<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/linux.git/drivers/media/mc, branch v5.15.7</title>
<subtitle>Linux kernel stable tree (mirror)</subtitle>
<id>https://git.radix-linux.su/kernel/linux.git/atom?h=v5.15.7</id>
<link rel='self' href='https://git.radix-linux.su/kernel/linux.git/atom?h=v5.15.7'/>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/'/>
<updated>2021-08-04T12:43:50+00:00</updated>
<entry>
<title>media: mc-device.c: use DEVICE_ATTR_RO() helper macro</title>
<updated>2021-08-04T12:43:50+00:00</updated>
<author>
<name>Zhen Lei</name>
<email>thunder.leizhen@huawei.com</email>
</author>
<published>2021-06-03T07:12:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=7b537f290a9a9039d10d8f6da45e21018cc18cb2'/>
<id>urn:sha1:7b537f290a9a9039d10d8f6da45e21018cc18cb2</id>
<content type='text'>
Use DEVICE_ATTR_RO() helper macro instead of DEVICE_ATTR(), which is
simpler and more readable.

Due to the name of the read function of the sysfs attribute is normalized,
there is a natural association.

Signed-off-by: Zhen Lei &lt;thunder.leizhen@huawei.com&gt;
Signed-off-by: Sakari Ailus &lt;sakari.ailus@linux.intel.com&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
<entry>
<title>media: Fix Media Controller API config checks</title>
<updated>2021-06-24T12:26:00+00:00</updated>
<author>
<name>Shuah Khan</name>
<email>skhan@linuxfoundation.org</email>
</author>
<published>2021-06-16T15:19:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=50e7a31d30e8221632675abed3be306382324ca2'/>
<id>urn:sha1:50e7a31d30e8221632675abed3be306382324ca2</id>
<content type='text'>
Smatch static checker warns that "mdev" can be null:

sound/usb/media.c:287 snd_media_device_create()
    warn: 'mdev' can also be NULL

If CONFIG_MEDIA_CONTROLLER is disabled, this file should not be included
in the build.

The below conditions in the sound/usb/Makefile are in place to ensure that
media.c isn't included in the build.

sound/usb/Makefile:
snd-usb-audio-$(CONFIG_SND_USB_AUDIO_USE_MEDIA_CONTROLLER) += media.o

select SND_USB_AUDIO_USE_MEDIA_CONTROLLER if MEDIA_CONTROLLER &amp;&amp;
       (MEDIA_SUPPORT=y || MEDIA_SUPPORT=SND_USB_AUDIO)

The following config check in include/media/media-dev-allocator.h is
in place to enable the API only when CONFIG_MEDIA_CONTROLLER and
CONFIG_USB are enabled.

 #if defined(CONFIG_MEDIA_CONTROLLER) &amp;&amp; defined(CONFIG_USB)

This check doesn't work as intended when CONFIG_USB=m. When CONFIG_USB=m,
CONFIG_USB_MODULE is defined and CONFIG_USB is not. The above config check
doesn't catch that CONFIG_USB is defined as a module and disables the API.
This results in sound/usb enabling Media Controller specific ALSA driver
code, while Media disables the Media Controller API.

Fix the problem requires two changes:

1. Change the check to use IS_ENABLED to detect when CONFIG_USB is enabled
   as a module or static. Since CONFIG_MEDIA_CONTROLLER is a bool, leave
   the check unchanged to be consistent with drivers/media/Makefile.

2. Change the drivers/media/mc/Makefile to include mc-dev-allocator.o
   in mc-objs when CONFIG_USB is enabled.

Link: https://lore.kernel.org/alsa-devel/YLeAvT+R22FQ%2FEyw@mwanda/

Reported-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Signed-off-by: Shuah Khan &lt;skhan@linuxfoundation.org&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil-cisco@xs4all.nl&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
<entry>
<title>media: mc-request.c: allow object_bind in QUEUED state</title>
<updated>2021-06-02T09:41:54+00:00</updated>
<author>
<name>Hans Verkuil</name>
<email>hverkuil-cisco@xs4all.nl</email>
</author>
<published>2021-06-02T08:42:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=1cb13613735a15b994b680ae5ef18aaf79108b95'/>
<id>urn:sha1:1cb13613735a15b994b680ae5ef18aaf79108b95</id>
<content type='text'>
If a request was queued without a control handler object, and
a control handler object is then created and bound to the request
when copying controls on request completion, then a WARN_ON in
mc-request.c is triggered since at that time the request is in
state QUEUED, and not UPDATING.

But this is too strict, and in this case it must also allow
binding objects when in state QUEUED.

This patch was unfortunately lost when the "always copy the controls
on completion" patch was posted, it should have been part of that
commit.

Signed-off-by: Hans Verkuil &lt;hverkuil-cisco@xs4all.nl&gt;
Fixes: c3bf5129f339 ("media: v4l2-ctrls: always copy the controls on completion")
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
<entry>
<title>media: mc: mc-entity.c: Fix typo</title>
<updated>2021-05-19T07:51:39+00:00</updated>
<author>
<name>Sebastian Fricke</name>
<email>sebastian.fricke@posteo.net</email>
</author>
<published>2021-04-17T13:34:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=b07006ff9365ddfc184e1836cd1f75355c6bb740'/>
<id>urn:sha1:b07006ff9365ddfc184e1836cd1f75355c6bb740</id>
<content type='text'>
s/entity in the other end/entity at the other end/

[hverkuil: also remove the spurious space after 'link']

Signed-off-by: Sebastian Fricke &lt;sebastian.fricke@posteo.net&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil-cisco@xs4all.nl&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
<entry>
<title>media: entity: Add lockdep check to media graph walk</title>
<updated>2021-04-06T12:35:14+00:00</updated>
<author>
<name>Sakari Ailus</name>
<email>sakari.ailus@linux.intel.com</email>
</author>
<published>2021-03-12T09:05:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=4ebddb7c17c4549f04741c7faf8e4ced62391d20'/>
<id>urn:sha1:4ebddb7c17c4549f04741c7faf8e4ced62391d20</id>
<content type='text'>
It was always assumed that walking the media graph would require holding
the media_device graph_mutex but this was not documented nor checked for.

Add a lockdep check to graph walk init and iter, and document the need for
acquiring the graph_mutex.

Signed-off-by: Sakari Ailus &lt;sakari.ailus@linux.intel.com&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
<entry>
<title>media: mc-device.c: change media_device_request_alloc to match media_ioctl_info</title>
<updated>2020-08-29T06:15:23+00:00</updated>
<author>
<name>Frederic Chen</name>
<email>frederic.chen@mediatek.com</email>
</author>
<published>2020-08-06T15:58:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=c478c7f4cb940b63eb675d236588c6fda7adea08'/>
<id>urn:sha1:c478c7f4cb940b63eb675d236588c6fda7adea08</id>
<content type='text'>
We modified the type of media_device_request_alloc()'s second
parameter from int* to void* so that it can match the interface
defined in struct media_ioctl_info.

[hverkuil: move #ifdef before variable to avoid compile warning]

Signed-off-by: Frederic Chen &lt;frederic.chen@mediatek.com&gt;
Reviewed-by: Laurent Pinchart &lt;laurent.pinchart@ideasonboard.com&gt;
Signed-off-by: Hans Verkuil &lt;hverkuil-cisco@xs4all.nl&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
<entry>
<title>media: media-request: Fix crash if memory allocation fails</title>
<updated>2020-06-23T13:19:37+00:00</updated>
<author>
<name>Tuomas Tynkkynen</name>
<email>tuomas.tynkkynen@iki.fi</email>
</author>
<published>2020-06-21T11:30:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=e30cc79cc80fd919b697a15c5000d9f57487de8e'/>
<id>urn:sha1:e30cc79cc80fd919b697a15c5000d9f57487de8e</id>
<content type='text'>
Syzbot reports a NULL-ptr deref in the kref_put() call:

BUG: KASAN: null-ptr-deref in media_request_put drivers/media/mc/mc-request.c:81 [inline]
 kref_put include/linux/kref.h:64 [inline]
 media_request_put drivers/media/mc/mc-request.c:81 [inline]
 media_request_close+0x4d/0x170 drivers/media/mc/mc-request.c:89
 __fput+0x2ed/0x750 fs/file_table.c:281
 task_work_run+0x147/0x1d0 kernel/task_work.c:123
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop arch/x86/entry/common.c:165 [inline]
 prepare_exit_to_usermode+0x48e/0x600 arch/x86/entry/common.c:196

What led to this crash was an injected memory allocation failure in
media_request_alloc():

FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
 should_failslab+0x5/0x20
 kmem_cache_alloc_trace+0x57/0x300
 ? anon_inode_getfile+0xe5/0x170
 media_request_alloc+0x339/0x440
 media_device_request_alloc+0x94/0xc0
 media_device_ioctl+0x1fb/0x330
 ? do_vfs_ioctl+0x6ea/0x1a00
 ? media_ioctl+0x101/0x120
 ? __media_device_usb_init+0x430/0x430
 ? media_poll+0x110/0x110
 __se_sys_ioctl+0xf9/0x160
 do_syscall_64+0xf3/0x1b0

When that allocation fails, filp-&gt;private_data is left uninitialized
which media_request_close() does not expect and crashes.

To avoid this, reorder media_request_alloc() such that
allocating the struct file happens as the last step thus
media_request_close() will no longer get called for a partially created
media request.

Reported-by: syzbot+6bed2d543cf7e48b822b@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Tuomas Tynkkynen &lt;tuomas.tynkkynen@iki.fi&gt;
Fixes: 10905d70d788 ("media: media-request: implement media requests")
Reviewed-by: Hans Verkuil &lt;hverkuil-cisco@xs4all.nl&gt;
Signed-off-by: Sakari Ailus &lt;sakari.ailus@linux.intel.com&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
<entry>
<title>media: entity: Pass entity to get_fwnode_pad operation</title>
<updated>2020-05-18T09:12:05+00:00</updated>
<author>
<name>Steve Longerbeam</name>
<email>slongerbeam@gmail.com</email>
</author>
<published>2020-05-01T17:15:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=70d4a9efee9cdd580207473379e3ee64b331ae75'/>
<id>urn:sha1:70d4a9efee9cdd580207473379e3ee64b331ae75</id>
<content type='text'>
Add a missing pointer to the entity in the media_entity operation
get_fwnode_pad. There are no implementers of this op yet, but a future
entity that does so will almost certainly need a reference to itself
to carry out the work.

operation")

Fixes: ae45cd5efc120 ("[media] media: entity: Add get_fwnode_pad entity
Signed-off-by: Steve Longerbeam &lt;slongerbeam@gmail.com&gt;
Reviewed-by: Laurent Pinchart &lt;laurent.pinchart@ideasonboard.com&gt;
Signed-off-by: Sakari Ailus &lt;sakari.ailus@linux.intel.com&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
<entry>
<title>media: mc/Kconfig: remove staging dependency for request API</title>
<updated>2020-04-17T06:57:39+00:00</updated>
<author>
<name>Mauro Carvalho Chehab</name>
<email>mchehab+huawei@kernel.org</email>
</author>
<published>2020-04-17T06:55:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=e36b68ed273e12a4539b54d24bcdb929d94b68ba'/>
<id>urn:sha1:e36b68ed273e12a4539b54d24bcdb929d94b68ba</id>
<content type='text'>
When the request API got merged, only drivers at staging were
using it. As we wanted to be able to do future changes on it,
we added an artificial depends on STAGING_MEDIA.

Yet, request API is there for quite some time now, and
didn't suffer any API breakages during this time. So, drop
this.

Reported-by: Stephen Rothwell &lt;sfr@canb.auug.org.au&gt;
Suggested-by: Ezequiel Garcia &lt;ezequiel@collabora.com&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
<entry>
<title>media: Kconfig: Don't expose the Request API option</title>
<updated>2020-04-16T08:36:11+00:00</updated>
<author>
<name>Ezequiel Garcia</name>
<email>ezequiel@collabora.com</email>
</author>
<published>2020-04-14T22:06:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=016baa59bf9f6c2550480b73f18100285e3a4fd2'/>
<id>urn:sha1:016baa59bf9f6c2550480b73f18100285e3a4fd2</id>
<content type='text'>
The Request API isn't meant to be chosen by users,
but instead should be selected by drivers that want
to support it.

Hantro and Cedrus are already selecting the right options,
so only the test drivers need to be fixed.

Signed-off-by: Ezequiel Garcia &lt;ezequiel@collabora.com&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab+huawei@kernel.org&gt;
</content>
</entry>
</feed>
