From 00542edf071e249ccb541ffb2d2b9034e2533968 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Sun, 31 Jul 2011 17:12:02 +0200 Subject: [media] omap3isp: Don't accept pipelines with no video source as valid Make sure the pipeline has a valid video source (either a subdev with no sink pad, or a non-subdev entity) at stream-on time and return -EPIPE if no video source can be found. Reported-by: Jonathan Cameron Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/omap3isp/ispvideo.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'drivers/media/video/omap3isp/ispvideo.c') diff --git a/drivers/media/video/omap3isp/ispvideo.c b/drivers/media/video/omap3isp/ispvideo.c index fd965adfd59..fd94cdf471b 100644 --- a/drivers/media/video/omap3isp/ispvideo.c +++ b/drivers/media/video/omap3isp/ispvideo.c @@ -278,7 +278,8 @@ isp_video_far_end(struct isp_video *video) * limits reported by every block in the pipeline. * * Return 0 if all formats match, or -EPIPE if at least one link is found with - * different formats on its two ends. + * different formats on its two ends or if the pipeline doesn't start with a + * video source (either a subdev with no input pad, or a non-subdev entity). */ static int isp_video_validate_pipeline(struct isp_pipeline *pipe) { @@ -329,10 +330,15 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe) * in the middle of it. */ shifter_link = subdev == &isp->isp_ccdc.subdev; - /* Retrieve the source format */ + /* Retrieve the source format. Return an error if no source + * entity can be found, and stop checking the pipeline if the + * source entity isn't a subdev. + */ pad = media_entity_remote_source(pad); - if (pad == NULL || - media_entity_type(pad->entity) != MEDIA_ENT_T_V4L2_SUBDEV) + if (pad == NULL) + return -EPIPE; + + if (media_entity_type(pad->entity) != MEDIA_ENT_T_V4L2_SUBDEV) break; subdev = media_entity_to_v4l2_subdev(pad->entity); -- cgit v1.2.3-70-g09d2 From 5b6c3ef0e43fe80b517735697e4d0fb5729b2ab4 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Sat, 13 Aug 2011 13:13:32 -0300 Subject: [media] omap3isp: video: Avoid crashes when pipeline set stream operation fails If streaming can't be enabled on the pipeline, the DMA buffers queue is not emptied. If the buffers then get freed the queue will end up referencing free memory. This is usually not an issue, as the DMA queue will be reinitialized the next time streaming is enabled, before enabling the hardware. However, if the sensor connected at the pipeline input is free-running, the CCDC will start generating interrupts as soon as it gets powered up, before the streaming gets enabled on the hardware. This will make the CCDC interrupt handler access freed memory, causing a crash. Reinitialize the DMA buffers queue in isp_video_streamon() if the error path to make sure this situation won't happen. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/omap3isp/ispvideo.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'drivers/media/video/omap3isp/ispvideo.c') diff --git a/drivers/media/video/omap3isp/ispvideo.c b/drivers/media/video/omap3isp/ispvideo.c index fd94cdf471b..ba86f119ebb 100644 --- a/drivers/media/video/omap3isp/ispvideo.c +++ b/drivers/media/video/omap3isp/ispvideo.c @@ -1056,6 +1056,14 @@ error: if (video->isp->pdata->set_constraints) video->isp->pdata->set_constraints(video->isp, false); media_entity_pipeline_stop(&video->video.entity); + /* The DMA queue must be emptied here, otherwise CCDC interrupts + * that will get triggered the next time the CCDC is powered up + * will try to access buffers that might have been freed but + * still present in the DMA queue. This can easily get triggered + * if the above omap3isp_pipeline_set_stream() call fails on a + * system with a free-running sensor. + */ + INIT_LIST_HEAD(&video->dmaqueue); video->queue = NULL; } -- cgit v1.2.3-70-g09d2