoxcell: remove mach/memory.h
ARM: at91: delete the pcontrol_g20_defconfig
arm/tegra: Remove code that's ifndef CONFIG_ARM_GIC
arm/tegra: remove unused defines
arm/tegra: fix variable formatting in makefile
ARM: davinci: vpif: move code to driver core header from platform
ARM: at91/gpio: fix display of number of irq setuped
ARM: at91/gpio: drop PIN_BASE
ARM: at91/udc: use gpio_is_valid to check the gpio
ARM: at91/ohci: use gpio_is_valid to check the gpio
ARM: at91/nand: use gpio_is_valid to check the gpio
ARM: at91/mmc: use gpio_is_valid to check the gpio
ARM: at91/ide: use gpio_is_valid to check the gpio
ARM: at91/pata: use gpio_is_valid to check the gpio
ARM: at91/soc: use gpio_is_valid to check the gpio
...
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (53 commits)
Kconfig: acpi: Fix typo in comment.
misc latin1 to utf8 conversions
devres: Fix a typo in devm_kfree comment
btrfs: free-space-cache.c: remove extra semicolon.
fat: Spelling s/obsolate/obsolete/g
SCSI, pmcraid: Fix spelling error in a pmcraid_err() call
tools/power turbostat: update fields in manpage
mac80211: drop spelling fix
types.h: fix comment spelling for 'architectures'
typo fixes: aera -> area, exntension -> extension
devices.txt: Fix typo of 'VMware'.
sis900: Fix enum typo 'sis900_rx_bufer_status'
decompress_bunzip2: remove invalid vi modeline
treewide: Fix comment and string typo 'bufer'
hyper-v: Update MAINTAINERS
treewide: Fix typos in various parts of the kernel, and fix some comments.
clockevents: drop unknown Kconfig symbol GENERIC_CLOCKEVENTS_MIGR
gpio: Kconfig: drop unknown symbol 'CS5535_GPIO'
leds: Kconfig: Fix typo 'D2NET_V2'
sound: Kconfig: drop unknown symbol ARCH_CLPS7500
...
Fix up trivial conflicts in arch/powerpc/platforms/40x/Kconfig (some new
kconfig additions, close to removed commented-out old ones)
* 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (165 commits)
reiserfs: Properly display mount options in /proc/mounts
vfs: prevent remount read-only if pending removes
vfs: count unlinked inodes
vfs: protect remounting superblock read-only
vfs: keep list of mounts for each superblock
vfs: switch ->show_options() to struct dentry *
vfs: switch ->show_path() to struct dentry *
vfs: switch ->show_devname() to struct dentry *
vfs: switch ->show_stats to struct dentry *
switch security_path_chmod() to struct path *
vfs: prefer ->dentry->d_sb to ->mnt->mnt_sb
vfs: trim includes a bit
switch mnt_namespace ->root to struct mount
vfs: take /proc/*/mounts and friends to fs/proc_namespace.c
vfs: opencode mntget() mnt_set_mountpoint()
vfs: spread struct mount - remaining argument of next_mnt()
vfs: move fsnotify junk to struct mount
vfs: move mnt_devname
vfs: move mnt_list to struct mount
vfs: switch pnode.h macros to struct mount *
...
Conflicts:
arch/arm/mach-at91/at91cap9.c
arch/arm/mach-at91/at91sam9260.c
arch/arm/mach-at91/at91sam9261.c
arch/arm/mach-at91/at91sam9263.c
arch/arm/mach-at91/at91sam9g45.c
arch/arm/mach-at91/at91sam9rl.c
arch/arm/mach-exynos/cpu.c
arch/arm/mach-shmobile/board-kota2.c
This resolves a bunch of conflicts between the arm-soc tree
and changes from the arm tree that have gone upstream.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This resolves the conflict in the arch/arm/mach-s3c64xx/s3c6400.c file,
and it fixes the build error in the arch/x86/kernel/microcode_core.c
file, that the merge did not catch.
The microcode_core.c patch was provided by Stephen Rothwell
<sfr@canb.auug.org.au> who was invaluable in the merge issues involved
with the large sysdev removal process in the driver-core tree.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
both callers of device_get_devnode() are only interested in lower 16bits
and nobody tries to return anything wider than 16bit anyway.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
The current gspca core code has a regression where it no longer properly
falls back to lower alt settings when there is not enough bandwidth.
This causes many iso based usb-1 cameras to not work when plugged into a
usb2 hub or a sandybridge chipset motherboard!
This patch fixes this.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The new iso bandwidth calculation code accidentally has broken support
for bulk mode cameras. This has broken the following drivers:
finepix, jeilinj, ovfx2, ov534, ov534_9, se401, sq905, sq905c, sq930x,
stv0680, vicam.
Thix patch fixes this. Fix tested with: se401, sq905, sq905c, stv0680 & vicam
cams.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] omap3isp: Fix crash caused by subdevs now having a pointer to devnodes
This reverts commit ff83bd82cb.
As requested by Antti:
From a talk with him at #linuxtv irc, he strong feeling that some apps
like MythTV will do a lot a lot of I2C I/O and now it adds locks,
with utimatelly means more delays. This could cause bad effects.
There is a new patch for 3.3 that re-writes af9013 in order to limit
I2C I/O. and thus those patches could be nice to have together
because those user who has has problems are most likely MythTV users.
So, let's revert this commit for now.
Requested-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
When using only subdev user-space operations the camera
interface input was not configured properly. Fix this by
updating the corresponding data structure in set_fmt
operation.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The ati_remote driver currently uses 2-byte scancodes. However, one of
those bytes is actually a checksum and therefore shouldn't be considered
as part of the scancode.
Fix the driver to only use the actual data byte as a scancode and to
check the checksum itself. Update the bundled keymaps accordingly.
Since ati_remote was only migrated to the rc subsystem for 3.2, the
previous scancodes weren't emitted on any stable kernel.
Reported-by: George Spelvin <linux@horizon.com>
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Otherwise compilation breaks with:
...
after apparently no longer included recursively from other header files.
Signed-off-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
priv gets dereferenced in mt9t112_set_params() so we should return
before calling that.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
On 64-bit platforms assigning a pointer to a 32-bit variable causes a
compiler warning and cannot actually work. Soc-camera currently doesn't
support any 64-bit systems, but such platforms can be added in the
and in any case compiler warnings should be avoided.
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: Janusz Krzysztofik <jkrzyszt@tis.icnet.pl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This patch is against the mainline v3.1 release (c3b92c8) and
fixes a compile error when building for OMAP3+DSS+VOUT
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Gary Thomas <gary@mlbassoc.com>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Likely misuse of & vs &&.
Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Sakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
omap_vout crashes on start if a corresponding driver is not loaded for a
display device.
This patch changes omap_vout init sequence to skip devices without a
driver.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Acked-by: Vaibhav Hiremath <hvaibhav@ti.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Move vpif related definitions for capture and display drivers
from dm646x platform header file to vpif_types.h inside
the driver as these definitions are related to driver code
rather than the platform or board.
This enables reusing this IP across platforms.
Signed-off-by: Manjunath Hadli <manjunath.hadli@ti.com>
Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
The below patch fixes some typos in various parts of the kernel, as well as fixes some comments.
Please let me know if I missed anything, and I will try to get it changed and resent.
Signed-off-by: Justin P. Mattock <justinmattock@gmail.com>
Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This patch fixes following build break:
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
In case pixel format is modified in set_fmt by the driver,
the changes are not propagated back to the caller. Fix this
by adjusting passed data for TRY and ACTIVE format.
Also remove redundant pixel format code information from
struct m5mols_info, it's already available in 'ffmt' array.
Remove pad number validation in set/get_fmt, this is already
done in the core.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: HeungJun Kim <riverful.kim@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
With 16-bit RGB565 colour format pixels are stored by the device in memory
in the following order:
| b3 | b2 | b1 | b0 |
~+-----+-----+-----+-----+
| R5 G6 B5 | R5 G6 B5 |
This corresponds to V4L2_PIX_FMT_RGB565 fourcc, not V4L2_PIX_FMT_RGB565X.
This change is required to avoid trouble when setting up video pipeline
with the s5p-tv devices, so the colour formats at both devices can be
properly matched.
Cc: <stable@kernel.org>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
When a sensor with MIPI-CSI interface is attached through platform
data definition and the MIPI-CSI receiver is not selected in kernel
configuration s5p-fimc driver probe() will now succeed, issuing only
a warning. It was done this way to allow the driver to work even if
system configuration is not exactly right.
Instead make the driver's probe() fail if a MIPI-CSI sensor was
requested but s5p-csis module is not present.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Minimum vertical pixel size alignment for input and output DMA and
the scaler depend on color format, rotation, the IP instance and revision.
Make vertical pixel size of format and crop better fit for each SoC
revision and the IP instance by adding min_vsize_align attribute to
the FIMC variant data structure. It's now common for the DMA engines
and the scaler.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The "s5p-fimc-md" platform device platform_data is used to pass
attached camera sensor data. Not allowing device probe() to succeed
when it's null prevents using FIMC as a mem-to-mem device only.
Fix this by removing the platform_data check against null and
registering sensors only if platform_data is specified.
Also add logging of the information which /dev/video is assigned
to which device during probe().
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
When requested more than 2 buffers the buffer dequeue order was wrong
due to erroneous updating FIMC registers in every interrupt handler
call. This also fixes regression of resetting the output DMA buffer
pointer at wrong time, when some buffers are already queued in hardware.
The hardware is reset in the start_streaming callback in order to align
the H/W state with the software output buffer pointer (buf_index).
Additionally a simple write to S5P_CISCCTRL register is replaced with
a read/modification/write to make sure the scaler is not being disabled
in fimc_hw_set_scaler().
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
ST_LPM bit must not be initially set, so the first resume helper
call properly quiesce the device's operation.
Also fimc_runtime_suspend() at device remove is unneeded and
leads to unbalanced clock disable so remove it.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Make sure the subdev pointer is cleared when the subdev object
has been freed.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
After i2c_unregister_device() has been called the client object can already
be freed and thus using the client pointer may lead to dereferencing freed
memory. Avoid this by saving the adapter pointer for further use before
i2c_unregister_device() call.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Register to read should be written to register 0xfb and then
perform I2C read to get reg value.
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Default IF for 6 MHz bandwidth is 3 MHz. Use that.
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
AF9015 firmware does not like if it gets interrupted by I2C adapter
request on some critical phases. During normal operation I2C adapter
is used only 2nd demodulator and tuner on dual tuner devices.
Override demodulator callbacks and use mutex for limit access to
those "critical" paths to keep AF9015 happy.
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This converts the drivers in drivers/media/* to use the
module_usb_driver() macro which makes the code smaller and a bit
simpler.
Added bonus is that it removes some unneeded kernel log messages about
drivers loading and/or unloading.
Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: Luca Risolia <luca.risolia@studio.unibo.it>
Cc: Jean-Francois Moine <moinejf@free.fr>
Cc: Frank Zago <frank@zago.net>
Cc: Olivier Lorin <o.lorin@laposte.net>
Cc: Erik Andren <erik.andren@gmail.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Brian Johnson <brijohn@gmail.com>
Cc: Leandro Costantino <lcostantino@gmail.com>
Cc: Antoine Jacquet <royale@zerezo.com>
Cc: Jarod Wilson <jarod@redhat.com>
Cc: Florian Mickler <florian@mickler.org>
Cc: Antti Palosaari <crope@iki.fi>
Cc: Michael Krufky <mkrufky@kernellabs.com>
Cc: "David Härdeman" <david@hardeman.nu>
Cc: Florent Audebert <florent.audebert@anevia.com>
Cc: Sam Doshi <sam@metal-fish.co.uk>
Cc: Manu Abraham <manu@linuxtv.org>
Cc: Olivier Grenie <olivier.grenie@dibcom.fr>
Cc: Patrick Boettcher <patrick.boettcher@dibcom.fr>
Cc: "Igor M. Liplianin" <liplianin@me.by>
Cc: Derek Kelly <user.vdr@gmail.com>
Cc: Malcolm Priestley <tvboxspy@gmail.com>
Cc: Steven Toth <stoth@kernellabs.com>
Cc: "André Weidemann" <Andre.Weidemann@web.de>
Cc: Martin Wilks <m.wilks@technisat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Jose Alberto Reguero <jareguero@telefonica.net>
Cc: David Henningsson <david.henningsson@canonical.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Joe Perches <joe@perches.com>
Cc: Jesper Juhl <jj@chaosbits.net>
Cc: Lucas De Marchi <lucas.demarchi@profusion.mobi>
Cc: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Anssi Hannula <anssi.hannula@iki.fi>
Cc: Rafi Rubin <rafi@seas.upenn.edu>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Paul Bender <pebender@gmail.com>
Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Cc: "Márcio A Alves" <froooozen@gmail.com>
Cc: Julia Lawall <julia@diku.dk>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Chris Rankin <rankincj@yahoo.com>
Cc: Lee Jones <lee.jones@canonical.com>
Cc: Andy Walls <awalls@md.metrocast.net>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mike Frysinger <vapier@gentoo.org>
Cc: Dean Anderson <linux-dev@sensoray.com>
Cc: Pete Eberlein <pete@sensoray.com>
Cc: Arvydas Sidorenko <asido4@gmail.com>
Cc: Andrea Anacleto <andreaanacleto@libero.it>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] v4l2-ctrl: Send change events to all fh for auto cluster slave controls
[media] v4l2-event: Don't set sev->fh to NULL on unsubscribe
[media] v4l2-event: Remove pending events from fh event queue when unsubscribing
[media] v4l2-event: Deny subscribing with a type of V4L2_EVENT_ALL
[media] MAINTAINERS: add a maintainer for s5p-mfc driver
[media] v4l: s5p-mfc: fix reported capabilities
[media] media: vb2: reset queued list on REQBUFS(0) call
[media] media: vb2: set buffer length correctly for all buffer types
[media] media: vb2: add a check for uninitialized buffer
[media] mxl111sf: fix build warning
[media] mxl111sf: remove pointless if condition in mxl111sf_config_spi
[media] mxl111sf: check for errors after mxl111sf_write_reg in mxl111sf_idac_config
[media] mxl111sf: fix return value of mxl111sf_idac_config
[media] uvcvideo: GET_RES should only be checked for BITMAP type menu controls
This file uses core functions like module_init() and module_exit()
and so it explicitly needs to include the module.h header.
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Otherwise the fh changing the master control won't get the inactive state
change event for the slave controls.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Setting sev->fh to NULL causes problems for the del op added in the next
patch of this series, since this op needs a way to get to its own data
structures, and typically this will be done by using container_of on an
embedded v4l2_fh struct.
The reason the original code is setting sev->fh to NULL is to signal
to users of the event framework that the unsubscription has happened,
but since their is no shared lock between the event framework and users
of it, this is inherently racy, and it also turns out to be unnecessary
as long as both the event framework and the user of the framework do their
own locking properly and the user guarantees that it holds no references
to the subcribed_event structure after its del operation has been called.
This is best explained by looking at the only code currently checking for
sev->fh being set to NULL on unsubscribe, which is the v4l2-ctrls.c send_event
function. Here is the relevant code from v4l2-ctrls: send_event():
if (sev->fh && (sev->fh != fh ||
(sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK)))
v4l2_event_queue_fh(sev->fh, &ev);
Now lets say that v4l2_event_unsubscribe and v4l2-ctrls: send_event() race
on the same sev, then the following could happens:
1) send_event checks sev->fh, finds it is not NULL
<thread switch>
2) v4l2_event_unsubscribe sets sev->fh NULL
3) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
as the thread calling send_event holds the ctrl_lock
<thread switch>
4) send_event calls v4l2_event_queue_fh(sev->fh, &ev) which not is equivalent
to calling: v4l2_event_queue_fh(NULL, &ev)
5) oops, NULL pointer deref.
Now again without setting sev->fh to NULL in v4l2_event_unsubscribe and
without the (now senseless since always true) sev->fh != NULL check in
1) send_event is about to call v4l2_event_queue_fh(sev->fh, &ev)
<thread switch>
2) v4l2_event_unsubscribe removes sev->list from the fh->subscribed list
<thread switch>
3) send_event calls v4l2_event_queue_fh(sev->fh, &ev)
4) v4l2_event_queue_fh blocks on the fh_lock spinlock
<thread switch>
5) v4l2_event_unsubscribe unlocks the fh_lock spinlock
6) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
as the thread calling send_event holds the ctrl_lock
<thread switch>
8) v4l2_event_queue_fh takes the fh_lock
7) v4l2_event_queue_fh calls v4l2_event_subscribed, does not find it since
sev->list has been removed from fh->subscribed already -> does nothing
9) v4l2_event_queue_fh releases the fh_lock
10) the caller of send_event releases the ctrl lock (mutex)
<thread switch>
11) v4l2_ctrls del_event takes the ctrl lock
12) v4l2_ctrls del_event removes sev->node from the ev_subs list
13) v4l2_ctrls del_event releases the ctrl lock
14) v4l2_event_unsubscribe frees the sev, to which no references are being
held anymore
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The kev pointers inside the pending events queue (the available queue) of the
fh point to data inside the sev, unsubscribing frees the sev, thus making these
pointers point to freed memory!
This patch fixes these dangling pointers in the available queue by removing
all matching pending events on unsubscription.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
