kernel.git/drivers/media/platform/davinci, branch linux-4.12.y

media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl

2017-08-11T15:33:54Z

commit da05d52d2f0f6bd61094a0cd045fed94bf7d673a upstream. this patch makes sure VPFE_CMD_S_CCDC_RAW_PARAMS ioctl no longer works for vpfe_capture driver with a minimal patch suitable for backporting. - This ioctl was never in public api and was only defined in kernel header. - The function set_params constantly mixes up pointers and phys_addr_t numbers. - This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is described as an 'experimental ioctl that will change in future kernels'. - The code to allocate the table never gets called after we copy_from_user the user input over the kernel settings, and then compare them for inequality. - We then go on to use an address provided by user space as both the __user pointer for input and pass it through phys_to_virt to come up with a kernel pointer to copy the data to. This looks like a trivially exploitable root hole. Due to these reasons we make sure this ioctl now returns -EINVAL and backport this patch as far as possible. Fixes: 5f15fbb68fd7 ("V4L/DVB (12251): v4l: dm644x ccdc module for vpfe capture driver") Signed-off-by: Lad, Prabhakar Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

[media] media: vpif: use a configurable i2c_adapter_id for vpif display

2017-03-22T14:55:56Z

The vpif display driver uses a static i2c adapter ID of 1 but on the da850-evm board in DT boot mode the i2c adapter ID is actually 0. Make the adapter ID configurable like it already is for vpif capture. Signed-off-by: Bartosz Golaszewski Acked-by: Kevin Hilman Acked-by: Lad, Prabhakar Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] Staging: media: platform: davinci: - Fix for memory leak

2017-02-03T09:14:28Z

Fix to avoid possible memory leak if the decoder initialization got failed. Free the allocated memory for file handle object before return in case decoder initialization fails. Signed-off-by: Shailendra Verma Signed-off-by: Mauro Carvalho Chehab

[media] davinci: VPIF: add basic support for DT init

2017-01-31T10:02:03Z

Add basic support for initialization via DT Signed-off-by: Kevin Hilman Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] davinci: vpif_capture: fix start/stop streaming locking

2017-01-31T10:01:07Z

Video capture subdevs may be over I2C and may sleep during xfer, so we cannot do IRQ-disabled locking when calling the subdev. The IRQ-disabled locking is meant to protect the DMA queue list throughout the rest of the driver, so update the locking in [start|stop]_streaming to protect just this list, and update the irqlock comment to reflect what it actually protects. Suggested-by: Laurent Pinchart Reviewed-by: Laurent Pinchart Signed-off-by: Kevin Hilman Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] davinci: vpif_capture: remove hard-coded I2C adapter id

2017-01-31T09:59:12Z

Remove hard-coded I2C adapter in favor of getting the ID from platform_data. Signed-off-by: Kevin Hilman Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] davinci: VPIF: fix module loading, init errors

2017-01-31T09:58:33Z

Fix problems with automatic module loading by adding MODULE_ALIAS. Also fix various load-time errors cause by incorrect or not present platform_data. Acked-by: Sakari Ailus Signed-off-by: Kevin Hilman Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] media: Drop FSF's postal address from the source code files

2017-01-27T13:38:09Z

Drop the FSF's postal address from the source code files that typically contain mostly the license text. Of the 628 removed instances, 578 are outdated. The patch has been created with the following command without manual edits: git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \ drivers/media/ include/media|while read i; do i=$i perl -e ' open(F,"< $ENV{i}"); $a=join("", ); $a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m && $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m; close(F); open(F, "> $ENV{i}"); print F $a; close(F);'; done Signed-off-by: Sakari Ailus

[media] DaVinci-VPFE-Capture: fix error handling

2016-11-25T09:57:07Z

A recent cleanup had the right idea to remove the initialization of the error variable, but missed the actual benefit of that, which is that we get warnings if there is a bug in it. Now we get a warning about a bug that was introduced by this cleanup: drivers/media/platform/davinci/vpfe_capture.c: In function 'vpfe_probe': drivers/media/platform/davinci/vpfe_capture.c:1992:9: error: 'ret' may be used uninitialized in this function [-Werror=maybe-uninitialized] This adds the missing initialization that the warning is about, and another one that was preexisting and that we did not get a warning for. That second bug has existed since the driver was first added. Fixes: efb74461f5a6 ("[media] DaVinci-VPFE-Capture: Delete an unnecessary variable initialisation in vpfe_probe()") Fixes: 7da8a6cb3e5b ("V4L/DVB (12248): v4l: vpfe capture bridge driver for DM355 and DM6446") [mchehab@s-opensource.com: fix a merge conflict] Signed-off-by: Arnd Bergmann Signed-off-by: Mauro Carvalho Chehab

[media] vpfe_capture: fix compiler warning

2016-11-22T10:13:24Z

davinci/vpfe_capture.c: In function 'vpfe_probe': davinci/vpfe_capture.c:1992:9: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized] return ret; ^~~ This is indeed correct, so if the kmalloc fails set ret to -ENOMEM. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab