kernel.git/drivers/media/platform/omap, branch linux-4.4.y

media: omap_vout: potential buffer overflow in vidioc_dqbuf()

2020-01-29T09:21:43Z

[ Upstream commit dd6e2a981bfe83aa4a493143fd8cf1edcda6c091 ] The "b->index" is a u32 the comes from the user in the ioctl. It hasn't been checked. We aren't supposed to use it but we're instead supposed to use the value that gets written to it when we call videobuf_dqbuf(). The videobuf_dqbuf() first memsets it to zero and then re-initializes it inside the videobuf_status() function. It's this final value which we want. Hans Verkuil pointed out that we need to check the return from videobuf_dqbuf(). I ended up doing a little cleanup related to that as well. Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf") Signed-off-by: Dan Carpenter Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

mm: replace get_vaddr_frames() write/force parameters with gup_flags

2018-12-17T20:55:16Z

commit 7f23b3504a0df63b724180262c5f3f117f21bcae upstream. This removes the 'write' and 'force' from get_vaddr_frames() and replaces them with 'gup_flags' to make the use of FOLL_FORCE explicit in callers as use of this flag can result in surprising behaviour (and hence bugs) within the mm subsystem. Signed-off-by: Lorenzo Stoakes Acked-by: Michal Hocko Reviewed-by: Jan Kara Signed-off-by: Linus Torvalds Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman

Merge tag 'media/v4.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2015-09-11T23:42:39Z

Pull media updates from Mauro Carvalho Chehab: "A series of patches that move part of the code used to allocate memory from the media subsystem to the mm subsystem" [ The mm parts have been acked by VM people, and the series was apparently in -mm for a while - Linus ] * tag 'media/v4.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] drm/exynos: Convert g2d_userptr_get_dma_addr() to use get_vaddr_frames() [media] media: vb2: Remove unused functions [media] media: vb2: Convert vb2_dc_get_userptr() to use frame vector [media] media: vb2: Convert vb2_vmalloc_get_userptr() to use frame vector [media] media: vb2: Convert vb2_dma_sg_get_userptr() to use frame vector [media] vb2: Provide helpers for mapping virtual addresses [media] media: omap_vout: Convert omap_vout_uservirt_to_phys() to use get_vaddr_pfns() [media] mm: Provide new get_vaddr_frames() helper [media] vb2: Push mmap_sem down to memops

mm: mark most vm_operations_struct const

2015-09-10T20:29:01Z

With two exceptions (drm/qxl and drm/radeon) all vm_operations_struct structs should be constant. Signed-off-by: Kirill A. Shutemov Reviewed-by: Oleg Nesterov Cc: "H. Peter Anvin" Cc: Andy Lutomirski Cc: Dave Hansen Cc: Ingo Molnar Cc: Minchan Kim Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[media] media: omap_vout: Convert omap_vout_uservirt_to_phys() to use get_vaddr_pfns()

2015-08-16T16:04:54Z

Convert omap_vout_uservirt_to_phys() to use get_vaddr_pfns() instead of hand made mapping of virtual address to physical address. Also the function leaked page reference from get_user_pages() so fix that by properly release the reference when omap_vout_buffer_release() is called. Signed-off-by: Jan Kara [hans.verkuil@cisco.com: remove unused variable] Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] omap_vout: use swap() in omapvid_init()

2015-06-06T10:32:03Z

Use kernel.h macro definition. Signed-off-by: Fabian Frederick Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] media: omap/omap_vout: fix type of input members to omap_vout_setup_vrfb_bufs()

2015-03-03T14:22:58Z

the declaration for omap_vout_setup_vrfb_bufs() said it needed 'u32 static_vrfb_allocation' but definition took 'bool static_vrfb_allocation', this patch fixes the declaration so that it matches with the definition and pass a bool instead of int to the call, also included omap_vout_vrfb.h in omap_vout_vrfb.c file so that sparse doesn't complain of making omap_vout_setup_vrfb_bufs() as static function. Signed-off-by: Lad, Prabhakar Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] omap_vout: fix compile warnings

2014-12-02T13:35:05Z

When compiling under COMPILE_TEST on a x86_64 the following warnings appear: drivers/media/platform/omap/omap_vout.c: In function 'omap_vout_uservirt_to_phys': drivers/media/platform/omap/omap_vout.c:209:23: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] return virt_to_phys((void *) virtp); ^ drivers/media/platform/omap/omap_vout.c: In function 'omapvid_setup_overlay': drivers/media/platform/omap/omap_vout.c:420:2: warning: format '%x' expects argument of type 'unsigned int', but argument 5 has type 'dma_addr_t' [-Wformat=] v4l2_dbg(1, debug, &vout->vid_dev->v4l2_dev, ^ drivers/media/platform/omap/omap_vout.c: In function 'omap_vout_buffer_prepare': drivers/media/platform/omap/omap_vout.c:794:34: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] vout->queued_buf_addr[vb->i] = (u8 *) ^ In file included from arch/x86/include/asm/dma-mapping.h:44:0, from include/linux/dma-mapping.h:82, from drivers/media/platform/omap/omap_vout.c:40: drivers/media/platform/omap/omap_vout.c:803:58: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] dma_addr = dma_map_single(vout->vid_dev->v4l2_dev.dev, (void *) addr, ^ include/asm-generic/dma-mapping-common.h:174:60: note: in definition of macro 'dma_map_single' #define dma_map_single(d, a, s, r) dma_map_single_attrs(d, a, s, r, NULL) ^ These are fixed by this patch. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] media/platform: fix querycap

2014-12-02T13:31:34Z

Querycap shouldn't set the version field (the core does that for you), but it should set the device_caps field. Signed-off-by: Hans Verkuil Cc: Scott Jiang Cc: Gerhard Sittig Cc: Jonathan Corbet Cc: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab

[media] omap: disable COMPILE_TEST

2014-11-26T12:27:29Z

This causes lots of errors, because of sub-arch specific dependencies: All error/warnings: >> ERROR: "omapdss_compat_init" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omap_dss_get_overlay_manager" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omap_dss_get_num_overlay_managers" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omap_dss_get_overlay" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omapdss_is_initialized" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omap_dispc_register_isr" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omapdss_get_version" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omap_dss_put_device" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omap_dss_get_next_device" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omap_dispc_unregister_isr" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omapdss_compat_uninit" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omap_dss_get_device" [drivers/media/platform/omap/omap-vout.ko] undefined! >> ERROR: "omap_dss_get_num_overlays" [drivers/media/platform/omap/omap-vout.ko] undefined! Signed-off-by: Mauro Carvalho Chehab