kernel.git/drivers/media/platform/vivid, branch linux-5.0.y

media: vivid: use vfree() instead of kfree() for dev->bitmap_cap

2019-05-31T13:44:48Z

commit dad7e270ba712ba1c99cd2d91018af6044447a06 upstream. syzkaller reported crashes on kfree() called from vivid_vid_cap_s_selection(). This looks like a simple typo, as dev->bitmap_cap is allocated with vzalloc() throughout the file. Fixes: ef834f7836ec0 ("[media] vivid: add the video capture and output parts") Signed-off-by: Alexander Potapenko Reported-by: Syzbot Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

Merge tag 'v4.20-rc7' into patchwork

2018-12-17T15:34:24Z

Linux 4.20-rc7 * tag 'v4.20-rc7': (403 commits) Linux 4.20-rc7 scripts/spdxcheck.py: always open files in binary mode checkstack.pl: fix for aarch64 userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered fs/iomap.c: get/put the page in iomap_page_create/release() hugetlbfs: call VM_BUG_ON_PAGE earlier in free_huge_page() memblock: annotate memblock_is_reserved() with __init_memblock psi: fix reference to kernel commandline enable arch/sh/include/asm/io.h: provide prototypes for PCI I/O mapping in asm/io.h mm/sparse: add common helper to mark all memblocks present mm: introduce common STRUCT_PAGE_MAX_SHIFT define alpha: fix hang caused by the bootmem removal XArray: Fix xa_alloc when id exceeds max drm/vmwgfx: Protect from excessive execbuf kernel memory allocations v3 MAINTAINERS: Daniel for drm co-maintainer drm/amdgpu: drop fclk/gfxclk ratio setting IB/core: Fix oops in netdev_next_upper_dev_rcu() dm thin: bump target version drm/vmwgfx: remove redundant return ret statement drm/i915: Flush GPU relocs harder for gen3 ...

media: vivid: Improve timestamping

2018-12-07T13:30:33Z

Simulate a more precise timestamp by calculating it based on the current framerate. Signed-off-by: Gabriel Francisco Mandaji Signed-off-by: Hans Verkuil [hverkuil-cisco@xs4all.nl: replaced division by 2 with bit shift] Signed-off-by: Mauro Carvalho Chehab

media: vivid: drop v4l2_ctrl_request_complete() from start_streaming

2018-12-03T20:04:07Z

If start_streaming() fails and all queued buffers are returned to vb2, then do not call v4l2_ctrl_request_complete(). Nothing happened to the request and the state should remain as it was before start_streaming was called. Signed-off-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: vivid: add req_validate error injection

2018-12-03T19:44:31Z

Add a new vivid button control to inject an error into the req_validate request callback. This will help testing with v4l2-compliance. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: vivid: fix smatch warnings

2018-12-03T19:30:27Z

Reorganize code to fix two smatch warnings: drivers/media/platform/vivid/vivid-core.c: drivers/media/platform/vivid/vivid-core.c:889 vivid_create_instance() warn: potentially one past the end of array 'dev->query_dv_timings_qmenu[dev->query_dv_timings_size]' drivers/media/platform/vivid/vivid-core.c: drivers/media/platform/vivid/vivid-core.c:889 vivid_create_instance() warn: potentially one past the end of array 'dev->query_dv_timings_qmenu[dev->query_dv_timings_size]' Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: vivid: free bitmap_cap when updating std/timings/etc.

2018-11-23T11:23:40Z

When vivid_update_format_cap() is called it should free any overlay bitmap since the compose size will change. Signed-off-by: Hans Verkuil Reported-by: syzbot+0cc8e3cc63ca373722c6@syzkaller.appspotmail.com Cc: # for v3.18 and up Signed-off-by: Mauro Carvalho Chehab

media: vivid: fill in media_device bus_info

2018-11-23T11:07:36Z

If you create multiple vivid instances, each with their own media device, then there was no way to tell them apart. Fill in the bus_info so each instance has a unique bus_info string. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: vivid: set min width/height to a value > 0

2018-11-23T11:06:42Z

The capture DV timings capabilities allowed for a minimum width and height of 0. So passing a timings struct with 0 values is allowed and will later cause a division by zero. Ensure that the width and height must be >= 16 to avoid this. Signed-off-by: Hans Verkuil Reported-by: syzbot+57c3d83d71187054d56f@syzkaller.appspotmail.com Signed-off-by: Mauro Carvalho Chehab

media: vivid: fix error handling of kthread_run

2018-11-23T11:06:03Z

kthread_run returns an error pointer, but elsewhere in the code dev->kthread_vid_cap/out is checked against NULL. If kthread_run returns an error, then set the pointer to NULL. I chose this method over changing all kthread_vid_cap/out tests elsewhere since this is more robust. Signed-off-by: Hans Verkuil Reported-by: syzbot+53d5b2df0d9744411e2e@syzkaller.appspotmail.com Signed-off-by: Mauro Carvalho Chehab