media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()

vpu_get_plat_device() increases the reference count of the returned
platform device. However, when devm_kzalloc() fails, the

media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()

vpu_get_plat_device() increases the reference count of the returned
platform device. However, when devm_kzalloc() fails, the reference
is not released, causing a reference leak.

Fix this by calling put_device() on fw_pdev->dev before returning
on the error path.

Fixes: e25a89f743b1 ("media: mtk-vcodec: potential dereference of null pointer")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

show more ...

media: mediatek: vcodec: Use spinlock for context list protection lock

Previously a mutex was added to protect the encoder and decoder context
lists from unexpected changes originating from the SCP

media: mediatek: vcodec: Use spinlock for context list protection lock

Previously a mutex was added to protect the encoder and decoder context
lists from unexpected changes originating from the SCP IP block, causing
the context pointer to go invalid, resulting in a NULL pointer
dereference in the IPI handler.

Turns out on the MT8173, the VPU IPI handler is called from hard IRQ
context. This causes a big warning from the scheduler. This was first
reported downstream on the ChromeOS kernels, but is also reproducible
on mainline using Fluster with the FFmpeg v4l2m2m decoders. Even though
the actual capture format is not supported, the affected code paths
are triggered.

Since this lock just protects the context list and operations on it are
very fast, it should be OK to switch to a spinlock.

Fixes: 6467cda18c9f ("media: mediatek: vcodec: adding lock to protect decoder context list")
Fixes: afaaf3a0f647 ("media: mediatek: vcodec: adding lock to protect encoder context list")
Cc: Yunfei Dong <yunfei.dong@mediatek.com>
Cc: stable@vger.kernel.org
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Fei Shao <fshao@chromium.org>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

show more ...

media: v4l2-mem2mem: Don't copy frame flags in v4l2_m2m_buf_copy_metadata()

The v4l2_m2m_buf_copy_metadata() function takes a boolean
copy_frame_flags argument. When true, it causes the function to

media: v4l2-mem2mem: Don't copy frame flags in v4l2_m2m_buf_copy_metadata()

The v4l2_m2m_buf_copy_metadata() function takes a boolean
copy_frame_flags argument. When true, it causes the function to copy the
V4L2_BUF_FLAG_KEYFRAME, V4L2_BUF_FLAG_BFRAME and V4L2_BUF_FLAG_PFRAME
flags from the output buffer to the capture buffer.

There is no use cases in any upstream driver for copying the flags.
KEY/P/B frames are properties of the bitstream buffer in some formats.
Once decoded, this is no longer a property of the video frame and should
be discarded.

It was considered useful to know if an uncompressed frame was decoded
from a KEY/P/B compressed frame, and to preserve that information if
that same uncompressed frame was passed through another M2M device (e.g.
a scaler). However, the V4L2 documentation makes it clear that the flags
are meant for compressed frames only.

Drop the copy_frame_flags argument from v4l2_m2m_buf_copy_metadata().
The change to drivers was performed with the following Coccinelle
semantic patch:

@@
expression src;
expression dst;
expression flag;
@@
- v4l2_m2m_buf_copy_metadata(src, dst, flag);
+ v4l2_m2m_buf_copy_metadata(src, dst);

include/media/v4l2-mem2mem.h and drivers/media/v4l2-core/v4l2-mem2mem.c
have been updated manually.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

show more ...

media: mediatek: vcodec: Use %pe format specifier

The %pe format specifier is designed to print error pointers. It prints
a symbolic error name (eg. -EINVAL) and it makes the code simpler by
omittin

media: mediatek: vcodec: Use %pe format specifier

The %pe format specifier is designed to print error pointers. It prints
a symbolic error name (eg. -EINVAL) and it makes the code simpler by
omitting PTR_ERR().

This patch fixes this cocci report:
./platform/mediatek/vcodec/common/mtk_vcodec_dbgfs.c:187:3-10: WARNING: Consider using %pe to print PTR_ERR()

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

show more ...

media: mediatek: vcodec: Drop unneeded v4l2_m2m_get_vq() NULL check

The v4l2_m2m_get_vq() function never returns NULL.

In the set format handlers, the check may have been intended to catch
invalid

media: mediatek: vcodec: Drop unneeded v4l2_m2m_get_vq() NULL check

The v4l2_m2m_get_vq() function never returns NULL.

In the set format handlers, the check may have been intended to catch
invalid format types, but that's not needed as the V4L2 core picks the
appropriate VIDIOC_S_FMT ioctl handler based on the format type, so the
type can't be incorrect.

In the get format handlers, the return value is not used for any purpose
other than the NULL check, which was therefore probably intended to
catch invalid format types. That's not needed for the same reason as in
the set format handler.

In other locations the v4l2_m2m_get_vq() function is called with a
hardcoded V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE type, so the NULL check
can't have been an attempt to catch an invalid type there either.

Drop the unneeded return value checks and, as the function has no side
effect, the unneeded function call as well.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

show more ...