* [PATCH AUTOSEL 5.15 05/17] media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()
[not found] <20230501030435.3254695-1-sashal@kernel.org>
@ 2023-05-01 3:04 ` Sasha Levin
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 06/17] media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish Sasha Levin
` (2 subsequent siblings)
3 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2023-05-01 3:04 UTC (permalink / raw)
To: linux-kernel, stable
Cc: harperchen, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin,
daniel.lee.kruse, linux-media
From: harperchen <harperchen1110@gmail.com>
[ Upstream commit 47e8b73bc35d7c54642f78e498697692f6358996 ]
When the driver calls cx23885_risc_buffer() to prepare the buffer, the
function call dma_alloc_coherent may fail, resulting in a empty buffer
risc->cpu. Later when we free the buffer or access the buffer, null ptr
deref is triggered.
This bug is similar to the following one:
https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
We believe the bug can be also dynamically triggered from user side.
Similarly, we fix this by checking the return value of cx23885_risc_buffer()
and the value of risc->cpu before buffer free.
Signed-off-by: harperchen <harperchen1110@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx23885/cx23885-core.c | 4 +++-
drivers/media/pci/cx23885/cx23885-video.c | 13 +++++++------
2 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
index a07b18f2034e9..8019cdf5dbae5 100644
--- a/drivers/media/pci/cx23885/cx23885-core.c
+++ b/drivers/media/pci/cx23885/cx23885-core.c
@@ -1325,7 +1325,9 @@ void cx23885_free_buffer(struct cx23885_dev *dev, struct cx23885_buffer *buf)
{
struct cx23885_riscmem *risc = &buf->risc;
- dma_free_coherent(&dev->pci->dev, risc->size, risc->cpu, risc->dma);
+ if (risc->cpu)
+ dma_free_coherent(&dev->pci->dev, risc->size, risc->cpu, risc->dma);
+ memset(risc, 0, sizeof(*risc));
}
static void cx23885_tsport_reg_dump(struct cx23885_tsport *port)
diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c
index a380e0920a21f..b01499f810697 100644
--- a/drivers/media/pci/cx23885/cx23885-video.c
+++ b/drivers/media/pci/cx23885/cx23885-video.c
@@ -342,6 +342,7 @@ static int queue_setup(struct vb2_queue *q,
static int buffer_prepare(struct vb2_buffer *vb)
{
+ int ret;
struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
struct cx23885_dev *dev = vb->vb2_queue->drv_priv;
struct cx23885_buffer *buf =
@@ -358,12 +359,12 @@ static int buffer_prepare(struct vb2_buffer *vb)
switch (dev->field) {
case V4L2_FIELD_TOP:
- cx23885_risc_buffer(dev->pci, &buf->risc,
+ ret = cx23885_risc_buffer(dev->pci, &buf->risc,
sgt->sgl, 0, UNSET,
buf->bpl, 0, dev->height);
break;
case V4L2_FIELD_BOTTOM:
- cx23885_risc_buffer(dev->pci, &buf->risc,
+ ret = cx23885_risc_buffer(dev->pci, &buf->risc,
sgt->sgl, UNSET, 0,
buf->bpl, 0, dev->height);
break;
@@ -391,21 +392,21 @@ static int buffer_prepare(struct vb2_buffer *vb)
line0_offset = 0;
line1_offset = buf->bpl;
}
- cx23885_risc_buffer(dev->pci, &buf->risc,
+ ret = cx23885_risc_buffer(dev->pci, &buf->risc,
sgt->sgl, line0_offset,
line1_offset,
buf->bpl, buf->bpl,
dev->height >> 1);
break;
case V4L2_FIELD_SEQ_TB:
- cx23885_risc_buffer(dev->pci, &buf->risc,
+ ret = cx23885_risc_buffer(dev->pci, &buf->risc,
sgt->sgl,
0, buf->bpl * (dev->height >> 1),
buf->bpl, 0,
dev->height >> 1);
break;
case V4L2_FIELD_SEQ_BT:
- cx23885_risc_buffer(dev->pci, &buf->risc,
+ ret = cx23885_risc_buffer(dev->pci, &buf->risc,
sgt->sgl,
buf->bpl * (dev->height >> 1), 0,
buf->bpl, 0,
@@ -418,7 +419,7 @@ static int buffer_prepare(struct vb2_buffer *vb)
buf, buf->vb.vb2_buf.index,
dev->width, dev->height, dev->fmt->depth, dev->fmt->fourcc,
(unsigned long)buf->risc.dma);
- return 0;
+ return ret;
}
static void buffer_finish(struct vb2_buffer *vb)
--
2.39.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH AUTOSEL 5.15 06/17] media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish
[not found] <20230501030435.3254695-1-sashal@kernel.org>
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 05/17] media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() Sasha Levin
@ 2023-05-01 3:04 ` Sasha Levin
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 15/17] media: cros-ec-cec: Don't exit early in .remove() callback Sasha Levin
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 17/17] media: Prefer designated initializers over memset for subdev pad ops Sasha Levin
3 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2023-05-01 3:04 UTC (permalink / raw)
To: linux-kernel, stable
Cc: harperchen, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin,
hverkuil, linux-media
From: harperchen <harperchen1110@gmail.com>
[ Upstream commit 1634b7adcc5bef645b3666fdd564e5952a9e24e0 ]
When the driver calls tw68_risc_buffer() to prepare the buffer, the
function call dma_alloc_coherent may fail, resulting in a empty buffer
buf->cpu. Later when we free the buffer or access the buffer, null ptr
deref is triggered.
This bug is similar to the following one:
https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
We believe the bug can be also dynamically triggered from user side.
Similarly, we fix this by checking the return value of tw68_risc_buffer()
and the value of buf->cpu before buffer free.
Signed-off-by: harperchen <harperchen1110@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/tw68/tw68-video.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/drivers/media/pci/tw68/tw68-video.c b/drivers/media/pci/tw68/tw68-video.c
index fe94944d05317..0d1120abc6471 100644
--- a/drivers/media/pci/tw68/tw68-video.c
+++ b/drivers/media/pci/tw68/tw68-video.c
@@ -437,6 +437,7 @@ static void tw68_buf_queue(struct vb2_buffer *vb)
*/
static int tw68_buf_prepare(struct vb2_buffer *vb)
{
+ int ret;
struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
struct vb2_queue *vq = vb->vb2_queue;
struct tw68_dev *dev = vb2_get_drv_priv(vq);
@@ -452,30 +453,30 @@ static int tw68_buf_prepare(struct vb2_buffer *vb)
bpl = (dev->width * dev->fmt->depth) >> 3;
switch (dev->field) {
case V4L2_FIELD_TOP:
- tw68_risc_buffer(dev->pci, buf, dma->sgl,
+ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
0, UNSET, bpl, 0, dev->height);
break;
case V4L2_FIELD_BOTTOM:
- tw68_risc_buffer(dev->pci, buf, dma->sgl,
+ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
UNSET, 0, bpl, 0, dev->height);
break;
case V4L2_FIELD_SEQ_TB:
- tw68_risc_buffer(dev->pci, buf, dma->sgl,
+ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
0, bpl * (dev->height >> 1),
bpl, 0, dev->height >> 1);
break;
case V4L2_FIELD_SEQ_BT:
- tw68_risc_buffer(dev->pci, buf, dma->sgl,
+ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
bpl * (dev->height >> 1), 0,
bpl, 0, dev->height >> 1);
break;
case V4L2_FIELD_INTERLACED:
default:
- tw68_risc_buffer(dev->pci, buf, dma->sgl,
+ ret = tw68_risc_buffer(dev->pci, buf, dma->sgl,
0, bpl, bpl, bpl, dev->height >> 1);
break;
}
- return 0;
+ return ret;
}
static void tw68_buf_finish(struct vb2_buffer *vb)
@@ -485,7 +486,8 @@ static void tw68_buf_finish(struct vb2_buffer *vb)
struct tw68_dev *dev = vb2_get_drv_priv(vq);
struct tw68_buf *buf = container_of(vbuf, struct tw68_buf, vb);
- dma_free_coherent(&dev->pci->dev, buf->size, buf->cpu, buf->dma);
+ if (buf->cpu)
+ dma_free_coherent(&dev->pci->dev, buf->size, buf->cpu, buf->dma);
}
static int tw68_start_streaming(struct vb2_queue *q, unsigned int count)
--
2.39.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH AUTOSEL 5.15 15/17] media: cros-ec-cec: Don't exit early in .remove() callback
[not found] <20230501030435.3254695-1-sashal@kernel.org>
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 05/17] media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() Sasha Levin
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 06/17] media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish Sasha Levin
@ 2023-05-01 3:04 ` Sasha Levin
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 17/17] media: Prefer designated initializers over memset for subdev pad ops Sasha Levin
3 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2023-05-01 3:04 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Uwe Kleine-König, Hans Verkuil, Sasha Levin, mchehab, bleung,
groeck, kevin.chiu.17802, zoey_wu, scott_chao, ajye_huang,
linux-media, chrome-platform
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 0ff7aee24e47beb4306ce050824b54147f2fabfa ]
Exiting early in remove without releasing all acquired resources yields
leaks. Note that e.g. memory allocated with devm_zalloc() is freed after
.remove() returns, even if the return code was negative.
While blocking_notifier_chain_unregister() won't fail and so the
change is somewhat cosmetic, platform driver's .remove callbacks are
about to be converted to return void. To prepare that, keep the error
message but don't return early.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/cec/platform/cros-ec/cros-ec-cec.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c
index f66699d5dc66e..8bf34620db5fe 100644
--- a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c
+++ b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c
@@ -324,14 +324,16 @@ static int cros_ec_cec_remove(struct platform_device *pdev)
struct device *dev = &pdev->dev;
int ret;
+ /*
+ * blocking_notifier_chain_unregister() only fails if the notifier isn't
+ * in the list. We know it was added to it by .probe(), so there should
+ * be no need for error checking. Be cautious and still check.
+ */
ret = blocking_notifier_chain_unregister(
&cros_ec_cec->cros_ec->event_notifier,
&cros_ec_cec->notifier);
-
- if (ret) {
+ if (ret)
dev_err(dev, "failed to unregister notifier\n");
- return ret;
- }
cec_notifier_cec_adap_unregister(cros_ec_cec->notify,
cros_ec_cec->adap);
--
2.39.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH AUTOSEL 5.15 17/17] media: Prefer designated initializers over memset for subdev pad ops
[not found] <20230501030435.3254695-1-sashal@kernel.org>
` (2 preceding siblings ...)
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 15/17] media: cros-ec-cec: Don't exit early in .remove() callback Sasha Levin
@ 2023-05-01 3:04 ` Sasha Levin
3 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2023-05-01 3:04 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Laurent Pinchart, Lad Prabhakar, Sakari Ailus, Tomi Valkeinen,
Kieran Bingham, Philipp Zabel, Hans Verkuil, Sasha Levin, mchehab,
krzysztof.kozlowski, mkrufky, slongerbeam, gregkh, shawnguo,
linux-media, linux-arm-kernel, linux-samsung-soc, linux-staging
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
[ Upstream commit e3a69496a1cde364c74a600d7a370179b58aed29 ]
Structures passed to subdev pad operations are all zero-initialized, but
not always with the same kind of code constructs. While most drivers
used designated initializers, which zero all the fields that are not
specified, when declaring variables, some use memset(). Those two
methods lead to the same end result, and, depending on compiler
optimizations, may even be completely equivalent, but they're not
consistent.
Improve coding style consistency by using designated initializers
instead of calling memset(). Where applicable, also move the variables
to inner scopes of for loops to ensure correct initialization in all
iterations.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Lad Prabhakar <prabhakar.csengg@gmail.com> # For am437x
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/am437x/am437x-vpfe.c | 15 ++++++++-------
.../media/platform/exynos4-is/fimc-capture.c | 7 ++++---
drivers/media/platform/ti-vpe/cal-video.c | 8 ++++----
drivers/media/platform/vsp1/vsp1_drm.c | 18 +++++++++---------
drivers/media/platform/vsp1/vsp1_entity.c | 11 +++++------
drivers/media/usb/dvb-usb/cxusb-analog.c | 14 +++++++-------
drivers/staging/media/imx/imx-media-capture.c | 12 ++++++------
drivers/staging/media/imx/imx-media-utils.c | 8 ++++----
drivers/staging/media/omap4iss/iss_video.c | 6 +++---
9 files changed, 50 insertions(+), 49 deletions(-)
diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c
index 1c9cb9e05fdf6..c1ce93efc6559 100644
--- a/drivers/media/platform/am437x/am437x-vpfe.c
+++ b/drivers/media/platform/am437x/am437x-vpfe.c
@@ -1499,7 +1499,9 @@ static int vpfe_enum_size(struct file *file, void *priv,
struct v4l2_frmsizeenum *fsize)
{
struct vpfe_device *vpfe = video_drvdata(file);
- struct v4l2_subdev_frame_size_enum fse;
+ struct v4l2_subdev_frame_size_enum fse = {
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
struct v4l2_subdev *sd = vpfe->current_subdev->sd;
struct vpfe_fmt *fmt;
int ret;
@@ -1514,11 +1516,9 @@ static int vpfe_enum_size(struct file *file, void *priv,
memset(fsize->reserved, 0x0, sizeof(fsize->reserved));
- memset(&fse, 0x0, sizeof(fse));
fse.index = fsize->index;
fse.pad = 0;
fse.code = fmt->code;
- fse.which = V4L2_SUBDEV_FORMAT_ACTIVE;
ret = v4l2_subdev_call(sd, pad, enum_frame_size, NULL, &fse);
if (ret)
return ret;
@@ -2146,7 +2146,6 @@ vpfe_async_bound(struct v4l2_async_notifier *notifier,
{
struct vpfe_device *vpfe = container_of(notifier->v4l2_dev,
struct vpfe_device, v4l2_dev);
- struct v4l2_subdev_mbus_code_enum mbus_code;
struct vpfe_subdev_info *sdinfo;
struct vpfe_fmt *fmt;
int ret = 0;
@@ -2173,9 +2172,11 @@ vpfe_async_bound(struct v4l2_async_notifier *notifier,
vpfe->num_active_fmt = 0;
for (j = 0, i = 0; (ret != -EINVAL); ++j) {
- memset(&mbus_code, 0, sizeof(mbus_code));
- mbus_code.index = j;
- mbus_code.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+ struct v4l2_subdev_mbus_code_enum mbus_code = {
+ .index = j,
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
+
ret = v4l2_subdev_call(subdev, pad, enum_mbus_code,
NULL, &mbus_code);
if (ret)
diff --git a/drivers/media/platform/exynos4-is/fimc-capture.c b/drivers/media/platform/exynos4-is/fimc-capture.c
index 7ff4024003f4a..0b3cf01e9537e 100644
--- a/drivers/media/platform/exynos4-is/fimc-capture.c
+++ b/drivers/media/platform/exynos4-is/fimc-capture.c
@@ -763,7 +763,10 @@ static int fimc_pipeline_try_format(struct fimc_ctx *ctx,
struct fimc_dev *fimc = ctx->fimc_dev;
struct fimc_pipeline *p = to_fimc_pipeline(fimc->vid_cap.ve.pipe);
struct v4l2_subdev *sd = p->subdevs[IDX_SENSOR];
- struct v4l2_subdev_format sfmt;
+ struct v4l2_subdev_format sfmt = {
+ .which = set ? V4L2_SUBDEV_FORMAT_ACTIVE
+ : V4L2_SUBDEV_FORMAT_TRY,
+ };
struct v4l2_mbus_framefmt *mf = &sfmt.format;
struct media_entity *me;
struct fimc_fmt *ffmt;
@@ -774,9 +777,7 @@ static int fimc_pipeline_try_format(struct fimc_ctx *ctx,
if (WARN_ON(!sd || !tfmt))
return -EINVAL;
- memset(&sfmt, 0, sizeof(sfmt));
sfmt.format = *tfmt;
- sfmt.which = set ? V4L2_SUBDEV_FORMAT_ACTIVE : V4L2_SUBDEV_FORMAT_TRY;
me = fimc_pipeline_get_head(&sd->entity);
diff --git a/drivers/media/platform/ti-vpe/cal-video.c b/drivers/media/platform/ti-vpe/cal-video.c
index 3e936a2ca36c6..d87177d04e921 100644
--- a/drivers/media/platform/ti-vpe/cal-video.c
+++ b/drivers/media/platform/ti-vpe/cal-video.c
@@ -814,7 +814,6 @@ static const struct v4l2_file_operations cal_fops = {
static int cal_ctx_v4l2_init_formats(struct cal_ctx *ctx)
{
- struct v4l2_subdev_mbus_code_enum mbus_code;
struct v4l2_mbus_framefmt mbus_fmt;
const struct cal_format_info *fmtinfo;
unsigned int i, j, k;
@@ -829,10 +828,11 @@ static int cal_ctx_v4l2_init_formats(struct cal_ctx *ctx)
ctx->num_active_fmt = 0;
for (j = 0, i = 0; ; ++j) {
+ struct v4l2_subdev_mbus_code_enum mbus_code = {
+ .index = j,
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
- memset(&mbus_code, 0, sizeof(mbus_code));
- mbus_code.index = j;
- mbus_code.which = V4L2_SUBDEV_FORMAT_ACTIVE;
ret = v4l2_subdev_call(ctx->phy->source, pad, enum_mbus_code,
NULL, &mbus_code);
if (ret == -EINVAL)
diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c
index 06f74d410973e..706d48601bf2c 100644
--- a/drivers/media/platform/vsp1/vsp1_drm.c
+++ b/drivers/media/platform/vsp1/vsp1_drm.c
@@ -66,7 +66,9 @@ static int vsp1_du_insert_uif(struct vsp1_device *vsp1,
struct vsp1_entity *prev, unsigned int prev_pad,
struct vsp1_entity *next, unsigned int next_pad)
{
- struct v4l2_subdev_format format;
+ struct v4l2_subdev_format format = {
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
int ret;
if (!uif) {
@@ -82,8 +84,6 @@ static int vsp1_du_insert_uif(struct vsp1_device *vsp1,
prev->sink = uif;
prev->sink_pad = UIF_PAD_SINK;
- memset(&format, 0, sizeof(format));
- format.which = V4L2_SUBDEV_FORMAT_ACTIVE;
format.pad = prev_pad;
ret = v4l2_subdev_call(&prev->subdev, pad, get_fmt, NULL, &format);
@@ -118,8 +118,12 @@ static int vsp1_du_pipeline_setup_rpf(struct vsp1_device *vsp1,
struct vsp1_entity *uif,
unsigned int brx_input)
{
- struct v4l2_subdev_selection sel;
- struct v4l2_subdev_format format;
+ struct v4l2_subdev_selection sel = {
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
+ struct v4l2_subdev_format format = {
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
const struct v4l2_rect *crop;
int ret;
@@ -129,8 +133,6 @@ static int vsp1_du_pipeline_setup_rpf(struct vsp1_device *vsp1,
*/
crop = &vsp1->drm->inputs[rpf->entity.index].crop;
- memset(&format, 0, sizeof(format));
- format.which = V4L2_SUBDEV_FORMAT_ACTIVE;
format.pad = RWPF_PAD_SINK;
format.format.width = crop->width + crop->left;
format.format.height = crop->height + crop->top;
@@ -147,8 +149,6 @@ static int vsp1_du_pipeline_setup_rpf(struct vsp1_device *vsp1,
__func__, format.format.width, format.format.height,
format.format.code, rpf->entity.index);
- memset(&sel, 0, sizeof(sel));
- sel.which = V4L2_SUBDEV_FORMAT_ACTIVE;
sel.pad = RWPF_PAD_SINK;
sel.target = V4L2_SEL_TGT_CROP;
sel.r = *crop;
diff --git a/drivers/media/platform/vsp1/vsp1_entity.c b/drivers/media/platform/vsp1/vsp1_entity.c
index 823c15facd1b4..b40926270c149 100644
--- a/drivers/media/platform/vsp1/vsp1_entity.c
+++ b/drivers/media/platform/vsp1/vsp1_entity.c
@@ -184,15 +184,14 @@ vsp1_entity_get_pad_selection(struct vsp1_entity *entity,
int vsp1_entity_init_cfg(struct v4l2_subdev *subdev,
struct v4l2_subdev_state *sd_state)
{
- struct v4l2_subdev_format format;
unsigned int pad;
for (pad = 0; pad < subdev->entity.num_pads - 1; ++pad) {
- memset(&format, 0, sizeof(format));
-
- format.pad = pad;
- format.which = sd_state ? V4L2_SUBDEV_FORMAT_TRY
- : V4L2_SUBDEV_FORMAT_ACTIVE;
+ struct v4l2_subdev_format format = {
+ .pad = pad,
+ .which = sd_state ? V4L2_SUBDEV_FORMAT_TRY
+ : V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
v4l2_subdev_call(subdev, pad, set_fmt, sd_state, &format);
}
diff --git a/drivers/media/usb/dvb-usb/cxusb-analog.c b/drivers/media/usb/dvb-usb/cxusb-analog.c
index e93183ddd7975..deba5224cb8df 100644
--- a/drivers/media/usb/dvb-usb/cxusb-analog.c
+++ b/drivers/media/usb/dvb-usb/cxusb-analog.c
@@ -1014,7 +1014,10 @@ static int cxusb_medion_try_s_fmt_vid_cap(struct file *file,
{
struct dvb_usb_device *dvbdev = video_drvdata(file);
struct cxusb_medion_dev *cxdev = dvbdev->priv;
- struct v4l2_subdev_format subfmt;
+ struct v4l2_subdev_format subfmt = {
+ .which = isset ? V4L2_SUBDEV_FORMAT_ACTIVE :
+ V4L2_SUBDEV_FORMAT_TRY,
+ };
u32 field;
int ret;
@@ -1024,9 +1027,6 @@ static int cxusb_medion_try_s_fmt_vid_cap(struct file *file,
field = vb2_start_streaming_called(&cxdev->videoqueue) ?
cxdev->field_order : cxusb_medion_field_order(cxdev);
- memset(&subfmt, 0, sizeof(subfmt));
- subfmt.which = isset ? V4L2_SUBDEV_FORMAT_ACTIVE :
- V4L2_SUBDEV_FORMAT_TRY;
subfmt.format.width = f->fmt.pix.width & ~1;
subfmt.format.height = f->fmt.pix.height & ~1;
subfmt.format.code = MEDIA_BUS_FMT_FIXED;
@@ -1464,7 +1464,9 @@ int cxusb_medion_analog_init(struct dvb_usb_device *dvbdev)
.buf = tuner_analog_msg_data,
.len =
sizeof(tuner_analog_msg_data) };
- struct v4l2_subdev_format subfmt;
+ struct v4l2_subdev_format subfmt = {
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
int ret;
/* switch tuner to analog mode so IF demod will become accessible */
@@ -1507,8 +1509,6 @@ int cxusb_medion_analog_init(struct dvb_usb_device *dvbdev)
v4l2_subdev_call(cxdev->tuner, video, s_std, cxdev->norm);
v4l2_subdev_call(cxdev->cx25840, video, s_std, cxdev->norm);
- memset(&subfmt, 0, sizeof(subfmt));
- subfmt.which = V4L2_SUBDEV_FORMAT_ACTIVE;
subfmt.format.width = cxdev->width;
subfmt.format.height = cxdev->height;
subfmt.format.code = MEDIA_BUS_FMT_FIXED;
diff --git a/drivers/staging/media/imx/imx-media-capture.c b/drivers/staging/media/imx/imx-media-capture.c
index 93ba092360105..5cc67786b9169 100644
--- a/drivers/staging/media/imx/imx-media-capture.c
+++ b/drivers/staging/media/imx/imx-media-capture.c
@@ -501,14 +501,14 @@ static int capture_legacy_g_parm(struct file *file, void *fh,
struct v4l2_streamparm *a)
{
struct capture_priv *priv = video_drvdata(file);
- struct v4l2_subdev_frame_interval fi;
+ struct v4l2_subdev_frame_interval fi = {
+ .pad = priv->src_sd_pad,
+ };
int ret;
if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
return -EINVAL;
- memset(&fi, 0, sizeof(fi));
- fi.pad = priv->src_sd_pad;
ret = v4l2_subdev_call(priv->src_sd, video, g_frame_interval, &fi);
if (ret < 0)
return ret;
@@ -523,14 +523,14 @@ static int capture_legacy_s_parm(struct file *file, void *fh,
struct v4l2_streamparm *a)
{
struct capture_priv *priv = video_drvdata(file);
- struct v4l2_subdev_frame_interval fi;
+ struct v4l2_subdev_frame_interval fi = {
+ .pad = priv->src_sd_pad,
+ };
int ret;
if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
return -EINVAL;
- memset(&fi, 0, sizeof(fi));
- fi.pad = priv->src_sd_pad;
fi.interval = a->parm.capture.timeperframe;
ret = v4l2_subdev_call(priv->src_sd, video, s_frame_interval, &fi);
if (ret < 0)
diff --git a/drivers/staging/media/imx/imx-media-utils.c b/drivers/staging/media/imx/imx-media-utils.c
index 6f90acf9c725c..49ba521dd9edd 100644
--- a/drivers/staging/media/imx/imx-media-utils.c
+++ b/drivers/staging/media/imx/imx-media-utils.c
@@ -432,15 +432,15 @@ int imx_media_init_cfg(struct v4l2_subdev *sd,
struct v4l2_subdev_state *sd_state)
{
struct v4l2_mbus_framefmt *mf_try;
- struct v4l2_subdev_format format;
unsigned int pad;
int ret;
for (pad = 0; pad < sd->entity.num_pads; pad++) {
- memset(&format, 0, sizeof(format));
+ struct v4l2_subdev_format format = {
+ .pad = pad,
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
- format.pad = pad;
- format.which = V4L2_SUBDEV_FORMAT_ACTIVE;
ret = v4l2_subdev_call(sd, pad, get_fmt, NULL, &format);
if (ret)
continue;
diff --git a/drivers/staging/media/omap4iss/iss_video.c b/drivers/staging/media/omap4iss/iss_video.c
index d0da083deed53..801e145ea976a 100644
--- a/drivers/staging/media/omap4iss/iss_video.c
+++ b/drivers/staging/media/omap4iss/iss_video.c
@@ -244,7 +244,9 @@ static int
__iss_video_get_format(struct iss_video *video,
struct v4l2_mbus_framefmt *format)
{
- struct v4l2_subdev_format fmt;
+ struct v4l2_subdev_format fmt = {
+ .which = V4L2_SUBDEV_FORMAT_ACTIVE,
+ };
struct v4l2_subdev *subdev;
u32 pad;
int ret;
@@ -253,9 +255,7 @@ __iss_video_get_format(struct iss_video *video,
if (!subdev)
return -EINVAL;
- memset(&fmt, 0, sizeof(fmt));
fmt.pad = pad;
- fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE;
mutex_lock(&video->mutex);
ret = v4l2_subdev_call(subdev, pad, get_fmt, NULL, &fmt);
--
2.39.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-05-01 3:16 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20230501030435.3254695-1-sashal@kernel.org>
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 05/17] media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() Sasha Levin
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 06/17] media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish Sasha Levin
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 15/17] media: cros-ec-cec: Don't exit early in .remove() callback Sasha Levin
2023-05-01 3:04 ` [PATCH AUTOSEL 5.15 17/17] media: Prefer designated initializers over memset for subdev pad ops Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).