Merge tag 'v4.20-rc7' into patchwork

Linux 4.20-rc7

* tag 'v4.20-rc7': (403 commits)
  Linux 4.20-rc7
  scripts/spdxcheck.py: always open files in binary mode
  checkstack.pl: fix for aarch64
  userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered
  fs/iomap.c: get/put the page in iomap_page_create/release()
  hugetlbfs: call VM_BUG_ON_PAGE earlier in free_huge_page()
  memblock: annotate memblock_is_reserved() with __init_memblock
  psi: fix reference to kernel commandline enable
  arch/sh/include/asm/io.h: provide prototypes for PCI I/O mapping in asm/io.h
  mm/sparse: add common helper to mark all memblocks present
  mm: introduce common STRUCT_PAGE_MAX_SHIFT define
  alpha: fix hang caused by the bootmem removal
  XArray: Fix xa_alloc when id exceeds max
  drm/vmwgfx: Protect from excessive execbuf kernel memory allocations v3
  MAINTAINERS: Daniel for drm co-maintainer
  drm/amdgpu: drop fclk/gfxclk ratio setting
  IB/core: Fix oops in netdev_next_upper_dev_rcu()
  dm thin: bump target version
  drm/vmwgfx: remove redundant return ret statement
  drm/i915: Flush GPU relocs harder for gen3
  ...

2 files changed, 44 insertions, 13 deletions

diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 0ca81d495bda..70e8c3366f9c 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -948,7 +948,7 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state)
         }
         atomic_dec(&q->owned_by_drv_count);
 
-        if (vb->req_obj.req) {
+        if (state != VB2_BUF_STATE_QUEUED && vb->req_obj.req) {
                 /* This is not supported at the moment */
                 WARN_ON(state == VB2_BUF_STATE_REQUEUEING);
                 media_request_object_unbind(&vb->req_obj);
@@ -1360,8 +1360,12 @@ static void vb2_req_release(struct media_request_object *obj)
 {
         struct vb2_buffer *vb = container_of(obj, struct vb2_buffer, req_obj);
 
-        if (vb->state == VB2_BUF_STATE_IN_REQUEST)
+        if (vb->state == VB2_BUF_STATE_IN_REQUEST) {
                 vb->state = VB2_BUF_STATE_DEQUEUED;
+                if (vb->request)
+                        media_request_put(vb->request);
+                vb->request = NULL;
+        }
 }
 
 static const struct media_request_object_ops vb2_core_req_ops = {
@@ -1529,6 +1533,18 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb,
                         return ret;
 
                 vb->state = VB2_BUF_STATE_IN_REQUEST;
+
+                /*
+                 * Increment the refcount and store the request.
+                 * The request refcount is decremented again when the
+                 * buffer is dequeued. This is to prevent vb2_buffer_done()
+                 * from freeing the request from interrupt context, which can
+                 * happen if the application closed the request fd after
+                 * queueing the request.
+                 */
+                media_request_get(req);
+                vb->request = req;
+
                 /* Fill buffer information for the userspace */
                 if (pb) {
                         call_void_bufop(q, copy_timestamp, vb, pb);
@@ -1750,10 +1766,6 @@ static void __vb2_dqbuf(struct vb2_buffer *vb)
                         call_void_memop(vb, unmap_dmabuf, vb->planes[i].mem_priv);
                         vb->planes[i].dbuf_mapped = 0;
                 }
-        if (vb->req_obj.req) {
-                media_request_object_unbind(&vb->req_obj);
-                media_request_object_put(&vb->req_obj);
-        }
         call_void_bufop(q, init_buffer, vb);
 }
 
@@ -1798,6 +1810,14 @@ int vb2_core_dqbuf(struct vb2_queue *q, unsigned int *pindex, void *pb,
         /* go back to dequeued state */
         __vb2_dqbuf(vb);
 
+        if (WARN_ON(vb->req_obj.req)) {
+                media_request_object_unbind(&vb->req_obj);
+                media_request_object_put(&vb->req_obj);
+        }
+        if (vb->request)
+                media_request_put(vb->request);
+        vb->request = NULL;
+
         dprintk(2, "dqbuf of buffer %d, with state %d\n",
                         vb->index, vb->state);
 
@@ -1904,6 +1924,14 @@ static void __vb2_queue_cancel(struct vb2_queue *q)
                         vb->prepared = false;
                 }
                 __vb2_dqbuf(vb);
+
+                if (vb->req_obj.req) {
+                        media_request_object_unbind(&vb->req_obj);
+                        media_request_object_put(&vb->req_obj);
+                }
+                if (vb->request)
+                        media_request_put(vb->request);
+                vb->request = NULL;
         }
 }
 
@@ -1941,10 +1969,8 @@ int vb2_core_streamon(struct vb2_queue *q, unsigned int type)
                 if (ret)
                         return ret;
                 ret = vb2_start_streaming(q);
-                if (ret) {
-                        __vb2_queue_cancel(q);
+                if (ret)
                         return ret;
-                }
         }
 
         q->streaming = 1;
diff --git a/drivers/media/common/videobuf2/videobuf2-v4l2.c b/drivers/media/common/videobuf2/videobuf2-v4l2.c
index 1244c246d0c4..78a841b83d41 100644
--- a/drivers/media/common/videobuf2/videobuf2-v4l2.c
+++ b/drivers/media/common/videobuf2/videobuf2-v4l2.c
@@ -332,10 +332,10 @@ static int vb2_fill_vb2_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b
 }
 
 static int vb2_queue_or_prepare_buf(struct vb2_queue *q, struct media_device *mdev,
-                                    struct v4l2_buffer *b,
-                                    const char *opname,
+                                    struct v4l2_buffer *b, bool is_prepare,
                                     struct media_request **p_req)
 {
+        const char *opname = is_prepare ? "prepare_buf" : "qbuf";
         struct media_request *req;
         struct vb2_v4l2_buffer *vbuf;
         struct vb2_buffer *vb;
@@ -377,6 +377,9 @@ static int vb2_queue_or_prepare_buf(struct vb2_queue *q, struct media_device *md
                         return ret;
         }
 
+        if (is_prepare)
+                return 0;
+
         if (!(b->flags & V4L2_BUF_FLAG_REQUEST_FD)) {
                 if (q->uses_requests) {
                         dprintk(1, "%s: queue uses requests\n", opname);
@@ -630,8 +633,10 @@ static void fill_buf_caps(struct vb2_queue *q, u32 *caps)
                 *caps |= V4L2_BUF_CAP_SUPPORTS_USERPTR;
         if (q->io_modes & VB2_DMABUF)
                 *caps |= V4L2_BUF_CAP_SUPPORTS_DMABUF;
+#ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
         if (q->supports_requests)
                 *caps |= V4L2_BUF_CAP_SUPPORTS_REQUESTS;
+#endif
 }
 
 int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
@@ -656,7 +661,7 @@ int vb2_prepare_buf(struct vb2_queue *q, struct media_device *mdev,
         if (b->flags & V4L2_BUF_FLAG_REQUEST_FD)
                 return -EINVAL;
 
-        ret = vb2_queue_or_prepare_buf(q, mdev, b, "prepare_buf", NULL);
+        ret = vb2_queue_or_prepare_buf(q, mdev, b, true, NULL);
 
         return ret ? ret : vb2_core_prepare_buf(q, b->index, b);
 }
@@ -728,7 +733,7 @@ int vb2_qbuf(struct vb2_queue *q, struct media_device *mdev,
                 return -EBUSY;
         }
 
-        ret = vb2_queue_or_prepare_buf(q, mdev, b, "qbuf", &req);
+        ret = vb2_queue_or_prepare_buf(q, mdev, b, false, &req);
         if (ret)
                 return ret;
         ret = vb2_core_qbuf(q, b->index, b, req);