kernel/linux.git/drivers/media/test-drivers/vimc, branch v6.12.80

media: vimc: skip .s_stream() for stopped entities

2025-04-10T12:39:40+00:00

commit 36cef585e2a31e4ddf33a004b0584a7a572246de upstream. Syzbot reported [1] a warning prompted by a check in call_s_stream() that checks whether .s_stream() operation is warranted for unstarted or stopped subdevs. Add a simple fix in vimc_streamer_pipeline_terminate() ensuring that entities skip a call to .s_stream() unless they have been previously properly started. [1] Syzbot report: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5933 at drivers/media/v4l2-core/v4l2-subdev.c:460 call_s_stream+0x2df/0x350 drivers/media/v4l2-core/v4l2-subdev.c:460 Modules linked in: CPU: 0 UID: 0 PID: 5933 Comm: syz-executor330 Not tainted 6.13.0-rc2-syzkaller-00362-g2d8308bf5b67 #0 ... Call Trace: vimc_streamer_pipeline_terminate+0x218/0x320 drivers/media/test-drivers/vimc/vimc-streamer.c:62 vimc_streamer_pipeline_init drivers/media/test-drivers/vimc/vimc-streamer.c:101 [inline] vimc_streamer_s_stream+0x650/0x9a0 drivers/media/test-drivers/vimc/vimc-streamer.c:203 vimc_capture_start_streaming+0xa1/0x130 drivers/media/test-drivers/vimc/vimc-capture.c:256 vb2_start_streaming+0x15f/0x5a0 drivers/media/common/videobuf2/videobuf2-core.c:1789 vb2_core_streamon+0x2a7/0x450 drivers/media/common/videobuf2/videobuf2-core.c:2348 vb2_streamon drivers/media/common/videobuf2/videobuf2-v4l2.c:875 [inline] vb2_ioctl_streamon+0xf4/0x170 drivers/media/common/videobuf2/videobuf2-v4l2.c:1118 __video_do_ioctl+0xaf0/0xf00 drivers/media/v4l2-core/v4l2-ioctl.c:3122 video_usercopy+0x4d2/0x1620 drivers/media/v4l2-core/v4l2-ioctl.c:3463 v4l2_ioctl+0x1ba/0x250 drivers/media/v4l2-core/v4l2-dev.c:366 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2b85c01b19 ... Reported-by: syzbot+5bcd7c809d365e14c4df@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5bcd7c809d365e14c4df Fixes: adc589d2a208 ("media: vimc: Add vimc-streamer for stream control") Cc: stable@vger.kernel.org Signed-off-by: Nikita Zhandarovich Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

media: vimc: scaler: Use subdev active state

2024-06-26T14:39:34+00:00

Store the active formats and crop rectangle in the subdevice active state. This simplifies implementation of the format and selection accessors, and allows using the v4l2_subdev_get_fmt() helper to implement the .get_fmt() operation. The active configuration that is used in the .process_frame() handler is still stored in the vimc_scaler_device structure. The driver could instead access the active state in the .process_frame() handler, but the required locking could interfere with the real time constraints of the frame processing. This data would be stored in registers in the .s_stream() handler for real hardware, storing it in dedicated storage thus mimics a real driver. To differentiate them from the rest of the device private data, move the corresponding fields to a sub-structure of vimc_scaler_device named hw. Signed-off-by: Laurent Pinchart Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil

media: vimc: debayer: Use subdev active state

2024-06-26T14:39:34+00:00

Store the active formats and crop rectangle in the subdevice active state. This simplifies implementation of the format and selection accessors, and allows using the v4l2_subdev_get_fmt() helper to implement the .get_fmt() operation. The active configuration that is used in the .process_frame() handler is still stored in the vimc_debayer_device structure. The driver could instead access the active state in the .process_frame() handler, but the required locking could interfere with the real time constraints of the frame processing. This data would be stored in registers in the .s_stream() handler for real hardware, storing it in dedicated storage thus mimics a real driver. To differentiate them from the rest of the device private data, move the corresponding fields to a sub-structure of vimc_debayer_device named hw. Signed-off-by: Laurent Pinchart Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil

media: vimc: sensor: Use subdev active state

2024-06-26T14:39:34+00:00

Store the active formats and crop rectangle in the subdevice active state. This simplifies implementation of the format and selection accessors, and allows using the v4l2_subdev_get_fmt() helper to implement the .get_fmt() operation. The active configuration that is used in the .process_frame() handler is still stored in the vimc_sensor_device structure. The driver could instead access the active state in the .process_frame() handler, but the required locking could interfere with the real time constraints of the frame processing. This data would be stored in registers in the .s_stream() handler for real hardware, storing it in dedicated storage thus mimics a real driver. To differentiate them from the rest of the device private data, move the corresponding fields to a sub-structure of vimc_sensor_device named hw. Signed-off-by: Laurent Pinchart Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil

media: vimc: Initialize subdev active state

2024-06-26T14:39:34+00:00

Finalize subdev initialization for all subdevs that provide a .init_state() operation. This creates an active state for all those subdevs, which subsequent patches will use to simplify the implementation of individual vimc entities. Signed-off-by: Laurent Pinchart Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil

media: vimc: Centralize subdev internal_ops initialization

2024-06-26T14:39:34+00:00

Initialize the subdev internal_ops field in the vimc_ent_sd_register() function. This handles the internal ops the same way as the subdev ops, and prepares for moving to the V4L2 subdev active state API. Signed-off-by: Laurent Pinchart Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil

media: vimc: scaler: Rename vic_sca_pad enum to vimc_scaler_pad

2024-06-26T14:39:34+00:00

The vic_sca_pad enum's name has been shortened to the extreme for no good reason. Rename it to vimc_scaler_pad. Signed-off-by: Laurent Pinchart Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil

media: vimc: Constify the ent_config array

2024-06-26T14:39:34+00:00

The ent_config array contains data that is never modified. Make it const. Signed-off-by: Laurent Pinchart Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil

media: vimc: Constify vimc_ent_type structures

2024-06-26T14:39:34+00:00

The vimc_ent_type structure contains static pointers to functions, and no other information that need to be modified after initialization. Make them const to avoid the risk of arbitrary code execution following an overflow that would overwrite the structure's contents. Signed-off-by: Laurent Pinchart Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil

media: vimc: Don't iterate over single pad

2024-06-26T14:39:34+00:00

The .init_state() operations of the debayer and sensor entities iterate over the entity's pads. In practice, the iteration covers a single pad only. Access the pad directly and remove the loops. Signed-off-by: Laurent Pinchart Reviewed-by: Sakari Ailus Signed-off-by: Shuah Khan Signed-off-by: Hans Verkuil