9 files changed, 75 insertions, 40 deletions

diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index 31d1f4ab915e..65a933a21e68 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -807,7 +807,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
         }
 
         if (adap->transmit_queue_sz >= CEC_MAX_MSG_TX_QUEUE_SZ) {
-                dprintk(1, "%s: transmit queue full\n", __func__);
+                dprintk(2, "%s: transmit queue full\n", __func__);
                 return -EBUSY;
         }
 
@@ -1180,6 +1180,8 @@ static int cec_config_log_addr(struct cec_adapter *adap,
 {
         struct cec_log_addrs *las = &adap->log_addrs;
         struct cec_msg msg = { };
+        const unsigned int max_retries = 2;
+        unsigned int i;
         int err;
 
         if (cec_has_log_addr(adap, log_addr))
@@ -1188,19 +1190,44 @@ static int cec_config_log_addr(struct cec_adapter *adap,
         /* Send poll message */
         msg.len = 1;
         msg.msg[0] = (log_addr << 4) | log_addr;
-        err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        /*
-         * While trying to poll the physical address was reset
-         * and the adapter was unconfigured, so bail out.
-         */
-        if (!adap->is_configuring)
-                return -EINTR;
+        for (i = 0; i < max_retries; i++) {
+                err = cec_transmit_msg_fh(adap, &msg, NULL, true);
 
-        if (err)
-                return err;
+                /*
+                 * While trying to poll the physical address was reset
+                 * and the adapter was unconfigured, so bail out.
+                 */
+                if (!adap->is_configuring)
+                        return -EINTR;
+
+                if (err)
+                        return err;
 
-        if (msg.tx_status & CEC_TX_STATUS_OK)
+                /*
+                 * The message was aborted due to a disconnect or
+                 * unconfigure, just bail out.
+                 */
+                if (msg.tx_status & CEC_TX_STATUS_ABORTED)
+                        return -EINTR;
+                if (msg.tx_status & CEC_TX_STATUS_OK)
+                        return 0;
+                if (msg.tx_status & CEC_TX_STATUS_NACK)
+                        break;
+                /*
+                 * Retry up to max_retries times if the message was neither
+                 * OKed or NACKed. This can happen due to e.g. a Lost
+                 * Arbitration condition.
+                 */
+        }
+
+        /*
+         * If we are unable to get an OK or a NACK after max_retries attempts
+         * (and note that each attempt already consists of four polls), then
+         * then we assume that something is really weird and that it is not a
+         * good idea to try and claim this logical address.
+         */
+        if (i == max_retries)
                 return 0;
 
         /*
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index a38e54b8f687..22cafc07de25 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1918,7 +1918,6 @@ static int tc358743_probe_of(struct tc358743_state *state)
         ret = v4l2_fwnode_endpoint_alloc_parse(of_fwnode_handle(ep), &endpoint);
         if (ret) {
                 dev_err(dev, "failed to parse endpoint\n");
-                ret = ret;
                 goto put_node;
         }
 
diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
index 452eb9b42140..447baaebca44 100644
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1844,14 +1844,12 @@ fail_mutex_destroy:
 static void cio2_pci_remove(struct pci_dev *pci_dev)
 {
         struct cio2_device *cio2 = pci_get_drvdata(pci_dev);
-        unsigned int i;
 
+        media_device_unregister(&cio2->media_dev);
         cio2_notifier_exit(cio2);
+        cio2_queues_exit(cio2);
         cio2_fbpt_exit_dummy(cio2);
-        for (i = 0; i < CIO2_QUEUES; i++)
-                cio2_queue_exit(cio2, &cio2->queue[i]);
         v4l2_device_unregister(&cio2->v4l2_dev);
-        media_device_unregister(&cio2->media_dev);
         media_device_cleanup(&cio2->media_dev);
         mutex_destroy(&cio2->lock);
 }
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 77fb7987b42f..13f2828d880d 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -1587,6 +1587,8 @@ static void isp_pm_complete(struct device *dev)
 
 static void isp_unregister_entities(struct isp_device *isp)
 {
+        media_device_unregister(&isp->media_dev);
+
         omap3isp_csi2_unregister_entities(&isp->isp_csi2a);
         omap3isp_ccp2_unregister_entities(&isp->isp_ccp2);
         omap3isp_ccdc_unregister_entities(&isp->isp_ccdc);
@@ -1597,7 +1599,6 @@ static void isp_unregister_entities(struct isp_device *isp)
         omap3isp_stat_unregister_entities(&isp->isp_hist);
 
         v4l2_device_unregister(&isp->v4l2_dev);
-        media_device_unregister(&isp->media_dev);
         media_device_cleanup(&isp->media_dev);
 }
 
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
index 1eb9132bfc85..b292cff26c86 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -42,7 +42,7 @@ MODULE_PARM_DESC(debug, " activates debug info");
 #define MAX_WIDTH               4096U
 #define MIN_WIDTH               640U
 #define MAX_HEIGHT              2160U
-#define MIN_HEIGHT              480U
+#define MIN_HEIGHT              360U
 
 #define dprintk(dev, fmt, arg...) \
         v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: " fmt, __func__, ## arg)
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index af150a0395df..d82db738f174 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -1009,7 +1009,7 @@ static const struct v4l2_m2m_ops m2m_ops = {
 
 static const struct media_device_ops m2m_media_ops = {
         .req_validate = vb2_request_validate,
-        .req_queue = vb2_m2m_request_queue,
+        .req_queue = v4l2_m2m_request_queue,
 };
 
 static int vim2m_probe(struct platform_device *pdev)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 6e37950292cd..5f2b033a7a42 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1664,6 +1664,11 @@ static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx,
                     p_mpeg2_slice_params->forward_ref_index >= VIDEO_MAX_FRAME)
                         return -EINVAL;
 
+                if (p_mpeg2_slice_params->pad ||
+                    p_mpeg2_slice_params->picture.pad ||
+                    p_mpeg2_slice_params->sequence.pad)
+                        return -EINVAL;
+
                 return 0;
 
         case V4L2_CTRL_TYPE_MPEG2_QUANTIZATION:
diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index a3ef1f50a4b3..481e3c65cf97 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -193,6 +193,22 @@ int v4l2_event_pending(struct v4l2_fh *fh)
 }
 EXPORT_SYMBOL_GPL(v4l2_event_pending);
 
+static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev)
+{
+        struct v4l2_fh *fh = sev->fh;
+        unsigned int i;
+
+        lockdep_assert_held(&fh->subscribe_lock);
+        assert_spin_locked(&fh->vdev->fh_lock);
+
+        /* Remove any pending events for this subscription */
+        for (i = 0; i < sev->in_use; i++) {
+                list_del(&sev->events[sev_pos(sev, i)].list);
+                fh->navailable--;
+        }
+        list_del(&sev->list);
+}
+
 int v4l2_event_subscribe(struct v4l2_fh *fh,
                          const struct v4l2_event_subscription *sub, unsigned elems,
                          const struct v4l2_subscribed_event_ops *ops)
@@ -224,27 +240,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
 
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
         found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
+        if (!found_ev)
+                list_add(&sev->list, &fh->subscribed);
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
         if (found_ev) {
                 /* Already listening */
                 kvfree(sev);
-                goto out_unlock;
-        }
-
-        if (sev->ops && sev->ops->add) {
+        } else if (sev->ops && sev->ops->add) {
                 ret = sev->ops->add(sev, elems);
                 if (ret) {
+                        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+                        __v4l2_event_unsubscribe(sev);
+                        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
                         kvfree(sev);
-                        goto out_unlock;
                 }
         }
 
-        spin_lock_irqsave(&fh->vdev->fh_lock, flags);
-        list_add(&sev->list, &fh->subscribed);
-        spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
-
-out_unlock:
         mutex_unlock(&fh->subscribe_lock);
 
         return ret;
@@ -279,7 +291,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
 {
         struct v4l2_subscribed_event *sev;
         unsigned long flags;
-        int i;
 
         if (sub->type == V4L2_EVENT_ALL) {
                 v4l2_event_unsubscribe_all(fh);
@@ -291,14 +302,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
         spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 
         sev = v4l2_event_subscribed(fh, sub->type, sub->id);
-        if (sev != NULL) {
-                /* Remove any pending events for this subscription */
-                for (i = 0; i < sev->in_use; i++) {
-                        list_del(&sev->events[sev_pos(sev, i)].list);
-                        fh->navailable--;
-                }
-                list_del(&sev->list);
-        }
+        if (sev != NULL)
+                __v4l2_event_unsubscribe(sev);
 
         spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index d7806db222d8..1ed2465972ac 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -953,7 +953,7 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_buf_queue);
 
-void vb2_m2m_request_queue(struct media_request *req)
+void v4l2_m2m_request_queue(struct media_request *req)
 {
         struct media_request_object *obj, *obj_safe;
         struct v4l2_m2m_ctx *m2m_ctx = NULL;
@@ -997,7 +997,7 @@ void vb2_m2m_request_queue(struct media_request *req)
         if (m2m_ctx)
                 v4l2_m2m_try_schedule(m2m_ctx);
 }
-EXPORT_SYMBOL_GPL(vb2_m2m_request_queue);
+EXPORT_SYMBOL_GPL(v4l2_m2m_request_queue);
 
 /* Videobuf2 ioctl helpers */