summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* media: mtk-jpeg: Fix use after free bug due to uncanceled workZheng Wang2023-07-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run and mtk_jpeg_enc_device_run may be called to start the work. If we remove the module which will call mtk_jpeg_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the work before cleanup in the mtk_jpeg_remove CPU0 CPU1 |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: verisilicon: Fix TRY_FMT on encoder OUTPUTMichael Tretter2023-07-251-2/+7
| | | | | | | | | | | | | | | | | | | | | Commit f100ce3bbd6a ("media: verisilicon: Fix crash when probing encoder") removed vpu_fmt from hantro_try_fmt(), since it was initialized from vpu_dst_fmt, which may not be initialized, when TRY_FMT is called. It was replaced by fmt, which is found using the pixelformat. For the encoder, this changed the fmt to contain the raw format instead of the coded format. The format constraints as of fmt->frmsize are only valid for the coded format and are 0 for the raw formats. Therefore, the size of a encoder OUTPUT device is constrained to 0 and the v4l2-compliance tests for G_FMT, TRY_FMT, and SET_FMT fail. Bring back vpu_fmt to use the coded format on an encoder OUTPUT device, but initialize it using the currently set pixelformat on dst_fmt, which is the coded format on an encoder. Fixes: f100ce3bbd6a ("media: verisilicon: Fix crash when probing encoder") Signed-off-by: Michael Tretter <m.tretter@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: rkvdec: removed redundant blank lineEmma Christy2023-07-251-1/+0
| | | | | | | | | | Adhere to Linux kernel coding style. Removed redundant blank line. Issue found by checkpatch. Signed-off-by: Emma Christy <emma.t.christy@gmail.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: meson: vdec: Add MODULE_FIRMWARE macroJuerg Haefliger2023-07-251-0/+9
| | | | | | | | | The meson-vdec module loads firmware so add MODULE_FIRMWARE macros to provide that information via modinfo. Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com> Reviewed-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: amphion: add helper function to get id nameMing Qian2023-07-256-13/+79
| | | | | | | | | | convert numbers into meaningful names, then it can improve the log readability Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") Signed-off-by: Ming Qian <ming.qian@nxp.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: amphion: reinit vpu if reqbufs output 0Ming Qian2023-07-252-3/+6
| | | | | | | | | | | | | | according to v4l2 stateful decoder document 4.5.1.3. State Machine, the state should change from seek to initialization if call VIDIOC_REQBUFS(OUTPUT, 0). so reinit the vpu decoder if reqbufs output 0 Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver") Signed-off-by: Ming Qian <ming.qian@nxp.com> Tested-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: pci: saa7164: replace BUG with error returnHans Verkuil2023-07-251-1/+1
| | | | | | | | | It was completely unnecessary to use BUG in saa7164_s_frequency, just return an error instead. This also solves a smatch error: drivers/media/pci/saa7164/saa7164-encoder.c:388 saa7164_s_frequency() error: potentially dereferencing uninitialized 'tsport'. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: pci: cx23885: replace BUG with error returnHans Verkuil2023-07-251-1/+1
| | | | | | | | | It was completely unnecessary to use BUG in buffer_prepare(). Just replace it with an error return. This also fixes a smatch warning: drivers/media/pci/cx23885/cx23885-video.c:422 buffer_prepare() error: uninitialized symbol 'ret'. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* staging: media: tegra-video: include video.h headerHans Verkuil2023-07-251-0/+1
| | | | | | | | | | | | This tells sparse that tegra_vip_driver is actually used, and so avoids this warning: drivers/staging/media/tegra-video/vip.c:280:31: warning: 'tegra_vip_driver' defined but not used [-Wunused-variable] 280 | static struct platform_driver tegra_vip_driver = { | ^~~~~~~~~~~~~~~~ Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
* staging: media: sun6i-isp: drop of_match_ptr for ID tableHans Verkuil2023-07-251-1/+1
| | | | | | | | | | | | | | The driver can match only via the DT table so the table should be always used and the of_match_ptr does not make any sense. This also fixes this !CONFIG_OF error: drivers/staging/media/sunxi/sun6i-isp/sun6i_isp.c:529:34: warning: 'sun6i_isp_of_match' defined but not used [-Wunused-const-variable=] 529 | static const struct of_device_id sun6i_isp_of_match[] = { | ^~~~~~~~~~~~~~~~~ Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Chen-Yu Tsai <wens@csie.org>
* media: tuners: qt1010: replace BUG_ON with a regular errorHans Verkuil2023-07-251-5/+6
| | | | | | | | | | BUG_ON is unnecessary here, and in addition it confuses smatch. Replacing this with an error return help resolve this smatch warning: drivers/media/tuners/qt1010.c:350 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34 Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* MAINTAINERS: update amphion vpu driver entryMing Qian2023-07-251-1/+0
| | | | | | | | | | | Shijie has not been actively working on the driver, his e-mail address is bouncing for quite awhile now. remove him from the maintainer list here. I do want to thank him for his work on the driver. Signed-off-by: Zhou Peng <eagle.zhou@nxp.com> Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: drxk: Use %*ph for printing hexdump of a small bufferAndy Shevchenko2023-07-251-24/+5
| | | | | | | | | | | | The kernel already has a helper to print a hexdump of a small buffer via pointer extension. Use that instead of open coded variant. In long term it helps to kill pr_cont() or at least narrow down its use. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: i2c: ds90ub913: Fix a warning about use of uninitialized variableTomi Valkeinen2023-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Fix the following warning: drivers/media/i2c/ds90ub913.c:488:9: warning: 'v' may be used uninitialized [-Wmaybe-uninitialized] 488 | ub913_write(priv, UB913_REG_GENERAL_CFG, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 489 | v | UB913_REG_GENERAL_CFG_CRC_ERR_RESET); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/media/i2c/ds90ub913.c:477:12: note: 'v' was declared here 477 | u8 v, v1, v2; | ^ Fix the warning by initializing the variable to 0. Proper error handling here would be somewhat pointless, as we are just printing register values, and the user will see an error about the failed i2c transaction. Fixes: c158d0d4ff15 ("media: i2c: add DS90UB913 driver") Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Closes: https://lore.kernel.org/all/a0180488-f7f5-8538-a8bb-52ae52912835@xs4all.nl/ Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: Remove flag FBINFO_FLAG_DEFAULT from fbdev driversThomas Zimmermann2023-07-252-2/+0
| | | | | | | | | | | | | | | | | | | | The flag FBINFO_FLAG_DEFAULT is 0 and has no effect, as struct fbinfo.flags has been allocated to zero by kzalloc(). So do not set it. Flags should signal differences from the default values. After cleaning up all occurrences of FBINFO_DEFAULT, the token will be removed. v2: * fix commit message (Miguel) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Sam Ravnborg <sam@ravnborg.org> Cc: Andy Walls <awalls@md.metrocast.net> Cc: Mauro Carvalho Chehab <mchehab@kernel.org> Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: ti: cal: Implement get_frame_desc for camera-rxTomi Valkeinen2023-07-253-47/+47
| | | | | | | | | | | | CAL uses get_frame_desc to get the VC and DT for the incoming CSI-2 stream, but does it in a bit hacky way. Clean this up by implementing .get_frame_desc to camera-rx, and calling that from cal.c. No functional change intended. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: ti: cal: Use subdev stateTomi Valkeinen2023-07-253-107/+53
| | | | | | | | | | | | Change TI CAL driver to use subdev state. No functional changes (intended). This allows us to get rid of the 'formats' field, as the formats are kept in the state, and also the 'mutex' as we already have state locking. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: ti: cal: Fix cal_camerarx_create() error handlingTomi Valkeinen2023-07-251-10/+13
| | | | | | | | | | | | We don't do a proper job at freeing resources in cal_camerarx_create's error paths. Fix these, and also switch the phy allcation from kzalloc to devm_kzalloc to simplify the code further. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: ti: cal: Clean up mbus formats usesTomi Valkeinen2023-07-253-32/+8
| | | | | | | | | | | | | | | | | | Clean up the CAL drivers uses of mbus formats: - Switch all YUV formats from 2X8 formats to 1X16, as those are what should be used for CSI-2 bus. - Drop 24 and 32 bit formats, as the driver doesn't support them (see cal_ctx_pix_proc_config()). - Switch RGB565_2X8_LE to RGB565_1X16 (for the same reason as for the YUV formats) and drop RGB565_2X8_BE as it cannot be supported with CSI-2. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: imx: Unstage the imx8mq-mipi-csi2 driverMartin Kepplinger2023-07-256-13/+17
| | | | | | | | | | | | | | | | | The imx8mq-mipi-csi2 MIPI CSI-2 receiver driver is used and maintained. There is no reason to keep it in staging. The accompanying CSI bridge driver that uses it is in drivers/media/platform/nxp as well. One TODO is to get rid of csi_state's "state" and "lock" variables. Especially make sure suspend/resume is working without them. That can very well be worked on from the new location. Also add a MAINTAINERS section for the imx8mq-mipi-csi2 mipi receiver driver. Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* staging: media: ipu3: code style fix - avoid multiple line dereferenceNikolay Kyx2023-07-251-8/+6
| | | | | | | | | | | This patch fixes the following checkpatch.pl warning: WARNING: Avoid multiple line dereference in file ipu3-css.c Signed-off-by: Nikolay Kyx <knv418@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: i2c: ov01a10: Switch back to use struct i2c_driver::probeUwe Kleine-König2023-07-191-1/+1
| | | | | | | | | struct i2c_driver::probe_new is about to go away. Switch the driver to use the probe callback with the same prototype. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: aspeed: Fix memory overwrite if timing is 1600x900Jammy Huang2023-07-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | When capturing 1600x900, system could crash when system memory usage is tight. The way to reproduce this issue: 1. Use 1600x900 to display on host 2. Mount ISO through 'Virtual media' on OpenBMC's web 3. Run script as below on host to do sha continuously #!/bin/bash while [ [1] ]; do find /media -type f -printf '"%h/%f"\n' | xargs sha256sum done 4. Open KVM on OpenBMC's web The size of macro block captured is 8x8. Therefore, we should make sure the height of src-buf is 8 aligned to fix this issue. Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: ds90ub9xx: switch three more drivers back to use struct ↵Uwe Kleine-König2023-07-193-3/+3
| | | | | | | | | | | | | | | | | | i2c_driver::probe() struct i2c_driver::probe_new() is about to go away. Since I converted all drivers below drivers/media use struct i2c_driver::probe, three more drivers were added in the following commits that use .probe_new(): commit 6363db1c9d45 ("media: i2c: add DS90UB953 driver") commit c158d0d4ff15 ("media: i2c: add DS90UB913 driver") commit afe267f2d368 ("media: i2c: add DS90UB960 driver") Switch these driver to use the probe callback. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil: use proper commit description style]
* media: i2c: ds90ub960: fix error handling in ub960_rxport_add_serializer()Harshit Mogalapalli2023-07-191-2/+2
| | | | | | | | | | | | | | | | | Smatch warns: drivers/media/i2c/ds90ub960.c:1671 ub960_rxport_add_serializer(): err: 'rxport->ser.client' dereferencing possible ERR_PTR() i2c_new_client_device() returns error pointers on failure and in dev_dbg statement we are dereferencing error pointer which is a bug. Fix this by using IS_ERR() which checks for error pointers. Fixes: afe267f2d368 ("media: i2c: add DS90UB960 driver") Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: i2c: ds90ub953: No need to set device_driver ownerYang Li2023-07-191-1/+0
| | | | | | | | | | | | | Remove .owner field if calls are used which set it automatically. to silence the warning: ./drivers/media/i2c/ds90ub953.c:1390:3-8: No need to set .owner here. The core will do it. Reported-by: Abaci Robot <abaci@linux.alibaba.com> Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5902 Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: Explicitly include correct DT includesRob Herring2023-07-1959-71/+44
| | | | | | | | | | | | | | The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it as merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xferZhang Shurong2023-07-191-1/+1
| | | | | | | | | | | | | | | In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: dvb-usb: opera1: fix uninit-value in dvb_usb_adapter_dvb_initZhang Shurong2023-07-191-2/+7
| | | | | | | | | | | If opera1_xilinx_rw fails, the mac address is not initialized. And opera1_read_mac_address does not handle this failure, which leads to the uninit-value in dvb_usb_adapter_dvb_init. Fix this by handling the failure of opera1_xilinx_rw. Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()Zhang Shurong2023-07-191-0/+8
| | | | | | | | | | | | | | | In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: anysee: fix null-ptr-deref in anysee_master_xferZhang Shurong2023-07-191-1/+1
| | | | | | | | | | | | | | | | In anysee_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach anysee_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil: add spaces around +]
* media: af9005: Fix null-ptr-deref in af9005_i2c_xferZhang Shurong2023-07-191-0/+5
| | | | | | | | | | | | | | | In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9005_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()Zhang Shurong2023-07-191-0/+24
| | | | | | | | | | | | | | | In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach dw2102_i2c_transfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 950e252cb469 ("[media] dw2102: limit messages to buffer size") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: sh_vou: Convert to devm_platform_ioremap_resource()Yangtao Li2023-07-191-6/+6
| | | | | | | Use devm_platform_ioremap_resource() to simplify code. Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: fimc-core: Convert to devm_platform_ioremap_resource()Yangtao Li2023-07-191-3/+1
| | | | | | | Use devm_platform_ioremap_resource() to simplify code. Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: platform: ti: Use devm_platform_get_and_ioremap_resource()Yangtao Li2023-07-191-2/+1
| | | | | | | | | | | Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yangtao Li <frank.li@vivo.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil: retained the line wrap]
* media: stm32-dcmi: Use devm_platform_get_and_ioremap_resource()Yangtao Li2023-07-191-13/+4
| | | | | | | | | Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: verisilicon: Convert to devm_platform_ioremap_resource() and ↵Yangtao Li2023-07-191-6/+3
| | | | | | | | | | | devm_platform_ioremap_resource_byname() Use devm_platform_ioremap_resource() and devm_platform_ioremap_resource_byname() to simplify code. Signed-off-by: Yangtao Li <frank.li@vivo.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: microchip-sama7g5-isc: Convert to devm_platform_ioremap_resource()Yangtao Li2023-07-191-3/+1
| | | | | | | Use devm_platform_ioremap_resource() to simplify code. Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: fimc-lite: Convert to devm_platform_ioremap_resource()Yangtao Li2023-07-191-3/+1
| | | | | | | Use devm_platform_ioremap_resource() to simplify code. Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: microchip-sama5d2-isc: Convert to devm_platform_ioremap_resource()Yangtao Li2023-07-191-3/+1
| | | | | | | Use devm_platform_ioremap_resource() to simplify code. Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: marvell: Use devm_platform_get_and_ioremap_resource()Yangtao Li2023-07-191-2/+1
| | | | | | | | | Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: pxa_camera: Use devm_platform_get_and_ioremap_resource()Yangtao Li2023-07-191-9/+8
| | | | | | | | | Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: atmel-isi: Convert to devm_platform_ioremap_resource()Yangtao Li2023-07-191-3/+1
| | | | | | | Use devm_platform_ioremap_resource() to simplify code. Signed-off-by: Yangtao Li <frank.li@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xferZhang Shurong2023-07-191-4/+5
| | | | | | | | | | | | | | | In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* drivers: saa7164: remove duplicate assignmentsMinjie Du2023-07-191-1/+0
| | | | | | | make second_timeout avoid double assignment. Signed-off-by: Minjie Du <duminjie@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: wl128x: Fix spelling mistake "Transfered" -> "Transferred"Colin Ian King2023-07-191-1/+2
| | | | | | | | There is a spelling mistake in a fmdbg message. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil: split overly long line over two lines]
* media: docs: qcom_camss: Update Code Aurora referencesJeffrey Hugo2023-07-191-3/+3
| | | | | | | | | | source.codeaurora.org is no longer accessible and so the reference links in the documentation are not useful. The content was mirrored over to Code Linaro so lets update the references to point there instead. Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: cx24120: Add retval check for cx24120_message_send()Daniil Dulov2023-07-191-1/+3
| | | | | | | | | | | If cx24120_message_send() returns error, we should keep local struct unchanged. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 5afc9a25be8d ("[media] Add support for TechniSat Skystar S2") Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: mdp3: Fix resource leaks in of_find_device_by_nodeLu Hongfei2023-07-191-0/+2
| | | | | | | | Use put_device to release the object get through of_find_device_by_node, avoiding resource leaks. Signed-off-by: Lu Hongfei <luhongfei@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-15 13:12:55 +0000