Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 872dfcfe authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

[media] bttv/cx25821/cx88/ivtv: use sg_next instead of sg++ 



Never use sg++, always use sg = sg_next(sg). Scatterlist entries can
be combined if the memory is contiguous but sg++ won't know about that.

As far as I can tell cx88 and ivtv are really broken because of this,
and bttv and cx25821 are OK because vb1 doesn't combine scatterlist
entries.

But regardless, sg++ should never be used, only sg_next is safe.

Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent 6dfa5131

drivers/media/pci/bt8xx/bttv-risc.c

+6 −6
Original line number Diff line number Diff line
@@ -84,7 +84,7 @@ bttv_risc_packed(struct bttv *btv, struct btcx_riscmem *risc, 
			continue;

		while (offset && offset >= sg_dma_len(sg)) {

			offset -= sg_dma_len(sg);

			sg++;

			sg = sg_next(sg);

		}

		if (bpl <= sg_dma_len(sg)-offset) {

			/* fits into current chunk */
@@ -100,13 +100,13 @@ bttv_risc_packed(struct bttv *btv, struct btcx_riscmem *risc, 
			*(rp++)=cpu_to_le32(sg_dma_address(sg)+offset);

			todo -= (sg_dma_len(sg)-offset);

			offset = 0;

			sg++;

			sg = sg_next(sg);

			while (todo > sg_dma_len(sg)) {

				*(rp++)=cpu_to_le32(BT848_RISC_WRITE|

						    sg_dma_len(sg));

				*(rp++)=cpu_to_le32(sg_dma_address(sg));

				todo -= sg_dma_len(sg);

				sg++;

				sg = sg_next(sg);

			}

			*(rp++)=cpu_to_le32(BT848_RISC_WRITE|BT848_RISC_EOL|

					    todo);
@@ -187,15 +187,15 @@ bttv_risc_planar(struct bttv *btv, struct btcx_riscmem *risc, 
			/* go to next sg entry if needed */

			while (yoffset && yoffset >= sg_dma_len(ysg)) {

				yoffset -= sg_dma_len(ysg);

				ysg++;

				ysg = sg_next(ysg);

			}

			while (uoffset && uoffset >= sg_dma_len(usg)) {

				uoffset -= sg_dma_len(usg);

				usg++;

				usg = sg_next(usg);

			}

			while (voffset && voffset >= sg_dma_len(vsg)) {

				voffset -= sg_dma_len(vsg);

				vsg++;

				vsg = sg_next(vsg);

			}



			/* calculate max number of bytes we can write */

drivers/media/pci/cx25821/cx25821-core.c

+6 −6
Original line number Diff line number Diff line
@@ -996,7 +996,7 @@ static __le32 *cx25821_risc_field(__le32 * rp, struct scatterlist *sglist, 
	for (line = 0; line < lines; line++) {

		while (offset && offset >= sg_dma_len(sg)) {

			offset -= sg_dma_len(sg);

			sg++;

			sg = sg_next(sg);

		}

		if (bpl <= sg_dma_len(sg) - offset) {

			/* fits into current chunk */
@@ -1014,14 +1014,14 @@ static __le32 *cx25821_risc_field(__le32 * rp, struct scatterlist *sglist, 
			*(rp++) = cpu_to_le32(0);	/* bits 63-32 */

			todo -= (sg_dma_len(sg) - offset);

			offset = 0;

			sg++;

			sg = sg_next(sg);

			while (todo > sg_dma_len(sg)) {

				*(rp++) = cpu_to_le32(RISC_WRITE |

						sg_dma_len(sg));

				*(rp++) = cpu_to_le32(sg_dma_address(sg));

				*(rp++) = cpu_to_le32(0);	/* bits 63-32 */

				todo -= sg_dma_len(sg);

				sg++;

				sg = sg_next(sg);

			}

			*(rp++) = cpu_to_le32(RISC_WRITE | RISC_EOL | todo);

			*(rp++) = cpu_to_le32(sg_dma_address(sg));
@@ -1101,7 +1101,7 @@ static __le32 *cx25821_risc_field_audio(__le32 * rp, struct scatterlist *sglist, 
	for (line = 0; line < lines; line++) {

		while (offset && offset >= sg_dma_len(sg)) {

			offset -= sg_dma_len(sg);

			sg++;

			sg = sg_next(sg);

		}



		if (lpi && line > 0 && !(line % lpi))
@@ -1125,14 +1125,14 @@ static __le32 *cx25821_risc_field_audio(__le32 * rp, struct scatterlist *sglist, 
			*(rp++) = cpu_to_le32(0);	/* bits 63-32 */

			todo -= (sg_dma_len(sg) - offset);

			offset = 0;

			sg++;

			sg = sg_next(sg);

			while (todo > sg_dma_len(sg)) {

				*(rp++) = cpu_to_le32(RISC_WRITE |

						sg_dma_len(sg));

				*(rp++) = cpu_to_le32(sg_dma_address(sg));

				*(rp++) = cpu_to_le32(0);	/* bits 63-32 */

				todo -= sg_dma_len(sg);

				sg++;

				sg = sg_next(sg);

			}

			*(rp++) = cpu_to_le32(RISC_WRITE | RISC_EOL | todo);

			*(rp++) = cpu_to_le32(sg_dma_address(sg));

drivers/media/pci/cx88/cx88-core.c

+3 −3
Original line number Diff line number Diff line
@@ -95,7 +95,7 @@ static __le32* cx88_risc_field(__le32 *rp, struct scatterlist *sglist, 
	for (line = 0; line < lines; line++) {

		while (offset && offset >= sg_dma_len(sg)) {

			offset -= sg_dma_len(sg);

			sg++;

			sg = sg_next(sg);

		}

		if (lpi && line>0 && !(line % lpi))

			sol = RISC_SOL | RISC_IRQ1 | RISC_CNT_INC;
@@ -114,13 +114,13 @@ static __le32* cx88_risc_field(__le32 *rp, struct scatterlist *sglist, 
			*(rp++)=cpu_to_le32(sg_dma_address(sg)+offset);

			todo -= (sg_dma_len(sg)-offset);

			offset = 0;

			sg++;

			sg = sg_next(sg);

			while (todo > sg_dma_len(sg)) {

				*(rp++)=cpu_to_le32(RISC_WRITE|

						    sg_dma_len(sg));

				*(rp++)=cpu_to_le32(sg_dma_address(sg));

				todo -= sg_dma_len(sg);

				sg++;

				sg = sg_next(sg);

			}

			*(rp++)=cpu_to_le32(RISC_WRITE|RISC_EOL|todo);

			*(rp++)=cpu_to_le32(sg_dma_address(sg));

drivers/media/pci/ivtv/ivtv-udma.c

+1 −1
Original line number Diff line number Diff line
@@ -76,7 +76,7 @@ void ivtv_udma_fill_sg_array (struct ivtv_user_dma *dma, u32 buffer_offset, u32 
	int i;

	struct scatterlist *sg;



	for (i = 0, sg = dma->SGlist; i < dma->SG_length; i++, sg++) {

	for (i = 0, sg = dma->SGlist; i < dma->SG_length; i++, sg = sg_next(sg)) {

		dma->SGarray[i].size = cpu_to_le32(sg_dma_len(sg));

		dma->SGarray[i].src = cpu_to_le32(sg_dma_address(sg));

		dma->SGarray[i].dst = cpu_to_le32(buffer_offset);