linux.git/drivers/media, branch v5.12.5

media: meson-ge2d: fix rotation parameters

2021-05-14T08:52:42+00:00

[ Upstream commit 87e780db2253a1759822c2c9ea207135fcc059de ]

With these settings, 90deg and 270deg rotation leads to inverted
vertical, fix them to have correct rotation.

Fixes: 59a635327ca7 ("media: meson: Add M2M driver for the Amlogic GE2D Accelerator Unit")
Signed-off-by: Neil Armstrong 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: i2c: rdamc21: Fix warning on u8 cast

2021-05-14T08:52:40+00:00

[ Upstream commit 5f58ac04f36e32507d8f60fd47266ae2a60a2fa8 ]

Sparse reports a warning on a cast to u8 of a 16 bits constant.

drivers/media/i2c/rdacm21.c:348:62: warning: cast truncates bits
from constant value (300a becomes a)

Even if the behaviour is intended, silence the sparse warning replacing
the cast with a bitwise & operation.

Fixes: a59f853b3b4b ("media: i2c: Add driver for RDACM21 camera module")
Reported-by: Hans Verkuil 
Reviewed-by: Kieran Bingham 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Jacopo Mondi 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: v4l2-ctrls.c: fix race condition in hdl->requests list

2021-05-14T08:52:39+00:00

[ Upstream commit be7e8af98f3af729aa9f08b1053f9533a5cceb91 ]

When a request is re-inited it will release all control handler
objects that are still in the request. It does that by unbinding
and putting all those objects. When the object is unbound the
obj->req pointer is set to NULL, and the object's unbind op is
called. When the object it put the object's release op is called
to free the memory.

For a request object that contains a control handler that means
that v4l2_ctrl_handler_free() is called in the release op.

A control handler used in a request has a pointer to the main
control handler that is created by the driver and contains the
current state of all controls. If the device is unbound (due to
rmmod or a forced unbind), then that main handler is freed, again
by calling v4l2_ctrl_handler_free(), and any outstanding request
objects that refer to that main handler have to be unbound and put
as well.

It does that by this test:

	if (!hdl->req_obj.req && !list_empty(&hdl->requests)) {

I.e. the handler has no pointer to a request, so is the main
handler, and one or more request objects refer to this main
handler.

However, this test is wrong since hdl->req_obj.req is actually
NULL when re-initing a request (the object unbind will set req to
NULL), and the only reason this seemingly worked is that the
requests list is typically empty since the request's unbind op
will remove the handler from the requests list.

But if another thread is at the same time adding a new control
to a request, then there is a race condition where one thread
is removing a control handler object from the requests list and
another thread is adding one. The result is that hdl->requests
is no longer empty and the code thinks that a main handler is
being freed instead of a control handler that is part of a request.

There are two bugs here: first the test for hdl->req_obj.req: this
should be hdl->req_obj.ops since only the main control handler will
have a NULL pointer there.

The second is that adding or deleting request objects from the
requests list of the main handler isn't protected by taking the
main handler's lock.

Signed-off-by: Hans Verkuil 
Reported-by: John Cox 
Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support")
Tested-by: John Cox 
Reported-by: John Cox 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: i2c: imx219: Balance runtime PM use-count

2021-05-14T08:52:39+00:00

[ Upstream commit dd90caa0111e178b52b21e56364bc2244a3973b3 ]

Move incrementing/decrementing runtime PM count to
imx219_start_streaming()/imx219_stop_streaming() functions respectively.

This fixes an issue of unbalanced runtime PM count in resume callback
error path where streaming is stopped and runtime PM count is left
unbalanced.

Fixes: 1283b3b8f82b9 ("media: i2c: Add driver for Sony IMX219 sensor")
Reported-by: Pavel Machek 
Signed-off-by: Lad Prabhakar 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Sakari Ailus 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream

2021-05-14T08:52:39+00:00

[ Upstream commit 745d4612d2c853c00abadbf69799c8aee7f99c39 ]

Move out locking/unlocking of vflip and hflip controls from
imx219_set_stream() to the imx219_start_streaming()/
imx219_stop_streaming() respectively.

This fixes an issue in resume callback error path where streaming is
stopped and the controls are left in locked state.

Fixes: 1283b3b8f82b9 ("media: i2c: Add driver for Sony IMX219 sensor")
Reported-by: Pavel Machek 
Signed-off-by: Lad Prabhakar 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Sakari Ailus 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: ipu3-cio2: Fix pixel-rate derived link frequency

2021-05-14T08:52:38+00:00

[ Upstream commit a7de6eac6f6f73d48d97a6c93032107775f4593b ]

The driver uses v4l2_get_link_freq() helper to obtain the link frequency
using the LINK_FREQ but also the PIXEL_RATE control. The divisor for the
pixel rate derived link frequency was wrong, missing the bus uses double
data rate. Fix this.

Reported-by: Laurent Pinchart 
Fixes: 4b6c129e87a3 ("media: ipu3-cio2: Use v4l2_get_link_freq helper")
Signed-off-by: Sakari Ailus 
Reviewed-by: Laurent Pinchart 
Reviewed-by: Bingbu Cao 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: ccs: Fix sub-device function

2021-05-14T08:52:38+00:00

[ Upstream commit 8c43126e8c9f0990fa75fb5219c03b20d5ead7b7 ]

Fix sub-device function for the pixel array and the scaler.

It seems that the pixel array had gotten assigned as SCALER whereas the
scaler had CAM_SENSOR function. Fix this by setting the pixel array
function to CAM_SENSOR and that of scaler to SCALER.

Fixes: 9ec2ac9bd0f9 ("media: ccs: Give all subdevs a function")
Signed-off-by: Sakari Ailus 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: m88rs6000t: avoid potential out-of-bounds reads on arrays

2021-05-14T08:52:36+00:00

[ Upstream commit 9baa3d64e8e2373ddd11c346439e5dfccb2cbb0d ]

There a 3 array for-loops that don't check the upper bounds of the
index into arrays and this may lead to potential out-of-bounds
reads.  Fix this by adding array size upper bounds checks to be
full safe.

Addresses-Coverity: ("Out-of-bounds read")

Link: https://lore.kernel.org/linux-media/20201007121628.20676-1-colin.king@canonical.com
Fixes: 333829110f1d ("[media] m88rs6000t: add new dvb-s/s2 tuner for integrated chip M88RS6000")
Signed-off-by: Colin Ian King 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: m88ds3103: fix return value check in m88ds3103_probe()

2021-05-14T08:52:36+00:00

[ Upstream commit e61f9ea271933d987ab895c689fa37744f6fc27f ]

In case of error, the function i2c_new_dummy_device() returns
ERR_PTR() and never returns NULL. The NULL test in the return
value check should be replaced with IS_ERR().

Fixes: e6089feca460 ("media: m88ds3103: Add support for ds3103b demod")
Reported-by: Hulk Robot 
Signed-off-by: Wei Yongjun 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming()

2021-05-14T08:52:36+00:00

[ Upstream commit f3d384e36630e2a552d874e422835606d9cf230a ]

When sun6i_video_remote_subdev() returns NULL to subdev, no error return
code of sun6i_video_start_streaming() is assigned.
To fix this bug, ret is assigned with -EINVAL in this case.

Reported-by: TOTE Robot 
Signed-off-by: Jia-Ju Bai 
Fixes: 5cc7522d8965 ("media: sun6i: Add support for Allwinner CSI V3s")
Acked-by: Chen-Yu Tsai 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin