Commit 89f2ddce authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 

Pull media fixes from Mauro Carvalho Chehab:

 - some fixes for the v4l2 ioctl handler logic

 - a fix for an out of bound access in the DVB videobuf2 handler

 - three driver fixes (rkvdec, mediatek/vcodek and uvcvideo)

* tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: rkvdec: Disable H.264 error detection
  media: mediatek: vcodec: Drop platform_get_resource(IORESOURCE_IRQ)
  media: dvb_vb2: fix possible out of bound access
  media: v4l2-ioctl.c: fix incorrect error path
  media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args()
  media: uvcvideo: Fix InterfaceProtocol for Quanta camera
parents 2a4b6e13 3a99c447

drivers/media/dvb-core/dvb_vb2.c

+11 −0
Original line number Diff line number Diff line
@@ -354,6 +354,12 @@ int dvb_vb2_reqbufs(struct dvb_vb2_ctx *ctx, struct dmx_requestbuffers *req) 


int dvb_vb2_querybuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)

{

	struct vb2_queue *q = &ctx->vb_q;



	if (b->index >= q->num_buffers) {

		dprintk(1, "[%s] buffer index out of range\n", ctx->name);

		return -EINVAL;

	}

	vb2_core_querybuf(&ctx->vb_q, b->index, b);

	dprintk(3, "[%s] index=%d\n", ctx->name, b->index);

	return 0;
@@ -378,8 +384,13 @@ int dvb_vb2_expbuf(struct dvb_vb2_ctx *ctx, struct dmx_exportbuffer *exp) 


int dvb_vb2_qbuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)

{

	struct vb2_queue *q = &ctx->vb_q;

	int ret;



	if (b->index >= q->num_buffers) {

		dprintk(1, "[%s] buffer index out of range\n", ctx->name);

		return -EINVAL;

	}

	ret = vb2_core_qbuf(&ctx->vb_q, b->index, b, NULL);

	if (ret) {

		dprintk(1, "[%s] index=%d errno=%d\n", ctx->name,

drivers/media/platform/mediatek/vcodec/mtk_vcodec_enc_drv.c

+3 −6
Original line number Diff line number Diff line
@@ -228,7 +228,6 @@ static int mtk_vcodec_probe(struct platform_device *pdev) 
{

	struct mtk_vcodec_dev *dev;

	struct video_device *vfd_enc;

	struct resource *res;

	phandle rproc_phandle;

	enum mtk_vcodec_fw_type fw_type;

	int ret;
@@ -272,14 +271,12 @@ static int mtk_vcodec_probe(struct platform_device *pdev) 
		goto err_res;

	}



	res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);

	if (res == NULL) {

		dev_err(&pdev->dev, "failed to get irq resource");

		ret = -ENOENT;

	dev->enc_irq = platform_get_irq(pdev, 0);

	if (dev->enc_irq < 0) {

		ret = dev->enc_irq;

		goto err_res;

	}



	dev->enc_irq = platform_get_irq(pdev, 0);

	irq_set_status_flags(dev->enc_irq, IRQ_NOAUTOEN);

	ret = devm_request_irq(&pdev->dev, dev->enc_irq,

			       mtk_vcodec_enc_irq_handler,

drivers/media/usb/uvc/uvc_driver.c

+1 −1
Original line number Diff line number Diff line
@@ -2740,7 +2740,7 @@ static const struct usb_device_id uvc_ids[] = { 
	  .idProduct		= 0x4034,

	  .bInterfaceClass	= USB_CLASS_VIDEO,

	  .bInterfaceSubClass	= 1,

	  .bInterfaceProtocol	= 0,

	  .bInterfaceProtocol	= UVC_PC_PROTOCOL_15,

	  .driver_info		= (kernel_ulong_t)&uvc_ctrl_power_line_limited },

	/* LogiLink Wireless Webcam */

	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE

drivers/media/v4l2-core/v4l2-compat-ioctl32.c

+2 −0
Original line number Diff line number Diff line
@@ -1040,6 +1040,8 @@ int v4l2_compat_get_array_args(struct file *file, void *mbuf, 
{

	int err = 0;



	memset(mbuf, 0, array_size);



	switch (cmd) {

	case VIDIOC_G_FMT32:

	case VIDIOC_S_FMT32:

drivers/media/v4l2-core/v4l2-ioctl.c

+12 −14
Original line number Diff line number Diff line
@@ -2872,9 +2872,9 @@ static const struct v4l2_ioctl_info v4l2_ioctls[] = { 
	IOCTL_INFO(VIDIOC_S_PRIORITY, v4l_s_priority, v4l_print_u32, INFO_FL_PRIO),

	IOCTL_INFO(VIDIOC_G_SLICED_VBI_CAP, v4l_g_sliced_vbi_cap, v4l_print_sliced_vbi_cap, INFO_FL_CLEAR(v4l2_sliced_vbi_cap, type)),

	IOCTL_INFO(VIDIOC_LOG_STATUS, v4l_log_status, v4l_print_newline, 0),

	IOCTL_INFO(VIDIOC_G_EXT_CTRLS, v4l_g_ext_ctrls, v4l_print_ext_controls, INFO_FL_CTRL),

	IOCTL_INFO(VIDIOC_S_EXT_CTRLS, v4l_s_ext_ctrls, v4l_print_ext_controls, INFO_FL_PRIO | INFO_FL_CTRL),

	IOCTL_INFO(VIDIOC_TRY_EXT_CTRLS, v4l_try_ext_ctrls, v4l_print_ext_controls, INFO_FL_CTRL),

	IOCTL_INFO(VIDIOC_G_EXT_CTRLS, v4l_g_ext_ctrls, v4l_print_ext_controls, INFO_FL_CTRL | INFO_FL_ALWAYS_COPY),

	IOCTL_INFO(VIDIOC_S_EXT_CTRLS, v4l_s_ext_ctrls, v4l_print_ext_controls, INFO_FL_PRIO | INFO_FL_CTRL | INFO_FL_ALWAYS_COPY),

	IOCTL_INFO(VIDIOC_TRY_EXT_CTRLS, v4l_try_ext_ctrls, v4l_print_ext_controls, INFO_FL_CTRL | INFO_FL_ALWAYS_COPY),

	IOCTL_INFO(VIDIOC_ENUM_FRAMESIZES, v4l_stub_enum_framesizes, v4l_print_frmsizeenum, INFO_FL_CLEAR(v4l2_frmsizeenum, pixel_format)),

	IOCTL_INFO(VIDIOC_ENUM_FRAMEINTERVALS, v4l_stub_enum_frameintervals, v4l_print_frmivalenum, INFO_FL_CLEAR(v4l2_frmivalenum, height)),

	IOCTL_INFO(VIDIOC_G_ENC_INDEX, v4l_stub_g_enc_index, v4l_print_enc_idx, 0),
@@ -3367,8 +3367,7 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg, 
		array_buf = kvmalloc(array_size, GFP_KERNEL);

		err = -ENOMEM;

		if (array_buf == NULL)

			goto out_array_args;

		err = -EFAULT;

			goto out;

		if (in_compat_syscall())

			err = v4l2_compat_get_array_args(file, array_buf,

							 user_ptr, array_size,
@@ -3377,7 +3376,7 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg, 
			err = copy_from_user(array_buf, user_ptr, array_size) ?

								-EFAULT : 0;

		if (err)

			goto out_array_args;

			goto out;

		*kernel_ptr = array_buf;

	}
@@ -3395,6 +3394,13 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg, 
			trace_v4l2_qbuf(video_devdata(file)->minor, parg);

	}



	/*

	 * Some ioctls can return an error, but still have valid

	 * results that must be returned.

	 */

	if (err < 0 && !always_copy)

		goto out;



	if (has_array_args) {

		*kernel_ptr = (void __force *)user_ptr;

		if (in_compat_syscall()) {
@@ -3409,16 +3415,8 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg, 
		} else if (copy_to_user(user_ptr, array_buf, array_size)) {

			err = -EFAULT;

		}

		goto out_array_args;

	}

	/*

	 * Some ioctls can return an error, but still have valid

	 * results that must be returned.

	 */

	if (err < 0 && !always_copy)

		goto out;



out_array_args:

	if (video_put_user((void __user *)arg, parg, cmd, orig_cmd))

		err = -EFAULT;

out: