kernel/include/media, branch linux-5.11.y

media: v4l2-ctrls: fix reference to freed memory

2021-05-12T06:37:38Z

commit ac34b79da14d67a9b494f6125186becbd067e225 upstream. When controls are used together with the Request API, then for each request a v4l2_ctrl_handler struct is allocated. This contains the controls that can be set in a request. If a control is *not* set in the request, then the value used in the most recent previous request must be used, or the current value if it is not found in any outstanding requests. The framework tried to find such a previous request and it would set the 'req' pointer in struct v4l2_ctrl_ref to the v4l2_ctrl_ref of the control in such a previous request. So far, so good. However, when that previous request was applied to the hardware, returned to userspace, and then userspace would re-init or free that request, any 'ref' pointer in still-queued requests would suddenly point to freed memory. This was not noticed before since the drivers that use this expected that each request would always have the controls set, so there was never any need to find a control in older requests. This requirement was relaxed, and now this bug surfaced. It was also made worse by changeset 2fae4d6aabc8 ("media: v4l2-ctrls: v4l2_ctrl_request_complete() should always set ref->req") which increased the chance of this happening. The use of the 'req' pointer in v4l2_ctrl_ref was very fragile, so drop this entirely. Instead add a valid_p_req bool to indicate that p_req contains a valid value for this control. And if it is false, then just use the current value of the control. Note that VIDIOC_G_EXT_CTRLS will always return -EACCES when attempting to get a control from a request until the request is completed. And in that case, all controls in the request will have the control value set (i.e. valid_p_req is true). This means that the whole 'find the most recent previous request containing a control' idea is pointless, and the code can be simplified considerably. The v4l2_g_ext_ctrls_common() function was refactored a bit to make it more understandable. It also avoids updating volatile controls in a completed request since that was already done when the request was completed. Signed-off-by: Hans Verkuil Fixes: 2fae4d6aabc8 ("media: v4l2-ctrls: v4l2_ctrl_request_complete() should always set ref->req") Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support") Cc: # for v5.9 and up Tested-by: Alexandre Courbot Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

media: rc: compile rc-cec.c into rc-core

2021-03-17T16:11:29Z

commit f09f9f93afad770a04b35235a0aa465fcc8d6e3d upstream. The rc-cec keymap is unusual in that it can't be built as a module, instead it is registered directly in rc-main.c if CONFIG_MEDIA_CEC_RC is set. This is because it can be called from drm_dp_cec_set_edid() via cec_register_adapter() in an asynchronous context, and it is not allowed to use request_module() to load rc-cec.ko in that case. Trying to do so results in a 'WARN_ON_ONCE(wait && current_is_async())'. Since this keymap is only used if CONFIG_MEDIA_CEC_RC is set, we just compile this keymap into the rc-core module and never as a separate module. Signed-off-by: Hans Verkuil Fixes: 2c6d1fffa1d9 (drm: add support for DisplayPort CEC-Tunneling-over-AUX) Reported-by: Hans de Goede Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

media: v4l: common: Fix naming of v4l2_get_link_rate

2021-01-07T14:47:52Z

Rename v4l2_get_link_rate() as v4l2_get_link_freq(). What the function returns is the frequency of the link; rename it to reflect the name of the control where the information is obtained. Fixes: 1b888b3cebef ("media: v4l: Add a helper for obtaining the link frequency") Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab

media: rc: add keymap for pine64 remote

2020-12-07T12:51:59Z

Add a keymap for the pine64 IR remote [0]. The mouse key has been mapped to KEY_EPG to provide a more useful remote. [0] http://files.pine64.org/doc/Pine%20A64%20Schematic/remote-wit-logo.jpg Signed-off-by: Jonas Karlman Signed-off-by: Christian Hewitt Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: vicodec: mark the stateless FWHT API as stable

2020-12-03T11:27:33Z

The FWHT stateless 'uAPI' was staging and marked explicitly in the V4L2 specification that it will change and is unstable. Note that these control IDs were never exported as a public API, they were only defined in kernel-local headers (fwht-ctrls.h). Now, the FWHT stateless controls is ready to be part of the stable uAPI. While not too late: - Rename V4L2_CID_MPEG_VIDEO_FWHT_PARAMS to V4L2_CID_STATELESS_FWHT_PARAMS. - Move the contents of fwht-ctrls.h to v4l2-controls.h. - Move the public parts of drivers/media/test-drivers/vicodec/codec-fwht.h to v4l2-controls.h. - Add V4L2_CTRL_TYPE_FWHT_PARAMS control initialization and validation. - Add p_fwht_params to struct v4l2_ext_control. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: uapi: move H264 stateless controls out of staging

2020-12-03T11:27:33Z

The H.264 stateless 'uAPI' was staging and marked explicitly in the V4L2 specification that it will change and is unstable. Note that these control IDs were never exported as a public API, they were only defined in kernel-local headers (h264-ctrls.h). Now, the H264 stateless controls is ready to be part of the stable uAPI. While not too late, let's rename them and re-number their control IDs, moving them to the newly created stateless control class, and updating all the drivers accordingly. Signed-off-by: Ezequiel Garcia Tested-by: Jernej Skrabec Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: uapi: Move the H264 stateless control types out of staging

2020-12-03T11:27:33Z

Move the H264 stateless control types out of staging, and re-number them to avoid any confusion. Signed-off-by: Ezequiel Garcia Tested-by: Jernej Skrabec Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: uapi: Move parsed H264 pixel format out of staging

2020-12-03T11:27:33Z

Since we are ready to stabilize the H264 stateless API, start by first moving the parsed H264 pixel format. Signed-off-by: Ezequiel Garcia Tested-by: Jernej Skrabec Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: controls: Validate H264 stateless controls

2020-12-03T11:27:33Z

Check that all the fields that correspond or are related to a H264 specification syntax element have legal values. Signed-off-by: Ezequiel Garcia Tested-by: Jernej Skrabec Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: Clean stateless control includes

2020-12-03T11:27:33Z

Avoid including h264-ctrls.h, vp8-ctrls.h, etc, and instead just include v4l2-ctrls.h which does the right thing. This is in preparation for moving the stateless controls out of staging, which will mean removing some of these headers. Signed-off-by: Ezequiel Garcia Tested-by: Jernej Skrabec Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab