linux-toradex.git/drivers/media/platform/soc_camera, branch v3.18.21

[media] soc-camera: Fix devm_kfree() in soc_of_bind()

2015-04-24T21:14:09+00:00

[ Upstream commit 8e48a2d54c5d74ea3e9dc4c3b9037786bb447f36 ]

Unlike scan_async_group(), soc_of_bind() doesn't allocate its
soc_camera_async_client structure using devm_kzalloc(), but has it
embedded inside the soc_of_info structure.  Hence on failure, it must
free the whole soc_of_info structure, and not just the embedded
soc_camera_async_client structure, as the latter causes a warning, and
may cause slab corruption:

    soc-camera-pdrv soc-camera-pdrv.0: Probing soc-camera-pdrv.0
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 1 at drivers/base/devres.c:887 devm_kfree+0x30/0x40()
    CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.19.0-shmobile-08386-g37feb0d093cb2d8e #128
    Hardware name: Generic R8A7791 (Flattened Device Tree)
    Backtrace:
    [] (dump_backtrace) from [] (show_stack+0x18/0x1c)
     r6:c05a923b r5:00000009 r4:00000000 r3:00204140
    [] (show_stack) from [] (dump_stack+0x78/0x94)
    [] (dump_stack) from [] (warn_slowpath_common+0x8c/0xb8)
     r4:00000000 r3:00000000
    [] (warn_slowpath_common) from [] (warn_slowpath_null+0x24/0x2c)
     r8:ee7d8214 r7:ed83b810 r6:ed83bc20 r5:fffffffa r4:ed83e510
    [] (warn_slowpath_null) from [] (devm_kfree+0x30/0x40)
    [] (devm_kfree) from [] (soc_of_bind.isra.14+0x194/0x1d4)
    [] (soc_of_bind.isra.14) from [] (soc_camera_host_register+0x208/0x31c)
     r9:00000070 r8:ee7e05d0 r7:ee153210 r6:00000000 r5:ee7e0218 r4:ed83bc20
    [] (soc_camera_host_register) from [] (rcar_vin_probe+0x1f4/0x238)
     r8:ee153200 r7:00000008 r6:ee153210 r5:ed83bc10 r4:c066319c r3:000000c0
    [] (rcar_vin_probe) from [] (platform_drv_probe+0x50/0xa0)
     r10:00000000 r9:c0662fa8 r8:00000000 r7:c06a3700 r6:c0662fa8 r5:ee153210
     r4:00000000
    [] (platform_drv_probe) from [] (driver_probe_device+0xc4/0x208)
     r6:c06a36f4 r5:00000000 r4:ee153210 r3:c025c2e4
    [] (driver_probe_device) from [] (__driver_attach+0x70/0x94)
     r9:c066f9c0 r8:c0624a98 r7:c065b790 r6:c0662fa8 r5:ee153244 r4:ee153210
    [] (__driver_attach) from [] (bus_for_each_dev+0x74/0x98)
     r6:c025b098 r5:c0662fa8 r4:00000000 r3:00000001
    [] (bus_for_each_dev) from [] (driver_attach+0x20/0x28)
     r6:ed83c200 r5:00000000 r4:c0662fa8
    [] (driver_attach) from [] (bus_add_driver+0xdc/0x1c4)
    [] (bus_add_driver) from [] (driver_register+0xa4/0xe8)
     r7:c0624a98 r6:00000000 r5:c060b010 r4:c0662fa8
    [] (driver_register) from [] (__platform_driver_register+0x50/0x64)
     r5:c060b010 r4:ed8394c0
    [] (__platform_driver_register) from [] (rcar_vin_driver_init+0x18/0x20)
    [] (rcar_vin_driver_init) from [] (do_one_initcall+0x108/0x1b8)
    [] (do_one_initcall) from [] (kernel_init_freeable+0x11c/0x1e4)
     r9:c066f9c0 r8:c066f9c0 r7:c062eab0 r6:c06252c4 r5:000000ad r4:00000006
    [] (kernel_init_freeable) from [] (kernel_init+0x10/0xec)
     r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c048c3c0 r4:00000000
    [] (kernel_init) from [] (ret_from_fork+0x14/0x34)
     r4:00000000 r3:ee04e000
    ---[ end trace e3a984cc0335c8a0 ]---
    rcar_vin e6ef1000.video: group probe failed: -6

Fixes: 1ddc6a6caa94e1e1 ("[media] soc_camera: add support for dt binding soc_camera drivers")

Cc:  # 3.17+
Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Guennadi Liakhovetski 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma

2014-10-19T01:11:04+00:00

Pull slave-dmaengine updates from Vinod Koul:
 "For dmaengine contributions we have:
   - designware cleanup by Andy
   - my series moving device_control users to dmanegine_xxx APIs for
     later removal of device_control API
   - minor fixes spread over drivers mainly mv_xor, pl330, mmp, imx-sdma
     etc"

* 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma: (60 commits)
  serial: atmel: add missing dmaengine header
  dmaengine: remove FSLDMA_EXTERNAL_START
  dmaengine: freescale: remove FSLDMA_EXTERNAL_START control method
  carma-fpga: move to fsl_dma_external_start()
  carma-fpga: use dmaengine_xxx() API
  dmaengine: freescale: add and export fsl_dma_external_start()
  dmaengine: add dmaengine_prep_dma_sg() helper
  video: mx3fb: use dmaengine_terminate_all() API
  serial: sh-sci: use dmaengine_terminate_all() API
  net: ks8842: use dmaengine_terminate_all() API
  mtd: sh_flctl: use dmaengine_terminate_all() API
  mtd: fsmc_nand: use dmaengine_terminate_all() API
  V4L2: mx3_camer: use dmaengine_pause() API
  dmaengine: coh901318: use dmaengine_terminate_all() API
  pata_arasan_cf: use dmaengine_terminate_all() API
  dmaengine: edma: check for echan->edesc => NULL in edma_dma_pause()
  dmaengine: dw: export probe()/remove() and Co to users
  dmaengine: dw: enable and disable controller when needed
  dmaengine: dw: always export dw_dma_{en,dis}able
  dmaengine: dw: introduce dw_dma_on() helper
  ...

V4L2: mx3_camer: use dmaengine_pause() API

2014-10-15T16:00:59+00:00

The drivers should use dmaengine_pause() API instead of
accessing the device_control which will be deprecated soon

Signed-off-by: Vinod Koul

[media] soc_camera: Support VIDIOC_EXPBUF ioctl

2014-09-26T09:47:44+00:00

This patch allows for exporting a dmabuf descriptor from soc_camera drivers.

Signed-off-by: Kazunori Kobayashi 
Signed-off-by: Guennadi Liakhovetski 
Signed-off-by: Mauro Carvalho Chehab

[media] mx2-camera: potential negative underflow bug

2014-09-26T09:47:43+00:00

My static checker complains:

	drivers/media/platform/soc_camera/mx2_camera.c:1070
	mx2_emmaprp_resize() warn: no lower bound on 'num'

The heuristic is that it's looking for values which the user can
influence and we put an upper bound on them but we (perhaps
accidentally) allow negative numbers.

I am not very familiar with this code but I have looked at it and think
there might be a bug.  Making the variable unsigned seems like a safe
option either way and this silences the static checker warning.

The call tree is:
  -> subdev_do_ioctl()
     -> mx2_camera_set_fmt()
        -> mx2_emmaprp_resize()
The check:
	if (num > RESIZE_NUM_MAX)
can underflow and then we use "num" on the else path.

Signed-off-by: Dan Carpenter 
Signed-off-by: Guennadi Liakhovetski 
Signed-off-by: Mauro Carvalho Chehab

[media] rcar_vin: fix error message in rcar_vin_get_formats()

2014-09-26T09:47:43+00:00

The dev_err() call is supposed to output x in decimal but one of
the format specifiers is "%x" instead of "%u" (most probably due  to a typo).

Signed-off-by: Sergei Shtylyov 
Signed-off-by: Guennadi Liakhovetski 
Signed-off-by: Mauro Carvalho Chehab

[media] disable COMPILE_TEST for omap1_camera

2014-09-09T21:07:39+00:00

This driver depends on a legacy OMAP DMA API. So, it won't
compile-test on other archs.

While we might add stubs to the functions, this is not a
good idea, as the hole API should be replaced.

So, for now, let's just remove COMPILE_TEST and wait for
some time for people to fix. If not fixed, then we'll end
by removing this driver as a hole.

Acked-by: Guennadi Liakhovetski 
Signed-off-by: Mauro Carvalho Chehab

[media] soc_camera: remove uneeded semicolons

2014-09-03T20:59:12+00:00

We don't use semicolons after curly braces in the middle of the
code.

Signed-off-by: Mauro Carvalho Chehab

[media] soc_camera: use kmemdup()

2014-09-03T20:58:30+00:00

Instead of calling kzalloc and then copying, use kmemdup(). That
avoids zeroing the data structure before copying.

Found by coccinelle.

Acked-by: Guennadi Liakhovetski 
Signed-off-by: Mauro Carvalho Chehab

[media] be sure that HAS_DMA is enabled for vb2-dma-contig

2014-08-26T21:52:19+00:00

vb2-dma-contig depends on HAS_DMA, but the Kbuild doesn't take
it into account at select.

Signed-off-by: Mauro Carvalho Chehab