user/sven/linux.git/include/media/media-devnode.h, branch v4.9.173

[media] mc-core.rst: fix a warning about an internal routine

2016-09-09T12:59:12Z

Fix this warning: Documentation/media/kapi/mc-core.rst:97: WARNING: c:func reference target not found: media_devnode_release The media_device_release() is a function internal to media-devnode.c, and not exported elsewhere. So, we can't cross-reference it here. Make it explicit at the documentation. Signed-off-by: Mauro Carvalho Chehab

[media] docs-rst: improve the kAPI documentation for the mediactl

2016-09-09T12:28:55Z

There are several issues on the documentation: - the media.h header were not properly referenced; - verbatim expressions were not properly marked as such; - struct member references were wrong; - some notes were not using the right markup; - a comment that were moved to the kernel-doc markup were duplicated as a comment inside the struct media_entity; - some args were not pointing to the struct they're using; - macros weren't documented. Signed-off-by: Mauro Carvalho Chehab

[media] media-devnode.h: Fix documentation

2016-06-16T11:14:56Z

Two parameters were documented with a wrong name, and a struct device pointer description was missing. That caused the following warnings, when building documentation: include/media/media-devnode.h:102: warning: No description found for parameter 'media_dev' include/media/media-devnode.h:126: warning: No description found for parameter 'mdev' include/media/media-devnode.h:126: warning: Excess function parameter 'media_dev' description in 'media_devnode_register' Rename the description, to match the function parameter and fix Documentation. No funcional changes. Signed-off-by: Mauro Carvalho Chehab

[media] media: fix media devnode ioctl/syscall and unregister race

2016-06-15T20:59:28Z

Media devnode open/ioctl could be in progress when media device unregister is initiated. System calls and ioctls check media device registered status at the beginning, however, there is a window where unregister could be in progress without changing the media devnode status to unregistered. process 1 process 2 fd = open(/dev/media0) media_devnode_is_registered() (returns true here) media_device_unregister() (unregister is in progress and devnode isn't unregistered yet) ... ioctl(fd, ...) __media_ioctl() media_devnode_is_registered() (returns true here) ... media_devnode_unregister() ... (driver releases the media device memory) media_device_ioctl() (By this point devnode->media_dev does not point to allocated memory. use-after free in in mutex_lock_nested) BUG: KASAN: use-after-free in mutex_lock_nested+0x79c/0x800 at addr ffff8801ebe914f0 Fix it by clearing register bit when unregister starts to avoid the race. process 1 process 2 fd = open(/dev/media0) media_devnode_is_registered() (could return true here) media_device_unregister() (clear the register bit, then start unregister.) ... ioctl(fd, ...) __media_ioctl() media_devnode_is_registered() (return false here, ioctl returns I/O error, and will not access media device memory) ... media_devnode_unregister() ... (driver releases the media device memory) Signed-off-by: Shuah Khan Suggested-by: Sakari Ailus Reported-by: Mauro Carvalho Chehab Tested-by: Mauro Carvalho Chehab Signed-off-by: Mauro Carvalho Chehab

[media] media-device: dynamically allocate struct media_devnode

2016-06-15T20:57:24Z

struct media_devnode is currently embedded at struct media_device. While this works fine during normal usage, it leads to a race condition during devnode unregister. the problem is that drivers assume that, after calling media_device_unregister(), the struct that contains media_device can be freed. This is not true, as it can't be freed until userspace closes all opened /dev/media devnodes. In other words, if the media devnode is still open, and media_device gets freed, any call to an ioctl will make the core to try to access struct media_device, with will cause an use-after-free and even GPF. Fix this by dynamically allocating the struct media_devnode and only freeing it when it is safe. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Mauro Carvalho Chehab

[media] media-devnode: fix namespace mess

2016-06-15T20:56:06Z

Along all media controller code, "mdev" is used to represent a pointer to struct media_device, and "devnode" for a pointer to struct media_devnode. However, inside media-devnode.[ch], "mdev" is used to represent a pointer to struct media_devnode. This is very confusing and may lead to development errors. So, let's change all occurrences at media-devnode.[ch] to also use "devnode" for such pointers. This patch doesn't make any functional changes. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Mauro Carvalho Chehab

[media] media-devnode.h: document the remaining struct/functions

2016-01-11T14:19:13Z

There is one struct and two functions that were not documented. Add the corresponding kernel-doc documentation for them. Signed-off-by: Mauro Carvalho Chehab

[media] media-devnode: move kernel-doc documentation to the header

2016-01-11T14:19:13Z

As we're using the headers file only for documentation, move the two kernel-doc macros to the header, and fix it to avoid warnings. Signed-off-by: Mauro Carvalho Chehab

[media] Docbook: Fix description of struct media_devnode

2015-08-22T07:45:03Z

Warning(.//include/media/media-devnode.h:80): No description found for parameter 'fops' Warning(.//include/media/media-devnode.h:80): No description found for parameter 'dev' Warning(.//include/media/media-devnode.h:80): No description found for parameter 'cdev' Warning(.//include/media/media-devnode.h:80): No description found for parameter 'release' Signed-off-by: Mauro Carvalho Chehab Acked-by: Jonathan Corbet

[media] media: Use a better owner for the media device

2014-05-13T16:39:00Z

mdev->fops->owner is actually the owner of the very same module which implements media_device_register(), so it can't be unloaded anyway. Instead, use THIS_MODULE through a macro as does video_register_device(). Signed-off-by: Sakari Ailus Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab