user/sven/linux.git/include/media, branch v5.13.18

media: subdev: disallow ioctl for saa6588/davinci

2021-07-19T08:04:53Z

commit 0a7790be182d32b9b332a37cb4206e24fe94b728 upstream. The saa6588_ioctl() function expects to get called from other kernel functions with a 'saa6588_command' pointer, but I found nothing stops it from getting called from user space instead, which seems rather dangerous. The same thing happens in the davinci vpbe driver with its VENC_GET_FLD command. As a quick fix, add a separate .command() callback pointer for this driver and change the two callers over to that. This change can easily get backported to stable kernels if necessary, but since there are only two drivers, we may want to eventually replace this with a set of more specialized callbacks in the long run. Fixes: c3fda7f835b0 ("V4L/DVB (10537): saa6588: convert to v4l2_subdev.") Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

media: Fix Media Controller API config checks

2021-07-14T15:06:29Z

[ Upstream commit 50e7a31d30e8221632675abed3be306382324ca2 ] Smatch static checker warns that "mdev" can be null: sound/usb/media.c:287 snd_media_device_create() warn: 'mdev' can also be NULL If CONFIG_MEDIA_CONTROLLER is disabled, this file should not be included in the build. The below conditions in the sound/usb/Makefile are in place to ensure that media.c isn't included in the build. sound/usb/Makefile: snd-usb-audio-$(CONFIG_SND_USB_AUDIO_USE_MEDIA_CONTROLLER) += media.o select SND_USB_AUDIO_USE_MEDIA_CONTROLLER if MEDIA_CONTROLLER && (MEDIA_SUPPORT=y || MEDIA_SUPPORT=SND_USB_AUDIO) The following config check in include/media/media-dev-allocator.h is in place to enable the API only when CONFIG_MEDIA_CONTROLLER and CONFIG_USB are enabled. #if defined(CONFIG_MEDIA_CONTROLLER) && defined(CONFIG_USB) This check doesn't work as intended when CONFIG_USB=m. When CONFIG_USB=m, CONFIG_USB_MODULE is defined and CONFIG_USB is not. The above config check doesn't catch that CONFIG_USB is defined as a module and disables the API. This results in sound/usb enabling Media Controller specific ALSA driver code, while Media disables the Media Controller API. Fix the problem requires two changes: 1. Change the check to use IS_ENABLED to detect when CONFIG_USB is enabled as a module or static. Since CONFIG_MEDIA_CONTROLLER is a bool, leave the check unchanged to be consistent with drivers/media/Makefile. 2. Change the drivers/media/mc/Makefile to include mc-dev-allocator.o in mc-objs when CONFIG_USB is enabled. Link: https://lore.kernel.org/alsa-devel/YLeAvT+R22FQ%2FEyw@mwanda/ Reported-by: Dan Carpenter Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: hevc: Fix dependent slice segment flags

2021-07-14T15:06:22Z

[ Upstream commit 67a7e53d5b21f3a84efc03a4e62db7caf97841ef ] Dependent slice segment flag for PPS control is misnamed. It should have "enabled" at the end. It only tells if this flag is present in slice header or not and not the actual value. Fix this by renaming the PPS flag and introduce another flag for slice control which tells actual value. Signed-off-by: Jernej Skrabec Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

Merge tag 'media/v5.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2021-04-28T16:24:36Z

Pull media updates from Mauro Carvalho Chehab: - addition of a maintainer's profile for the media subsystem - addition of i.MX8 IP support - qcom/camss gained support for hardware version Titan 170 - new RC keymaps - Lots of other improvements, cleanups and bug fixes * tag 'media/v5.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (488 commits) media: coda: fix macroblocks count control usage media: rkisp1: params: fix wrong bits settings media: cedrus: Fix H265 status definitions media: meson-ge2d: fix rotation parameters media: v4l2-ctrls: fix reference to freed memory media: venus : hfi: add venus image info into smem media: venus: Fix internal buffer size calculations for v6. media: venus: helpers: keep max bandwidth when mbps exceeds the supported range media: venus: fix hw overload error log condition media: venus: core: correct firmware name for sm8250 media: venus: core,pm: fix potential infinite loop media: venus: core: Fix kerneldoc warnings media: gscpa/stv06xx: fix memory leak media: cx25821: remove unused including media: staging: media/meson: remove redundant dev_err call media: adv7842: support 1 block EDIDs, fix clearing EDID media: adv7842: configure all pads media: allegro: change kernel-doc comment blocks to normal comments media: camss: ispif: Remove redundant dev_err call in msm_ispif_subdev_init() media: i2c: rdamc21: Fix warning on u8 cast ...

media: v4l2-ctrls: fix reference to freed memory

2021-04-15T11:18:09Z

When controls are used together with the Request API, then for each request a v4l2_ctrl_handler struct is allocated. This contains the controls that can be set in a request. If a control is *not* set in the request, then the value used in the most recent previous request must be used, or the current value if it is not found in any outstanding requests. The framework tried to find such a previous request and it would set the 'req' pointer in struct v4l2_ctrl_ref to the v4l2_ctrl_ref of the control in such a previous request. So far, so good. However, when that previous request was applied to the hardware, returned to userspace, and then userspace would re-init or free that request, any 'ref' pointer in still-queued requests would suddenly point to freed memory. This was not noticed before since the drivers that use this expected that each request would always have the controls set, so there was never any need to find a control in older requests. This requirement was relaxed, and now this bug surfaced. It was also made worse by changeset 2fae4d6aabc8 ("media: v4l2-ctrls: v4l2_ctrl_request_complete() should always set ref->req") which increased the chance of this happening. The use of the 'req' pointer in v4l2_ctrl_ref was very fragile, so drop this entirely. Instead add a valid_p_req bool to indicate that p_req contains a valid value for this control. And if it is false, then just use the current value of the control. Note that VIDIOC_G_EXT_CTRLS will always return -EACCES when attempting to get a control from a request until the request is completed. And in that case, all controls in the request will have the control value set (i.e. valid_p_req is true). This means that the whole 'find the most recent previous request containing a control' idea is pointless, and the code can be simplified considerably. The v4l2_g_ext_ctrls_common() function was refactored a bit to make it more understandable. It also avoids updating volatile controls in a completed request since that was already done when the request was completed. Signed-off-by: Hans Verkuil Fixes: 2fae4d6aabc8 ("media: v4l2-ctrls: v4l2_ctrl_request_complete() should always set ref->req") Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support") Cc: # for v5.9 and up Tested-by: Alexandre Courbot Signed-off-by: Mauro Carvalho Chehab

media: rc: add keymaps for mecool-kii-pro/kiii-pro remotes

2021-04-09T11:01:59Z

Add keymaps and bindings for the simple IR (NEC) remotes used with the MeCool KII-Pro and MeCool KIII-Pro Android STB devices. Tested-by: Drazen Spio Signed-off-by: Christian Hewitt Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: v4l: Add HDR10 static metadata controls

2021-04-06T12:56:00Z

Introduce Content light level and Mastering display colour volume Colorimetry compound controls with relevant payload structures and validation. Signed-off-by: Stanimir Varbanov Reviewed-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: v4l: fwnode: Rename v4l2_async_register_subdev_sensor_common

2021-04-06T12:36:54Z

Rename v4l2_async_register_subdev_sensor_common as v4l2_async_register_subdev_sensor. This is a part of the effort to make the long names present in V4L2 fwnode and async frameworks shorter. Signed-off-by: Sakari Ailus Reviewed-by: Ezequiel Garcia Signed-off-by: Mauro Carvalho Chehab

media: v4l: fwnode: Rename and make static V4L2 async notifier helper

2021-04-06T12:35:59Z

Rename v4l2_async_notifier_parse_fwnode_sensor_common() as v4l2_async_notifier_parse_fwnode_sensor() and make the function static, as it's not used by a driver and maybe never will. Signed-off-by: Sakari Ailus Reviewed-by: Ezequiel Garcia Signed-off-by: Mauro Carvalho Chehab

media: entity: Add lockdep check to media graph walk

2021-04-06T12:35:14Z

It was always assumed that walking the media graph would require holding the media_device graph_mutex but this was not documented nor checked for. Add a lockdep check to graph walk init and iter, and document the need for acquiring the graph_mutex. Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab