Commit f44c6511 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'media/v7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 

Pull media fixes from Mauro Carvalho Chehab:

 - uvcvideo may cause OOPS when out of memory

 - remove a deadlock in the ccs driver

* tag 'media/v7.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: ccs: Avoid deadlock in ccs_init_state()
  media: uvcvideo: Fix bug in error path of uvc_alloc_urb_buffers
parents 0b8bf3b6 7587fbf5

drivers/media/i2c/ccs/ccs-core.c

+0 −2
Original line number Diff line number Diff line
@@ -3080,8 +3080,6 @@ static int ccs_init_state(struct v4l2_subdev *sd, 
	struct v4l2_rect *crop =

		v4l2_subdev_state_get_crop(sd_state, pad);



	guard(mutex)(&sensor->mutex);



	ccs_get_native_size(ssd, crop);



	fmt->width = crop->width;

drivers/media/usb/uvc/uvc_video.c

+5 −4
Original line number Diff line number Diff line
@@ -1751,7 +1751,8 @@ static void uvc_video_complete(struct urb *urb) 
/*

 * Free transfer buffers.

 */

static void uvc_free_urb_buffers(struct uvc_streaming *stream)

static void uvc_free_urb_buffers(struct uvc_streaming *stream,

				 unsigned int size)

{

	struct usb_device *udev = stream->dev->udev;

	struct uvc_urb *uvc_urb;
@@ -1760,7 +1761,7 @@ static void uvc_free_urb_buffers(struct uvc_streaming *stream) 
		if (!uvc_urb->buffer)

			continue;



		usb_free_noncoherent(udev, stream->urb_size, uvc_urb->buffer,

		usb_free_noncoherent(udev, size, uvc_urb->buffer,

				     uvc_stream_dir(stream), uvc_urb->sgt);

		uvc_urb->buffer = NULL;

		uvc_urb->sgt = NULL;
@@ -1820,7 +1821,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream, 


			if (!uvc_alloc_urb_buffer(stream, uvc_urb, urb_size,

						  gfp_flags)) {

				uvc_free_urb_buffers(stream);

				uvc_free_urb_buffers(stream, urb_size);

				break;

			}
@@ -1868,7 +1869,7 @@ static void uvc_video_stop_transfer(struct uvc_streaming *stream, 
	}



	if (free_buffers)

		uvc_free_urb_buffers(stream);

		uvc_free_urb_buffers(stream, stream->urb_size);

}



/*