[PATCH v1 00/11] media: intel/ipu6: bounds, leak, and error handling fixes

[Valerii Sokolov]

This series fixes bugs in the Intel IPU6 input system (ISYS), Buttress,
DMA/MMU and firmware interface code:

 1    Move the vb2_is_busy() check from VIDIOC_TRY_FMT to VIDIOC_S_FMT, so
      TRY_FMT never returns -EBUSY and S_FMT can no longer overwrite
      av->pix_fmt with an unvalidated format while buffers are allocated.
 2    Return firmware message buffers to the free pool when sending a
      stream start or capture command fails.
 3    Bound the number of input and output pins in
      ipu6_isys_fw_pin_cfg().
 4    Clamp the crop top offset in ipu6_isys_csi2_set_sel().
 5    Only call auxiliary device ISRs for interrupts that belong to them.
 6    Release the firmware context when ipu6_fw_com_open() fails.
 7-10 DMA/MMU fixes: an IOVA leak and a silently ignored mapping failure
      in the scatterlist mapping helpers, a missing DMA unmap of the dummy
      L2 page table, and a dev_err(NULL, ...).
11    Log the correct frame sequence number on EOF (debug only).

Patches 1, 3, 4 and 8 are tagged for stable. The other fixes address
bounded leaks or cosmetic issues.

The IPU7 code recently added to this driver appears to have the same
issues as patches 3 and 11 (ipu7_isys_fw_pin_cfg() and
ipu7_isys_isr_one()). I have left those alone as I have no IPU7 hardware
to test on.

Testing: each patch was build-tested with W=1 on top of
media-committers/next, and the series was runtime-tested on a Raptor
Lake laptop (Lenovo ThinkPad X1 Carbon Gen 11, OV2740 sensor).

Signed-off-by: Valerii Sokolov <valerii.sokolov@xxxxx>

Valerii Sokolov (11):
  media: intel/ipu6: move busy check to ipu6_isys_vidioc_s_fmt_vid_cap()
  media: intel/ipu6: fix firmware message buffer leak on send failure
  media: intel/ipu6: check pin bounds in ipu6_isys_fw_pin_cfg()
  media: intel/ipu6: clamp crop top offset in ipu6_isys_csi2_set_sel()
  media: intel/ipu6: check irq_status mask before calling subdevice ISR
  media: intel/ipu6: clean up fwctx on ipu6_fw_com_open() failure
  media: intel/ipu6: fix IOVA leak on first entry failure in
    ipu6_dma_map_sg()
  media: intel/ipu6: return an error from ipu6_dma_map_sgtable() on
    failure
  media: intel/ipu6: unmap the dummy L2 page table in ipu6_mmu_destroy()
  media: intel/ipu6: pass the device to dev_err() in ipu6_mmu_unmap()
  media: intel/ipu6: fix EOF sequence logging in ipu6_isys_isr_one()

 drivers/media/pci/intel/ipu6/ipu6-buttress.c   |  3 ++-
 drivers/media/pci/intel/ipu6/ipu6-dma.c        |  9 ++++++---
 drivers/media/pci/intel/ipu6/ipu6-fw-isys.c    | 10 ++++++++--
 drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c  |  2 ++
 drivers/media/pci/intel/ipu6/ipu6-isys-queue.c |  4 +++-
 drivers/media/pci/intel/ipu6/ipu6-isys-video.c |  7 ++++---
 drivers/media/pci/intel/ipu6/ipu6-mmu.c        |  5 +++--
 7 files changed, 28 insertions(+), 12 deletions(-)


base-commit: d7e7bca7169873b46e857c025c10f3336c1258d8
-- 
2.56.0