The v4l2_of_parse_endpoint() function can fail so check the return value.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The v4l2_of_parse_endpoint() function can fail so check the return value.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The v4l2_of_parse_endpoint() function can fail so check the return value.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The v4l2_of_parse_endpoint() function can fail so check the return value.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The v4l2_of_parse_endpoint() function can fail so check the return value.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The v4l2_of_parse_endpoint() function can fail so check the return value.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The v4l2_of_parse_endpoint() function can fail so check the return value.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The v4l2_of_parse_endpoint function kernel-doc says that the return value
is always 0. But that is not true since the function can fail and a error
negative code is returned on failure. So correct the kernel-doc to match.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The two formats are very similar, having two separate pages to describe
them is overkill.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Add fallback compatibility string.
This is in keeping with the fallback scheme being adopted wherever
appropriate for drivers for Renesas SoCs.
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This memory is allocated using kzalloc so there is no need to call
memset(..., 0, ...)
[mchehab@osg.samsung.com: as suggested by Joe Perches,
It's unusual to not see the alloc above the if, removed a
blank line between kzalloc/if and added a blank line after if]
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
ts2020_remove was calling kfree(dev) with possibly still active
schedule_delayed_work(dev->stat_work). A similar bug in si2157 caused
kernel panics in call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
rtl2830_remove was calling kfree(dev) with possibly still active
schedule_delayed_work(&dev->stat_work). A similar bug in si2157
caused kernel panics in call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
si2157_remove was calling kfree(dev) with possibly still active
schedule_delayed_work(dev->stat_work). This caused kernel panics in
call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
af9033_remove was calling kfree(dev) with possibly still active
schedule_delayed_work(&dev->stat_work). A similar bug in si2157
caused kernel panics in call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
af9013_remove was calling kfree(state) with possibly still active
schedule_delayed_work(&state->statistics_work). A similar bug in
si2157 caused kernel panics in call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Although ALSA timer code got hardening for races, it still causes
use-after-free error. This is however rather a corrupted linked list,
not actually the concurrent accesses. Namely, when timer start is
triggered twice, list_add_tail() is called twice, too. This ends
up with the link corruption and triggers KASAN error.
The simplest fix would be replacing list_add_tail() with
list_move_tail(), but fundamentally it's the problem that we don't
check the double start/stop correctly. So, the right fix here is to
add the proper checks to snd_timer_start() and snd_timer_stop() (and
their variants).
BugLink: http://lkml.kernel.org/r/CACT4Y+ZyPRoMQjmawbvmCEDrkBD2BQuH7R09=eOkf5ESK8kJAw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
ALSA sequencer may open/close and control ALSA timer instance
dynamically either via sequencer events or direct ioctls. These are
done mostly asynchronously, and it may call still some timer action
like snd_timer_start() while another is calling snd_timer_close().
Since the instance gets removed by snd_timer_close(), it may lead to
a use-after-free.
This patch tries to address such a race by protecting each
snd_timer_*() call via the existing spinlock and also by avoiding the
access to timer during close call.
BugLink: http://lkml.kernel.org/r/CACT4Y+Z6RzW5MBr-HUdV-8zwg71WQfKTdPpYGvOeS7v4cyurNQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
There are potential deadlocks in PCM OSS emulation code while
accessing read/write and mmap concurrently. This comes from the
infamous mmap_sem usage in copy_from/to_user(). Namely,
snd_pcm_oss_write() ->
&runtime->oss.params_lock ->
copy_to_user() ->
&mm->mmap_sem
mmap() ->
&mm->mmap_sem ->
snd_pcm_oss_mmap() ->
&runtime->oss.params_lock
Since we can't avoid taking params_lock from mmap code path, use
trylock variant and aborts with -EAGAIN as a workaround of this AB/BA
deadlock.
BugLink: http://lkml.kernel.org/r/CACT4Y+bVrBKDG0G2_AcUgUQa+X91VKTeS4v+wN7BSHwHtqn3kQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
NULL user-space buffer can be passed even in a normal path, thus it's
not good to spew a kernel warning with stack trace at each time.
Just drop snd_BUG_ON() macro usage there.
BugLink: http://lkml.kernel.org/r/CACT4Y+YfVJ3L+q0i-4vyQVyyPD7V=OMX0PWPi29x9Bo3QaBLdw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The virmidi driver has an open race at closing its assigned rawmidi
device, and this may lead to use-after-free in
snd_seq_deliver_single_event().
Plug the hole by properly protecting the linked list deletion and
calling in the right order in snd_virmidi_input_close().
BugLink: http://lkml.kernel.org/r/CACT4Y+Zd66+w12fNN85-425cVQT=K23kWbhnCEcMB8s3us-Frw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Sometimes i2c transfer fails. That happens especially when large
amount of data is written sequentially eg. firmware download.
Problem arises with both integrated rtl2832 demod and external
mn88472 demod, which is clear indicator it is busy i2c bus issue.
Use i2c core retry logic in order fix the issue by repeating failed
message. Another solution which also works is to add ~100us delay
between i2c messages - but repeating sounds more elegant and does
not cause any extra delay for success cases.
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Add a new product id to dvb-usb-dvbsky for new version of TechnoTrend CT2-4650 CI
Signed-off-by: Torbjörn Jansson <torbjorn.jansson@mbox200.swipnet.se>
Reviewed-by: Olli Salonen <olli.salonen@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
PIP tested with VLC. Diversity tested with the Windows driver.
Signed-off-by: Stefan Pöschel <basic.master@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The Terratec Cinergy S2 USB BOX uses a Montage M88TS2022 tuner
and a M88DS3103 demodulator, same as Technotrend TT-connect S2-4600.
This patch adds the missing USB Product ID to make it work.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Extend the locking to protect more critical actions like register accesses
in the interrupt handlers.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Only handle an interrupt if at least one combination of event bit
and related interrupt bit is set.
Previously it was just checked that at least one event bit and
at least one interrupt bit are set.
This fixes issues like the following which was caused by
interrupt sharing:
An interrupt intended for nvt_cir_isr was handled by nvt_cir_wake_isr
first and because status bit CIR_WAKE_IRSTS_IR_PENDING was set
the wake fifo was accidently cleared.
This patch also fixes the bug that nvt_cir_wake_isr returned IRQ_HANDLED
even if it detected that the (shared) interrupt was meant for another
handler.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Check for the case that no Nuvoton chip is found on either EFM port.
Also move the position of nvt_efm_disable to reduce the time the
EFM ports are locked.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The v4l2-common.h user space header was split off from videodev2.h, but
the dual licensing of the videodev2.h (as well as other V4L2 headers) was
missed. Change the license of the v4l2-common.h from GNU GPL v2 to both
GNU GPL v2 and BSD.
Sakari Ailus <sakari.ailus@iki.fi>:
> Would you approve a license change of the patches to
> include/uapi/linux/v4l2-common.h (formerly include/linux/v4l2-common.h) you
> or your company have contributed from GNU GPL v2 to dual GNU GPL v2 and BSD
> licenses, changing the copyright notice in the file as below (from
> videodev2.h):
>
> -------------8<------------
> * This program is free software; you can redistribute it and/or modify
> * it under the terms of the GNU General Public License as published by
> * the Free Software Foundation; either version 2 of the License, or
> * (at your option) any later version.
> *
> * This program is distributed in the hope that it will be useful,
> * but WITHOUT ANY WARRANTY; without even the implied warranty of
> * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> * GNU General Public License for more details.
> *
> * Alternatively you can redistribute this file under the terms of the
> * BSD license as stated below:
> *
> * Redistribution and use in source and binary forms, with or without
> * modification, are permitted provided that the following conditions
> * are met:
> * 1. Redistributions of source code must retain the above copyright
> * notice, this list of conditions and the following disclaimer.
> * 2. Redistributions in binary form must reproduce the above copyright
> * notice, this list of conditions and the following disclaimer in
> * the documentation and/or other materials provided with the
> * distribution.
> * 3. The names of its contributors may not be used to endorse or promote
> * products derived from this software without specific prior written
> * permission.
> *
> * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
> * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
> * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
> * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
> * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
> * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
> * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
> * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
> * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
> * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
> * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
> -------------8<------------
Mauro Carvalho Chehab <mchehab@osg.samsung.com>:
> No problem from my side.
Hans Verkuil <hans.verkuil@cisco.com>:
> Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Aaro Koskinen <aaro.koskinen@nokia.com>:
> This fine also for us.
>
> Acked-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The Camera Adaptation Layer (CAL) is a block which consists of a dual
port CSI2/MIPI camera capture engine.
Port #0 can handle CSI2 camera connected to up to 4 data lanes.
Port #1 can handle CSI2 camera connected to up to 2 data lanes.
The driver implements the required API/ioctls to be V4L2 compliant.
Driver supports the following:
- V4L2 API using DMABUF/MMAP buffer access based on videobuf2 api
- Asynchronous sensor sub device registration
- DT support
Signed-off-by: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Device Tree bindings for the Camera Adaptation Layer (CAL) driver
Signed-off-by: Benoit Parrot <bparrot@ti.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Sometimes when a Bayer pixelformat is selected the rendering of the OSD text
by vivid was all wrong: every other line of the text was shifted by half the width
or more.
It turned out that to render Bayer formats the interleaved boolean is set to true
in the tpg. This mode indicates a semi-biplanar mode where two interleaved planes
are used to render the frame. From outside the tpg it looks like a single plane,
but internally it is two planes.
However, in the tpg_s_bytesperline() function the interleaved bool wasn't checked
and only the bytesperline value for plane 0 was updated. But for the interleaved
mode the same value has to be copied to bytesperline[1] as well.
The effect was that whatever old value was left in bytesperline[1] was used, which
caused all sorts of weird and seemingly unpredictable shifts.
Reported-by: Ove Brynestad <ovebryne@cisco.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
In v4l2-compliance utility, test QUERYBUF required correct length
value to go through each planar to check planar's length in
multi-planar buffer type
Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: <stable@vger.kernel.org> # for v3.7 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
A driver might detect a new standard or DV timings, but it will never change to
those new timings automatically. Instead it will send an event and let the application
take care of it.
Make this explicit in the documentation.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
i2c_wr() is called from ops and the interrupt service routine, while
state->wr_data is shared and unprotected, and could be overwritten.
This shared buffer is therefore replaced with a local array with fixed
size. The array has the size of one EDID block (128 bytes) + 2 bytes
i2c address, and the EDID is written block by block (up to 8 blocks).
Signed-off-by: Mats Randgaard <matrandg@cisco.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Skip validating the standards field in v4l2_valid_dv_timings() if the
V4L2_DV_BT_CAP_CUSTOM capability is set, since that implies that
non-standard timings are allowed.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Dead code found on below code:
si476x_radio_add_new_custom(radio, SI476X_IDX_DIVERSITY_MODE);
if (rval < 0)
goto exit;
si476x_radio_add_new_custom(radio, SI476X_IDX_INTERCHIP_LINK);
if (rval < 0) ====> Dead code !!!
goto exit;
The piece of code miss return value check after calling .si476x_radio_add_new_custom(),
the patch fix it.
Signed-off-by: Fugang Duan <B38611@freescale.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
dma_area needs to be freed when the device is closed.
Based on em23xx-audio.c
Signed-off-by: Jean-Baptiste Theou <jtheou@adeneo-embedded.us>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The module_param() is "default_rds_buf" and the MODULE_PARM_DESC()
should match.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
It "tx_mask" was intended instead of "tx_maxk".
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
The DMA-330 has an "irq_abort" interrupt line on which it signals faults
separately from the "irq[n:0]" channel interrupts. On Juno, this is
wired up to SPI 92; add it to the DT so that DMAC faults are correctly
reported for the driver to reset the thing, rather than leaving it
locked up and waiting to time out.
CC: Liviu Dudau <liviu.dudau@arm.com>
CC: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
for_each_compatible_node performs an of_node_get on each iteration, so
to break out of the loop an of_node_put is required.
Found using Coccinelle. The semantic patch used for this is as follows:
// <smpl>
@@
expression e;
local idexpression n;
@@
for_each_compatible_node(n, ...) {
... when != of_node_put(n)
when != e = n
(
return n;
+ of_node_put(n);
? return ...;
)
...
}
// </smpl>
Acked-by: Liviu Dudau <Liviu.Dudau@arm.com>
Signed-off-by: Amitoj Kaur Chawla <amitoj1606@gmail.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
The intent was to return -1 on error and that's what the callers expect
but the current code returns USHRT_MAX instead.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
During the recent vb2_buffer restructuring, the calculation of the
buffer payload reported to userspace was accidentally broken for the
first encoded frame, counting only the length of the headers.
This patch re-adds the length of the actual frame data.
Fixes: 2d7007153f ("[media] media: videobuf2: Restructure vb2_buffer")
Reported-by: Michael Olbrich <m.olbrich@pengutronix.de>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Tested-by: Jan Luebbe <jlu@pengutronix.de>
Cc: <stable@vger.kernel.org> # for v4.4 and up
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This sp887x_config structure is never modified, so declare it as const.
Done with the help of Coccinelle.
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
