aboutsummaryrefslogtreecommitdiff
path: root/drivers/media/usb
AgeCommit message (Collapse)Author
2021-04-06media: em28xx/em28xx.h: Remove duplicate struct declarationWan Jiabing
struct em28xx is declared at 219th line. The declaration here is unnecessary. Remove it. Signed-off-by: Wan Jiabing <wanjiabing@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-06media: cx231xx/cx231xx.h: Remove repeated struct declarationWan Jiabing
struct cx231xx is declared at 146th line. The declaration here is unnecessary. Remove it. Signed-off-by: Wan Jiabing <wanjiabing@vivo.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-06media: uvcvideo: Support devices that report an OT as an entity sourceLaurent Pinchart
Some devices reference an output terminal as the source of extension units. This is incorrect, as output terminals only have an input pin, and thus can't be connected to any entity in the forward direction. The resulting topology would cause issues when registering the media controller graph. To avoid this problem, connect the extension unit to the source of the output terminal instead. While at it, and while no device has been reported to be affected by this issue, also handle forward scans where two output terminals would be connected together, and skip the terminals found through such an invalid connection. Reported-and-tested-by: John Nealy <jnealy3@yahoo.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-06media: uvcvideo: Fix XU id print in forward scanLaurent Pinchart
An error message in the forward scan code incorrectly prints the ID of the source entity instead of the XU entity being scanned. Fix it. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-06media: em28xx: fix memory leakMuhammad Usama Anjum
If some error occurs, URB buffers should also be freed. If they aren't freed with the dvb here, the em28xx_dvb_fini call doesn't frees the URB buffers as dvb is set to NULL. The function in which error occurs should do all the cleanup for the allocations it had done. Tested the patch with the reproducer provided by syzbot. This patch fixes the memleak. Reported-by: syzbot+889397c820fa56adf25d@syzkaller.appspotmail.com Signed-off-by: Muhammad Usama Anjum <musamaanjum@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-22media: media/usb: fix kernel-doc header issuesHans Verkuil
Fix the following kernel-doc warnings: drivers/media/usb/dvb-usb-v2/dvb_usb.h:109: warning: cannot understand function prototype: 'struct dvb_usb_driver_info ' drivers/media/usb/dvb-usb-v2/dvb_usb.h:126: warning: cannot understand function prototype: 'struct dvb_usb_rc ' drivers/media/usb/dvb-usb-v2/dvb_usb.h:143: warning: cannot understand function prototype: 'struct usb_data_stream_properties ' drivers/media/usb/dvb-usb-v2/dvb_usb.h:170: warning: expecting prototype for properties of dvb usb device adapter(). Prototype was for MAX_NO_OF_FE_PER_ADAP() instead drivers/media/usb/dvb-usb-v2/dvb_usb.h:221: error: Cannot parse struct or union! drivers/media/usb/dvb-usb-v2/dvb_usb.h:277: warning: expecting prototype for generic object of an usb stream(). Prototype was for MAX_NO_URBS_FOR_DATA_STREAM() instead drivers/media/usb/dvb-usb-v2/dvb_usb.h:319: warning: cannot understand function prototype: 'struct dvb_usb_adapter ' drivers/media/usb/dvb-usb-v2/dvb_usb.h:363: warning: cannot understand function prototype: 'struct dvb_usb_device ' drivers/media/usb/dvb-usb/dvb-usb.h:104: warning: cannot understand function prototype: 'struct usb_data_stream_properties ' drivers/media/usb/dvb-usb/dvb-usb.h:163: warning: expecting prototype for struct dvb_usb_adapter_properties. Prototype was for struct dvb_usb_adapter_fe_properties instead drivers/media/usb/dvb-usb/dvb-usb.h:205: warning: cannot understand function prototype: 'struct dvb_rc ' drivers/media/usb/dvb-usb/dvb-usb.h:227: warning: Enum value 'DVB_RC_LEGACY' not described in enum 'dvb_usb_mode' drivers/media/usb/dvb-usb/dvb-usb.h:227: warning: Enum value 'DVB_RC_CORE' not described in enum 'dvb_usb_mode' drivers/media/usb/dvb-usb/dvb-usb.h:271: error: Cannot parse struct or union! drivers/media/usb/dvb-usb/dvb-usb.h:325: error: Cannot parse struct or union! drivers/media/usb/dvb-usb/dvb-usb.h:385: warning: expecting prototype for struct dvb_usb_adapter. Prototype was for struct dvb_usb_fe_adapter instead drivers/media/usb/dvb-usb/dvb-usb.h:476: warning: Function parameter or member 'num_adapters_initialized' not described in 'dvb_usb_device' drivers/media/usb/dvb-usb/dvb-usb.h:476: warning: Function parameter or member 'adapter' not described in 'dvb_usb_device' drivers/media/usb/dvb-usb/dvb-usb.h:476: warning: Function parameter or member 'rc_phys' not described in 'dvb_usb_device' drivers/media/usb/em28xx/em28xx.h:377: warning: cannot understand function prototype: 'enum em28xx_amux ' Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-22media: gspca/sq905.c: fix uninitialized variableHans Verkuil
act_len can be uninitialized if usb_bulk_msg() returns an error. Set it to 0 to avoid a KMSAN error. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reported-by: syzbot+a4e309017a5f3a24c7b3@syzkaller.appspotmail.com Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-22media: media/usb/gspca/w996Xcf.c: /** -> /*Hans Verkuil
The copyright text is just a comment, not kernel-doc documentation. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-22media: flexcop-usb: delete unneeded returnJulia Lawall
No need for a return after a break; Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: anysee: simplify the return expression of anysee_ci_* functionLiu Shixin
Simplify the return expression. Signed-off-by: Liu Shixin <liushixin2@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: fix incorrect kernel doc usagesHans Verkuil
This patch fixes the following trivial warnings w.r.t. kernel-doc usage: drivers/media/common/videobuf2/frame_vector.c:38: warning: Excess function parameter 'gup_flags' description in 'get_vaddr_frames' drivers/media/dvb-core/dvb_ca_en50221.c:193: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1014: warning: expecting prototype for Wake up the DVB CA thread(). Prototype was for dvb_ca_en50221_thread_wakeup() instead drivers/media/dvb-core/dvb_ca_en50221.c:1023: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1081: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1112: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1327: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1411: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1426: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1582: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1693: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1743: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1772: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1830: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1922: warning: wrong kernel-doc identifier on line: drivers/media/rc/img-ir/img-ir-hw.c:628: warning: expecting prototype for img_ir_decoder_compatable(). Prototype was for img_ir_decoder_compatible() instead drivers/media/v4l2-core/v4l2-jpeg.c:461: warning: expecting prototype for jpeg_parse_header(). Prototype was for v4l2_jpeg_parse_header() instead drivers/media/platform/vsp1/vsp1_dl.c:166: warning: expecting prototype for struct vsp1_cmd_pool. Prototype was for struct vsp1_dl_cmd_pool instead drivers/media/platform/mtk-vpu/mtk_vpu.c:28: warning: expecting prototype for is a tiny processor controlling video hardware(). Prototype was for INIT_TIMEOUT_MS() instead drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:73: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct vp9_ref_buf instead drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:85: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct vp9_sf_ref_fb instead drivers/media/tuners/mt2063.c:1404: warning: expecting prototype for fLO_FractionalTerm(). Prototype was for MT2063_fLO_FractionalTerm() instead drivers/media/tuners/mt2063.c:1465: warning: expecting prototype for CalcLO2Mult(). Prototype was for MT2063_CalcLO2Mult() instead drivers/media/usb/pwc/pwc-dec23.c:640: warning: wrong kernel-doc identifier on line: drivers/media/platform/exynos4-is/media-dev.c:820: warning: expecting prototype for __fimc_md_create_fimc_links(). Prototype was for __fimc_md_create_fimc_sink_links() instead drivers/media/i2c/s5k6aa.c:426: warning: expecting prototype for s5k6aa_configure_pixel_clock(). Prototype was for s5k6aa_configure_pixel_clocks() instead drivers/media/i2c/imx274.c:700: warning: wrong kernel-doc identifier on line: drivers/media/i2c/imx274.c:735: warning: wrong kernel-doc identifier on line: drivers/media/i2c/imx274.c:983: warning: wrong kernel-doc identifier on line: Most are missing or mistyped function names. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: drivers/media/usb: fix memory leak in zr364xx_probePavel Skripkin
syzbot reported memory leak in zr364xx_probe()[1]. The problem was in invalid error handling order. All error conditions rigth after v4l2_ctrl_handler_init() must call v4l2_ctrl_handler_free(). Reported-by: syzbot+efe9aefc31ae1e6f7675@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: media/usb:Remove superfluous "breaks" in the ttusb_dec.cdingsenjie
Remove superfluous "breaks", as there is a "return" before them. Signed-off-by: dingsenjie <dingsenjie@yulong.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: media/usb:Remove superfluous "breaks"dingsenjie
Remove superfluous "breaks", as there is a "return" before them. Signed-off-by: dingsenjie <dingsenjie@yulong.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: usbtv: constify static structsRikard Falkeborn
Constify two static structs which are never modified to allow the compiler to put them in read-only memory. The only usage of norm_params is only read from it in usbtv_configure_for_norm(). Making it const shrinks the resulting ko-file with 300 bytes (tested with gcc 10). The only usage of usbtv_ioctl_ops is to put its address to the ioctl_ops field in the video_device struct. Making it const moves ~1kb to read-only memory. Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: dvb-usb: Fix use-after-free accessTakashi Iwai
dvb_usb_device_init() copies the properties to the own data, so that the callers can release the original properties later (as done in the commit 299c7007e936 ("media: dw2102: Fix memleak on sequence of probes")). However, it also stores dev->desc pointer that is a reference to the original properties data. Since dev->desc is referred later, it may result in use-after-free, in the worst case, leading to a kernel Oops as reported. This patch addresses the problem by allocating and copying the properties at first, then get the desc from the copied properties. Reported-and-tested-by: Stefan Seyfried <seife+kernel@b1-systems.com> BugLink: http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 Reviewed-by: Robert Foss <robert.foss@linaro.org> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: dvb-usb: Fix memory leak at error in dvb_usb_device_init()Takashi Iwai
dvb_usb_device_init() allocates a dvb_usb_device object, but it doesn't release the object by itself even at errors. The object is released in the callee side (dvb_usb_init()) in some error cases via dvb_usb_exit() call, but it also missed the object free in other error paths. And, the caller (it's only dvb_usb_device_init()) doesn't seem caring the resource management as well, hence those memories are leaked. This patch assures releasing the memory at the error path in dvb_usb_device_init(). Now dvb_usb_init() frees the resources it allocated but leaves the passed dvb_usb_device object intact. In turn, the dvb_usb_device object is released in dvb_usb_device_init() instead. We could use dvb_usb_exit() function for releasing everything in the callee (as it was used for some error cases in the original code), but releasing the passed object in the callee is non-intuitive and error-prone. So I took this approach (which is more standard in Linus kernel code) although it ended with a bit more open codes. Along with the change, the patch makes sure that USB intfdata is reset and don't return the bogus pointer to the caller of dvb_usb_device_init() at the error path, too. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: em28xx: Add pid for bulk revision of Hauppauge 461eV2Brad Love
Manufacturing has switched from ISOC to bulk transport, the pid has accordingly changed to signify this. 0x2013:0x0461 is an ISOC 461e v2 0x2013:0x8461 is a bulk transport 461e v2 Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: em28xx: Add pid for bulk revision of Hauppauge 461eBrad Love
Manufacturing has switched from ISOC to bulk transport, the pid has accordingly changed to signify this. 0x2013:0x0258 is an ISOC 461e 0x2013:0x8258 is a bulk transport 461e Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-02-05media: uvc: strncpy -> strscpyHans Verkuil
The use of strncpy is discouraged, use strscpy instead. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-02-05media: em28xx: Add support for Hauppauge USB QuadHDBrad Love
Hauppauge USB QuadHD contains two two-tuner em28xx devices behind a usb hub. Each of the four dvb adapters contains a MaxLinear 692 combo ATSC demod/tuner. Bus 003 Device 006: ID 2040:846d Hauppauge Bus 003 Device 005: ID 2040:846d Hauppauge Bus 003 Device 004: ID 04e2:0404 Exar Corp. Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-02-05media: em28xx-core: Fix i2c error debugBrad Love
Read errors are currently reported as write errors. An incorrectly received read operation is never reported at all. Add a debug statement indicating the request mismatch. Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-02-05media: em28xx-core: Fix TS2 active ledBrad Love
TS2 active led is completely igored, fix that. Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Rename debug functionsJoe Perches
trace isn't a good name as it's not a trace mechanism, it is a typical debug mechanism. Rename uvc_trace/uvc_trace_cont macros to uvc_dbg/uvc_dbg_cont. Rename uvc_trace_param to uvc_dbg_param Rename UVC_TRACE_<FOO> defines to UVC_DBG_<FOO> Use ## concatenation in uvc_dbg macros to avoid overly long and repetitive UVC_DBG uses Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: use dev_printk() for uvc_trace()Ricardo Ribalda
Instead of calling prink() inside uvc_trace, use dev_printk(), which adds context to the output. Now that we are at it, regroup the strings so the messages can be easily "grepable". Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: New macro uvc_trace_contRicardo Ribalda
Remove all the duplicated code around printk(KERN_CONT, with a new macro. Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Use dev_ printk aliasesRicardo Ribalda
Replace all the uses of printk() and uvc_printk() with its equivalent dev_ alias macros. Modify uvc_warn_once() macro to use dev_info instead printk(). They are more standard across the kernel tree and provide more context about the error. Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Add Privacy control based on EXT_GPIORicardo Ribalda
Add a new control and mapping for Privacy controls connected to UVC_GUID_EXT_GPIO_CONTROLLERs. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Implement UVC_EXT_GPIO_UNITRicardo Ribalda
Some devices can implement a physical switch to disable the input of the camera on demand. Think of it like an elegant privacy sticker. The system can read the status of the privacy switch via a GPIO. It is important to know the status of the switch, e.g. to notify the user when the camera will produce black frames and a videochat application is used. In some systems, the GPIO is connected to the main SoC instead of the camera controller, with the connection reported by the system firmware (ACPI or DT). In that case, the UVC device isn't aware of the GPIO. We need to implement a virtual entity to handle the GPIO fully on the driver side. For example, for ACPI-based systems, the GPIO is reported in the USB device object: Scope (\_SB.PCI0.XHCI.RHUB.HS07) { /.../ Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings { GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly, "\\_SB.PCI0.GPIO", 0x00, ResourceConsumer, , ) { // Pin list 0x0064 } }) Name (_DSD, Package (0x02) // _DSD: Device-Specific Data { ToUUID ("daffd814-6eba-4d8c-8a91-bc9bbf4aa301") /* Device Properties for _DSD */, Package (0x01) { Package (0x02) { "privacy-gpio", Package (0x04) { \_SB.PCI0.XHCI.RHUB.HS07, Zero, Zero, One } } } }) } Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Allow entity-defined get_info and get_curRicardo Ribalda
Allows controls to get their properties and current value from an entity-defined function instead of via a query to the USB device. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Provide sync and async uvc_ctrl_status_eventRicardo Ribalda
Split the functionality of void uvc_ctrl_status_event_work in two, so it can be called by functions outside interrupt context and not part of an URB. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Allow entities with no padsRicardo Ribalda
Avoid an underflow while calculating the number of inputs for entities with zero pads. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Allow extra entitiesRicardo Ribalda
Increase the size of the id, to avoid collisions with entities implemented by the driver that are not part of the UVC device. Entities exposed by the UVC device use IDs 0-255, extra entities implemented by the driver (such as the GPIO entity) use IDs 256 and up. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Move guid to entityRicardo Ribalda
Instead of having multiple copies of the entity guid on the code, move it to the entity structure. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex valuesLaurent Pinchart
The Renkforce RF AC4K 300 Action Cam 4K reports invalid bFormatIndex and bFrameIndex values when negotiating the video probe and commit controls. The UVC descriptors report a single supported format and frame size, with bFormatIndex and bFrameIndex both equal to 2, but the video probe and commit controls report bFormatIndex and bFrameIndex set to 1. The device otherwise operates correctly, but the driver rejects the values and fails the format try operation. Fix it by ignoring the invalid indices, and assuming that the format and frame requested by the driver are accepted by the device. Link: https://bugzilla.kernel.org/show_bug.cgi?id=210767 Fixes: 8a652a17e3c0 ("media: uvcvideo: Ensure all probed info is returned to v4l2") Reported-by: Till Dörges <doerges@pre-sense.de> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Force UVC version to 1.0a for 1bcf:0b40Laurent Pinchart
The Shenzhen Aoni Electronic Co.,Ltd 2K FHD camera reports a UVC 1.10 version, but implements UVC 1.0a as shown by the UVC probe control being 26 bytes long. Force the UVC version for that device. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reported-by: Doncho Minkov <donchominkov@gmail.com> Tested-by: Doncho Minkov <donchominkov@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: zr364xx: fix memory leaks in probe()Dan Carpenter
Syzbot discovered that the probe error handling doesn't clean up the resources allocated in zr364xx_board_init(). There are several related bugs in this code so I have re-written the error handling. 1) Introduce a new function zr364xx_board_uninit() which cleans up the resources in zr364xx_board_init(). 2) In zr364xx_board_init() if the call to zr364xx_start_readpipe() fails then release the "cam->buffer.frame[i].lpvbits" memory before returning. This way every function either allocates everything successfully or it cleans up after itself. 3) Re-write the probe function so that each failure path goto frees the most recent allocation. That way we don't free anything before it has been allocated and we can also verify that everything is freed. 4) Originally, in the probe function the "cam->v4l2_dev.release" pointer was set to "zr364xx_release" near the start but I moved that assignment to the end, after everything had succeeded. The release function was never actually called during the probe cleanup process, but with this change I wanted to make it clear that we don't want to call zr364xx_release() until everything is allocated successfully. Next I re-wrote the zr364xx_release() function. Ideally this would have been a simple matter of copy and pasting the cleanup code from probe and adding an additional call to video_unregister_device(). But there are a couple quirks to note. 1) The probe function does not call videobuf_mmap_free() and I don't know where the videobuf_mmap is allocated. I left the code as-is to avoid introducing a bug in code I don't understand. 2) The zr364xx_board_uninit() has a call to zr364xx_stop_readpipe() which is a change from the original behavior with regards to unloading the driver. Calling zr364xx_stop_readpipe() on a stopped pipe is not a problem so this is safe and is potentially a bugfix. Reported-by: syzbot+b4d54814b339b5c6bbd4@syzkaller.appspotmail.com Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: rc: select CONFIG_BITREVERSE where neededArnd Bergmann
A number of remote control drivers require the bitreverse helper, and run into a link error when it is disabled: arm-linux-gnueabi-ld: drivers/media/rc/img-ir/img-ir-nec.o: in function `img_ir_nec_scancode': img-ir-nec.c:(.text+0x10c): undefined reference to `byte_rev_table' arm-linux-gnueabi-ld: drivers/media/rc/img-ir/img-ir-nec.o: in function `img_ir_nec_filter': img-ir-nec.c:(.text+0x2dc): undefined reference to `byte_rev_table' arm-linux-gnueabi-ld: drivers/media/usb/cx231xx/cx231xx-input.o: in function `get_key_isdbt': cx231xx-input.c:(.text+0x38c): undefined reference to `byte_rev_table' arm-linux-gnueabi-ld: drivers/media/usb/em28xx/em28xx-input.o: in function `em28xx_get_key_em_haup': em28xx-input.c:(.text+0x1704): undefined reference to `byte_rev_table' Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Sean Young <sean@mess.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: usb: dvb-usb-v2: Fix fall-through warnings for ClangGustavo A. R. Silva
In preparation to enable -Wimplicit-fallthrough for Clang, fix multiple warnings by explicitly adding a couple of break statements instead of just letting the code fall through to the next case. Link: https://github.com/KSPP/linux/issues/115 Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: usb/dvb-usb-v2/rtl28xxu.c: clean up code to fix smatch warningHans Verkuil
Fixes this smatch warning: drivers/media/usb/dvb-usb-v2/rtl28xxu.c:1040 rtl2832u_frontend_attach() warn: missing error code 'ret' It is actually a bogus warning since in this particular case ret isn't meant to be set. But by reworking the code a bit the code is actually a lot more understandable and it fixes this warning. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: lmedm04: Remove lme2510_kill_urb function.Malcolm Priestley
This function is not necessary and largely a remnant of dvb-usb workaround and is now controlled by dvb-usb-v2. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: lmedm04: Use GFP_KERNEL for URB allocation/submission.Malcolm Priestley
lme2510_int_read is not atomically called so use GFP_KERNEL for usb_alloc_urb and usb_submit_urb which is the first in the chain of interrupt submissions. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: lmedm04: Fix misuse of commaJoe Perches
There's a comma used instead of a semicolon that causes multiple statements to be executed after an if instead of just the intended single statement. Replace the comma with a semicolon. Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb") Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-12media: pwc: Use correct device for DMAMatwey V. Kornilov
This fixes the following newly introduced warning: [ 15.518253] ------------[ cut here ]------------ [ 15.518941] WARNING: CPU: 0 PID: 246 at kernel/dma/mapping.c:149 dma_map_page_attrs+0x1a8/0x1d0 [ 15.520634] Modules linked in: pwc videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc efivarfs [ 15.522335] CPU: 0 PID: 246 Comm: v4l2-test Not tainted 5.11.0-rc1+ #1 [ 15.523281] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 [ 15.524438] RIP: 0010:dma_map_page_attrs+0x1a8/0x1d0 [ 15.525135] Code: 10 5b 5d 41 5c 41 5d c3 4d 89 d0 eb d7 4d 89 c8 89 e9 48 89 da e8 68 29 00 00 eb d1 48 89 f2 48 2b 50 18 48 89 d0 eb 83 0f 0b <0f> 0b 48 c7 c0 ff ff ff ff eb b8 48 89 d9 48 8b 40 40 e8 61 69 d2 [ 15.527938] RSP: 0018:ffffa2694047bca8 EFLAGS: 00010246 [ 15.528716] RAX: 0000000000000000 RBX: 0000000000002580 RCX: 0000000000000000 [ 15.529782] RDX: 0000000000000000 RSI: ffffcdce000ecc00 RDI: ffffa0b4bdb888a0 [ 15.530849] RBP: 0000000000000002 R08: 0000000000000002 R09: 0000000000000000 [ 15.531881] R10: 0000000000000004 R11: 000000000002d8c0 R12: 0000000000000000 [ 15.532911] R13: ffffa0b4bdb88800 R14: ffffa0b483820000 R15: ffffa0b4bdb888a0 [ 15.533942] FS: 00007fc5fbb5e4c0(0000) GS:ffffa0b4fc000000(0000) knlGS:0000000000000000 [ 15.535141] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 15.535988] CR2: 00007fc5fb6ea138 CR3: 0000000003812000 CR4: 00000000001506f0 [ 15.537025] Call Trace: [ 15.537425] start_streaming+0x2e9/0x4b0 [pwc] [ 15.538143] vb2_start_streaming+0x5e/0x110 [videobuf2_common] [ 15.538989] vb2_core_streamon+0x107/0x140 [videobuf2_common] [ 15.539831] __video_do_ioctl+0x18f/0x4a0 [videodev] [ 15.540670] video_usercopy+0x13a/0x5b0 [videodev] [ 15.541349] ? video_put_user+0x230/0x230 [videodev] [ 15.542096] ? selinux_file_ioctl+0x143/0x200 [ 15.542752] v4l2_ioctl+0x40/0x50 [videodev] [ 15.543360] __x64_sys_ioctl+0x89/0xc0 [ 15.543930] do_syscall_64+0x33/0x40 [ 15.544448] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 15.545236] RIP: 0033:0x7fc5fb671587 [ 15.545780] Code: b3 66 90 48 8b 05 11 49 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 48 2c 00 f7 d8 64 89 01 48 [ 15.548486] RSP: 002b:00007fff0f71f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 15.549578] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc5fb671587 [ 15.550664] RDX: 00007fff0f71f060 RSI: 0000000040045612 RDI: 0000000000000003 [ 15.551706] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 15.552738] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff0f71f060 [ 15.553817] R13: 00007fff0f71f1d0 R14: 0000000000de1270 R15: 0000000000000000 [ 15.554914] ---[ end trace 7be03122966c2486 ]--- Fixes: 1161db6776bd ("media: usb: pwc: Don't use coherent DMA buffers for ISO transfer") Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-12media: tm6000: Fix memleak in tm6000_start_streamDinghao Liu
When usb_clear_halt() fails, dvb->bulk_urb->transfer_buffer and dvb->bulk_urb should be freed just like when usb_submit_urb() fails. Fixes: 3169c9b26fffa ("V4L/DVB (12788): tm6000: Add initial DVB-T support") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-12media: em28xx: Fix use-after-free in em28xx_alloc_urbsDinghao Liu
When kzalloc() fails, em28xx_uninit_usb_xfer() will free usb_bufs->buf and set it to NULL. Thus the later access to usb_bufs->buf[i] will lead to null pointer dereference. Also the kfree(usb_bufs->buf) after that is redundant. Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: gspca: Fix memory leak in probeAlan Stern
The gspca driver leaks memory when a probe fails. gspca_dev_probe2() calls v4l2_device_register(), which takes a reference to the underlying device node (in this case, a USB interface). But the failure pathway neglects to call v4l2_device_unregister(), the routine responsible for dropping this reference. Consequently the memory for the USB interface and its device never gets released. This patch adds the missing function call. Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-27media: uvcvideo: Use DIV_ROUND_CLOSEST directly to make it readablezhong jiang
The kernel.h macro DIV_ROUND_CLOSEST performs the computation (x + d/2)/d but is perhaps more readable. Signed-off-by: zhong jiang <zhongjiang@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-27media: msi2500: assign SPI bus number dynamicallyAntti Palosaari
SPI bus number must be assigned dynamically for each device, otherwise it will crash when multiple devices are plugged to system. Reported-and-tested-by: syzbot+c60ddb60b685777d9d59@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-27media: usb: msi2500: Fix a possible null-pointer dereference in ↵Jia-Ju Bai
msi2500_stop_streaming() In msi2500_stop_streaming(), there is an if statement on line 870 to check whether dev->udev is NULL: if (dev->udev) When dev->udev is NULL, it is used on line 877: msi2500_ctrl_msg(dev, CMD_STOP_STREAMING, 0) usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), ...) Thus, a possible null-pointer dereference may occur. To fix this bug, dev->udev is checked before calling msi2500_ctrl_msg(). This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-05 04:31:19 +0000