kernel.git/drivers/media/video/Makefile, branch linux-3.2.y

media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic

2018-03-03T15:51:07Z

commit a1dfb4c48cc1e64eeb7800a27c66a6f7e88d075a upstream. The 32-bit compat v4l2 ioctl handling is implemented based on its 64-bit equivalent. It converts 32-bit data structures into its 64-bit equivalents and needs to provide the data to the 64-bit ioctl in user space memory which is commonly allocated using compat_alloc_user_space(). However, due to how that function is implemented, it can only be called a single time for every syscall invocation. Supposedly to avoid this limitation, the existing code uses a mix of memory from the kernel stack and memory allocated through compat_alloc_user_space(). Under normal circumstances, this would not work, because the 64-bit ioctl expects all pointers to point to user space memory. As a workaround, set_fs(KERNEL_DS) is called to temporarily disable this extra safety check and allow kernel pointers. However, this might introduce a security vulnerability: The result of the 32-bit to 64-bit conversion is writeable by user space because the output buffer has been allocated via compat_alloc_user_space(). A malicious user space process could then manipulate pointers inside this output buffer, and due to the previous set_fs(KERNEL_DS) call, functions like get_user() or put_user() no longer prevent kernel memory access. The new approach is to pre-calculate the total amount of user space memory that is needed, allocate it using compat_alloc_user_space() and then divide up the allocated memory to accommodate all data structures that need to be converted. An alternative approach would have been to retain the union type karg that they allocated on the kernel stack in do_video_ioctl(), copy all data from user space into karg and then back to user space. However, we decided against this approach because it does not align with other compat syscall implementations. Instead, we tried to replicate the get_user/put_user pairs as found in other places in the kernel: if (get_user(clipcount, &up->clipcount) || put_user(clipcount, &kp->clipcount)) return -EFAULT; Notes from hans.verkuil@cisco.com: This patch was taken from: https://github.com/LineageOS/android_kernel_samsung_apq8084/commit/97b733953c06e4f0398ade18850f0817778255f7 Clearly nobody could be bothered to upstream this patch or at minimum tell us :-( We only heard about this a week ago. This patch was rebased and cleaned up. Compared to the original I also swapped the order of the convert_in_user arguments so that they matched copy_in_user. It was hard to review otherwise. I also replaced the ALLOC_USER_SPACE/ALLOC_AND_GET by a normal function. Fixes: 6b5a9492ca ("v4l: introduce string control support.") Signed-off-by: Daniel Mentz Co-developed-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab [bwh: Rebased on top of some earlier fixes] Signed-off-by: Ben Hutchings

[media] v4l: Add v4l2 subdev driver for S5K6AAFX sensor

2011-11-03T20:29:11Z

This driver exposes preview mode operation of the S5K6AAFX sensor with embedded SoC ISP. The native capture (snapshot) operation mode is not supported. Following controls are available: manual/auto exposure and gain, power line frequency (anti-flicker), saturation, sharpness, brightness, contrast, white balance temperature, color effects, horizontal/vertical image flip, frame interval, auto white balance. RGB component gains are currently exposed through private controls. Reviewed-by: Sakari Ailus Signed-off-by: Sylwester Nawrocki Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab

[media] move cx25821 out of staging

2011-11-03T09:58:21Z

This driver had the major issues already fixed. Move it out of staging. Acked-by: Greg Kroah-Hartman Signed-off-by: Mauro Carvalho Chehab

[media] move tm6000 to drivers/media/video

2011-09-23T12:32:35Z

The serious bugs got fixed already. Signed-off-by: Mauro Carvalho Chehab

[media] mt9t001: Aptina (Micron) MT9T001 3MP sensor driver

2011-09-21T18:31:08Z

The MT9T001 is a parallel 3MP sensor from Aptina (formerly Micron) controlled through I2C. The driver creates a V4L2 subdevice. It currently supports binning and cropping, and the gain, exposure, test pattern and black level controls. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab

[media] mt9p031: Aptina (Micron) MT9P031 5MP sensor driver

2011-09-11T12:49:28Z

The MT9P031 is a parallel 12-bit 5MP sensor from Aptina (formerly Micron) controlled through I2C. The driver creates a V4L2 subdevice. It currently supports skipping, cropping, automatic binning, and gain, exposure, h/v flip and test pattern controls. Signed-off-by: Javier Martin Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab

[media] drivers/media: do not use EXTRA_CFLAGS

2011-09-03T21:50:59Z

Usage of these flags has been deprecated for nearly 4 years by: commit f77bf01425b11947eeb3b5b54685212c302741b8 Author: Sam Ravnborg Date: Mon Oct 15 22:25:06 2007 +0200 kbuild: introduce ccflags-y, asflags-y and ldflags-y Moreover, these flags (at least EXTRA_CFLAGS) have been documented for command line use. By default, gmake(1) do not override command line setting, so this is likely to result in build failure or unexpected behavior. Replace their usage by Kbuild's `{as,cc,ld}flags-y'. Cc: Sam Ravnborg Cc: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org Signed-off-by: Arnaud Lacombe Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab

[media] V4L: initial driver for ov5642 CMOS sensor

2011-07-27T20:56:09Z

This is an initial driver release for the Omnivision 5642 CMOS sensor. Signed-off-by: Bastian Hecht Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab

[media] v4l: s5p-tv: add drivers for HDMI on Samsung S5P platform

2011-07-27T20:56:01Z

Add drivers for HDMI outputs on Samsung platforms from S5P family. Drivers are using: - v4l2 framework - runtime PM Signed-off-by: Tomasz Stanislawski Signed-off-by: Kyungmin Park Reviewed-by: Marek Szyprowski Reviewed-by: Sylwester Nawrocki Reviewed-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] MFC: Add MFC 5.1 V4L2 driver

2011-07-27T20:56:00Z

Multi Format Codec 5.1 is a hardware video coding acceleration module found in the S5PV210 and Exynos4 Samsung SoCs. It is capable of handling a range of video codecs and this driver provides a V4L2 interface for video decoding and encoding. Signed-off-by: Kamil Debski Signed-off-by: Kyungmin Park Cc: Jeongtae Park Signed-off-by: Mauro Carvalho Chehab