summaryrefslogtreecommitdiff
path: root/drivers/media/platform/imx-jpeg
AgeCommit message (Collapse)AuthorFilesLines
2022-04-08media: imx-jpeg: fix a bug of accessing array out of boundsMing Qian1-1/+0
[ Upstream commit 97558d170a1236280407e8d29a7d095d2c2ed554 ] When error occurs in parsing jpeg, the slot isn't acquired yet, it may be the default value MXC_MAX_SLOTS. If the driver access the slot using the incorrect slot number, it will access array out of bounds. The result is the driver will change num_domains, which follows slot_data in struct mxc_jpeg_dev. Then the driver won't detach the pm domain at rmmod, which will lead to kernel panic when trying to insmod again. Signed-off-by: Ming Qian <ming.qian@nxp.com> Reviewed-by: Mirela Rabulea <mirela.rabulea@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-08media: imx-jpeg: Prevent decoding NV12M jpegs into single-planar buffersMirela Rabulea1-0/+6
[ Upstream commit 417591a766b3c040c346044541ff949c0b2bb7b2 ] If the application queues an NV12M jpeg as output buffer, but then queues a single planar capture buffer, the kernel will crash with "Unable to handle kernel NULL pointer dereference" in mxc_jpeg_addrs, prevent this by finishing the job with error. Signed-off-by: Mirela Rabulea <mirela.rabulea@oss.nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()'Christophe JAILLET1-0/+2
[ Upstream commit 5c47dc6657543b3c4dffcbe741fb693b9b96796d ] A successful 'mxc_jpeg_attach_pm_domains()' call should be balanced by a corresponding 'mxc_jpeg_detach_pm_domains()' call in the error handling path of the probe, as already done in the remove function. Update the error handling path accordingly. Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18media: imx-jpeg: Fix possible null pointer dereferenceMirela Rabulea1-0/+4
[ Upstream commit 83f5f0633b156c636f5249d3c10f2a9423dd4c96 ] Found by Coverity scan. Signed-off-by: Mirela Rabulea <mirela.rabulea@nxp.com> Reviewed-by: Laurentiu Palcu <laurentiu.palcu@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-17media: imx-jpeg: Constify static struct mxc_jpeg_fmtRikard Falkeborn2-17/+17
It is only read-from, so make it const. In order to be able to do this, constify all places where mxc_jpeg_fmt is used, in function arguments, return values and pointers. On top of that, make the name a pointer to const char. On aarch64, this shrinks object code size with 550 bytes with gcc 11.1.0, and almost 2kB with clang 12.0.0. Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-06-17media: imx-jpeg: Constify static struct v4l2_m2m_opsRikard Falkeborn1-1/+1
The only usage of mxc_jpeg_m2m_ops is to pass its address to v4l2_m2m_init() which takes a pointer to const struct v4l2_m2m_ops. Make it const to allow the compiler to put it in read-only memory. Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-09media: imx-jpeg: Fix double free in mxc_jpeg_removeMirela Rabulea1-1/+0
The video_unregister_device already calls video_device_release, so remove video_device_release, to avoid a double free, when removing the module. This showed up in a repeated rmmod/insmod scenario. Signed-off-by: Mirela Rabulea <mirela.rabulea@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-06media: VIDEO_IMX8_JPEG should depend on ARCH_MXC and not default to mGeert Uytterhoeven1-1/+1
The i.MX8 QXP/QM integrated JPEG encoder/decoder is only present on Freescale/NXP i.MX8 QXP and QM SoCs. Hence add a dependency on ARCH_MXC, to prevent asking the user about this driver when configuring a kernel without i.MX8 support. Drop the "default m" (which means "default y" if CONFIG_MODULES is not enabled), as merely enabling CONFIG_COMPILE_TEST should not enable additional code. Fixes: 2db16c6ed72ce644 ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-06media: imx-jpeg: Pass the v4l2_jpeg_header header argument by referenceColin Ian King1-7/+7
Currently the header argument is being passed by value, so a copy of 256 byte structure on the stack is potentially occurring. Fix this by passing by reference to avoid any large stack copies. Addresses-Coverity: ("Big parameter passed by value") Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-06media: imx-jpeg: Fix return value check in mxc_jpeg_attach_pm_domains()Wei Yongjun1-2/+2
In case of error, the function device_link_add() returns NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check should be replaced with NULL test. Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-06media: imx-jpeg: Fix error return code in mxc_jpeg_probe()Wei Yongjun1-0/+2
Fix to return negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-04-06media: imx-jpeg: Fix spelling mistake "Canot" -> "Cannot"Colin Ian King1-1/+1
There is a spelling mistake in a dev_err message. Fix it. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-22media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/DecoderMirela Rabulea6-0/+2627
V4L2 driver for the JPEG encoder/decoder from i.MX8QXP/i.MX8QM application processors. The multi-planar buffers API is used. Baseline and extended sequential jpeg decoding is supported. Progressive jpeg decoding is not supported by the IP. Supports encode and decode of various formats: YUV444, YUV422, YUV420, RGB, ARGB, Gray YUV420 is the only multi-planar format supported. Minimum resolution is 64 x 64, maximum 8192 x 8192. The alignment requirements for the resolution depend on the format, multiple of 16 resolutions should work for all formats. v4l2-compliance tests are passing, including the streaming tests, "v4l2-compliance -s" [hverkuil: fix kernel-doc typos] Signed-off-by: Mirela Rabulea <mirela.rabulea@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>