Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media fixes from Mauro Carvalho Chehab:
 "Most of the changes are drivers fixes (rtl28xuu, fc2580, ov7670,
  davinci, gspca, s5p-fimc and s5c73m3).

  There is also a compat32 fix and one infoleak fixup at the media
  controller"

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] V4L2: fix VIDIOC_CREATE_BUFS in 64- / 32-bit compatibility mode
  [media] V4L2: ov7670: fix a wrong index, potentially Oopsing the kernel from user-space
  [media] media-device: fix infoleak in ioctl media_enum_entities()
  [media] fc2580: fix tuning failure on 32-bit arch
  [media] Prefer gspca_sonixb over sn9c102 for all devices
  [media] media: davinci: vpfe: make sure all the buffers unmapped and released
  [media] staging: media: davinci: vpfe: make sure all the buffers are released
  [media] media: davinci: vpbe_display: fix releasing of active buffers
  [media] media: davinci: vpif_display: fix releasing of active buffers
  [media] media: davinci: vpif_capture: fix releasing of active buffers
  [media] s5p-fimc: Fix YUV422P depth
  [media] s5c73m3: Add missing rename of v4l2_of_get_next_endpoint() function
  [media] rtl28xxu: silence error log about disabled rtl2832_sdr module
  [media] rtl28xxu: do not hard depend on staging SDR module

16 files changed, 132 insertions, 47 deletions

diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
index e8a1ce204036..cdd7c1b7259b 100644
--- a/drivers/media/i2c/ov7670.c
+++ b/drivers/media/i2c/ov7670.c
@@ -1109,7 +1109,7 @@ static int ov7670_enum_framesizes(struct v4l2_subdev *sd,
          * windows that fall outside that.
          */
         for (i = 0; i < n_win_sizes; i++) {
-                struct ov7670_win_size *win = &info->devtype->win_sizes[index];
+                struct ov7670_win_size *win = &info->devtype->win_sizes[i];
                 if (info->min_width && win->width < info->min_width)
                         continue;
                 if (info->min_height && win->height < info->min_height)
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index a4459301b5f8..ee0f57e01b56 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -1616,7 +1616,7 @@ static int s5c73m3_get_platform_data(struct s5c73m3 *state)
         if (ret < 0)
                 return -EINVAL;
 
-        node_ep = v4l2_of_get_next_endpoint(node, NULL);
+        node_ep = of_graph_get_next_endpoint(node, NULL);
         if (!node_ep) {
                 dev_warn(dev, "no endpoint defined for node: %s\n",
                                                 node->full_name);
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index d5a7a135f75d..703560fa5e73 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -93,6 +93,7 @@ static long media_device_enum_entities(struct media_device *mdev,
         struct media_entity *ent;
         struct media_entity_desc u_ent;
 
+        memset(&u_ent, 0, sizeof(u_ent));
         if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
                 return -EFAULT;
 
diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
index b4f12d00be05..656708252962 100644
--- a/drivers/media/platform/davinci/vpbe_display.c
+++ b/drivers/media/platform/davinci/vpbe_display.c
@@ -372,18 +372,32 @@ static int vpbe_stop_streaming(struct vb2_queue *vq)
 {
         struct vpbe_fh *fh = vb2_get_drv_priv(vq);
         struct vpbe_layer *layer = fh->layer;
+        struct vpbe_display *disp = fh->disp_dev;
+        unsigned long flags;
 
         if (!vb2_is_streaming(vq))
                 return 0;
 
         /* release all active buffers */
+        spin_lock_irqsave(&disp->dma_queue_lock, flags);
+        if (layer->cur_frm == layer->next_frm) {
+                vb2_buffer_done(&layer->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (layer->cur_frm != NULL)
+                        vb2_buffer_done(&layer->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (layer->next_frm != NULL)
+                        vb2_buffer_done(&layer->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
+
         while (!list_empty(&layer->dma_queue)) {
                 layer->next_frm = list_entry(layer->dma_queue.next,
                                                 struct vpbe_disp_buffer, list);
                 list_del(&layer->next_frm->list);
                 vb2_buffer_done(&layer->next_frm->vb, VB2_BUF_STATE_ERROR);
         }
-
+        spin_unlock_irqrestore(&disp->dma_queue_lock, flags);
         return 0;
 }
 
diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c
index d762246eabf5..0379cb9f9a9c 100644
--- a/drivers/media/platform/davinci/vpfe_capture.c
+++ b/drivers/media/platform/davinci/vpfe_capture.c
@@ -734,6 +734,8 @@ static int vpfe_release(struct file *file)
                 }
                 vpfe_dev->io_usrs = 0;
                 vpfe_dev->numbuffers = config_params.numbuffers;
+                videobuf_stop(&vpfe_dev->buffer_queue);
+                videobuf_mmap_free(&vpfe_dev->buffer_queue);
         }
 
         /* Decrement device usrs counter */
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index 756da78bac23..8dea0b84a3ad 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -358,8 +358,31 @@ static int vpif_stop_streaming(struct vb2_queue *vq)
 
         common = &ch->common[VPIF_VIDEO_INDEX];
 
+        /* Disable channel as per its device type and channel id */
+        if (VPIF_CHANNEL0_VIDEO == ch->channel_id) {
+                enable_channel0(0);
+                channel0_intr_enable(0);
+        }
+        if ((VPIF_CHANNEL1_VIDEO == ch->channel_id) ||
+                (2 == common->started)) {
+                enable_channel1(0);
+                channel1_intr_enable(0);
+        }
+        common->started = 0;
+
         /* release all active buffers */
         spin_lock_irqsave(&common->irqlock, flags);
+        if (common->cur_frm == common->next_frm) {
+                vb2_buffer_done(&common->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (common->cur_frm != NULL)
+                        vb2_buffer_done(&common->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (common->next_frm != NULL)
+                        vb2_buffer_done(&common->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
+
         while (!list_empty(&common->dma_queue)) {
                 common->next_frm = list_entry(common->dma_queue.next,
                                                 struct vpif_cap_buffer, list);
@@ -933,17 +956,6 @@ static int vpif_release(struct file *filep)
         if (fh->io_allowed[VPIF_VIDEO_INDEX]) {
                 /* Reset io_usrs member of channel object */
                 common->io_usrs = 0;
-                /* Disable channel as per its device type and channel id */
-                if (VPIF_CHANNEL0_VIDEO == ch->channel_id) {
-                        enable_channel0(0);
-                        channel0_intr_enable(0);
-                }
-                if ((VPIF_CHANNEL1_VIDEO == ch->channel_id) ||
-                    (2 == common->started)) {
-                        enable_channel1(0);
-                        channel1_intr_enable(0);
-                }
-                common->started = 0;
                 /* Free buffers allocated */
                 vb2_queue_release(&common->buffer_queue);
                 vb2_dma_contig_cleanup_ctx(common->alloc_ctx);
diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c
index 0ac841e35aa4..aed41edd0501 100644
--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -320,8 +320,31 @@ static int vpif_stop_streaming(struct vb2_queue *vq)
 
         common = &ch->common[VPIF_VIDEO_INDEX];
 
+        /* Disable channel */
+        if (VPIF_CHANNEL2_VIDEO == ch->channel_id) {
+                enable_channel2(0);
+                channel2_intr_enable(0);
+        }
+        if ((VPIF_CHANNEL3_VIDEO == ch->channel_id) ||
+                (2 == common->started)) {
+                enable_channel3(0);
+                channel3_intr_enable(0);
+        }
+        common->started = 0;
+
         /* release all active buffers */
         spin_lock_irqsave(&common->irqlock, flags);
+        if (common->cur_frm == common->next_frm) {
+                vb2_buffer_done(&common->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (common->cur_frm != NULL)
+                        vb2_buffer_done(&common->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (common->next_frm != NULL)
+                        vb2_buffer_done(&common->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
+
         while (!list_empty(&common->dma_queue)) {
                 common->next_frm = list_entry(common->dma_queue.next,
                                                 struct vpif_disp_buffer, list);
@@ -773,18 +796,6 @@ static int vpif_release(struct file *filep)
         if (fh->io_allowed[VPIF_VIDEO_INDEX]) {
                 /* Reset io_usrs member of channel object */
                 common->io_usrs = 0;
-                /* Disable channel */
-                if (VPIF_CHANNEL2_VIDEO == ch->channel_id) {
-                        enable_channel2(0);
-                        channel2_intr_enable(0);
-                }
-                if ((VPIF_CHANNEL3_VIDEO == ch->channel_id) ||
-                    (2 == common->started)) {
-                        enable_channel3(0);
-                        channel3_intr_enable(0);
-                }
-                common->started = 0;
-
                 /* Free buffers allocated */
                 vb2_queue_release(&common->buffer_queue);
                 vb2_dma_contig_cleanup_ctx(common->alloc_ctx);
diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c
index da2fc86cc524..25dbf5b05a96 100644
--- a/drivers/media/platform/exynos4-is/fimc-core.c
+++ b/drivers/media/platform/exynos4-is/fimc-core.c
@@ -122,7 +122,7 @@ static struct fimc_fmt fimc_formats[] = {
         }, {
                 .name           = "YUV 4:2:2 planar, Y/Cb/Cr",
                 .fourcc         = V4L2_PIX_FMT_YUV422P,
-                .depth          = { 12 },
+                .depth          = { 16 },
                 .color          = FIMC_FMT_YCBYCR422,
                 .memplanes      = 1,
                 .colplanes      = 3,
diff --git a/drivers/media/tuners/fc2580.c b/drivers/media/tuners/fc2580.c
index 3aecaf465094..f0c9c42867de 100644
--- a/drivers/media/tuners/fc2580.c
+++ b/drivers/media/tuners/fc2580.c
@@ -195,7 +195,7 @@ static int fc2580_set_params(struct dvb_frontend *fe)
 
         f_ref = 2UL * priv->cfg->clock / r_val;
         n_val = div_u64_rem(f_vco, f_ref, &k_val);
-        k_val_reg = 1UL * k_val * (1 << 20) / f_ref;
+        k_val_reg = div_u64(1ULL * k_val * (1 << 20), f_ref);
 
         ret = fc2580_wr_reg(priv, 0x18, r18_val | ((k_val_reg >> 16) & 0xff));
         if (ret < 0)
@@ -348,8 +348,8 @@ static int fc2580_set_params(struct dvb_frontend *fe)
         if (ret < 0)
                 goto err;
 
-        ret = fc2580_wr_reg(priv, 0x37, 1UL * priv->cfg->clock * \
-                        fc2580_if_filter_lut[i].mul / 1000000000);
+        ret = fc2580_wr_reg(priv, 0x37, div_u64(1ULL * priv->cfg->clock *
+                        fc2580_if_filter_lut[i].mul, 1000000000));
         if (ret < 0)
                 goto err;
 
diff --git a/drivers/media/tuners/fc2580_priv.h b/drivers/media/tuners/fc2580_priv.h
index be38a9e637e0..646c99452136 100644
--- a/drivers/media/tuners/fc2580_priv.h
+++ b/drivers/media/tuners/fc2580_priv.h
@@ -22,6 +22,7 @@
 #define FC2580_PRIV_H
 
 #include "fc2580.h"
+#include <linux/math64.h>
 
 struct fc2580_reg_val {
         u8 reg;
diff --git a/drivers/media/usb/dvb-usb-v2/Makefile b/drivers/media/usb/dvb-usb-v2/Makefile
index 7407b8338ccf..bc38f03394cd 100644
--- a/drivers/media/usb/dvb-usb-v2/Makefile
+++ b/drivers/media/usb/dvb-usb-v2/Makefile
@@ -41,4 +41,3 @@ ccflags-y += -I$(srctree)/drivers/media/dvb-core
 ccflags-y += -I$(srctree)/drivers/media/dvb-frontends
 ccflags-y += -I$(srctree)/drivers/media/tuners
 ccflags-y += -I$(srctree)/drivers/media/common
-ccflags-y += -I$(srctree)/drivers/staging/media/rtl2832u_sdr
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 61d196e8b3ab..dcbd392e6efc 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -24,7 +24,6 @@
 
 #include "rtl2830.h"
 #include "rtl2832.h"
-#include "rtl2832_sdr.h"
 
 #include "qt1010.h"
 #include "mt2060.h"
@@ -36,6 +35,45 @@
 #include "tua9001.h"
 #include "r820t.h"
 
+/*
+ * RTL2832_SDR module is in staging. That logic is added in order to avoid any
+ * hard dependency to drivers/staging/ directory as we want compile mainline
+ * driver even whole staging directory is missing.
+ */
+#include <media/v4l2-subdev.h>
+
+#if IS_ENABLED(CONFIG_DVB_RTL2832_SDR)
+struct dvb_frontend *rtl2832_sdr_attach(struct dvb_frontend *fe,
+        struct i2c_adapter *i2c, const struct rtl2832_config *cfg,
+        struct v4l2_subdev *sd);
+#else
+static inline struct dvb_frontend *rtl2832_sdr_attach(struct dvb_frontend *fe,
+        struct i2c_adapter *i2c, const struct rtl2832_config *cfg,
+        struct v4l2_subdev *sd)
+{
+        return NULL;
+}
+#endif
+
+#ifdef CONFIG_MEDIA_ATTACH
+#define dvb_attach_sdr(FUNCTION, ARGS...) ({ \
+        void *__r = NULL; \
+        typeof(&FUNCTION) __a = symbol_request(FUNCTION); \
+        if (__a) { \
+                __r = (void *) __a(ARGS); \
+                if (__r == NULL) \
+                        symbol_put(FUNCTION); \
+        } \
+        __r; \
+})
+
+#else
+#define dvb_attach_sdr(FUNCTION, ARGS...) ({ \
+        FUNCTION(ARGS); \
+})
+
+#endif
+
 static int rtl28xxu_disable_rc;
 module_param_named(disable_rc, rtl28xxu_disable_rc, int, 0644);
 MODULE_PARM_DESC(disable_rc, "disable RTL2832U remote controller");
@@ -908,7 +946,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                                 adap->fe[0]->ops.tuner_ops.get_rf_strength;
 
                 /* attach SDR */
-                dvb_attach(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
+                dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
                                 &rtl28xxu_rtl2832_fc0012_config, NULL);
                 break;
         case TUNER_RTL2832_FC0013:
@@ -920,7 +958,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                                 adap->fe[0]->ops.tuner_ops.get_rf_strength;
 
                 /* attach SDR */
-                dvb_attach(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
+                dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
                                 &rtl28xxu_rtl2832_fc0013_config, NULL);
                 break;
         case TUNER_RTL2832_E4000: {
@@ -951,7 +989,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                         i2c_set_adapdata(i2c_adap_internal, d);
 
                         /* attach SDR */
-                        dvb_attach(rtl2832_sdr_attach, adap->fe[0],
+                        dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0],
                                         i2c_adap_internal,
                                         &rtl28xxu_rtl2832_e4000_config, sd);
                 }
@@ -982,7 +1020,7 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
                                 adap->fe[0]->ops.tuner_ops.get_rf_strength;
 
                 /* attach SDR */
-                dvb_attach(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
+                dvb_attach_sdr(rtl2832_sdr_attach, adap->fe[0], &d->i2c_adap,
                                 &rtl28xxu_rtl2832_r820t_config, NULL);
                 break;
         case TUNER_RTL2832_R828D:
diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
index 7277dbd2afcd..ecbcb39feb71 100644
--- a/drivers/media/usb/gspca/sonixb.c
+++ b/drivers/media/usb/gspca/sonixb.c
@@ -1430,10 +1430,8 @@ static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0c45, 0x600d), SB(PAS106, 101)},
         {USB_DEVICE(0x0c45, 0x6011), SB(OV6650, 101)},
         {USB_DEVICE(0x0c45, 0x6019), SB(OV7630, 101)},
-#if !IS_ENABLED(CONFIG_USB_SN9C102)
         {USB_DEVICE(0x0c45, 0x6024), SB(TAS5130CXX, 102)},
         {USB_DEVICE(0x0c45, 0x6025), SB(TAS5130CXX, 102)},
-#endif
         {USB_DEVICE(0x0c45, 0x6027), SB(OV7630, 101)}, /* Genius Eye 310 */
         {USB_DEVICE(0x0c45, 0x6028), SB(PAS202, 102)},
         {USB_DEVICE(0x0c45, 0x6029), SB(PAS106, 102)},
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 04b2daf567be..7e2411c36419 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -178,6 +178,9 @@ struct v4l2_create_buffers32 {
 
 static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
 {
+        if (get_user(kp->type, &up->type))
+                return -EFAULT;
+
         switch (kp->type) {
         case V4L2_BUF_TYPE_VIDEO_CAPTURE:
         case V4L2_BUF_TYPE_VIDEO_OUTPUT:
@@ -204,17 +207,16 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us
 
 static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)) ||
-                        get_user(kp->type, &up->type))
-                        return -EFAULT;
+        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)))
+                return -EFAULT;
         return __get_v4l2_format32(kp, up);
 }
 
 static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up)
 {
         if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) ||
-            copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format.fmt)))
-                        return -EFAULT;
+            copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format)))
+                return -EFAULT;
         return __get_v4l2_format32(&kp->format, &up->format);
 }
 
diff --git a/drivers/staging/media/davinci_vpfe/vpfe_video.c b/drivers/staging/media/davinci_vpfe/vpfe_video.c
index 8c101cbbee97..acc8184c46cd 100644
--- a/drivers/staging/media/davinci_vpfe/vpfe_video.c
+++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c
@@ -1247,9 +1247,18 @@ static int vpfe_stop_streaming(struct vb2_queue *vq)
         struct vpfe_fh *fh = vb2_get_drv_priv(vq);
         struct vpfe_video_device *video = fh->video;
 
-        if (!vb2_is_streaming(vq))
-                return 0;
         /* release all active buffers */
+        if (video->cur_frm == video->next_frm) {
+                vb2_buffer_done(&video->cur_frm->vb, VB2_BUF_STATE_ERROR);
+        } else {
+                if (video->cur_frm != NULL)
+                        vb2_buffer_done(&video->cur_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+                if (video->next_frm != NULL)
+                        vb2_buffer_done(&video->next_frm->vb,
+                                        VB2_BUF_STATE_ERROR);
+        }
+
         while (!list_empty(&video->dma_queue)) {
                 video->next_frm = list_entry(video->dma_queue.next,
                                                 struct vpfe_cap_buffer, list);
diff --git a/drivers/staging/media/sn9c102/sn9c102_devtable.h b/drivers/staging/media/sn9c102/sn9c102_devtable.h
index b3d2cc729657..4ba569258498 100644
--- a/drivers/staging/media/sn9c102/sn9c102_devtable.h
+++ b/drivers/staging/media/sn9c102/sn9c102_devtable.h
@@ -48,10 +48,8 @@ static const struct usb_device_id sn9c102_id_table[] = {
         { SN9C102_USB_DEVICE(0x0c45, 0x600d, BRIDGE_SN9C102), },
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x6011, BRIDGE_SN9C102), }, OV6650 */
         { SN9C102_USB_DEVICE(0x0c45, 0x6019, BRIDGE_SN9C102), },
-#endif
         { SN9C102_USB_DEVICE(0x0c45, 0x6024, BRIDGE_SN9C102), },
         { SN9C102_USB_DEVICE(0x0c45, 0x6025, BRIDGE_SN9C102), },
-#if !defined CONFIG_USB_GSPCA_SONIXB && !defined CONFIG_USB_GSPCA_SONIXB_MODULE
         { SN9C102_USB_DEVICE(0x0c45, 0x6028, BRIDGE_SN9C102), },
         { SN9C102_USB_DEVICE(0x0c45, 0x6029, BRIDGE_SN9C102), },
         { SN9C102_USB_DEVICE(0x0c45, 0x602a, BRIDGE_SN9C102), },