Backport upstream solution [1][2] to fix below kernel panic:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208 ... pc : _raw_spin_lock_irqsave+0x50/0x90 lr : v4l2_m2m_cancel_job+0x38/0x1c4 [v4l2_mem2mem] sp : ffffffc012d2bcb0 x29: ffffffc012d2bcb0 x28: ffffff8098d6bb00 x27: 0000000000000000 x26: ffffffc01009b5c8 x25: 00000000000e001f x24: ffffff808ff3eb50 x23: ffffffc01009f5a0 x22: 0000000000000000 x21: ffffff808ffef000 x20: 0000000000000208 x19: 0000000000000000 x18: ffffffc012b51048 x17: ffffffc011e0ef7c x16: 00000000000000c0 x15: ffffffc010fc78f4 x14: ffffffc0119dd790 x13: 0000000000001b26 x12: 0000000053555555 x11: 0000000000000002 x10: 0000000000000001 x9 : 0000000000000000 x8 : 0000000000000208 x7 : 2020202020202020 x6 : ffffffc011e313a6 x5 : 0000000000000000 x4 : 0000000000000008 x3 : 000000000000002e x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000208 Call trace: _raw_spin_lock_irqsave+0x50/0x90 v4l2_m2m_cancel_job+0x38/0x1c4 [v4l2_mem2mem] v4l2_m2m_ctx_release+0x38/0x60 [v4l2_mem2mem] vim2m_release+0x5c/0xe0 [vim2m] v4l2_release+0x90/0x18c __fput+0xdc/0x2cc ____fput+0x10/0x1c task_work_run+0xc4/0x130 do_notify_resume+0xdc/0x158 work_pending+0x8/0x10
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
Mark-PK Tsai (2): media: vim2m: Register video device after setting up internals media: vim2m: initialize the media device earlier
drivers/media/platform/vim2m.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
commit cf7f34777a5b4100a3a44ff95f3d949c62892bdd upstream.
Prevent NULL (or close to NULL) pointer dereference in various places by registering the video device only when the V4L2 m2m framework has been set up.
Fixes: commit 96d8eab5d0a1 ("V4L/DVB: [v5,2/2] v4l: Add a mem-to-mem videobuf framework test device") Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org [ backport to 5.4 LTS ] CC: stable@vger.kernel.org Signed-off-by: Mark-PK Tsai mark-pk.tsai@mediatek.com --- drivers/media/platform/vim2m.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c index 8d6b09623d88..02f5bc82ba46 100644 --- a/drivers/media/platform/vim2m.c +++ b/drivers/media/platform/vim2m.c @@ -1333,12 +1333,6 @@ static int vim2m_probe(struct platform_device *pdev) vfd->lock = &dev->dev_mutex; vfd->v4l2_dev = &dev->v4l2_dev;
- ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0); - if (ret) { - v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); - goto error_v4l2; - } - video_set_drvdata(vfd, dev); v4l2_info(&dev->v4l2_dev, "Device registered as /dev/video%d\n", vfd->num); @@ -1353,6 +1347,12 @@ static int vim2m_probe(struct platform_device *pdev) goto error_dev; }
+ ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0); + if (ret) { + v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); + goto error_m2m; + } + #ifdef CONFIG_MEDIA_CONTROLLER dev->mdev.dev = &pdev->dev; strscpy(dev->mdev.model, "vim2m", sizeof(dev->mdev.model)); @@ -1366,7 +1366,7 @@ static int vim2m_probe(struct platform_device *pdev) MEDIA_ENT_F_PROC_VIDEO_SCALER); if (ret) { v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem media controller\n"); - goto error_dev; + goto error_v4l2; }
ret = media_device_register(&dev->mdev); @@ -1381,11 +1381,13 @@ static int vim2m_probe(struct platform_device *pdev) error_m2m_mc: v4l2_m2m_unregister_media_controller(dev->m2m_dev); #endif -error_dev: +error_v4l2: video_unregister_device(&dev->vfd); /* vim2m_device_release called by video_unregister_device to release various objects */ return ret; -error_v4l2: +error_m2m: + v4l2_m2m_release(dev->m2m_dev); +error_dev: v4l2_device_unregister(&dev->v4l2_dev); error_free: kfree(dev);
commit 1a28dce222a6ece725689ad58c0cf4a1b48894f4 upstream.
Before the video device node is registered, the v4l2_dev.mdev pointer must be set in order to correctly associate the video device with the media device. Move the initialization of the media device up.
Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org [ backport to 5.4 LTS] CC: stable@vger.kernel.org Signed-off-by: Mark-PK Tsai mark-pk.tsai@mediatek.com --- drivers/media/platform/vim2m.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c index 02f5bc82ba46..6fba00e03c67 100644 --- a/drivers/media/platform/vim2m.c +++ b/drivers/media/platform/vim2m.c @@ -1347,12 +1347,6 @@ static int vim2m_probe(struct platform_device *pdev) goto error_dev; }
- ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0); - if (ret) { - v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); - goto error_m2m; - } - #ifdef CONFIG_MEDIA_CONTROLLER dev->mdev.dev = &pdev->dev; strscpy(dev->mdev.model, "vim2m", sizeof(dev->mdev.model)); @@ -1361,7 +1355,15 @@ static int vim2m_probe(struct platform_device *pdev) media_device_init(&dev->mdev); dev->mdev.ops = &m2m_media_ops; dev->v4l2_dev.mdev = &dev->mdev; +#endif
+ ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0); + if (ret) { + v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); + goto error_m2m; + } + +#ifdef CONFIG_MEDIA_CONTROLLER ret = v4l2_m2m_register_media_controller(dev->m2m_dev, vfd, MEDIA_ENT_F_PROC_VIDEO_SCALER); if (ret) {
On Wed, May 25, 2022 at 04:27:29PM +0800, Mark-PK Tsai wrote:
Backport upstream solution [1][2] to fix below kernel panic:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208 ... pc : _raw_spin_lock_irqsave+0x50/0x90 lr : v4l2_m2m_cancel_job+0x38/0x1c4 [v4l2_mem2mem] sp : ffffffc012d2bcb0 x29: ffffffc012d2bcb0 x28: ffffff8098d6bb00 x27: 0000000000000000 x26: ffffffc01009b5c8 x25: 00000000000e001f x24: ffffff808ff3eb50 x23: ffffffc01009f5a0 x22: 0000000000000000 x21: ffffff808ffef000 x20: 0000000000000208 x19: 0000000000000000 x18: ffffffc012b51048 x17: ffffffc011e0ef7c x16: 00000000000000c0 x15: ffffffc010fc78f4 x14: ffffffc0119dd790 x13: 0000000000001b26 x12: 0000000053555555 x11: 0000000000000002 x10: 0000000000000001 x9 : 0000000000000000 x8 : 0000000000000208 x7 : 2020202020202020 x6 : ffffffc011e313a6 x5 : 0000000000000000 x4 : 0000000000000008 x3 : 000000000000002e x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000208 Call trace: _raw_spin_lock_irqsave+0x50/0x90 v4l2_m2m_cancel_job+0x38/0x1c4 [v4l2_mem2mem] v4l2_m2m_ctx_release+0x38/0x60 [v4l2_mem2mem] vim2m_release+0x5c/0xe0 [vim2m] v4l2_release+0x90/0x18c __fput+0xdc/0x2cc ____fput+0x10/0x1c task_work_run+0xc4/0x130 do_notify_resume+0xdc/0x158 work_pending+0x8/0x10
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... [2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
Mark-PK Tsai (2): media: vim2m: Register video device after setting up internals media: vim2m: initialize the media device earlier
drivers/media/platform/vim2m.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-)
-- 2.18.0
All now queued up, thanks.
greg k-h
linux-stable-mirror@lists.linaro.org
-
Greg KH -
Mark-PK Tsai