kernel/linux.git/drivers/media/mc, branch linux-5.9.y

media: media-request: Fix crash if memory allocation fails

2020-06-23T13:19:37+00:00

Syzbot reports a NULL-ptr deref in the kref_put() call: BUG: KASAN: null-ptr-deref in media_request_put drivers/media/mc/mc-request.c:81 [inline] kref_put include/linux/kref.h:64 [inline] media_request_put drivers/media/mc/mc-request.c:81 [inline] media_request_close+0x4d/0x170 drivers/media/mc/mc-request.c:89 __fput+0x2ed/0x750 fs/file_table.c:281 task_work_run+0x147/0x1d0 kernel/task_work.c:123 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:165 [inline] prepare_exit_to_usermode+0x48e/0x600 arch/x86/entry/common.c:196 What led to this crash was an injected memory allocation failure in media_request_alloc(): FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 should_failslab+0x5/0x20 kmem_cache_alloc_trace+0x57/0x300 ? anon_inode_getfile+0xe5/0x170 media_request_alloc+0x339/0x440 media_device_request_alloc+0x94/0xc0 media_device_ioctl+0x1fb/0x330 ? do_vfs_ioctl+0x6ea/0x1a00 ? media_ioctl+0x101/0x120 ? __media_device_usb_init+0x430/0x430 ? media_poll+0x110/0x110 __se_sys_ioctl+0xf9/0x160 do_syscall_64+0xf3/0x1b0 When that allocation fails, filp->private_data is left uninitialized which media_request_close() does not expect and crashes. To avoid this, reorder media_request_alloc() such that allocating the struct file happens as the last step thus media_request_close() will no longer get called for a partially created media request. Reported-by: syzbot+6bed2d543cf7e48b822b@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Tuomas Tynkkynen Fixes: 10905d70d788 ("media: media-request: implement media requests") Reviewed-by: Hans Verkuil Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab

media: entity: Pass entity to get_fwnode_pad operation

2020-05-18T09:12:05+00:00

Add a missing pointer to the entity in the media_entity operation get_fwnode_pad. There are no implementers of this op yet, but a future entity that does so will almost certainly need a reference to itself to carry out the work. operation") Fixes: ae45cd5efc120 ("[media] media: entity: Add get_fwnode_pad entity Signed-off-by: Steve Longerbeam Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab

media: mc/Kconfig: remove staging dependency for request API

2020-04-17T06:57:39+00:00

When the request API got merged, only drivers at staging were using it. As we wanted to be able to do future changes on it, we added an artificial depends on STAGING_MEDIA. Yet, request API is there for quite some time now, and didn't suffer any API breakages during this time. So, drop this. Reported-by: Stephen Rothwell Suggested-by: Ezequiel Garcia Signed-off-by: Mauro Carvalho Chehab

media: Kconfig: Don't expose the Request API option

2020-04-16T08:36:11+00:00

The Request API isn't meant to be chosen by users, but instead should be selected by drivers that want to support it. Hantro and Cedrus are already selecting the right options, so only the test drivers need to be fixed. Signed-off-by: Ezequiel Garcia Signed-off-by: Mauro Carvalho Chehab

media: Kconfig: move media controller core select to main Kconfig

2020-04-14T08:29:06+00:00

Let's place the main API selections at the media/Kconfig file, as this way we can better organize things. Signed-off-by: Mauro Carvalho Chehab

media: Kconfig files: use select for V4L2 subdevs and MC

2020-04-14T08:29:05+00:00

There are lots of drivers that only work when the media controller and/or the V4L2 subdev APIs are present. Right now, someone need to first enable those APIs before using those drivers. Well, ideally, drivers, should, instead *optionally* depend on it, in order for PC camera drivers to be able to use them, but nowadays most drivers are UVC cameras, with don't require a sensor driver. So, be it. Let's instead make them select the MEDIA_CONTROLLER and the SUBDEV API, in order to make easier for people to be able of enabling them. Signed-off-by: Mauro Carvalho Chehab

media: add SPDX headers on Kconfig and Makefile files

2020-04-14T08:29:05+00:00

Most of media Kconfig/Makefile files already has SPDX, but there are a few ones still missing. Add it to them. Signed-off-by: Mauro Carvalho Chehab

media: mc-entity.c: use WARN_ON, validate link pads

2020-02-24T16:21:58+00:00

Use WARN_ON instead of BUG_ON. Add two new WARN_ONs to verify that the source pad is really a source and that the sink pad is really a sink. Signed-off-by: Hans Verkuil [hverkuil-cisco@xs4all.nl: use ! instead of == NULL for source and sink] Signed-off-by: Mauro Carvalho Chehab

media: mc-entity.c: use & to check pad flags, not ==

2020-02-24T14:10:04+00:00

These are bits so to test if a pad is a sink you use & but not ==. It looks like the only reason this hasn't caused problems before is that media_get_pad_index() is currently only used with pads that do not set the MEDIA_PAD_FL_MUST_CONNECT flag. So a pad really had only the SINK or SOURCE flag set and nothing else. Signed-off-by: Hans Verkuil Cc: # for v5.3 and up Signed-off-by: Mauro Carvalho Chehab

media: mc-device.c: fix memleak in media_device_register_entity

2019-10-01T15:26:35+00:00

In media_device_register_entity, if media_graph_walk_init fails, need to free the previously memory. Reported-by: Hulk Robot Signed-off-by: zhengbin Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab