aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/media/pci/cx88/cx88-vbi.c
AgeCommit message (Collapse)Author
2022-10-26media: cx88: Fix a null-ptr-deref bug in buffer_prepare()Zheyu Ma
[ Upstream commit 2b064d91440b33fba5b452f2d1b31f13ae911d71 ] When the driver calls cx88_risc_buffer() to prepare the buffer, the function call may fail, resulting in a empty buffer and null-ptr-deref later in buffer_queue(). The following log can reveal it: [ 41.822762] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 41.824488] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 41.828027] RIP: 0010:buffer_queue+0xc2/0x500 [ 41.836311] Call Trace: [ 41.836945] __enqueue_in_driver+0x141/0x360 [ 41.837262] vb2_start_streaming+0x62/0x4a0 [ 41.838216] vb2_core_streamon+0x1da/0x2c0 [ 41.838516] __vb2_init_fileio+0x981/0xbc0 [ 41.839141] __vb2_perform_fileio+0xbf9/0x1120 [ 41.840072] vb2_fop_read+0x20e/0x400 [ 41.840346] v4l2_read+0x215/0x290 [ 41.840603] vfs_read+0x162/0x4c0 Fix this by checking the return value of cx88_risc_buffer() [hverkuil: fix coding style issues] Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-05-05media: cx88: Get rid of spurious call to cx8800_start_vbi_dma()Devin Heitmueller
This was left over from the conversion to VB2, where the call was getting invoked both in buffer_queue and start_streaming, which was intermittently causing invalid opcodes on the VBI RISC queue. This change effectively mirrors the exact same change Hans Verkuil made in cx88-video.c in commit 389208e1173e ("[media] cx88: remove leftover start_video_dma() call"). Thanks to Daniel Glöckner for spotting the actual bug after I spent several days trying to chase down the issue. Fixes: 389208e1173e ("[media] cx88: remove leftover start_video_dma() call") Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com> Thanks-to: Daniel Glöckner <daniel-gl@gmx.net> Cc: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2017-11-02License cleanup: add SPDX GPL-2.0 license identifier to files with no licenseGreg Kroah-Hartman
Many source files in the tree are missing licensing information, which makes it harder for compliance tools to determine the correct license. By default all files without license information are under the default license of the kernel, which is GPL version 2. Update the files which contain no license information with the 'GPL-2.0' SPDX license identifier. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This patch is based on work done by Thomas Gleixner and Kate Stewart and Philippe Ombredanne. How this work was done: Patches were generated and checked against linux-4.14-rc6 for a subset of the use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information, Further patches will be generated in subsequent months to fix up cases where non-standard license headers were used, and references to license had to be inferred by heuristics based on keywords. The analysis to determine which SPDX License Identifier to be applied to a file was done in a spreadsheet of side by side results from of the output of two independent scanners (ScanCode & Windriver) producing SPDX tag:value files created by Philippe Ombredanne. Philippe prepared the base worksheet, and did an initial spot review of a few 1000 files. The 4.13 kernel was the starting point of the analysis with 60,537 files assessed. Kate Stewart did a file by file comparison of the scanner results in the spreadsheet to determine which SPDX license identifier(s) to be applied to the file. She confirmed any determination that was not immediately clear with lawyers working with the Linux Foundation. Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines). All documentation files were explicitly excluded. The following heuristics were used to determine which SPDX license identifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time. In total, over 70 hours of logged manual review was done on the spreadsheet to determine the SPDX license identifiers to apply to the source files by Kate, Philippe, Thomas and, in some cases, confirmation by lawyers working with the Linux Foundation. Kate also obtained a third independent scan of the 4.13 code base from FOSSology, and compared selected files where the other two scanners disagreed against that SPDX file, to see if there was new insights. The Windriver scanner is based on an older version of FOSSology in part, so they are related. Thomas did random spot checks in about 500 files from the spreadsheets for the uapi headers and agreed with SPDX license identifier in the files he inspected. For the non-uapi files Thomas did random spot checks in about 15000 files. In initial set of patches against 4.14-rc6, 3 files were found to have copy/paste license identifier errors, and have been fixed to reflect the correct identifier. Additionally Philippe spent 10 hours this week doing a detailed manual inspection and review of the 12,461 patched files from the initial patch version early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correct This produced a worksheet with 20 files needing minor correction. This worksheet was then exported into 3 different .csv files for the different types of files to be modified. These .csv files were then reviewed by Greg. Thomas wrote a script to parse the csv files and add the proper SPDX tag to the file, in the format that the file expected. This script was further refined by Greg based on the output to detect more types of files automatically and to distinguish between header and source .c files (which need different comment types.) Finally Greg ran the script using the .csv files to generate the patches. Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-25[media] cx88: make checkpatch.pl happyMauro Carvalho Chehab
Usually, I don't like fixing coding style issues on non-staging drivers, as it could be a mess pretty easy, and could become like a snow ball. That's the case of recent changes on two changesets: they disalign some statements. Yet, a care a lot with cx88 driver, as it was the first driver I touched at the Kernel, and I've been maintaining it since 2005. So, several of the coding style issues were due to my code. Per Andrey's suggestion, I ran checkpatch.pl in strict mode, with fixed several other issues, did some function alinments, but broke other alinments. So, I had to manually apply another round of manual fixes to make sure that everything is ok, and to make checkpatch happy with this patch. With this patch, checkpatch.pl is now happy when called with: ./scripts/checkpatch.pl -f --max-line-length=998 --ignore PREFER_PR_LEVEL Also, the 80-cols violations that made sense were fixed. Checkpatch would be happier if we convert it to use dev_foo(), but this is a more complex change. NOTE: there are some places with msleep(1). As this driver was written at the time that the default was to sleep at least 10ms on such calls (e. g. CONFIG_HZ=100), I replaced those calls by usleep_range(10000, 20000), with should be safe to avoid breakages. Fixes: 65bc2fe86e66 ("[media] cx88: convert it to use pr_foo() macros") Fixes: 7b61ba8ff838 ("[media] cx88: make checkpatch happier") Suggested-by: Andrey Utkin <andrey_utkin@fastmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Reviewed-by: Andrey Utkin <andrey_utkin@fastmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18[media] cx88: make checkpatch happierMauro Carvalho Chehab
This driver is old, and have lots of checkpatch violations. As we're touching a lot on this driver due to the printk conversions, let's run checkpatch --fix on it, in order to solve some of those issues. Also, do a few manual adjustments: - remove the FSF address and use the usual coding style for the initial comments; - use WARN_ON() instead of BUG_ON(); - remove an unused typedef; - break a few long lines. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18[media] cx88: convert it to use pr_foo() macrosMauro Carvalho Chehab
Instead of calling printk() directly, use pr_foo() macros, as suggested at the Kernel's coding style. Please notice that a conversion to dev_foo() is not trivial, as several parts on this driver uses pr_cont(). Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-08[media] vb2: replace void *alloc_ctxs by struct device *alloc_devsHans Verkuil
Make this a proper typed array. Drop the old allocate context code since that is no longer used. Note that the memops functions now get a struct device pointer instead of the struct device ** that was there initially (actually a void pointer to a struct containing only a struct device pointer). This code is now a lot cleaner. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Sakari Ailus <sakari.ailus@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-08[media] media/pci: convert drivers to use the new vb2_queue dev fieldHans Verkuil
Stop using alloc_ctx and just fill in the device pointer. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: Federico Vaga <federico.vaga@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2015-12-18[media] vb2: drop v4l2_format argument from queue_setupHans Verkuil
The queue_setup callback has a void pointer that is just for V4L2 and is the pointer to the v4l2_format struct that was passed to VIDIOC_CREATE_BUFS. The idea was that drivers would use the information from that struct to buffers suitable for the requested format. After the vb2 split series this pointer is now a void pointer, which is ugly, and the reality is that all existing drivers will effectively just look at the sizeimage field of v4l2_format. To make this more generic the queue_setup callback is changed: the void pointer is dropped, instead if the *num_planes argument is 0, then use the current format size, if it is non-zero, then it contains the number of requested planes and the sizes array contains the requested sizes. If either is unsupported, then return -EINVAL, otherwise use the requested size(s). Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-10-20[media] media: videobuf2: Change queue_setup argumentJunghak Sung
Replace struct v4l2_format * with void * to make queue_setup() for common use. And then, modify all device drivers related with this change. Signed-off-by: Junghak Sung <jh1009.sung@samsung.com> Signed-off-by: Geunyoung Kim <nenggun.kim@samsung.com> Acked-by: Seung-Woo Kim <sw0312.kim@samsung.com> Acked-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> [hans.verkuil@cisco.com: fix missing const in fimc-lite.c] Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-10-01[media] media: videobuf2: Restructure vb2_bufferJunghak Sung
Remove v4l2 stuff - v4l2_buf, v4l2_plane - from struct vb2_buffer. Add new member variables - bytesused, length, offset, userptr, fd, data_offset - to struct vb2_plane in order to cover all information of v4l2_plane. struct vb2_plane { <snip> unsigned int bytesused; unsigned int length; union { unsigned int offset; unsigned long userptr; int fd; } m; unsigned int data_offset; } Replace v4l2_buf with new member variables - index, type, memory - which are common fields for buffer management. struct vb2_buffer { <snip> unsigned int index; unsigned int type; unsigned int memory; unsigned int num_planes; struct vb2_plane planes[VIDEO_MAX_PLANES]; <snip> }; v4l2 specific fields - flags, field, timestamp, timecode, sequence - are moved to vb2_v4l2_buffer in videobuf2-v4l2.c struct vb2_v4l2_buffer { struct vb2_buffer vb2_buf; __u32 flags; __u32 field; struct timeval timestamp; struct v4l2_timecode timecode; __u32 sequence; }; Signed-off-by: Junghak Sung <jh1009.sung@samsung.com> Signed-off-by: Geunyoung Kim <nenggun.kim@samsung.com> Acked-by: Seung-Woo Kim <sw0312.kim@samsung.com> Acked-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2015-05-01[media] cx88: v4l2-compliance fixesHans Verkuil
Fix three v4l2-compliance failures: - the colorspace wasn't set in vidioc_try_fmt_vid_cap(). - the field wasn't set in v4l2_buffer when vb2_buffer_done() was called. - the sequence wasn't set in v4l2_buffer when vb2_buffer_done() was called. This fix also removes the unused buf->count field and starts the count at 0 instead of 1. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2014-12-16[media] cx88: add missing alloc_ctx supportHans Verkuil
The cx88 vb2 conversion and the vb2 dma_sg improvements were developed separately and were merged separately. Unfortunately, the patch updating drivers to the dma_sg improvements didn't take the updated cx88 driver into account. Basically two ships passing in the night, unaware of one another even though both ships have the same owner, i.e. me :-) Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Reported-by: Chris Lee <updatelee@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2014-11-03[media] cx88: fix VBI supportHans Verkuil
Now works with both NTSC and PAL. Tested with CC/XDS for NTSC and teletext/WSS for PAL. The start lines were wrong, the WSS signal wasn't captured and there was no difference between NTSC and PAL w.r.t. the count[] values so NTSC returned way too many lines. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2014-11-03[media] cx88: don't pollute the kernel logHans Verkuil
There is no reason to dump the sram code to the kernel log when you stop streaming. Remove those calls to cx88_sram_channel_dump. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2014-11-03[media] cx88: remove dependency on btcx-riscHans Verkuil
btcx-risc is for the bt8xx driver and other drivers shouldn't depend on it. There is no benefit to use that module just to do a pci_zalloc_consistent. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2014-11-03[media] cx88: drop cx88_free_bufferHans Verkuil
Remove this function. This makes all vb2 queues behave the same, which simplifies comparing the various vb2 queue op implementations. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2014-11-03[media] cx88: convert to vb2Hans Verkuil
As usual, this patch is very large due to the fact that half a vb2 conversion isn't possible. And since this affects blackbird, alsa, core, dvb, vbi and video the changes are all over. What made this more difficult was the peculiar way the risc program was setup. The driver allowed for running out of buffers in which case the DMA would stop and restart when the next buffer was queued. There was also a complicated timeout system for when buffers weren't filled. This was replaced by a much simpler scheme where there is always one buffer around and the DMA will just cycle that buffer until a new buffer is queued. In that case the previous buffer will be chained to the new buffer. An interrupt is generated at the start of the new buffer telling the driver that the previous buffer can be passed on to userspace. Much simpler and more robust. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2012-08-15[media] rename most media/video pci drivers to media/pciMauro Carvalho Chehab
Rename all PCI drivers with their own directory under drivers/media/video into drivers/media/pci and update the building system. Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>