syzbot

map[Actionable:true Confident:true Explanation:The bug report describes a slab-use-after-free in `vb2_core_queue_release`,
which is part of the `videobuf2` core framework used by V4L2 drivers. The report
is fully consistent and actionable.

### Analysis of the Report:
1.  **Access Stack**: The crash occurs in `vb2_core_queue_release` at
`drivers/media/common/videobuf2/videobuf2-core.c:2679`. This function is called
during the closing of a file descriptor (`__fput` -> `v4l2_release` ->
`vb2_fop_release`). The specific access is a read of `q->max_num_buffers`, where
`q` is a `struct vb2_queue` embedded within `struct hackrf_dev`.
2.  **Allocation Stack**: The memory was allocated in `hackrf_probe` at
`drivers/media/usb/hackrf/hackrf.c:1351` (using `kzalloc_obj(*dev)`). This
confirms the object is indeed `struct hackrf_dev`.
3.  **Free Stack**: The memory was freed in the error path of `hackrf_probe` at
`drivers/media/usb/hackrf/hackrf.c:1523` (using `kfree(dev)`).

### Root Cause:
The bug is a classic race condition in the driver's `probe` function error
handling. In `hackrf_probe`, the driver registers a video device
(`video_register_device(&dev->rx_vdev, ...)`). Once registered, the device is
visible to userspace. If a subsequent initialization step fails (e.g.,
registering the transmitter device), the driver enters its error cleanup path.

In the error path, the driver calls `video_unregister_device(&dev->rx_vdev)` and
then immediately calls `kfree(dev)`. However, `video_unregister_device` does not
guarantee that no userspace processes have the device open. If a process (like
`v4l_id` mentioned in the report) opened the device after registration but
before unregistration, it holds a reference to the `video_device` and the
underlying `v4l2_device`. When that process later closes the file descriptor,
the V4L2 core attempts to clean up the associated `vb2_queue`, leading to a
use-after-free because the parent `hackrf_dev` has already been freed.

### Conclusion:
The report is actionable because it clearly identifies the faulty error handling
in `hackrf_probe`. The fix involves using proper refcounting (e.g.,
`v4l2_device_put`) instead of direct `kfree(dev)` in the `probe` error path,
ensuring the structure is only freed when its last user (including the probe
function itself) has released it.

The report is self-consistent:
- The object type (`hackrf_dev`) matches across all stacks.
- The offset of the access (3912 bytes) correctly points to the `rx_vb2_queue`
within `hackrf_dev`.
- The tasks involved (`v4l_id` for access, and a kernel worker for
allocation/free) perfectly match the hypothesized race condition.]

map[KernelSrc:/app/workdir/cache/src/4aa618f477ef968aedd012f20995436dd0e1cd45]

map[KernelObj:/app/workdir/cache/build/8d1cc357f0745da10571f475a79d583b8d5ed030]

map[Index:codesearch-index]

gemini-3-flash-preview

map[Actionable:true Confident:true]

You are an experienced Linux kernel developer tasked with determining if the given kernel bug
report is actionable or not. Actionable means that it contains enough info to root cause
the underlying bug, and that the report is self-consistent and makes sense, rather than
e.g. a one-off nonsensical crash induced by a previous memory corruption.


The bug report is about a use-after-free bug generated by KASAN tool.
It should contain 3 stack traces: the bad memory access stack, the heap block allocation stack,
and the heap block free stack. If the report does not contain 3 stacks, it's not actionable.

All 3 stack traces should be related to the same object type,
and usually be in the same kernel subsystem (at least leaf stack frames).
An example of an actionable and consistent report would be: first access stack relates
to an access to a field of struct Foo, allocation/free stacks relate to allocation/free
of the struct Foo.
In inconsistent/nonsensical reports an access may be to a struct Foo, but allocation
stack allocates a different structure in a different subsystem.
Look for other suspicious signals/inconsistencies that can make this report hard to
debug/understand. 


In the final reply explain why you think the report is self-consistent and actionable,
or why it's inconsistent and/or not actionable.

Use the provided tools to confirm any assumptions, variables/fields being accessed, etc.
In particular, don't make assumptions about the kernel source code,
use codesearch tools to read the actual source code.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

The bug report is:

==================================================================
BUG: KASAN: slab-use-after-free in vb2_core_queue_release+0x150/0x190 drivers/media/common/videobuf2/videobuf2-core.c:2679
Read of size 4 at addr ffff88802d000f48 by task v4l_id/21137

CPU: 0 UID: 0 PID: 21137 Comm: v4l_id Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x156/0x4c9 mm/kasan/report.c:482
 kasan_report+0xdf/0x1e0 mm/kasan/report.c:595
 vb2_core_queue_release+0x150/0x190 drivers/media/common/videobuf2/videobuf2-core.c:2679
 vb2_queue_release drivers/media/common/videobuf2/videobuf2-v4l2.c:956 [inline]
 _vb2_fop_release+0xe8/0x280 drivers/media/common/videobuf2/videobuf2-v4l2.c:1159
 v4l2_release+0x280/0x390 drivers/media/v4l2-core/v4l2-dev.c:471
 __fput+0x3ff/0xb40 fs/file_table.c:469
 fput_close_sync+0x118/0x250 fs/file_table.c:574
 __do_sys_close fs/open.c:1509 [inline]
 __se_sys_close fs/open.c:1494 [inline]
 __x64_sys_close+0x8b/0x120 fs/open.c:1494
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1adb8a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffe883bdfc0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007f1adbff2880 RCX: 00007f1adb8a7407
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f1adbff26e8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffe883be1f0 R14: 00007f1adc159000 R15: 0000562e7d91b4d8
 </TASK>

Allocated by task 29:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 hackrf_probe+0xcf/0x5d0 drivers/media/usb/hackrf/hackrf.c:1351
 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:643 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:721
 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:863
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:893
 __device_attach_driver+0x1df/0x340 drivers/base/dd.c:1021
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1093
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1148
 bus_probe_device+0x64/0x160 drivers/base/bus.c:613
 device_add+0x11d9/0x1950 drivers/base/core.c:3691
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2266
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:643 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:721
 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:863
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:893
 __device_attach_driver+0x1df/0x340 drivers/base/dd.c:1021
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1093
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1148
 bus_probe_device+0x64/0x160 drivers/base/bus.c:613
 device_add+0x11d9/0x1950 drivers/base/core.c:3691
 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
 process_scheduled_works kernel/workqueue.c:3359 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 29:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2685 [inline]
 slab_free mm/slub.c:6165 [inline]
 kfree+0x1f6/0x6b0 mm/slub.c:6483
 hackrf_probe.cold+0x40/0x12f9 drivers/media/usb/hackrf/hackrf.c:1523
 usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:643 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:721
 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:863
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:893
 __device_attach_driver+0x1df/0x340 drivers/base/dd.c:1021
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1093
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1148
 bus_probe_device+0x64/0x160 drivers/base/bus.c:613
 device_add+0x11d9/0x1950 drivers/base/core.c:3691
 usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2266
 usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
 usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:643 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:721
 __driver_probe_device+0x1de/0x400 drivers/base/dd.c:863
 driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:893
 __device_attach_driver+0x1df/0x340 drivers/base/dd.c:1021
 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1093
 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1148
 bus_probe_device+0x64/0x160 drivers/base/bus.c:613
 device_add+0x11d9/0x1950 drivers/base/core.c:3691
 usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
 process_scheduled_works kernel/workqueue.c:3359 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff88802d000000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 3912 bytes inside of
 freed 8192-byte region [ffff88802d000000, ffff88802d002000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d000
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88813fe41280 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88813fe41280 dead000000000100 dead000000000122
head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
head: 00fff00000000003 ffffea0000b40001 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 11594, tgid 11586 (syz.1.1536), ts 456308172457, free_ts 456186809005
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x153/0x170 mm/page_alloc.c:1889
 prep_new_page mm/page_alloc.c:1897 [inline]
 get_page_from_freelist+0x111d/0x3140 mm/page_alloc.c:3962
 __alloc_frozen_pages_noprof+0x27c/0x2ba0 mm/page_alloc.c:5250
 alloc_slab_page mm/slub.c:3292 [inline]
 allocate_slab mm/slub.c:3481 [inline]
 new_slab+0xa6/0x6b0 mm/slub.c:3539
 refill_objects+0x26b/0x400 mm/slub.c:7175
 refill_sheaf mm/slub.c:2812 [inline]
 __pcs_replace_empty_main+0x1ab/0x660 mm/slub.c:4615
 alloc_from_pcs mm/slub.c:4717 [inline]
 slab_alloc_node mm/slub.c:4851 [inline]
 __do_kmalloc_node mm/slub.c:5259 [inline]
 __kmalloc_noprof+0x688/0x850 mm/slub.c:5272
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 tomoyo_init_log+0x1224/0x20c0 security/tomoyo/audit.c:275
 tomoyo_supervisor+0x506/0x1340 security/tomoyo/common.c:2232
 tomoyo_audit_path_log security/tomoyo/file.c:169 [inline]
 tomoyo_path_permission security/tomoyo/file.c:592 [inline]
 tomoyo_path_permission+0x270/0x3b0 security/tomoyo/file.c:577
 tomoyo_path_perm+0x3d6/0x460 security/tomoyo/file.c:843
 tomoyo_path_symlink+0x97/0xe0 security/tomoyo/tomoyo.c:212
 security_path_symlink+0x152/0x2d0 security/security.c:1477
 filename_symlinkat+0x122/0x560 fs/namei.c:5644
 __do_sys_symlink fs/namei.c:5673 [inline]
 __se_sys_symlink fs/namei.c:5669 [inline]
 __x64_sys_symlink+0x79/0xb0 fs/namei.c:5669
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
page last free pid 5181 tgid 5181 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0x7e1/0x10d0 mm/page_alloc.c:2978
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xe0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4538 [inline]
 slab_alloc_node mm/slub.c:4866 [inline]
 __do_kmalloc_node mm/slub.c:5259 [inline]
 __kvmalloc_node_noprof+0x316/0xa00 mm/slub.c:6752
 seq_buf_alloc fs/seq_file.c:39 [inline]
 seq_read_iter+0x819/0x1270 fs/seq_file.c:211
 kernfs_fop_read_iter+0x46c/0x610 fs/kernfs/file.c:297
 new_sync_read fs/read_write.c:493 [inline]
 vfs_read+0x825/0xb30 fs/read_write.c:574
 ksys_read+0x12a/0x250 fs/read_write.c:717
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff88802d000e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802d000e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802d000f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff88802d000f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802d001000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

The bug report describes a slab-use-after-free in `vb2_core_queue_release`, which is part of the `videobuf2` core framework used by V4L2 drivers. The report is fully consistent and actionable.

### Analysis of the Report:
1.  **Access Stack**: The crash occurs in `vb2_core_queue_release` at `drivers/media/common/videobuf2/videobuf2-core.c:2679`. This function is called during the closing of a file descriptor (`__fput` -> `v4l2_release` -> `vb2_fop_release`). The specific access is a read of `q->max_num_buffers`, where `q` is a `struct vb2_queue` embedded within `struct hackrf_dev`.
2.  **Allocation Stack**: The memory was allocated in `hackrf_probe` at `drivers/media/usb/hackrf/hackrf.c:1351` (using `kzalloc_obj(*dev)`). This confirms the object is indeed `struct hackrf_dev`.
3.  **Free Stack**: The memory was freed in the error path of `hackrf_probe` at `drivers/media/usb/hackrf/hackrf.c:1523` (using `kfree(dev)`).

### Root Cause:
The bug is a classic race condition in the driver's `probe` function error handling. In `hackrf_probe`, the driver registers a video device (`video_register_device(&dev->rx_vdev, ...)`). Once registered, the device is visible to userspace. If a subsequent initialization step fails (e.g., registering the transmitter device), the driver enters its error cleanup path.

In the error path, the driver calls `video_unregister_device(&dev->rx_vdev)` and then immediately calls `kfree(dev)`. However, `video_unregister_device` does not guarantee that no userspace processes have the device open. If a process (like `v4l_id` mentioned in the report) opened the device after registration but before unregistration, it holds a reference to the `video_device` and the underlying `v4l2_device`. When that process later closes the file descriptor, the V4L2 core attempts to clean up the associated `vb2_queue`, leading to a use-after-free because the parent `hackrf_dev` has already been freed.

### Conclusion:
The report is actionable because it clearly identifies the faulty error handling in `hackrf_probe`. The fix involves using proper refcounting (e.g., `v4l2_device_put`) instead of direct `kfree(dev)` in the `probe` error path, ensuring the structure is only freed when its last user (including the probe function itself) has released it.

The report is self-consistent:
- The object type (`hackrf_dev`) matches across all stacks.
- The offset of the access (3912 bytes) correctly points to the `rx_vb2_queue` within `hackrf_dev`.
- The tasks involved (`v4l_id` for access, and a kernel worker for allocation/free) perfectly match the hypothesized race condition.

gemini-3-flash-preview

							input: 8844
							output: 55
							thoughts: 709
						

**KASAN Slab-Use-After-Free Analysis: A Deep Dive**

Okay, so I've got a KASAN slab-use-after-free report. My first instinct is to determine if this is a genuine issue that requires action. This report points to a use-after-free in `vb2_core_queue_release`, and I need to unravel the details to understand what's happening.

First, I'll dissect the provided stack traces. The *access stack* shows a clear path: the faulting instruction is within `vb2_core_queue_release`, called from a chain that ultimately originates from a `close()` system call, suggesting that resource cleanup is the trigger. The critical functions in this chain are `vb2_core_queue_release`, `vb2_queue_release`, `_vb2_fop_release`, `v4l2_release`, `__fput`, `fput_close_sync`, and `__x64_sys_close`. This looks like a standard V4L2 device file teardown.

Then I look at the *allocation stack* - it is quite telling! The call stack points directly to the `hackrf_probe` function within the `drivers/media/usb/hackrf/hackrf.c` driver, specifically at line 1351. This strongly suggests that the problematic object is being created during the probing of a HackRF USB device. This further suggests that the `vb2` subsystem is somehow interacting with this `hackrf` driver.

The *free stack* mirrors the allocation stack until it gets to `hackrf_probe` - indicating the allocated object is being freed during module unload/device disconnect. The critical line to examine in `hackrf_probe` is line 1523.

So, the issue involves the `hackrf` driver, and the `videobuf2` subsystem. This is where things get interesting and where my knowledge is required. Now, my next step is clear: I need to scrutinize the code. I'll focus on what's being allocated and freed within `hackrf_probe`, paying attention to the relationship with `videobuf2`. I will carefully examine the interaction between `hackrf` and the `vb2` core, particularly around the lines identified in the stacks: line 1351 (allocation) and line 1523 (free) of `hackrf.c`. I will also need to review `vb2_core_queue_release` at line 2679 of `videobuf2-core.c` to see how it's interacting with the potential freed object. This looks like it requires a deep dive into the driver's memory management and how it interacts with the video buffer subsystem. I can see this might be a race condition, or a mis-handling of buffer objects upon device removal.

map[Dir:drivers/media/usb/hackrf/]

map[Files:[hackrf.c] Subdirs:<nil>]

map[Dir:drivers/media/common/videobuf2/]

map[Files:[frame_vector.c vb2-trace.c videobuf2-core.c videobuf2-dma-contig.c videobuf2-dma-sg.c videobuf2-dvb.c videobuf2-memops.c videobuf2-v4l2.c videobuf2-vmalloc.c] Subdirs:<nil>]

gemini-3-flash-preview

							input: 10353
							output: 95
							thoughts: 175
						

Okay, here's my take on those code locations:

**Investigating Potential Resource Management Issues**

Alright, I've got the relevant files pulled up. My primary focus is pinpointing any potential resource management issues, specifically related to the HackRF USB driver. I see these critical lines for memory allocation, deallocation, and access:

*   **`drivers/media/usb/hackrf/hackrf.c:1351`**: This is where memory is being allocated. I need to understand the allocation size, the context of the allocation (what is being allocated for), and if any error handling is present in case of allocation failure. I'll need to look at what calls this function to get a full picture.

*   **`drivers/media/usb/hackrf/hackrf.c:1523`**: This is where the memory is being freed. I need to verify if the corresponding `free` call matches the allocation. Is there proper error checking related to deallocation? Are there any potential double-free scenarios, or leaks if things go wrong?

*   **`drivers/media/common/videobuf2/videobuf2-core.c:2679`**: This is where the access to the buffer occurs. I have to see how it works and whether it can cause any issues in relation to allocation and freeing. It's likely involved in DMA or user-space access. I need to correlate this access with the allocation and free calls to see if there are any race conditions or use-after-free vulnerabilities.

To get a better understanding of the overall buffer management within this subsystem, I will also need to look at:

*   **`drivers/media/common/videobuf2/videobuf2-v4l2.c:956` (vb2\_queue\_release)**: This will be a critical part of understanding the cleanup process when a queue is released, potentially indicating when the buffers are truly deallocated. It should be where a queue releases all of its allocated buffers.

*   **`drivers/media/common/videobuf2/videobuf2-v4l2.c:1159` (\_vb2\_fop\_release)**: This likely handles the file operation release, representing a close/disconnect event. I need to check to make sure the memory gets handled correctly when a user application closes or the device is removed.

map[File:drivers/media/usb/hackrf/hackrf.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * HackRF driver
 *
 * Copyright (C) 2014 Antti Palosaari <crope@iki.fi>
 */

#include <linux/module.h>
#include <linux/slab.h>
#include <linux/usb.h>
#include <media/v4l2-device.h>
#include <media/v4l2-ioctl.h>
#include <media/v4l2-ctrls.h>
#include <media/v4l2-event.h>
#include <media/videobuf2-v4l2.h>
#include <media/videobuf2-vmalloc.h>

/*
 * Used Avago MGA-81563 RF amplifier could be destroyed pretty easily with too
 * strong signal or transmitting to bad antenna.
 * Set RF gain control to 'grabbed' state by default for sure.
 */
static bool hackrf_enable_rf_gain_ctrl;
module_param_named(enable_rf_gain_ctrl, hackrf_enable_rf_gain_ctrl, bool, 0644);
MODULE_PARM_DESC(enable_rf_gain_ctrl, "enable RX/TX RF amplifier control (warn: could damage amplifier)");

/* HackRF USB API commands (from HackRF Library) */
enum {
	CMD_SET_TRANSCEIVER_MODE           = 0x01,
	CMD_SAMPLE_RATE_SET                = 0x06,
	CMD_BASEBAND_FILTER_BANDWIDTH_SET  = 0x07,
	CMD_BOARD_ID_READ                  = 0x0e,
	CMD_VERSION_STRING_READ            = 0x0f,
	CMD_SET_FREQ                       = 0x10,
	CMD_AMP_ENABLE                     = 0x11,
	CMD_SET_LNA_GAIN                   = 0x13,
	CMD_SET_VGA_GAIN                   = 0x14,
	CMD_SET_TXVGA_GAIN                 = 0x15,
};

/*
 *       bEndpointAddress     0x81  EP 1 IN
 *         Transfer Type            Bulk
 *       wMaxPacketSize     0x0200  1x 512 bytes
 */
#define MAX_BULK_BUFS            (6)
#define BULK_BUFFER_SIZE         (128 * 512)

static const struct v4l2_frequency_band bands_adc_dac[] = {
	{
		.tuner = 0,
		.type = V4L2_TUNER_SDR,
		.index = 0,
		.capability = V4L2_TUNER_CAP_1HZ | V4L2_TUNER_CAP_FREQ_BANDS,
		.rangelow   =   200000,
		.rangehigh  = 24000000,
	},
};

static const struct v4l2_frequency_band bands_rx_tx[] = {
	{
		.tuner = 1,
		.type = V4L2_TUNER_RF,
		.index = 0,
		.capability = V4L2_TUNER_CAP_1HZ | V4L2_TUNER_CAP_FREQ_BANDS,
		.rangelow   =          1,
		.rangehigh  = 4294967294LL, /* max u32, hw goes over 7GHz */
	},
};

/* stream formats */
struct hackrf_format {
	u32	pixelformat;
	u32	buffersize;
};

/* format descriptions for capture and preview */
static struct hackrf_format formats[] = {
	{
		.pixelformat	= V4L2_SDR_FMT_CS8,
		.buffersize	= BULK_BUFFER_SIZE,
	},
};

static const unsigned int NUM_FORMATS = ARRAY_SIZE(formats);

/* intermediate buffers with raw data from the USB device */
struct hackrf_buffer {
	struct vb2_v4l2_buffer vb;
	struct list_head list;
};

struct hackrf_dev {
#define USB_STATE_URB_BUF                1 /* XXX: set manually */
#define RX_ON                            4
#define TX_ON                            5
#define RX_ADC_FREQUENCY                11
#define TX_DAC_FREQUENCY                12
#define RX_BANDWIDTH                    13
#define TX_BANDWIDTH                    14
#define RX_RF_FREQUENCY                 15
#define TX_RF_FREQUENCY                 16
#define RX_RF_GAIN                      17
#define TX_RF_GAIN                      18
#define RX_IF_GAIN                      19
#define RX_LNA_GAIN                     20
#define TX_LNA_GAIN                     21
	unsigned long flags;

	struct usb_interface *intf;
	struct device *dev;
	struct usb_device *udev;
	struct video_device rx_vdev;
	struct video_device tx_vdev;
	struct v4l2_device v4l2_dev;

	/* videobuf2 queue and queued buffers list */
	struct vb2_queue rx_vb2_queue;
	struct vb2_queue tx_vb2_queue;
	struct list_head rx_buffer_list;
	struct list_head tx_buffer_list;
	spinlock_t buffer_list_lock; /* Protects buffer_list */
	unsigned int sequence;	     /* Buffer sequence counter */
	unsigned int vb_full;        /* vb is full and packets dropped */
	unsigned int vb_empty;       /* vb is empty and packets dropped */

	/* Note if taking both locks v4l2_lock must always be locked first! */
	struct mutex v4l2_lock;      /* Protects everything else */
	struct mutex vb_queue_lock;  /* Protects vb_queue */

	struct urb     *urb_list[MAX_BULK_BUFS];
	int            buf_num;
	unsigned long  buf_size;
	u8             *buf_list[MAX_BULK_BUFS];
	dma_addr_t     dma_addr[MAX_BULK_BUFS];
	int            urbs_initialized;
	int            urbs_submitted;

	/* USB control message buffer */
	#define BUF_SIZE 24
	u8 buf[BUF_SIZE];

	/* Current configuration */
	unsigned int f_adc;
	unsigned int f_dac;
	unsigned int f_rx;
	unsigned int f_tx;
	u32 pixelformat;
	u32 buffersize;

	/* Controls */
	struct v4l2_ctrl_handler rx_ctrl_handler;
	struct v4l2_ctrl *rx_bandwidth_auto;
	struct v4l2_ctrl *rx_bandwidth;
	struct v4l2_ctrl *rx_rf_gain;
	struct v4l2_ctrl *rx_lna_gain;
	struct v4l2_ctrl *rx_if_gain;
	struct v4l2_ctrl_handler tx_ctrl_handler;
	struct v4l2_ctrl *tx_bandwidth_auto;
	struct v4l2_ctrl *tx_bandwidth;
	struct v4l2_ctrl *tx_rf_gain;
	struct v4l2_ctrl *tx_lna_gain;

	/* Sample rate calc */
	unsigned long jiffies_next;
	unsigned int sample;
	unsigned int sample_measured;
};

#define hackrf_dbg_usb_control_msg(_dev, _r, _t, _v, _i, _b, _l) { \
	char *_direction; \
	if (_t & USB_DIR_IN) \
		_direction = "<<<"; \
	else \
		_direction = ">>>"; \
	dev_dbg(_dev, "%02x %02x %02x %02x %02x %02x %02x %02x %s %*ph\n", \
			_t, _r, _v & 0xff, _v >> 8, _i & 0xff, \
			_i >> 8, _l & 0xff, _l >> 8, _direction, _l, _b); \
}

/* execute firmware command */
static int hackrf_ctrl_msg(struct hackrf_dev *dev, u8 request, u16 value,
		u16 index, u8 *data, u16 size)
{
	int ret;
	unsigned int pipe;
	u8 requesttype;

	switch (request) {
	case CMD_SET_TRANSCEIVER_MODE:
	case CMD_SET_FREQ:
	case CMD_AMP_ENABLE:
	case CMD_SAMPLE_RATE_SET:
	case CMD_BASEBAND_FILTER_BANDWIDTH_SET:
		pipe = usb_sndctrlpipe(dev->udev, 0);
		requesttype = (USB_TYPE_VENDOR | USB_DIR_OUT);
		break;
	case CMD_BOARD_ID_READ:
	case CMD_VERSION_STRING_READ:
	case CMD_SET_LNA_GAIN:
	case CMD_SET_VGA_GAIN:
	case CMD_SET_TXVGA_GAIN:
		pipe = usb_rcvctrlpipe(dev->udev, 0);
		requesttype = (USB_TYPE_VENDOR | USB_DIR_IN);
		break;
	default:
		dev_err(dev->dev, "Unknown command %02x\n", request);
		ret = -EINVAL;
		goto err;
	}

	/* write request */
	if (!(requesttype & USB_DIR_IN))
		memcpy(dev->buf, data, size);

	ret = usb_control_msg(dev->udev, pipe, request, requesttype, value,
			index, dev->buf, size, 1000);
	hackrf_dbg_usb_control_msg(dev->dev, request, requesttype, value,
			index, dev->buf, size);
	if (ret < 0) {
		dev_err(dev->dev, "usb_control_msg() failed %d request %02x\n",
				ret, request);
		goto err;
	}

	/* read request */
	if (requesttype & USB_DIR_IN)
		memcpy(data, dev->buf, size);

	return 0;
err:
	return ret;
}

static int hackrf_set_params(struct hackrf_dev *dev)
{
	struct usb_interface *intf = dev->intf;
	int ret, i;
	u8 buf[8], u8tmp;
	unsigned int uitmp, uitmp1, uitmp2;
	const bool rx = test_bit(RX_ON, &dev->flags);
	const bool tx = test_bit(TX_ON, &dev->flags);
	static const struct {
		u32 freq;
	} bandwidth_lut[] = {
		{ 1750000}, /*  1.75 MHz */
		{ 2500000}, /*  2.5  MHz */
		{ 3500000}, /*  3.5  MHz */
		{ 5000000}, /*  5    MHz */
		{ 5500000}, /*  5.5  MHz */
		{ 6000000}, /*  6    MHz */
		{ 7000000}, /*  7    MHz */
		{ 8000000}, /*  8    MHz */
		{ 9000000}, /*  9    MHz */
		{10000000}, /* 10    MHz */
		{12000000}, /* 12    MHz */
		{14000000}, /* 14    MHz */
		{15000000}, /* 15    MHz */
		{20000000}, /* 20    MHz */
		{24000000}, /* 24    MHz */
		{28000000}, /* 28    MHz */
	};

	if (!rx && !tx) {
		dev_dbg(&intf->dev, "device is sleeping\n");
		return 0;
	}

	/* ADC / DAC frequency */
	if (rx && test_and_clear_bit(RX_ADC_FREQUENCY, &dev->flags)) {
		dev_dbg(&intf->dev, "RX ADC frequency=%u Hz\n", dev->f_adc);
		uitmp1 = dev->f_adc;
		uitmp2 = 1;
		set_bit(TX_DAC_FREQUENCY, &dev->flags);
	} else if (tx && test_and_clear_bit(TX_DAC_FREQUENCY, &dev->flags)) {
		dev_dbg(&intf->dev, "TX DAC frequency=%u Hz\n", dev->f_dac);
		uitmp1 = dev->f_dac;
		uitmp2 = 1;
		set_bit(RX_ADC_FREQUENCY, &dev->flags);
	} else {
		uitmp1 = uitmp2 = 0;
	}
	if (uitmp1 || uitmp2) {
		buf[0] = (uitmp1 >>  0) & 0xff;
		buf[1] = (uitmp1 >>  8) & 0xff;
		buf[2] = (uitmp1 >> 16) & 0xff;
		buf[3] = (uitmp1 >> 24) & 0xff;
		buf[4] = (uitmp2 >>  0) & 0xff;
		buf[5] = (uitmp2 >>  8) & 0xff;
		buf[6] = (uitmp2 >> 16) & 0xff;
		buf[7] = (uitmp2 >> 24) & 0xff;
		ret = hackrf_ctrl_msg(dev, CMD_SAMPLE_RATE_SET, 0, 0, buf, 8);
		if (ret)
			goto err;
	}

	/* bandwidth */
	if (rx && test_and_clear_bit(RX_BANDWIDTH, &dev->flags)) {
		if (dev->rx_bandwidth_auto->val == true)
			uitmp = dev->f_adc;
		else
			uitmp = dev->rx_bandwidth->val;

		for (i = 0; i < ARRAY_SIZE(bandwidth_lut); i++) {
			if (uitmp <= bandwidth_lut[i].freq) {
				uitmp = bandwidth_lut[i].freq;
				break;
			}
		}
		dev->rx_bandwidth->val = uitmp;
		dev->rx_bandwidth->cur.val = uitmp;
		dev_dbg(&intf->dev, "RX bandwidth selected=%u\n", uitmp);
		set_bit(TX_BANDWIDTH, &dev->flags);
	} else if (tx && test_and_clear_bit(TX_BANDWIDTH, &dev->flags)) {
		if (dev->tx_bandwidth_auto->val == true)
			uitmp = dev->f_dac;
		else
			uitmp = dev->tx_bandwidth->val;

		for (i = 0; i < ARRAY_SIZE(bandwidth_lut); i++) {
			if (uitmp <= bandwidth_lut[i].freq) {
				uitmp = bandwidth_lut[i].freq;
				break;
			}
		}
		dev->tx_bandwidth->val = uitmp;
		dev->tx_bandwidth->cur.val = uitmp;
		dev_dbg(&intf->dev, "TX bandwidth selected=%u\n", uitmp);
		set_bit(RX_BANDWIDTH, &dev->flags);
	} else {
		uitmp = 0;
	}
	if (uitmp) {
		uitmp1 = uitmp2 = 0;
		uitmp1 |= ((uitmp >>  0) & 0xff) << 0;
		uitmp1 |= ((uitmp >>  8) & 0xff) << 8;
		uitmp2 |= ((uitmp >> 16) & 0xff) << 0;
		uitmp2 |= ((uitmp >> 24) & 0xff) << 8;
		ret = hackrf_ctrl_msg(dev, CMD_BASEBAND_FILTER_BANDWIDTH_SET,
				      uitmp1, uitmp2, NULL, 0);
		if (ret)
			goto err;
	}

	/* RX / TX RF frequency */
	if (rx && test_and_clear_bit(RX_RF_FREQUENCY, &dev->flags)) {
		dev_dbg(&intf->dev, "RX RF frequency=%u Hz\n", dev->f_rx);
		uitmp1 = dev->f_rx / 1000000;
		uitmp2 = dev->f_rx % 1000000;
		set_bit(TX_RF_FREQUENCY, &dev->flags);
	} else if (tx && test_and_clear_bit(TX_RF_FREQUENCY, &dev->flags)) {
		dev_dbg(&intf->dev, "TX RF frequency=%u Hz\n", dev->f_tx);
		uitmp1 = dev->f_tx / 1000000;
		uitmp2 = dev->f_tx % 1000000;
		set_bit(RX_RF_FREQUENCY, &dev->flags);
	} else {
		uitmp1 = uitmp2 = 0;
	}
	if (uitmp1 || uitmp2) {
		buf[0] = (uitmp1 >>  0) & 0xff;
		buf[1] = (uitmp1 >>  8) & 0xff;
		buf[2] = (uitmp1 >> 16) & 0xff;
		buf[3] = (uitmp1 >> 24) & 0xff;
		buf[4] = (uitmp2 >>  0) & 0xff;
		buf[5] = (uitmp2 >>  8) & 0xff;
		buf[6] = (uitmp2 >> 16) & 0xff;
		buf[7] = (uitmp2 >> 24) & 0xff;
		ret = hackrf_ctrl_msg(dev, CMD_SET_FREQ, 0, 0, buf, 8);
		if (ret)
			goto err;
	}

	/* RX RF gain */
	if (rx && test_and_clear_bit(RX_RF_GAIN, &dev->flags)) {
		dev_dbg(&intf->dev, "RX RF gain val=%d->%d\n",
			dev->rx_rf_gain->cur.val, dev->rx_rf_gain->val);

		u8tmp = (dev->rx_rf_gain->val) ? 1 : 0;
		ret = hackrf_ctrl_msg(dev, CMD_AMP_ENABLE, u8tmp, 0, NULL, 0);
		if (ret)
			goto err;
		set_bit(TX_RF_GAIN, &dev->flags);
	}

	/* TX RF gain */
	if (tx && test_and_clear_bit(TX_RF_GAIN, &dev->flags)) {
		dev_dbg(&intf->dev, "TX RF gain val=%d->%d\n",
			dev->tx_rf_gain->cur.val, dev->tx_rf_gain->val);

		u8tmp = (dev->tx_rf_gain->val) ? 1 : 0;
		ret = hackrf_ctrl_msg(dev, CMD_AMP_ENABLE, u8tmp, 0, NULL, 0);
		if (ret)
			goto err;
		set_bit(RX_RF_GAIN, &dev->flags);
	}

	/* RX LNA gain */
	if (rx && test_and_clear_bit(RX_LNA_GAIN, &dev->flags)) {
		dev_dbg(dev->dev, "RX LNA gain val=%d->%d\n",
			dev->rx_lna_gain->cur.val, dev->rx_lna_gain->val);

		ret = hackrf_ctrl_msg(dev, CMD_SET_LNA_GAIN, 0,
				      dev->rx_lna_gain->val, &u8tmp, 1);
		if (ret)
			goto err;
	}

	/* RX IF gain */
	if (rx && test_and_clear_bit(RX_IF_GAIN, &dev->flags)) {
		dev_dbg(&intf->dev, "IF gain val=%d->%d\n",
			dev->rx_if_gain->cur.val, dev->rx_if_gain->val);

		ret = hackrf_ctrl_msg(dev, CMD_SET_VGA_GAIN, 0,
				      dev->rx_if_gain->val, &u8tmp, 1);
		if (ret)
			goto err;
	}

	/* TX LNA gain */
	if (tx && test_and_clear_bit(TX_LNA_GAIN, &dev->flags)) {
		dev_dbg(&intf->dev, "TX LNA gain val=%d->%d\n",
			dev->tx_lna_gain->cur.val, dev->tx_lna_gain->val);

		ret = hackrf_ctrl_msg(dev, CMD_SET_TXVGA_GAIN, 0,
				      dev->tx_lna_gain->val, &u8tmp, 1);
		if (ret)
			goto err;
	}

	return 0;
err:
	dev_dbg(&intf->dev, "failed=%d\n", ret);
	return ret;
}

/* Private functions */
static struct hackrf_buffer *hackrf_get_next_buffer(struct hackrf_dev *dev,
						    struct list_head *buffer_list)
{
	unsigned long flags;
	struct hackrf_buffer *buffer = NULL;

	spin_lock_irqsave(&dev->buffer_list_lock, flags);
	if (list_empty(buffer_list))
		goto leave;

	buffer = list_entry(buffer_list->next, struct hackrf_buffer, list);
	list_del(&buffer->list);
leave:
	spin_unlock_irqrestore(&dev->buffer_list_lock, flags);
	return buffer;
}

static void hackrf_copy_stream(struct hackrf_dev *dev, void *dst, void *src,
			       unsigned int src_len)
{
	memcpy(dst, src, src_len);

	/* calculate sample rate and output it in 10 seconds intervals */
	if (unlikely(time_is_before_jiffies(dev->jiffies_next))) {
		#define MSECS 10000UL
		unsigned int msecs = jiffies_to_msecs(jiffies -
				dev->jiffies_next + msecs_to_jiffies(MSECS));
		unsigned int samples = dev->sample - dev->sample_measured;

		dev->jiffies_next = jiffies + msecs_to_jiffies(MSECS);
		dev->sample_measured = dev->sample;
		dev_dbg(dev->dev, "slen=%u samples=%u msecs=%u sample rate=%lu\n",
				src_len, samples, msecs,
				samples * 1000UL / msecs);
	}

	/* total number of samples */
	dev->sample += src_len / 2;
}

/*
 * This gets called for the bulk stream pipe. This is done in interrupt
 * time, so it has to be fast, not crash, and not stall. Neat.
 */
static void hackrf_urb_complete_in(struct urb *urb)
{
	struct hackrf_dev *dev = urb->context;
	struct usb_interface *intf = dev->intf;
	struct hackrf_buffer *buffer;
	unsigned int len;

	dev_dbg_ratelimited(&intf->dev, "status=%d length=%u/%u\n", urb->status,
			    urb->actual_length, urb->transfer_buffer_length);

	switch (urb->status) {
	case 0:             /* success */
	case -ETIMEDOUT:    /* NAK */
		break;
	case -ECONNRESET:   /* kill */
	case -ENOENT:
	case -ESHUTDOWN:
		return;
	default:            /* error */
		dev_err_ratelimited(&intf->dev, "URB failed %d\n", urb->status);
		goto exit_usb_submit_urb;
	}

	/* get buffer to write */
	buffer = hackrf_get_next_buffer(dev, &dev->rx_buffer_list);
	if (unlikely(buffer == NULL)) {
		dev->vb_full++;
		dev_notice_ratelimited(&intf->dev,
				       "buffer is full - %u packets dropped\n",
				       dev->vb_full);
		goto exit_usb_submit_urb;
	}

	len = min_t(unsigned long, vb2_plane_size(&buffer->vb.vb2_buf, 0),
		    urb->actual_length);
	hackrf_copy_stream(dev, vb2_plane_vaddr(&buffer->vb.vb2_buf, 0),
		    urb->transfer_buffer, len);
	vb2_set_plane_payload(&buffer->vb.vb2_buf, 0, len);
	buffer->vb.sequence = dev->sequence++;
	buffer->vb.vb2_buf.timestamp = ktime_get_ns();
	vb2_buffer_done(&buffer->vb.vb2_buf, VB2_BUF_STATE_DONE);
exit_usb_submit_urb:
	usb_submit_urb(urb, GFP_ATOMIC);
}

static void hackrf_urb_complete_out(struct urb *urb)
{
	struct hackrf_dev *dev = urb->context;
	struct usb_interface *intf = dev->intf;
	struct hackrf_buffer *buffer;
	unsigned int len;

	dev_dbg_ratelimited(&intf->dev, "status=%d length=%u/%u\n", urb->status,
			    urb->actual_length, urb->transfer_buffer_length);

	switch (urb->status) {
	case 0:             /* success */
	case -ETIMEDOUT:    /* NAK */
		break;
	case -ECONNRESET:   /* kill */
	case -ENOENT:
	case -ESHUTDOWN:
		return;
	default:            /* error */
		dev_err_ratelimited(&intf->dev, "URB failed %d\n", urb->status);
	}

	/* get buffer to read */
	buffer = hackrf_get_next_buffer(dev, &dev->tx_buffer_list);
	if (unlikely(buffer == NULL)) {
		dev->vb_empty++;
		dev_notice_ratelimited(&intf->dev,
				       "buffer is empty - %u packets dropped\n",
				       dev->vb_empty);
		urb->actual_length = 0;
		goto exit_usb_submit_urb;
	}

	len = min_t(unsigned long, urb->transfer_buffer_length,
		    vb2_get_plane_payload(&buffer->vb.vb2_buf, 0));
	hackrf_copy_stream(dev, urb->transfer_buffer,
			   vb2_plane_vaddr(&buffer->vb.vb2_buf, 0), len);
	urb->actual_length = len;
	buffer->vb.sequence = dev->sequence++;
	buffer->vb.vb2_buf.timestamp = ktime_get_ns();
	vb2_buffer_done(&buffer->vb.vb2_buf, VB2_BUF_STATE_DONE);
exit_usb_submit_urb:
	usb_submit_urb(urb, GFP_ATOMIC);
}

static int hackrf_kill_urbs(struct hackrf_dev *dev)
{
	int i;

	for (i = dev->urbs_submitted - 1; i >= 0; i--) {
		dev_dbg(dev->dev, "kill urb=%d\n", i);
		/* stop the URB */
		usb_kill_urb(dev->urb_list[i]);
	}
	dev->urbs_submitted = 0;

	return 0;
}

static int hackrf_submit_urbs(struct hackrf_dev *dev)
{
	int i, ret;

	for (i = 0; i < dev->urbs_initialized; i++) {
		dev_dbg(dev->dev, "submit urb=%d\n", i);
		ret = usb_submit_urb(dev->urb_list[i], GFP_KERNEL);
		if (ret) {
			dev_err(dev->dev, "Could not submit URB no. %d - get them all back\n",
					i);
			hackrf_kill_urbs(dev);
			return ret;
		}
		dev->urbs_submitted++;
	}

	return 0;
}

static int hackrf_free_stream_bufs(struct hackrf_dev *dev)
{
	if (dev->flags & USB_STATE_URB_BUF) {
		while (dev->buf_num) {
			dev->buf_num--;
			dev_dbg(dev->dev, "free buf=%d\n", dev->buf_num);
			usb_free_coherent(dev->udev, dev->buf_size,
					  dev->buf_list[dev->buf_num],
					  dev->dma_addr[dev->buf_num]);
		}
	}
	dev->flags &= ~USB_STATE_URB_BUF;

	return 0;
}

static int hackrf_alloc_stream_bufs(struct hackrf_dev *dev)
{
	dev->buf_num = 0;
	dev->buf_size = BULK_BUFFER_SIZE;

	dev_dbg(dev->dev, "all in all I will use %u bytes for streaming\n",
			MAX_BULK_BUFS * BULK_BUFFER_SIZE);

	for (dev->buf_num = 0; dev->buf_num < MAX_BULK_BUFS; dev->buf_num++) {
		dev->buf_list[dev->buf_num] = usb_alloc_coherent(dev->udev,
				BULK_BUFFER_SIZE, GFP_KERNEL,
				&dev->dma_addr[dev->buf_num]);
		if (!dev->buf_list[dev->buf_num]) {
			dev_dbg(dev->dev, "alloc buf=%d failed\n",
					dev->buf_num);
			hackrf_free_stream_bufs(dev);
			return -ENOMEM;
		}

		dev_dbg(dev->dev, "alloc buf=%d %p (dma %llu)\n", dev->buf_num,
				dev->buf_list[dev->buf_num],
				(long long)dev->dma_addr[dev->buf_num]);
		dev->flags |= USB_STATE_URB_BUF;
	}

	return 0;
}

static int hackrf_free_urbs(struct hackrf_dev *dev)
{
	int i;

	hackrf_kill_urbs(dev);

	for (i = dev->urbs_initialized - 1; i >= 0; i--) {
		if (dev->urb_list[i]) {
			dev_dbg(dev->dev, "free urb=%d\n", i);
			/* free the URBs */
			usb_free_urb(dev->urb_list[i]);
		}
	}
	dev->urbs_initialized = 0;

	return 0;
}

static int hackrf_alloc_urbs(struct hackrf_dev *dev, bool rcv)
{
	int i, j;
	unsigned int pipe;
	usb_complete_t complete;

	if (rcv) {
		pipe = usb_rcvbulkpipe(dev->udev, 0x81);
		complete = &hackrf_urb_complete_in;
	} else {
		pipe = usb_sndbulkpipe(dev->udev, 0x02);
		complete = &hackrf_urb_complete_out;
	}

	/* allocate the URBs */
	for (i = 0; i < MAX_BULK_BUFS; i++) {
		dev_dbg(dev->dev, "alloc urb=%d\n", i);
		dev->urb_list[i] = usb_alloc_urb(0, GFP_KERNEL);
		if (!dev->urb_list[i]) {
			for (j = 0; j < i; j++)
				usb_free_urb(dev->urb_list[j]);
			return -ENOMEM;
		}
		usb_fill_bulk_urb(dev->urb_list[i],
				dev->udev,
				pipe,
				dev->buf_list[i],
				BULK_BUFFER_SIZE,
				complete, dev);

		dev->urb_list[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
		dev->urb_list[i]->transfer_dma = dev->dma_addr[i];
		dev->urbs_initialized++;
	}

	return 0;
}

/* The user yanked out the cable... */
static void hackrf_disconnect(struct usb_interface *intf)
{
	struct v4l2_device *v = usb_get_intfdata(intf);
	struct hackrf_dev *dev = container_of(v, struct hackrf_dev, v4l2_dev);

	dev_dbg(dev->dev, "\n");

	mutex_lock(&dev->vb_queue_lock);
	mutex_lock(&dev->v4l2_lock);
	/* No need to keep the urbs around after disconnection */
	dev->udev = NULL;
	v4l2_device_disconnect(&dev->v4l2_dev);
	video_unregister_device(&dev->tx_vdev);
	video_unregister_device(&dev->rx_vdev);
	mutex_unlock(&dev->v4l2_lock);
	mutex_unlock(&dev->vb_queue_lock);

	v4l2_device_put(&dev->v4l2_dev);
}

/* Videobuf2 operations */
static void hackrf_return_all_buffers(struct vb2_queue *vq,
				      enum vb2_buffer_state state)
{
	struct hackrf_dev *dev = vb2_get_drv_priv(vq);
	struct usb_interface *intf = dev->intf;
	struct hackrf_buffer *buffer, *node;
	struct list_head *buffer_list;
	unsigned long flags;

	dev_dbg(&intf->dev, "\n");

	if (vq->type == V4L2_BUF_TYPE_SDR_CAPTURE)
		buffer_list = &dev->rx_buffer_list;
	else
		buffer_list = &dev->tx_buffer_list;

	spin_lock_irqsave(&dev->buffer_list_lock, flags);
	list_for_each_entry_safe(buffer, node, buffer_list, list) {
		dev_dbg(&intf->dev, "list_for_each_entry_safe\n");
		vb2_buffer_done(&buffer->vb.vb2_buf, state);
		list_del(&buffer->list);
	}
	spin_unlock_irqrestore(&dev->buffer_list_lock, flags);
}

static int hackrf_queue_setup(struct vb2_queue *vq,
		unsigned int *nbuffers,
		unsigned int *nplanes, unsigned int sizes[], struct device *alloc_devs[])
{
	struct hackrf_dev *dev = vb2_get_drv_priv(vq);
	unsigned int q_num_bufs = vb2_get_num_buffers(vq);

	dev_dbg(dev->dev, "nbuffers=%d\n", *nbuffers);

	/* Need at least 8 buffers */
	if (q_num_bufs + *nbuffers < 8)
		*nbuffers = 8 - q_num_bufs;
	*nplanes = 1;
	sizes[0] = PAGE_ALIGN(dev->buffersize);

	dev_dbg(dev->dev, "nbuffers=%d sizes[0]=%d\n", *nbuffers, sizes[0]);
	return 0;
}

static void hackrf_buf_queue(struct vb2_buffer *vb)
{
	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
	struct vb2_queue *vq = vb->vb2_queue;
	struct hackrf_dev *dev = vb2_get_drv_priv(vq);
	struct hackrf_buffer *buffer = container_of(vbuf, struct hackrf_buffer, vb);
	struct list_head *buffer_list;
	unsigned long flags;

	dev_dbg_ratelimited(&dev->intf->dev, "\n");

	if (vq->type == V4L2_BUF_TYPE_SDR_CAPTURE)
		buffer_list = &dev->rx_buffer_list;
	else
		buffer_list = &dev->tx_buffer_list;

	spin_lock_irqsave(&dev->buffer_list_lock, flags);
	list_add_tail(&buffer->list, buffer_list);
	spin_unlock_irqrestore(&dev->buffer_list_lock, flags);
}

static int hackrf_start_streaming(struct vb2_queue *vq, unsigned int count)
{
	struct hackrf_dev *dev = vb2_get_drv_priv(vq);
	struct usb_interface *intf = dev->intf;
	int ret;
	unsigned int mode;

	dev_dbg(&intf->dev, "count=%i\n", count);

	mutex_lock(&dev->v4l2_lock);

	/* Allow only RX or TX, not both same time */
	if (vq->type == V4L2_BUF_TYPE_SDR_CAPTURE) {
		if (test_bit(TX_ON, &dev->flags)) {
			ret = -EBUSY;
			goto err_hackrf_return_all_buffers;
		}

		mode = 1;
		set_bit(RX_ON, &dev->flags);
	} else {
		if (test_bit(RX_ON, &dev->flags)) {
			ret = -EBUSY;
			goto err_hackrf_return_all_buffers;
		}

		mode = 2;
		set_bit(TX_ON, &dev->flags);
	}

	dev->sequence = 0;

	ret = hackrf_alloc_stream_bufs(dev);
	if (ret)
		goto err;

	ret = hackrf_alloc_urbs(dev, (mode == 1));
	if (ret)
		goto err;

	ret = hackrf_submit_urbs(dev);
	if (ret)
		goto err;

	ret = hackrf_set_params(dev);
	if (ret)
		goto err;

	/* start hardware streaming */
	ret = hackrf_ctrl_msg(dev, CMD_SET_TRANSCEIVER_MODE, mode, 0, NULL, 0);
	if (ret)
		goto err;

	mutex_unlock(&dev->v4l2_lock);

	return 0;
err:
	hackrf_kill_urbs(dev);
	hackrf_free_urbs(dev);
	hackrf_free_stream_bufs(dev);
	clear_bit(RX_ON, &dev->flags);
	clear_bit(TX_ON, &dev->flags);
err_hackrf_return_all_buffers:
	hackrf_return_all_buffers(vq, VB2_BUF_STATE_QUEUED);
	mutex_unlock(&dev->v4l2_lock);
	dev_dbg(&intf->dev, "failed=%d\n", ret);
	return ret;
}

static void hackrf_stop_streaming(struct vb2_queue *vq)
{
	struct hackrf_dev *dev = vb2_get_drv_priv(vq);
	struct usb_interface *intf = dev->intf;

	dev_dbg(&intf->dev, "\n");

	mutex_lock(&dev->v4l2_lock);

	/* stop hardware streaming */
	hackrf_ctrl_msg(dev, CMD_SET_TRANSCEIVER_MODE, 0, 0, NULL, 0);

	hackrf_kill_urbs(dev);
	hackrf_free_urbs(dev);
	hackrf_free_stream_bufs(dev);

	hackrf_return_all_buffers(vq, VB2_BUF_STATE_ERROR);

	if (vq->type == V4L2_BUF_TYPE_SDR_CAPTURE)
		clear_bit(RX_ON, &dev->flags);
	else
		clear_bit(TX_ON, &dev->flags);

	mutex_unlock(&dev->v4l2_lock);
}

static const struct vb2_ops hackrf_vb2_ops = {
	.queue_setup            = hackrf_queue_setup,
	.buf_queue              = hackrf_buf_queue,
	.start_streaming        = hackrf_start_streaming,
	.stop_streaming         = hackrf_stop_streaming,
};

static int hackrf_querycap(struct file *file, void *fh,
		struct v4l2_capability *cap)
{
	struct hackrf_dev *dev = video_drvdata(file);
	struct usb_interface *intf = dev->intf;

	dev_dbg(&intf->dev, "\n");

	cap->capabilities = V4L2_CAP_SDR_CAPTURE | V4L2_CAP_TUNER |
			    V4L2_CAP_SDR_OUTPUT | V4L2_CAP_MODULATOR |
			    V4L2_CAP_STREAMING | V4L2_CAP_READWRITE |
			    V4L2_CAP_DEVICE_CAPS;
	strscpy(cap->driver, KBUILD_MODNAME, sizeof(cap->driver));
	strscpy(cap->card, dev->rx_vdev.name, sizeof(cap->card));
	usb_make_path(dev->udev, cap->bus_info, sizeof(cap->bus_info));

	return 0;
}

static int hackrf_s_fmt_sdr(struct file *file, void *priv,
			    struct v4l2_format *f)
{
	struct hackrf_dev *dev = video_drvdata(file);
	struct video_device *vdev = video_devdata(file);
	struct vb2_queue *q;
	int i;

	dev_dbg(dev->dev, "pixelformat fourcc %4.4s\n",
			(char *)&f->fmt.sdr.pixelformat);

	if (vdev->vfl_dir == VFL_DIR_RX)
		q = &dev->rx_vb2_queue;
	else
		q = &dev->tx_vb2_queue;

	if (vb2_is_busy(q))
		return -EBUSY;

	for (i = 0; i < NUM_FORMATS; i++) {
		if (f->fmt.sdr.pixelformat == formats[i].pixelformat) {
			dev->pixelformat = formats[i].pixelformat;
			dev->buffersize = formats[i].buffersize;
			f->fmt.sdr.buffersize = formats[i].buffersize;
			return 0;
		}
	}

	dev->pixelformat = formats[0].pixelformat;
	dev->buffersize = formats[0].buffersize;
	f->fmt.sdr.pixelformat = formats[0].pixelformat;
	f->fmt.sdr.buffersize = formats[0].buffersize;

	return 0;
}

static int hackrf_g_fmt_sdr(struct file *file, void *priv,
			    struct v4l2_format *f)
{
	struct hackrf_dev *dev = video_drvdata(file);

	dev_dbg(dev->dev, "pixelformat fourcc %4.4s\n",
			(char *)&dev->pixelformat);

	f->fmt.sdr.pixelformat = dev->pixelformat;
	f->fmt.sdr.buffersize = dev->buffersize;

	return 0;
}

static int hackrf_try_fmt_sdr(struct file *file, void *priv,
			      struct v4l2_format *f)
{
	struct hackrf_dev *dev = video_drvdata(file);
	int i;

	dev_dbg(dev->dev, "pixelformat fourcc %4.4s\n",
			(char *)&f->fmt.sdr.pixelformat);

	for (i = 0; i < NUM_FORMATS; i++) {
		if (formats[i].pixelformat == f->fmt.sdr.pixelformat) {
			f->fmt.sdr.buffersize = formats[i].buffersize;
			return 0;
		}
	}

	f->fmt.sdr.pixelformat = formats[0].pixelformat;
	f->fmt.sdr.buffersize = formats[0].buffersize;

	return 0;
}

static int hackrf_enum_fmt_sdr(struct file *file, void *priv,
			       struct v4l2_fmtdesc *f)
{
	struct hackrf_dev *dev = video_drvdata(file);

	dev_dbg(dev->dev, "index=%d\n", f->index);

	if (f->index >= NUM_FORMATS)
		return -EINVAL;

	f->pixelformat = formats[f->index].pixelformat;

	return 0;
}

static int hackrf_s_tuner(struct file *file, void *priv,
		const struct v4l2_tuner *v)
{
	struct hackrf_dev *dev = video_drvdata(file);
	int ret;

	dev_dbg(dev->dev, "index=%d\n", v->index);

	if (v->index == 0)
		ret = 0;
	else if (v->index == 1)
		ret = 0;
	else
		ret = -EINVAL;

	return ret;
}

static int hackrf_g_tuner(struct file *file, void *priv, struct v4l2_tuner *v)
{
	struct hackrf_dev *dev = video_drvdata(file);
	int ret;

	dev_dbg(dev->dev, "index=%d\n", v->index);

	if (v->index == 0) {
		strscpy(v->name, "HackRF ADC", sizeof(v->name));
		v->type = V4L2_TUNER_SDR;
		v->capability = V4L2_TUNER_CAP_1HZ | V4L2_TUNER_CAP_FREQ_BANDS;
		v->rangelow  = bands_adc_dac[0].rangelow;
		v->rangehigh = bands_adc_dac[0].rangehigh;
		ret = 0;
	} else if (v->index == 1) {
		strscpy(v->name, "HackRF RF", sizeof(v->name));
		v->type = V4L2_TUNER_RF;
		v->capability = V4L2_TUNER_CAP_1HZ | V4L2_TUNER_CAP_FREQ_BANDS;
		v->rangelow  = bands_rx_tx[0].rangelow;
		v->rangehigh = bands_rx_tx[0].rangehigh;
		ret = 0;
	} else {
		ret = -EINVAL;
	}

	return ret;
}

static int hackrf_s_modulator(struct file *file, void *fh,
			      const struct v4l2_modulator *a)
{
	struct hackrf_dev *dev = video_drvdata(file);

	dev_dbg(dev->dev, "index=%d\n", a->index);

	return a->index > 1 ? -EINVAL : 0;
}

static int hackrf_g_modulator(struct file *file, void *fh,
			      struct v4l2_modulator *a)
{
	struct hackrf_dev *dev = video_drvdata(file);
	int ret;

	dev_dbg(dev->dev, "index=%d\n", a->index);

	if (a->index == 0) {
		strscpy(a->name, "HackRF DAC", sizeof(a->name));
		a->type = V4L2_TUNER_SDR;
		a->capability = V4L2_TUNER_CAP_1HZ | V4L2_TUNER_CAP_FREQ_BANDS;
		a->rangelow  = bands_adc_dac[0].rangelow;
		a->rangehigh = bands_adc_dac[0].rangehigh;
		ret = 0;
	} else if (a->index == 1) {
		strscpy(a->name, "HackRF RF", sizeof(a->name));
		a->type = V4L2_TUNER_RF;
		a->capability = V4L2_TUNER_CAP_1HZ | V4L2_TUNER_CAP_FREQ_BANDS;
		a->rangelow  = bands_rx_tx[0].rangelow;
		a->rangehigh = bands_rx_tx[0].rangehigh;
		ret = 0;
	} else {
		ret = -EINVAL;
	}

	return ret;
}

static int hackrf_s_frequency(struct file *file, void *priv,
		const struct v4l2_frequency *f)
{
	struct hackrf_dev *dev = video_drvdata(file);
	struct usb_interface *intf = dev->intf;
	struct video_device *vdev = video_devdata(file);
	int ret;
	unsigned int uitmp;

	dev_dbg(&intf->dev, "tuner=%d type=%d frequency=%u\n",
			f->tuner, f->type, f->frequency);

	if (f->tuner == 0) {
		uitmp = clamp(f->frequency, bands_adc_dac[0].rangelow,
			      bands_adc_dac[0].rangehigh);
		if (vdev->vfl_dir == VFL_DIR_RX) {
			dev->f_adc = uitmp;
			set_bit(RX_ADC_FREQUENCY, &dev->flags);
		} else {
			dev->f_dac = uitmp;
			set_bit(TX_DAC_FREQUENCY, &dev->flags);
		}
	} else if (f->tuner == 1) {
		uitmp = clamp(f->frequency, bands_rx_tx[0].rangelow,
			      bands_rx_tx[0].rangehigh);
		if (vdev->vfl_dir == VFL_DIR_RX) {
			dev->f_rx = uitmp;
			set_bit(RX_RF_FREQUENCY, &dev->flags);
		} else {
			dev->f_tx = uitmp;
			set_bit(TX_RF_FREQUENCY, &dev->flags);
		}
	} else {
		ret = -EINVAL;
		goto err;
	}

	ret = hackrf_set_params(dev);
	if (ret)
		goto err;

	return 0;
err:
	dev_dbg(&intf->dev, "failed=%d\n", ret);
	return ret;
}

static int hackrf_g_frequency(struct file *file, void *priv,
		struct v4l2_frequency *f)
{
	struct hackrf_dev *dev = video_drvdata(file);
	struct usb_interface *intf = dev->intf;
	struct video_device *vdev = video_devdata(file);
	int ret;

	dev_dbg(dev->dev, "tuner=%d type=%d\n", f->tuner, f->type);

	if (f->tuner == 0) {
		f->type = V4L2_TUNER_SDR;
		if (vdev->vfl_dir == VFL_DIR_RX)
			f->frequency = dev->f_adc;
		else
			f->frequency = dev->f_dac;
	} else if (f->tuner == 1) {
		f->type = V4L2_TUNER_RF;
		if (vdev->vfl_dir == VFL_DIR_RX)
			f->frequency = dev->f_rx;
		else
			f->frequency = dev->f_tx;
	} else {
		ret = -EINVAL;
		goto err;
	}

	return 0;
err:
	dev_dbg(&intf->dev, "failed=%d\n", ret);
	return ret;
}

static int hackrf_enum_freq_bands(struct file *file, void *priv,
		struct v4l2_frequency_band *band)
{
	struct hackrf_dev *dev = video_drvdata(file);
	int ret;

	dev_dbg(dev->dev, "tuner=%d type=%d index=%d\n",
			band->tuner, band->type, band->index);

	if (band->tuner == 0) {
		if (band->index >= ARRAY_SIZE(bands_adc_dac)) {
			ret = -EINVAL;
		} else {
			*band = bands_adc_dac[band->index];
			ret = 0;
		}
	} else if (band->tuner == 1) {
		if (band->index >= ARRAY_SIZE(bands_rx_tx)) {
			ret = -EINVAL;
		} else {
			*band = bands_rx_tx[band->index];
			ret = 0;
		}
	} else {
		ret = -EINVAL;
	}

	return ret;
}

static const struct v4l2_ioctl_ops hackrf_ioctl_ops = {
	.vidioc_querycap          = hackrf_querycap,

	.vidioc_s_fmt_sdr_cap     = hackrf_s_fmt_sdr,
	.vidioc_g_fmt_sdr_cap     = hackrf_g_fmt_sdr,
	.vidioc_enum_fmt_sdr_cap  = hackrf_enum_fmt_sdr,
	.vidioc_try_fmt_sdr_cap   = hackrf_try_fmt_sdr,

	.vidioc_s_fmt_sdr_out     = hackrf_s_fmt_sdr,
	.vidioc_g_fmt_sdr_out     = hackrf_g_fmt_sdr,
	.vidioc_enum_fmt_sdr_out  = hackrf_enum_fmt_sdr,
	.vidioc_try_fmt_sdr_out   = hackrf_try_fmt_sdr,

	.vidioc_reqbufs           = vb2_ioctl_reqbufs,
	.vidioc_create_bufs       = vb2_ioctl_create_bufs,
	.vidioc_prepare_buf       = vb2_ioctl_prepare_buf,
	.vidioc_querybuf          = vb2_ioctl_querybuf,
	.vidioc_qbuf              = vb2_ioctl_qbuf,
	.vidioc_dqbuf             = vb2_ioctl_dqbuf,
	.vidioc_expbuf            = vb2_ioctl_expbuf,

	.vidioc_streamon          = vb2_ioctl_streamon,
	.vidioc_streamoff         = vb2_ioctl_streamoff,

	.vidioc_s_tuner           = hackrf_s_tuner,
	.vidioc_g_tuner           = hackrf_g_tuner,

	.vidioc_s_modulator       = hackrf_s_modulator,
	.vidioc_g_modulator       = hackrf_g_modulator,

	.vidioc_s_frequency       = hackrf_s_frequency,
	.vidioc_g_frequency       = hackrf_g_frequency,
	.vidioc_enum_freq_bands   = hackrf_enum_freq_bands,

	.vidioc_subscribe_event   = v4l2_ctrl_subscribe_event,
	.vidioc_unsubscribe_event = v4l2_event_unsubscribe,
	.vidioc_log_status        = v4l2_ctrl_log_status,
};

static const struct v4l2_file_operations hackrf_fops = {
	.owner                    = THIS_MODULE,
	.open                     = v4l2_fh_open,
	.release                  = vb2_fop_release,
	.read                     = vb2_fop_read,
	.write                    = vb2_fop_write,
	.poll                     = vb2_fop_poll,
	.mmap                     = vb2_fop_mmap,
	.unlocked_ioctl           = video_ioctl2,
};

static const struct video_device hackrf_template = {
	.name                     = "HackRF One",
	.release                  = video_device_release_empty,
	.fops                     = &hackrf_fops,
	.ioctl_ops                = &hackrf_ioctl_ops,
};

static void hackrf_video_release(struct v4l2_device *v)
{
	struct hackrf_dev *dev = container_of(v, struct hackrf_dev, v4l2_dev);

	dev_dbg(dev->dev, "\n");

	v4l2_ctrl_handler_free(&dev->rx_ctrl_handler);
	v4l2_ctrl_handler_free(&dev->tx_ctrl_handler);
	v4l2_device_unregister(&dev->v4l2_dev);
	kfree(dev);
}

static int hackrf_s_ctrl_rx(struct v4l2_ctrl *ctrl)
{
	struct hackrf_dev *dev = container_of(ctrl->handler,
			struct hackrf_dev, rx_ctrl_handler);
	struct usb_interface *intf = dev->intf;
	int ret;

	switch (ctrl->id) {
	case V4L2_CID_RF_TUNER_BANDWIDTH_AUTO:
	case V4L2_CID_RF_TUNER_BANDWIDTH:
		set_bit(RX_BANDWIDTH, &dev->flags);
		break;
	case  V4L2_CID_RF_TUNER_RF_GAIN:
		set_bit(RX_RF_GAIN, &dev->flags);
		break;
	case  V4L2_CID_RF_TUNER_LNA_GAIN:
		set_bit(RX_LNA_GAIN, &dev->flags);
		break;
	case  V4L2_CID_RF_TUNER_IF_GAIN:
		set_bit(RX_IF_GAIN, &dev->flags);
		break;
	default:
		dev_dbg(&intf->dev, "unknown ctrl: id=%d name=%s\n",
			ctrl->id, ctrl->name);
		ret = -EINVAL;
		goto err;
	}

	ret = hackrf_set_params(dev);
	if (ret)
		goto err;

	return 0;
err:
	dev_dbg(&intf->dev, "failed=%d\n", ret);
	return ret;
}

static int hackrf_s_ctrl_tx(struct v4l2_ctrl *ctrl)
{
	struct hackrf_dev *dev = container_of(ctrl->handler,
			struct hackrf_dev, tx_ctrl_handler);
	struct usb_interface *intf = dev->intf;
	int ret;

	switch (ctrl->id) {
	case V4L2_CID_RF_TUNER_BANDWIDTH_AUTO:
	case V4L2_CID_RF_TUNER_BANDWIDTH:
		set_bit(TX_BANDWIDTH, &dev->flags);
		break;
	case  V4L2_CID_RF_TUNER_LNA_GAIN:
		set_bit(TX_LNA_GAIN, &dev->flags);
		break;
	case  V4L2_CID_RF_TUNER_RF_GAIN:
		set_bit(TX_RF_GAIN, &dev->flags);
		break;
	default:
		dev_dbg(&intf->dev, "unknown ctrl: id=%d name=%s\n",
			ctrl->id, ctrl->name);
		ret = -EINVAL;
		goto err;
	}

	ret = hackrf_set_params(dev);
	if (ret)
		goto err;

	return 0;
err:
	dev_dbg(&intf->dev, "failed=%d\n", ret);
	return ret;
}

static const struct v4l2_ctrl_ops hackrf_ctrl_ops_rx = {
	.s_ctrl = hackrf_s_ctrl_rx,
};

static const struct v4l2_ctrl_ops hackrf_ctrl_ops_tx = {
	.s_ctrl = hackrf_s_ctrl_tx,
};

static int hackrf_probe(struct usb_interface *intf,
		const struct usb_device_id *id)
{
	struct hackrf_dev *dev;
	int ret;
	u8 u8tmp, buf[BUF_SIZE];

	dev = kzalloc_obj(*dev);
	if (!dev) {
		ret = -ENOMEM;
		goto err;
	}

	mutex_init(&dev->v4l2_lock);
	mutex_init(&dev->vb_queue_lock);
	spin_lock_init(&dev->buffer_list_lock);
	INIT_LIST_HEAD(&dev->rx_buffer_list);
	INIT_LIST_HEAD(&dev->tx_buffer_list);
	dev->intf = intf;
	dev->dev = &intf->dev;
	dev->udev = interface_to_usbdev(intf);
	dev->pixelformat = formats[0].pixelformat;
	dev->buffersize = formats[0].buffersize;
	dev->f_adc = bands_adc_dac[0].rangelow;
	dev->f_dac = bands_adc_dac[0].rangelow;
	dev->f_rx = bands_rx_tx[0].rangelow;
	dev->f_tx = bands_rx_tx[0].rangelow;
	set_bit(RX_ADC_FREQUENCY, &dev->flags);
	set_bit(TX_DAC_FREQUENCY, &dev->flags);
	set_bit(RX_RF_FREQUENCY, &dev->flags);
	set_bit(TX_RF_FREQUENCY, &dev->flags);

	/* Detect device */
	ret = hackrf_ctrl_msg(dev, CMD_BOARD_ID_READ, 0, 0, &u8tmp, 1);
	if (ret == 0)
		ret = hackrf_ctrl_msg(dev, CMD_VERSION_STRING_READ, 0, 0,
				buf, BUF_SIZE);
	if (ret) {
		dev_err(dev->dev, "Could not detect board\n");
		goto err_kfree;
	}

	buf[BUF_SIZE - 1] = '\0';
	dev_info(dev->dev, "Board ID: %02x\n", u8tmp);
	dev_info(dev->dev, "Firmware version: %s\n", buf);

	/* Init vb2 queue structure for receiver */
	dev->rx_vb2_queue.type = V4L2_BUF_TYPE_SDR_CAPTURE;
	dev->rx_vb2_queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF |
				     VB2_READ;
	dev->rx_vb2_queue.ops = &hackrf_vb2_ops;
	dev->rx_vb2_queue.mem_ops = &vb2_vmalloc_memops;
	dev->rx_vb2_queue.drv_priv = dev;
	dev->rx_vb2_queue.buf_struct_size = sizeof(struct hackrf_buffer);
	dev->rx_vb2_queue.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
	dev->rx_vb2_queue.lock = &dev->vb_queue_lock;
	ret = vb2_queue_init(&dev->rx_vb2_queue);
	if (ret) {
		dev_err(dev->dev, "Could not initialize rx vb2 queue\n");
		goto err_kfree;
	}

	/* Init vb2 queue structure for transmitter */
	dev->tx_vb2_queue.type = V4L2_BUF_TYPE_SDR_OUTPUT;
	dev->tx_vb2_queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF |
				     VB2_WRITE;
	dev->tx_vb2_queue.ops = &hackrf_vb2_ops;
	dev->tx_vb2_queue.mem_ops = &vb2_vmalloc_memops;
	dev->tx_vb2_queue.drv_priv = dev;
	dev->tx_vb2_queue.buf_struct_size = sizeof(struct hackrf_buffer);
	dev->tx_vb2_queue.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
	dev->tx_vb2_queue.lock = &dev->vb_queue_lock;
	ret = vb2_queue_init(&dev->tx_vb2_queue);
	if (ret) {
		dev_err(dev->dev, "Could not initialize tx vb2 queue\n");
		goto err_kfree;
	}

	/* Register controls for receiver */
	v4l2_ctrl_handler_init(&dev->rx_ctrl_handler, 5);
	dev->rx_bandwidth_auto = v4l2_ctrl_new_std(&dev->rx_ctrl_handler,
		&hackrf_ctrl_ops_rx, V4L2_CID_RF_TUNER_BANDWIDTH_AUTO,
		0, 1, 0, 1);
	dev->rx_bandwidth = v4l2_ctrl_new_std(&dev->rx_ctrl_handler,
		&hackrf_ctrl_ops_rx, V4L2_CID_RF_TUNER_BANDWIDTH,
		1750000, 28000000, 50000, 1750000);
	v4l2_ctrl_auto_cluster(2, &dev->rx_bandwidth_auto, 0, false);
	dev->rx_rf_gain = v4l2_ctrl_new_std(&dev->rx_ctrl_handler,
		&hackrf_ctrl_ops_rx, V4L2_CID_RF_TUNER_RF_GAIN, 0, 12, 12, 0);
	dev->rx_lna_gain = v4l2_ctrl_new_std(&dev->rx_ctrl_handler,
		&hackrf_ctrl_ops_rx, V4L2_CID_RF_TUNER_LNA_GAIN, 0, 40, 8, 0);
	dev->rx_if_gain = v4l2_ctrl_new_std(&dev->rx_ctrl_handler,
		&hackrf_ctrl_ops_rx, V4L2_CID_RF_TUNER_IF_GAIN, 0, 62, 2, 0);
	if (dev->rx_ctrl_handler.error) {
		ret = dev->rx_ctrl_handler.error;
		dev_err(dev->dev, "Could not initialize controls\n");
		goto err_v4l2_ctrl_handler_free_rx;
	}
	v4l2_ctrl_grab(dev->rx_rf_gain, !hackrf_enable_rf_gain_ctrl);
	v4l2_ctrl_handler_setup(&dev->rx_ctrl_handler);

	/* Register controls for transmitter */
	v4l2_ctrl_handler_init(&dev->tx_ctrl_handler, 4);
	dev->tx_bandwidth_auto = v4l2_ctrl_new_std(&dev->tx_ctrl_handler,
		&hackrf_ctrl_ops_tx, V4L2_CID_RF_TUNER_BANDWIDTH_AUTO,
		0, 1, 0, 1);
	dev->tx_bandwidth = v4l2_ctrl_new_std(&dev->tx_ctrl_handler,
		&hackrf_ctrl_ops_tx, V4L2_CID_RF_TUNER_BANDWIDTH,
		1750000, 28000000, 50000, 1750000);
	v4l2_ctrl_auto_cluster(2, &dev->tx_bandwidth_auto, 0, false);
	dev->tx_lna_gain = v4l2_ctrl_new_std(&dev->tx_ctrl_handler,
		&hackrf_ctrl_ops_tx, V4L2_CID_RF_TUNER_LNA_GAIN, 0, 47, 1, 0);
	dev->tx_rf_gain = v4l2_ctrl_new_std(&dev->tx_ctrl_handler,
		&hackrf_ctrl_ops_tx, V4L2_CID_RF_TUNER_RF_GAIN, 0, 15, 15, 0);
	if (dev->tx_ctrl_handler.error) {
		ret = dev->tx_ctrl_handler.error;
		dev_err(dev->dev, "Could not initialize controls\n");
		goto err_v4l2_ctrl_handler_free_tx;
	}
	v4l2_ctrl_grab(dev->tx_rf_gain, !hackrf_enable_rf_gain_ctrl);
	v4l2_ctrl_handler_setup(&dev->tx_ctrl_handler);

	/* Register the v4l2_device structure */
	dev->v4l2_dev.release = hackrf_video_release;
	ret = v4l2_device_register(&intf->dev, &dev->v4l2_dev);
	if (ret) {
		dev_err(dev->dev, "Failed to register v4l2-device (%d)\n", ret);
		goto err_v4l2_ctrl_handler_free_tx;
	}

	/* Init video_device structure for receiver */
	dev->rx_vdev = hackrf_template;
	dev->rx_vdev.queue = &dev->rx_vb2_queue;
	dev->rx_vdev.v4l2_dev = &dev->v4l2_dev;
	dev->rx_vdev.ctrl_handler = &dev->rx_ctrl_handler;
	dev->rx_vdev.lock = &dev->v4l2_lock;
	dev->rx_vdev.vfl_dir = VFL_DIR_RX;
	dev->rx_vdev.device_caps = V4L2_CAP_STREAMING | V4L2_CAP_READWRITE |
				   V4L2_CAP_SDR_CAPTURE | V4L2_CAP_TUNER;
	video_set_drvdata(&dev->rx_vdev, dev);
	ret = video_register_device(&dev->rx_vdev, VFL_TYPE_SDR, -1);
	if (ret) {
		dev_err(dev->dev,
			"Failed to register as video device (%d)\n", ret);
		goto err_v4l2_device_unregister;
	}
	dev_info(dev->dev, "Registered as %s\n",
		 video_device_node_name(&dev->rx_vdev));

	/* Init video_device structure for transmitter */
	dev->tx_vdev = hackrf_template;
	dev->tx_vdev.queue = &dev->tx_vb2_queue;
	dev->tx_vdev.v4l2_dev = &dev->v4l2_dev;
	dev->tx_vdev.ctrl_handler = &dev->tx_ctrl_handler;
	dev->tx_vdev.lock = &dev->v4l2_lock;
	dev->tx_vdev.vfl_dir = VFL_DIR_TX;
	dev->tx_vdev.device_caps = V4L2_CAP_STREAMING | V4L2_CAP_READWRITE |
				   V4L2_CAP_SDR_OUTPUT | V4L2_CAP_MODULATOR;
	video_set_drvdata(&dev->tx_vdev, dev);
	ret = video_register_device(&dev->tx_vdev, VFL_TYPE_SDR, -1);
	if (ret) {
		dev_err(dev->dev,
			"Failed to register as video device (%d)\n", ret);
		goto err_video_unregister_device_rx;
	}
	dev_info(dev->dev, "Registered as %s\n",
		 video_device_node_name(&dev->tx_vdev));

	dev_notice(dev->dev, "SDR API is still slightly experimental and functionality changes may follow\n");
	return 0;
err_video_unregister_device_rx:
	video_unregister_device(&dev->rx_vdev);
err_v4l2_device_unregister:
	v4l2_device_unregister(&dev->v4l2_dev);
err_v4l2_ctrl_handler_free_tx:
	v4l2_ctrl_handler_free(&dev->tx_ctrl_handler);
err_v4l2_ctrl_handler_free_rx:
	v4l2_ctrl_handler_free(&dev->rx_ctrl_handler);
err_kfree:
	kfree(dev);
err:
	dev_dbg(&intf->dev, "failed=%d\n", ret);
	return ret;
}

/* USB device ID list */
static const struct usb_device_id hackrf_id_table[] = {
	{ USB_DEVICE(0x1d50, 0x6089) }, /* HackRF One */
	{ }
};
MODULE_DEVICE_TABLE(usb, hackrf_id_table);

/* USB subsystem interface */
static struct usb_driver hackrf_driver = {
	.name                     = KBUILD_MODNAME,
	.probe                    = hackrf_probe,
	.disconnect               = hackrf_disconnect,
	.id_table                 = hackrf_id_table,
};

module_usb_driver(hackrf_driver);

MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
MODULE_DESCRIPTION("HackRF");
MODULE_LICENSE("GPL");
]

map[File:drivers/media/common/videobuf2/videobuf2-core.c]

map[Contents:/*
 * videobuf2-core.c - video buffer 2 core framework
 *
 * Copyright (C) 2010 Samsung Electronics
 *
 * Author: Pawel Osciak <pawel@osciak.com>
 *	   Marek Szyprowski <m.szyprowski@samsung.com>
 *
 * The vb2_thread implementation was based on code from videobuf-dvb.c:
 *	(c) 2004 Gerd Knorr <kraxel@bytesex.org> [SUSE Labs]
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation.
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/err.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/mm.h>
#include <linux/poll.h>
#include <linux/slab.h>
#include <linux/sched.h>
#include <linux/freezer.h>
#include <linux/kthread.h>

#include <media/videobuf2-core.h>
#include <media/v4l2-mc.h>

#include <trace/events/vb2.h>

#define PLANE_INDEX_BITS	3
#define PLANE_INDEX_SHIFT	(PAGE_SHIFT + PLANE_INDEX_BITS)
#define PLANE_INDEX_MASK	(BIT_MASK(PLANE_INDEX_BITS) - 1)
#define MAX_BUFFER_INDEX	BIT_MASK(30 - PLANE_INDEX_SHIFT)
#define BUFFER_INDEX_MASK	(MAX_BUFFER_INDEX - 1)

#if BIT(PLANE_INDEX_BITS) != VIDEO_MAX_PLANES
#error PLANE_INDEX_BITS order must be equal to VIDEO_MAX_PLANES
#endif

static int debug;
module_param(debug, int, 0644);

#define dprintk(q, level, fmt, arg...)					\
	do {								\
		if (debug >= level)					\
			pr_info("[%s] %s: " fmt, (q)->name, __func__,	\
				## arg);				\
	} while (0)

#ifdef CONFIG_VIDEO_ADV_DEBUG

/*
 * If advanced debugging is on, then count how often each op is called
 * successfully, which can either be per-buffer or per-queue.
 *
 * This makes it easy to check that the 'init' and 'cleanup'
 * (and variations thereof) stay balanced.
 */

#define log_memop(vb, op)						\
	dprintk((vb)->vb2_queue, 2, "call_memop(%d, %s)%s\n",		\
		(vb)->index, #op,					\
		(vb)->vb2_queue->mem_ops->op ? "" : " (nop)")

#define call_memop(vb, op, args...)					\
({									\
	struct vb2_queue *_q = (vb)->vb2_queue;				\
	int err;							\
									\
	log_memop(vb, op);						\
	err = _q->mem_ops->op ? _q->mem_ops->op(args) : 0;		\
	if (!err)							\
		(vb)->cnt_mem_ ## op++;					\
	err;								\
})

#define call_ptr_memop(op, vb, args...)					\
({									\
	struct vb2_queue *_q = (vb)->vb2_queue;				\
	void *ptr;							\
									\
	log_memop(vb, op);						\
	ptr = _q->mem_ops->op ? _q->mem_ops->op(vb, args) : NULL;	\
	if (!IS_ERR_OR_NULL(ptr))					\
		(vb)->cnt_mem_ ## op++;					\
	ptr;								\
})

#define call_void_memop(vb, op, args...)				\
({									\
	struct vb2_queue *_q = (vb)->vb2_queue;				\
									\
	log_memop(vb, op);						\
	if (_q->mem_ops->op)						\
		_q->mem_ops->op(args);					\
	(vb)->cnt_mem_ ## op++;						\
})

#define log_qop(q, op)							\
	dprintk(q, 2, "call_qop(%s)%s\n", #op,				\
		(q)->ops->op ? "" : " (nop)")

#define call_qop(q, op, args...)					\
({									\
	int err;							\
									\
	log_qop(q, op);							\
	err = (q)->ops->op ? (q)->ops->op(args) : 0;			\
	if (!err)							\
		(q)->cnt_ ## op++;					\
	err;								\
})

#define call_void_qop(q, op, args...)					\
({									\
	log_qop(q, op);							\
	if ((q)->ops->op)						\
		(q)->ops->op(args);					\
	(q)->cnt_ ## op++;						\
})

#define log_vb_qop(vb, op, args...)					\
	dprintk((vb)->vb2_queue, 2, "call_vb_qop(%d, %s)%s\n",		\
		(vb)->index, #op,					\
		(vb)->vb2_queue->ops->op ? "" : " (nop)")

#define call_vb_qop(vb, op, args...)					\
({									\
	int err;							\
									\
	log_vb_qop(vb, op);						\
	err = (vb)->vb2_queue->ops->op ?				\
		(vb)->vb2_queue->ops->op(args) : 0;			\
	if (!err)							\
		(vb)->cnt_ ## op++;					\
	err;								\
})

#define call_void_vb_qop(vb, op, args...)				\
({									\
	log_vb_qop(vb, op);						\
	if ((vb)->vb2_queue->ops->op)					\
		(vb)->vb2_queue->ops->op(args);				\
	(vb)->cnt_ ## op++;						\
})

#else

#define call_memop(vb, op, args...)					\
	((vb)->vb2_queue->mem_ops->op ?					\
		(vb)->vb2_queue->mem_ops->op(args) : 0)

#define call_ptr_memop(op, vb, args...)					\
	((vb)->vb2_queue->mem_ops->op ?					\
		(vb)->vb2_queue->mem_ops->op(vb, args) : NULL)

#define call_void_memop(vb, op, args...)				\
	do {								\
		if ((vb)->vb2_queue->mem_ops->op)			\
			(vb)->vb2_queue->mem_ops->op(args);		\
	} while (0)

#define call_qop(q, op, args...)					\
	((q)->ops->op ? (q)->ops->op(args) : 0)

#define call_void_qop(q, op, args...)					\
	do {								\
		if ((q)->ops->op)					\
			(q)->ops->op(args);				\
	} while (0)

#define call_vb_qop(vb, op, args...)					\
	((vb)->vb2_queue->ops->op ? (vb)->vb2_queue->ops->op(args) : 0)

#define call_void_vb_qop(vb, op, args...)				\
	do {								\
		if ((vb)->vb2_queue->ops->op)				\
			(vb)->vb2_queue->ops->op(args);			\
	} while (0)

#endif

#define call_bufop(q, op, args...)					\
({									\
	int ret = 0;							\
	if (q && q->buf_ops && q->buf_ops->op)				\
		ret = q->buf_ops->op(args);				\
	ret;								\
})

#define call_void_bufop(q, op, args...)					\
({									\
	if (q && q->buf_ops && q->buf_ops->op)				\
		q->buf_ops->op(args);					\
})

static void __vb2_queue_cancel(struct vb2_queue *q);

static const char *vb2_state_name(enum vb2_buffer_state s)
{
	static const char * const state_names[] = {
		[VB2_BUF_STATE_DEQUEUED] = "dequeued",
		[VB2_BUF_STATE_IN_REQUEST] = "in request",
		[VB2_BUF_STATE_PREPARING] = "preparing",
		[VB2_BUF_STATE_QUEUED] = "queued",
		[VB2_BUF_STATE_ACTIVE] = "active",
		[VB2_BUF_STATE_DONE] = "done",
		[VB2_BUF_STATE_ERROR] = "error",
	};

	if ((unsigned int)(s) < ARRAY_SIZE(state_names))
		return state_names[s];
	return "unknown";
}

/*
 * __vb2_buf_mem_alloc() - allocate video memory for the given buffer
 */
static int __vb2_buf_mem_alloc(struct vb2_buffer *vb)
{
	struct vb2_queue *q = vb->vb2_queue;
	void *mem_priv;
	int plane;
	int ret = -ENOMEM;

	/*
	 * Allocate memory for all planes in this buffer
	 * NOTE: mmapped areas should be page aligned
	 */
	for (plane = 0; plane < vb->num_planes; ++plane) {
		/* Memops alloc requires size to be page aligned. */
		unsigned long size = PAGE_ALIGN(vb->planes[plane].length);

		/* Did it wrap around? */
		if (size < vb->planes[plane].length)
			goto free;

		mem_priv = call_ptr_memop(alloc,
					  vb,
					  q->alloc_devs[plane] ? : q->dev,
					  size);
		if (IS_ERR_OR_NULL(mem_priv)) {
			if (mem_priv)
				ret = PTR_ERR(mem_priv);
			goto free;
		}

		/* Associate allocator private data with this plane */
		vb->planes[plane].mem_priv = mem_priv;
	}

	return 0;
free:
	/* Free already allocated memory if one of the allocations failed */
	for (; plane > 0; --plane) {
		call_void_memop(vb, put, vb->planes[plane - 1].mem_priv);
		vb->planes[plane - 1].mem_priv = NULL;
	}

	return ret;
}

/*
 * __vb2_buf_mem_free() - free memory of the given buffer
 */
static void __vb2_buf_mem_free(struct vb2_buffer *vb)
{
	unsigned int plane;

	for (plane = 0; plane < vb->num_planes; ++plane) {
		call_void_memop(vb, put, vb->planes[plane].mem_priv);
		vb->planes[plane].mem_priv = NULL;
		dprintk(vb->vb2_queue, 3, "freed plane %d of buffer %d\n",
			plane, vb->index);
	}
}

/*
 * __vb2_buf_userptr_put() - release userspace memory associated with
 * a USERPTR buffer
 */
static void __vb2_buf_userptr_put(struct vb2_buffer *vb)
{
	unsigned int plane;

	for (plane = 0; plane < vb->num_planes; ++plane) {
		if (vb->planes[plane].mem_priv)
			call_void_memop(vb, put_userptr, vb->planes[plane].mem_priv);
		vb->planes[plane].mem_priv = NULL;
	}
}

/*
 * __vb2_plane_dmabuf_put() - release memory associated with
 * a DMABUF shared plane
 */
static void __vb2_plane_dmabuf_put(struct vb2_buffer *vb, struct vb2_plane *p)
{
	if (!p->mem_priv)
		return;

	if (!p->dbuf_duplicated) {
		if (p->dbuf_mapped)
			call_void_memop(vb, unmap_dmabuf, p->mem_priv);

		call_void_memop(vb, detach_dmabuf, p->mem_priv);
	}

	dma_buf_put(p->dbuf);
	p->mem_priv = NULL;
	p->dbuf = NULL;
	p->dbuf_mapped = 0;
	p->bytesused = 0;
	p->length = 0;
	p->m.fd = 0;
	p->data_offset = 0;
	p->dbuf_duplicated = false;
}

/*
 * __vb2_buf_dmabuf_put() - release memory associated with
 * a DMABUF shared buffer
 */
static void __vb2_buf_dmabuf_put(struct vb2_buffer *vb)
{
	int plane;

	/*
	 * When multiple planes share the same DMA buffer attachment, the plane
	 * with the lowest index owns the mem_priv.
	 * Put planes in the reversed order so that we don't leave invalid
	 * mem_priv behind.
	 */
	for (plane = vb->num_planes - 1; plane >= 0; --plane)
		__vb2_plane_dmabuf_put(vb, &vb->planes[plane]);
}

/*
 * __vb2_buf_mem_prepare() - call ->prepare() on buffer's private memory
 * to sync caches
 */
static void __vb2_buf_mem_prepare(struct vb2_buffer *vb)
{
	unsigned int plane;

	if (vb->synced)
		return;

	vb->synced = 1;
	for (plane = 0; plane < vb->num_planes; ++plane)
		call_void_memop(vb, prepare, vb->planes[plane].mem_priv);
}

/*
 * __vb2_buf_mem_finish() - call ->finish on buffer's private memory
 * to sync caches
 */
static void __vb2_buf_mem_finish(struct vb2_buffer *vb)
{
	unsigned int plane;

	if (!vb->synced)
		return;

	vb->synced = 0;
	for (plane = 0; plane < vb->num_planes; ++plane)
		call_void_memop(vb, finish, vb->planes[plane].mem_priv);
}

/*
 * __setup_offsets() - setup unique offsets ("cookies") for every plane in
 * the buffer.
 */
static void __setup_offsets(struct vb2_buffer *vb)
{
	struct vb2_queue *q = vb->vb2_queue;
	unsigned int plane;
	unsigned long offset = 0;

	/*
	 * The offset "cookie" value has the following constraints:
	 * - a buffer can have up to 8 planes.
	 * - v4l2 mem2mem uses bit 30 to distinguish between
	 *   OUTPUT (aka "source", bit 30 is 0) and
	 *   CAPTURE (aka "destination", bit 30 is 1) buffers.
	 * - must be page aligned
	 * That led to this bit mapping when PAGE_SHIFT = 12:
	 * |30                |29        15|14       12|11 0|
	 * |DST_QUEUE_OFF_BASE|buffer index|plane index| 0  |
	 * where there are 15 bits to store the buffer index.
	 * Depending on PAGE_SHIFT value we can have fewer bits
	 * to store the buffer index.
	 */
	offset = vb->index << PLANE_INDEX_SHIFT;

	for (plane = 0; plane < vb->num_planes; ++plane) {
		vb->planes[plane].m.offset = offset + (plane << PAGE_SHIFT);

		dprintk(q, 3, "buffer %d, plane %d offset 0x%08lx\n",
				vb->index, plane, offset);
	}
}

static void init_buffer_cache_hints(struct vb2_queue *q, struct vb2_buffer *vb)
{
	/*
	 * DMA exporter should take care of cache syncs, so we can avoid
	 * explicit ->prepare()/->finish() syncs. For other ->memory types
	 * we always need ->prepare() or/and ->finish() cache sync.
	 */
	if (q->memory == VB2_MEMORY_DMABUF) {
		vb->skip_cache_sync_on_finish = 1;
		vb->skip_cache_sync_on_prepare = 1;
		return;
	}

	/*
	 * ->finish() cache sync can be avoided when queue direction is
	 * TO_DEVICE.
	 */
	if (q->dma_dir == DMA_TO_DEVICE)
		vb->skip_cache_sync_on_finish = 1;
}

/**
 * vb2_queue_add_buffer() - add a buffer to a queue
 * @q:	pointer to &struct vb2_queue with videobuf2 queue.
 * @vb:	pointer to &struct vb2_buffer to be added to the queue.
 * @index: index where add vb2_buffer in the queue
 */
static void vb2_queue_add_buffer(struct vb2_queue *q, struct vb2_buffer *vb, unsigned int index)
{
	WARN_ON(index >= q->max_num_buffers || test_bit(index, q->bufs_bitmap) || vb->vb2_queue);

	q->bufs[index] = vb;
	vb->index = index;
	vb->vb2_queue = q;
	set_bit(index, q->bufs_bitmap);
}

/**
 * vb2_queue_remove_buffer() - remove a buffer from a queue
 * @vb:	pointer to &struct vb2_buffer to be removed from the queue.
 */
static void vb2_queue_remove_buffer(struct vb2_buffer *vb)
{
	clear_bit(vb->index, vb->vb2_queue->bufs_bitmap);
	vb->vb2_queue->bufs[vb->index] = NULL;
	vb->vb2_queue = NULL;
}

/*
 * __vb2_queue_alloc() - allocate vb2 buffer structures and (for MMAP type)
 * video buffer memory for all buffers/planes on the queue and initializes the
 * queue
 * @first_index: index of the first created buffer, all newly allocated buffers
 *		 have indices in the range [first_index..first_index+count-1]
 *
 * Returns the number of buffers successfully allocated.
 */
static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory,
			     unsigned int num_buffers, unsigned int num_planes,
			     const unsigned int plane_sizes[VB2_MAX_PLANES],
			     unsigned int *first_index)
{
	unsigned int buffer, plane;
	struct vb2_buffer *vb;
	unsigned long index = q->max_num_buffers;
	int ret;

	/*
	 * Ensure that the number of already queue + the number of buffers already
	 * in the queue is below q->max_num_buffers
	 */
	num_buffers = min_t(unsigned int, num_buffers,
			    q->max_num_buffers - vb2_get_num_buffers(q));

	while (num_buffers) {
		index = bitmap_find_next_zero_area(q->bufs_bitmap, q->max_num_buffers,
						   0, num_buffers, 0);

		if (index < q->max_num_buffers)
			break;
		/* Try to find free space for less buffers */
		num_buffers--;
	}

	/* If there is no space left to allocate buffers return 0 to indicate the error */
	if (!num_buffers) {
		*first_index = 0;
		return 0;
	}

	*first_index = index;

	for (buffer = 0; buffer < num_buffers; ++buffer) {
		/* Allocate vb2 buffer structures */
		vb = kzalloc(q->buf_struct_size, GFP_KERNEL);
		if (!vb) {
			dprintk(q, 1, "memory alloc for buffer struct failed\n");
			break;
		}

		vb->state = VB2_BUF_STATE_DEQUEUED;
		vb->num_planes = num_planes;
		vb->type = q->type;
		vb->memory = memory;
		init_buffer_cache_hints(q, vb);
		for (plane = 0; plane < num_planes; ++plane) {
			vb->planes[plane].length = plane_sizes[plane];
			vb->planes[plane].min_length = plane_sizes[plane];
		}

		vb2_queue_add_buffer(q, vb, index++);
		call_void_bufop(q, init_buffer, vb);

		/* Allocate video buffer memory for the MMAP type */
		if (memory == VB2_MEMORY_MMAP) {
			ret = __vb2_buf_mem_alloc(vb);
			if (ret) {
				dprintk(q, 1, "failed allocating memory for buffer %d\n",
					buffer);
				vb2_queue_remove_buffer(vb);
				kfree(vb);
				break;
			}
			__setup_offsets(vb);
			/*
			 * Call the driver-provided buffer initialization
			 * callback, if given. An error in initialization
			 * results in queue setup failure.
			 */
			ret = call_vb_qop(vb, buf_init, vb);
			if (ret) {
				dprintk(q, 1, "buffer %d %p initialization failed\n",
					buffer, vb);
				__vb2_buf_mem_free(vb);
				vb2_queue_remove_buffer(vb);
				kfree(vb);
				break;
			}
		}
	}

	dprintk(q, 3, "allocated %d buffers, %d plane(s) each\n",
		buffer, num_planes);

	return buffer;
}

/*
 * __vb2_free_mem() - release video buffer memory for a given range of
 * buffers in a given queue
 */
static void __vb2_free_mem(struct vb2_queue *q, unsigned int start, unsigned int count)
{
	unsigned int i;
	struct vb2_buffer *vb;

	for (i = start; i < start + count; i++) {
		vb = vb2_get_buffer(q, i);
		if (!vb)
			continue;

		/* Free MMAP buffers or release USERPTR buffers */
		if (q->memory == VB2_MEMORY_MMAP)
			__vb2_buf_mem_free(vb);
		else if (q->memory == VB2_MEMORY_DMABUF)
			__vb2_buf_dmabuf_put(vb);
		else
			__vb2_buf_userptr_put(vb);
	}
}

/*
 * __vb2_queue_free() - free @count buffers from @start index of the queue - video memory and
 * related information, if no buffers are left return the queue to an
 * uninitialized state. Might be called even if the queue has already been freed.
 */
static void __vb2_queue_free(struct vb2_queue *q, unsigned int start, unsigned int count)
{
	unsigned int i;

	lockdep_assert_held(&q->mmap_lock);

	/* Call driver-provided cleanup function for each buffer, if provided */
	for (i = start; i < start + count; i++) {
		struct vb2_buffer *vb = vb2_get_buffer(q, i);

		if (vb && vb->planes[0].mem_priv)
			call_void_vb_qop(vb, buf_cleanup, vb);
	}

	/* Release video buffer memory */
	__vb2_free_mem(q, start, count);

#ifdef CONFIG_VIDEO_ADV_DEBUG
	/*
	 * Check that all the calls were balanced during the life-time of this
	 * queue. If not then dump the counters to the kernel log.
	 */
	if (vb2_get_num_buffers(q)) {
		bool unbalanced = q->cnt_start_streaming != q->cnt_stop_streaming ||
				  q->cnt_prepare_streaming != q->cnt_unprepare_streaming;

		if (unbalanced) {
			pr_info("unbalanced counters for queue %p:\n", q);
			if (q->cnt_start_streaming != q->cnt_stop_streaming)
				pr_info("     setup: %u start_streaming: %u stop_streaming: %u\n",
					q->cnt_queue_setup, q->cnt_start_streaming,
					q->cnt_stop_streaming);
			if (q->cnt_prepare_streaming != q->cnt_unprepare_streaming)
				pr_info("     prepare_streaming: %u unprepare_streaming: %u\n",
					q->cnt_prepare_streaming, q->cnt_unprepare_streaming);
		}
		q->cnt_queue_setup = 0;
		q->cnt_prepare_streaming = 0;
		q->cnt_start_streaming = 0;
		q->cnt_stop_streaming = 0;
		q->cnt_unprepare_streaming = 0;
	}
	for (i = start; i < start + count; i++) {
		struct vb2_buffer *vb = vb2_get_buffer(q, i);
		bool unbalanced;

		if (!vb)
			continue;

		unbalanced = vb->cnt_mem_alloc != vb->cnt_mem_put ||
			     vb->cnt_mem_prepare != vb->cnt_mem_finish ||
			     vb->cnt_mem_get_userptr != vb->cnt_mem_put_userptr ||
			     vb->cnt_mem_attach_dmabuf != vb->cnt_mem_detach_dmabuf ||
			     vb->cnt_mem_map_dmabuf != vb->cnt_mem_unmap_dmabuf ||
			     vb->cnt_buf_queue != vb->cnt_buf_done ||
			     vb->cnt_buf_prepare != vb->cnt_buf_finish ||
			     vb->cnt_buf_init != vb->cnt_buf_cleanup;

		if (unbalanced) {
			pr_info("unbalanced counters for queue %p, buffer %d:\n",
				q, i);
			if (vb->cnt_buf_init != vb->cnt_buf_cleanup)
				pr_info("     buf_init: %u buf_cleanup: %u\n",
					vb->cnt_buf_init, vb->cnt_buf_cleanup);
			if (vb->cnt_buf_prepare != vb->cnt_buf_finish)
				pr_info("     buf_prepare: %u buf_finish: %u\n",
					vb->cnt_buf_prepare, vb->cnt_buf_finish);
			if (vb->cnt_buf_queue != vb->cnt_buf_done)
				pr_info("     buf_out_validate: %u buf_queue: %u buf_done: %u buf_request_complete: %u\n",
					vb->cnt_buf_out_validate, vb->cnt_buf_queue,
					vb->cnt_buf_done, vb->cnt_buf_request_complete);
			if (vb->cnt_mem_alloc != vb->cnt_mem_put)
				pr_info("     alloc: %u put: %u\n",
					vb->cnt_mem_alloc, vb->cnt_mem_put);
			if (vb->cnt_mem_prepare != vb->cnt_mem_finish)
				pr_info("     prepare: %u finish: %u\n",
					vb->cnt_mem_prepare, vb->cnt_mem_finish);
			if (vb->cnt_mem_get_userptr != vb->cnt_mem_put_userptr)
				pr_info("     get_userptr: %u put_userptr: %u\n",
					vb->cnt_mem_get_userptr, vb->cnt_mem_put_userptr);
			if (vb->cnt_mem_attach_dmabuf != vb->cnt_mem_detach_dmabuf)
				pr_info("     attach_dmabuf: %u detach_dmabuf: %u\n",
					vb->cnt_mem_attach_dmabuf, vb->cnt_mem_detach_dmabuf);
			if (vb->cnt_mem_map_dmabuf != vb->cnt_mem_unmap_dmabuf)
				pr_info("     map_dmabuf: %u unmap_dmabuf: %u\n",
					vb->cnt_mem_map_dmabuf, vb->cnt_mem_unmap_dmabuf);
			pr_info("     get_dmabuf: %u num_users: %u\n",
				vb->cnt_mem_get_dmabuf,
				vb->cnt_mem_num_users);
		}
	}
#endif

	/* Free vb2 buffers */
	for (i = start; i < start + count; i++) {
		struct vb2_buffer *vb = vb2_get_buffer(q, i);

		if (!vb)
			continue;

		vb2_queue_remove_buffer(vb);
		kfree(vb);
	}

	if (!vb2_get_num_buffers(q)) {
		q->memory = VB2_MEMORY_UNKNOWN;
		INIT_LIST_HEAD(&q->queued_list);
	}
}

bool vb2_buffer_in_use(struct vb2_queue *q, struct vb2_buffer *vb)
{
	unsigned int plane;
	for (plane = 0; plane < vb->num_planes; ++plane) {
		void *mem_priv = vb->planes[plane].mem_priv;
		/*
		 * If num_users() has not been provided, call_memop
		 * will return 0, apparently nobody cares about this
		 * case anyway. If num_users() returns more than 1,
		 * we are not the only user of the plane's memory.
		 */
		if (mem_priv && call_memop(vb, num_users, mem_priv) > 1)
			return true;
	}
	return false;
}
EXPORT_SYMBOL(vb2_buffer_in_use);

/*
 * __buffers_in_use() - return true if any buffers on the queue are in use and
 * the queue cannot be freed (by the means of REQBUFS(0)) call
 */
static bool __buffers_in_use(struct vb2_queue *q)
{
	unsigned int buffer;
	for (buffer = 0; buffer < q->max_num_buffers; ++buffer) {
		struct vb2_buffer *vb = vb2_get_buffer(q, buffer);

		if (!vb)
			continue;

		if (vb2_buffer_in_use(q, vb))
			return true;
	}
	return false;
}

void vb2_core_querybuf(struct vb2_queue *q, struct vb2_buffer *vb, void *pb)
{
	call_void_bufop(q, fill_user_buffer, vb, pb);
}
EXPORT_SYMBOL_GPL(vb2_core_querybuf);

/*
 * __verify_userptr_ops() - verify that all memory operations required for
 * USERPTR queue type have been provided
 */
static int __verify_userptr_ops(struct vb2_queue *q)
{
	if (!(q->io_modes & VB2_USERPTR) || !q->mem_ops->get_userptr ||
	    !q->mem_ops->put_userptr)
		return -EINVAL;

	return 0;
}

/*
 * __verify_mmap_ops() - verify that all memory operations required for
 * MMAP queue type have been provided
 */
static int __verify_mmap_ops(struct vb2_queue *q)
{
	if (!(q->io_modes & VB2_MMAP) || !q->mem_ops->alloc ||
	    !q->mem_ops->put || !q->mem_ops->mmap)
		return -EINVAL;

	return 0;
}

/*
 * __verify_dmabuf_ops() - verify that all memory operations required for
 * DMABUF queue type have been provided
 */
static int __verify_dmabuf_ops(struct vb2_queue *q)
{
	if (!(q->io_modes & VB2_DMABUF) || !q->mem_ops->attach_dmabuf ||
	    !q->mem_ops->detach_dmabuf  || !q->mem_ops->map_dmabuf ||
	    !q->mem_ops->unmap_dmabuf)
		return -EINVAL;

	return 0;
}

int vb2_verify_memory_type(struct vb2_queue *q,
		enum vb2_memory memory, unsigned int type)
{
	if (memory != VB2_MEMORY_MMAP && memory != VB2_MEMORY_USERPTR &&
	    memory != VB2_MEMORY_DMABUF) {
		dprintk(q, 1, "unsupported memory type\n");
		return -EINVAL;
	}

	if (type != q->type) {
		dprintk(q, 1, "requested type is incorrect\n");
		return -EINVAL;
	}

	/*
	 * Make sure all the required memory ops for given memory type
	 * are available.
	 */
	if (memory == VB2_MEMORY_MMAP && __verify_mmap_ops(q)) {
		dprintk(q, 1, "MMAP for current setup unsupported\n");
		return -EINVAL;
	}

	if (memory == VB2_MEMORY_USERPTR && __verify_userptr_ops(q)) {
		dprintk(q, 1, "USERPTR for current setup unsupported\n");
		return -EINVAL;
	}

	if (memory == VB2_MEMORY_DMABUF && __verify_dmabuf_ops(q)) {
		dprintk(q, 1, "DMABUF for current setup unsupported\n");
		return -EINVAL;
	}

	/*
	 * Place the busy tests at the end: -EBUSY can be ignored when
	 * create_bufs is called with count == 0, but count == 0 should still
	 * do the memory and type validation.
	 */
	if (vb2_fileio_is_active(q)) {
		dprintk(q, 1, "file io in progress\n");
		return -EBUSY;
	}
	return 0;
}
EXPORT_SYMBOL(vb2_verify_memory_type);

static void set_queue_coherency(struct vb2_queue *q, bool non_coherent_mem)
{
	q->non_coherent_mem = 0;

	if (!vb2_queue_allows_cache_hints(q))
		return;
	q->non_coherent_mem = non_coherent_mem;
}

static bool verify_coherency_flags(struct vb2_queue *q, bool non_coherent_mem)
{
	if (non_coherent_mem != q->non_coherent_mem) {
		dprintk(q, 1, "memory coherency model mismatch\n");
		return false;
	}
	return true;
}

static int vb2_core_allocated_buffers_storage(struct vb2_queue *q)
{
	if (!q->bufs)
		q->bufs = kzalloc_objs(*q->bufs, q->max_num_buffers);
	if (!q->bufs)
		return -ENOMEM;

	if (!q->bufs_bitmap)
		q->bufs_bitmap = bitmap_zalloc(q->max_num_buffers, GFP_KERNEL);
	if (!q->bufs_bitmap) {
		kfree(q->bufs);
		q->bufs = NULL;
		return -ENOMEM;
	}

	return 0;
}

static void vb2_core_free_buffers_storage(struct vb2_queue *q)
{
	kfree(q->bufs);
	q->bufs = NULL;
	bitmap_free(q->bufs_bitmap);
	q->bufs_bitmap = NULL;
}

int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
		     unsigned int flags, unsigned int *count)
{
	unsigned int num_buffers, allocated_buffers, num_planes = 0;
	unsigned int q_num_bufs = vb2_get_num_buffers(q);
	unsigned plane_sizes[VB2_MAX_PLANES] = { };
	bool non_coherent_mem = flags & V4L2_MEMORY_FLAG_NON_COHERENT;
	unsigned int i, first_index;
	int ret = 0;

	if (q->streaming) {
		dprintk(q, 1, "streaming active\n");
		return -EBUSY;
	}

	if (q->waiting_in_dqbuf && *count) {
		dprintk(q, 1, "another dup()ped fd is waiting for a buffer\n");
		return -EBUSY;
	}

	if (*count == 0 || q_num_bufs != 0 ||
	    (q->memory != VB2_MEMORY_UNKNOWN && q->memory != memory) ||
	    !verify_coherency_flags(q, non_coherent_mem)) {
		/*
		 * We already have buffers allocated, so first check if they
		 * are not in use and can be freed.
		 */
		mutex_lock(&q->mmap_lock);
		if (debug && q->memory == VB2_MEMORY_MMAP &&
		    __buffers_in_use(q))
			dprintk(q, 1, "memory in use, orphaning buffers\n");

		/*
		 * Call queue_cancel to clean up any buffers in the
		 * QUEUED state which is possible if buffers were prepared or
		 * queued without ever calling STREAMON.
		 */
		__vb2_queue_cancel(q);
		__vb2_queue_free(q, 0, q->max_num_buffers);
		mutex_unlock(&q->mmap_lock);

		q->is_busy = 0;
		/*
		 * In case of REQBUFS(0) return immediately without calling
		 * driver's queue_setup() callback and allocating resources.
		 */
		if (*count == 0)
			return 0;
	}

	/*
	 * Make sure the requested values and current defaults are sane.
	 */
	num_buffers = max_t(unsigned int, *count, q->min_reqbufs_allocation);
	num_buffers = min_t(unsigned int, num_buffers, q->max_num_buffers);
	memset(q->alloc_devs, 0, sizeof(q->alloc_devs));
	/*
	 * Set this now to ensure that drivers see the correct q->memory value
	 * in the queue_setup op.
	 */
	mutex_lock(&q->mmap_lock);
	ret = vb2_core_allocated_buffers_storage(q);
	q->memory = memory;
	mutex_unlock(&q->mmap_lock);
	if (ret)
		return ret;
	set_queue_coherency(q, non_coherent_mem);

	/*
	 * Ask the driver how many buffers and planes per buffer it requires.
	 * Driver also sets the size and allocator context for each plane.
	 */
	ret = call_qop(q, queue_setup, q, &num_buffers, &num_planes,
		       plane_sizes, q->alloc_devs);
	if (ret)
		goto error;

	/* Check that driver has set sane values */
	if (WARN_ON(!num_planes)) {
		ret = -EINVAL;
		goto error;
	}

	for (i = 0; i < num_planes; i++)
		if (WARN_ON(!plane_sizes[i])) {
			ret = -EINVAL;
			goto error;
		}

	/* Finally, allocate buffers and video memory */
	allocated_buffers =
		__vb2_queue_alloc(q, memory, num_buffers, num_planes, plane_sizes, &first_index);
	if (allocated_buffers == 0) {
		/* There shouldn't be any buffers allocated, so first_index == 0 */
		WARN_ON(first_index);
		dprintk(q, 1, "memory allocation failed\n");
		ret = -ENOMEM;
		goto error;
	}

	/*
	 * There is no point in continuing if we can't allocate the minimum
	 * number of buffers needed by this vb2_queue.
	 */
	if (allocated_buffers < q->min_reqbufs_allocation)
		ret = -ENOMEM;

	/*
	 * Check if driver can handle the allocated number of buffers.
	 */
	if (!ret && allocated_buffers < num_buffers) {
		num_buffers = allocated_buffers;
		/*
		 * num_planes is set by the previous queue_setup(), but since it
		 * signals to queue_setup() whether it is called from create_bufs()
		 * vs reqbufs() we zero it here to signal that queue_setup() is
		 * called for the reqbufs() case.
		 */
		num_planes = 0;

		ret = call_qop(q, queue_setup, q, &num_buffers,
			       &num_planes, plane_sizes, q->alloc_devs);

		if (!ret && allocated_buffers < num_buffers)
			ret = -ENOMEM;

		/*
		 * Either the driver has accepted a smaller number of buffers,
		 * or .queue_setup() returned an error
		 */
	}

	mutex_lock(&q->mmap_lock);

	if (ret < 0) {
		/*
		 * Note: __vb2_queue_free() will subtract 'allocated_buffers'
		 * from already queued buffers and it will reset q->memory to
		 * VB2_MEMORY_UNKNOWN.
		 */
		__vb2_queue_free(q, first_index, allocated_buffers);
		mutex_unlock(&q->mmap_lock);
		return ret;
	}
	mutex_unlock(&q->mmap_lock);

	/*
	 * Return the number of successfully allocated buffers
	 * to the userspace.
	 */
	*count = allocated_buffers;
	q->waiting_for_buffers = !q->is_output;
	q->is_busy = 1;

	return 0;

error:
	mutex_lock(&q->mmap_lock);
	q->memory = VB2_MEMORY_UNKNOWN;
	mutex_unlock(&q->mmap_lock);
	vb2_core_free_buffers_storage(q);
	return ret;
}
EXPORT_SYMBOL_GPL(vb2_core_reqbufs);

int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
			 unsigned int flags, unsigned int *count,
			 unsigned int requested_planes,
			 const unsigned int requested_sizes[],
			 unsigned int *first_index)
{
	unsigned int num_planes = 0, num_buffers, allocated_buffers;
	unsigned plane_sizes[VB2_MAX_PLANES] = { };
	bool non_coherent_mem = flags & V4L2_MEMORY_FLAG_NON_COHERENT;
	unsigned int q_num_bufs = vb2_get_num_buffers(q);
	bool no_previous_buffers = !q_num_bufs;
	int ret = 0;

	if (q_num_bufs == q->max_num_buffers) {
		dprintk(q, 1, "maximum number of buffers already allocated\n");
		return -ENOBUFS;
	}

	if (no_previous_buffers) {
		if (q->waiting_in_dqbuf && *count) {
			dprintk(q, 1, "another dup()ped fd is waiting for a buffer\n");
			return -EBUSY;
		}
		memset(q->alloc_devs, 0, sizeof(q->alloc_devs));
		/*
		 * Set this now to ensure that drivers see the correct q->memory
		 * value in the queue_setup op.
		 */
		mutex_lock(&q->mmap_lock);
		ret = vb2_core_allocated_buffers_storage(q);
		q->memory = memory;
		mutex_unlock(&q->mmap_lock);
		if (ret)
			return ret;
		q->waiting_for_buffers = !q->is_output;
		set_queue_coherency(q, non_coherent_mem);
	} else {
		if (q->memory != memory) {
			dprintk(q, 1, "memory model mismatch\n");
			return -EINVAL;
		}
		if (!verify_coherency_flags(q, non_coherent_mem))
			return -EINVAL;
	}

	num_buffers = min(*count, q->max_num_buffers - q_num_bufs);

	if (requested_planes && requested_sizes) {
		num_planes = requested_planes;
		memcpy(plane_sizes, requested_sizes, sizeof(plane_sizes));
	}

	/*
	 * Ask the driver, whether the requested number of buffers, planes per
	 * buffer and their sizes are acceptable
	 */
	ret = call_qop(q, queue_setup, q, &num_buffers,
		       &num_planes, plane_sizes, q->alloc_devs);
	if (ret)
		goto error;

	/* Finally, allocate buffers and video memory */
	allocated_buffers = __vb2_queue_alloc(q, memory, num_buffers,
				num_planes, plane_sizes, first_index);
	if (allocated_buffers == 0) {
		dprintk(q, 1, "memory allocation failed\n");
		ret = -ENOMEM;
		goto error;
	}

	/*
	 * Check if driver can handle the so far allocated number of buffers.
	 */
	if (allocated_buffers < num_buffers) {
		num_buffers = allocated_buffers;

		/*
		 * num_buffers contains the total number of buffers, that the
		 * queue driver has set up
		 */
		ret = call_qop(q, queue_setup, q, &num_buffers,
			       &num_planes, plane_sizes, q->alloc_devs);

		if (!ret && allocated_buffers < num_buffers)
			ret = -ENOMEM;

		/*
		 * Either the driver has accepted a smaller number of buffers,
		 * or .queue_setup() returned an error
		 */
	}

	mutex_lock(&q->mmap_lock);

	if (ret < 0) {
		/*
		 * Note: __vb2_queue_free() will subtract 'allocated_buffers'
		 * from already queued buffers and it will reset q->memory to
		 * VB2_MEMORY_UNKNOWN.
		 */
		__vb2_queue_free(q, *first_index, allocated_buffers);
		mutex_unlock(&q->mmap_lock);
		return -ENOMEM;
	}
	mutex_unlock(&q->mmap_lock);

	/*
	 * Return the number of successfully allocated buffers
	 * to the userspace.
	 */
	*count = allocated_buffers;
	q->is_busy = 1;

	return 0;

error:
	if (no_previous_buffers) {
		mutex_lock(&q->mmap_lock);
		q->memory = VB2_MEMORY_UNKNOWN;
		mutex_unlock(&q->mmap_lock);
	}
	return ret;
}
EXPORT_SYMBOL_GPL(vb2_core_create_bufs);

void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no)
{
	if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
		return NULL;

	return call_ptr_memop(vaddr, vb, vb->planes[plane_no].mem_priv);

}
EXPORT_SYMBOL_GPL(vb2_plane_vaddr);

void *vb2_plane_cookie(struct vb2_buffer *vb, unsigned int plane_no)
{
	if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
		return NULL;

	return call_ptr_memop(cookie, vb, vb->planes[plane_no].mem_priv);
}
EXPORT_SYMBOL_GPL(vb2_plane_cookie);

void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state)
{
	struct vb2_queue *q = vb->vb2_queue;
	unsigned long flags;

	if (WARN_ON(vb->state != VB2_BUF_STATE_ACTIVE))
		return;

	if (WARN_ON(state != VB2_BUF_STATE_DONE &&
		    state != VB2_BUF_STATE_ERROR &&
		    state != VB2_BUF_STATE_QUEUED))
		state = VB2_BUF_STATE_ERROR;

#ifdef CONFIG_VIDEO_ADV_DEBUG
	/*
	 * Although this is not a callback, it still does have to balance
	 * with the buf_queue op. So update this counter manually.
	 */
	vb->cnt_buf_done++;
#endif
	dprintk(q, 4, "done processing on buffer %d, state: %s\n",
		vb->index, vb2_state_name(state));

	if (state != VB2_BUF_STATE_QUEUED)
		__vb2_buf_mem_finish(vb);

	spin_lock_irqsave(&q->done_lock, flags);
	if (state == VB2_BUF_STATE_QUEUED) {
		vb->state = VB2_BUF_STATE_QUEUED;
	} else {
		/* Add the buffer to the done buffers list */
		list_add_tail(&vb->done_entry, &q->done_list);
		vb->state = state;
	}
	atomic_dec(&q->owned_by_drv_count);

	if (state != VB2_BUF_STATE_QUEUED && vb->req_obj.req) {
		media_request_object_unbind(&vb->req_obj);
		media_request_object_put(&vb->req_obj);
	}

	spin_unlock_irqrestore(&q->done_lock, flags);

	trace_vb2_buf_done(q, vb);

	switch (state) {
	case VB2_BUF_STATE_QUEUED:
		return;
	default:
		/* Inform any processes that may be waiting for buffers */
		wake_up(&q->done_wq);
		break;
	}
}
EXPORT_SYMBOL_GPL(vb2_buffer_done);

void vb2_discard_done(struct vb2_queue *q)
{
	struct vb2_buffer *vb;
	unsigned long flags;

	spin_lock_irqsave(&q->done_lock, flags);
	list_for_each_entry(vb, &q->done_list, done_entry)
		vb->state = VB2_BUF_STATE_ERROR;
	spin_unlock_irqrestore(&q->done_lock, flags);
}
EXPORT_SYMBOL_GPL(vb2_discard_done);

/*
 * __prepare_mmap() - prepare an MMAP buffer
 */
static int __prepare_mmap(struct vb2_buffer *vb)
{
	int ret = 0;

	ret = call_bufop(vb->vb2_queue, fill_vb2_buffer,
			 vb, vb->planes);
	return ret ? ret : call_vb_qop(vb, buf_prepare, vb);
}

/*
 * __prepare_userptr() - prepare a USERPTR buffer
 */
static int __prepare_userptr(struct vb2_buffer *vb)
{
	struct vb2_plane planes[VB2_MAX_PLANES];
	struct vb2_queue *q = vb->vb2_queue;
	void *mem_priv;
	unsigned int plane;
	int ret = 0;
	bool reacquired = vb->planes[0].mem_priv == NULL;

	memset(planes, 0, sizeof(planes[0]) * vb->num_planes);
	/* Copy relevant information provided by the userspace */
	ret = call_bufop(vb->vb2_queue, fill_vb2_buffer,
			 vb, planes);
	if (ret)
		return ret;

	for (plane = 0; plane < vb->num_planes; ++plane) {
		/* Skip the plane if already verified */
		if (vb->planes[plane].m.userptr &&
			vb->planes[plane].m.userptr == planes[plane].m.userptr
			&& vb->planes[plane].length == planes[plane].length)
			continue;

		dprintk(q, 3, "userspace address for plane %d changed, reacquiring memory\n",
			plane);

		/* Check if the provided plane buffer is large enough */
		if (planes[plane].length < vb->planes[plane].min_length) {
			dprintk(q, 1, "provided buffer size %u is less than setup size %u for plane %d\n",
						planes[plane].length,
						vb->planes[plane].min_length,
						plane);
			ret = -EINVAL;
			goto err;
		}

		/* Release previously acquired memory if present */
		if (vb->planes[plane].mem_priv) {
			if (!reacquired) {
				reacquired = true;
				vb->copied_timestamp = 0;
				call_void_vb_qop(vb, buf_cleanup, vb);
			}
			call_void_memop(vb, put_userptr, vb->planes[plane].mem_priv);
		}

		vb->planes[plane].mem_priv = NULL;
		vb->planes[plane].bytesused = 0;
		vb->planes[plane].length = 0;
		vb->planes[plane].m.userptr = 0;
		vb->planes[plane].data_offset = 0;

		/* Acquire each plane's memory */
		mem_priv = call_ptr_memop(get_userptr,
					  vb,
					  q->alloc_devs[plane] ? : q->dev,
					  planes[plane].m.userptr,
					  planes[plane].length);
		if (IS_ERR(mem_priv)) {
			dprintk(q, 1, "failed acquiring userspace memory for plane %d\n",
				plane);
			ret = PTR_ERR(mem_priv);
			goto err;
		}
		vb->planes[plane].mem_priv = mem_priv;
	}

	/*
	 * Now that everything is in order, copy relevant information
	 * provided by userspace.
	 */
	for (plane = 0; plane < vb->num_planes; ++plane) {
		vb->planes[plane].bytesused = planes[plane].bytesused;
		vb->planes[plane].length = planes[plane].length;
		vb->planes[plane].m.userptr = planes[plane].m.userptr;
		vb->planes[plane].data_offset = planes[plane].data_offset;
	}

	if (reacquired) {
		/*
		 * One or more planes changed, so we must call buf_init to do
		 * the driver-specific initialization on the newly acquired
		 * buffer, if provided.
		 */
		ret = call_vb_qop(vb, buf_init, vb);
		if (ret) {
			dprintk(q, 1, "buffer initialization failed\n");
			goto err;
		}
	}

	ret = call_vb_qop(vb, buf_prepare, vb);
	if (ret) {
		dprintk(q, 1, "buffer preparation failed\n");
		call_void_vb_qop(vb, buf_cleanup, vb);
		goto err;
	}

	return 0;
err:
	/* In case of errors, release planes that were already acquired */
	for (plane = 0; plane < vb->num_planes; ++plane) {
		if (vb->planes[plane].mem_priv)
			call_void_memop(vb, put_userptr,
				vb->planes[plane].mem_priv);
		vb->planes[plane].mem_priv = NULL;
		vb->planes[plane].m.userptr = 0;
		vb->planes[plane].length = 0;
	}

	return ret;
}

/*
 * __prepare_dmabuf() - prepare a DMABUF buffer
 */
static int __prepare_dmabuf(struct vb2_buffer *vb)
{
	struct vb2_plane planes[VB2_MAX_PLANES];
	struct vb2_queue *q = vb->vb2_queue;
	void *mem_priv;
	unsigned int plane, i;
	int ret = 0;
	bool reacquired = vb->planes[0].mem_priv == NULL;

	memset(planes, 0, sizeof(planes[0]) * vb->num_planes);
	/* Copy relevant information provided by the userspace */
	ret = call_bufop(vb->vb2_queue, fill_vb2_buffer,
			 vb, planes);
	if (ret)
		return ret;

	for (plane = 0; plane < vb->num_planes; ++plane) {
		struct dma_buf *dbuf = dma_buf_get(planes[plane].m.fd);

		planes[plane].dbuf = dbuf;

		if (IS_ERR_OR_NULL(dbuf)) {
			dprintk(q, 1, "invalid dmabuf fd for plane %d\n",
				plane);
			ret = -EINVAL;
			goto err_put_planes;
		}

		/* use DMABUF size if length is not provided */
		if (planes[plane].length == 0)
			planes[plane].length = dbuf->size;

		if (planes[plane].length < vb->planes[plane].min_length) {
			dprintk(q, 1, "invalid dmabuf length %u for plane %d, minimum length %u\n",
				planes[plane].length, plane,
				vb->planes[plane].min_length);
			ret = -EINVAL;
			goto err_put_planes;
		}

		/* Skip the plane if already verified */
		if (dbuf == vb->planes[plane].dbuf &&
		    vb->planes[plane].length == planes[plane].length)
			continue;

		dprintk(q, 3, "buffer for plane %d changed\n", plane);

		reacquired = true;
	}

	if (reacquired) {
		if (vb->planes[0].mem_priv) {
			vb->copied_timestamp = 0;
			call_void_vb_qop(vb, buf_cleanup, vb);
			__vb2_buf_dmabuf_put(vb);
		}

		for (plane = 0; plane < vb->num_planes; ++plane) {
			/*
			 * This is an optimization to reduce dma_buf attachment/mapping.
			 * When the same dma_buf is used for multiple planes, there is no need
			 * to create duplicated attachments.
			 */
			for (i = 0; i < plane; ++i) {
				if (planes[plane].dbuf == vb->planes[i].dbuf &&
				    q->alloc_devs[plane] == q->alloc_devs[i]) {
					vb->planes[plane].dbuf_duplicated = true;
					vb->planes[plane].dbuf = vb->planes[i].dbuf;
					vb->planes[plane].mem_priv = vb->planes[i].mem_priv;
					break;
				}
			}

			if (vb->planes[plane].dbuf_duplicated)
				continue;

			/* Acquire each plane's memory */
			mem_priv = call_ptr_memop(attach_dmabuf,
						  vb,
						  q->alloc_devs[plane] ? : q->dev,
						  planes[plane].dbuf,
						  planes[plane].length);
			if (IS_ERR(mem_priv)) {
				dprintk(q, 1, "failed to attach dmabuf\n");
				ret = PTR_ERR(mem_priv);
				goto err_put_vb2_buf;
			}

			vb->planes[plane].dbuf = planes[plane].dbuf;
			vb->planes[plane].mem_priv = mem_priv;

			/*
			 * This pins the buffer(s) with dma_buf_map_attachment()). It's done
			 * here instead just before the DMA, while queueing the buffer(s) so
			 * userspace knows sooner rather than later if the dma-buf map fails.
			 */
			ret = call_memop(vb, map_dmabuf, vb->planes[plane].mem_priv);
			if (ret) {
				dprintk(q, 1, "failed to map dmabuf for plane %d\n",
					plane);
				goto err_put_vb2_buf;
			}
			vb->planes[plane].dbuf_mapped = 1;
		}
	} else {
		for (plane = 0; plane < vb->num_planes; ++plane)
			dma_buf_put(planes[plane].dbuf);
	}

	/*
	 * Now that everything is in order, copy relevant information
	 * provided by userspace.
	 */
	for (plane = 0; plane < vb->num_planes; ++plane) {
		vb->planes[plane].bytesused = planes[plane].bytesused;
		vb->planes[plane].length = planes[plane].length;
		vb->planes[plane].m.fd = planes[plane].m.fd;
		vb->planes[plane].data_offset = planes[plane].data_offset;
	}

	if (reacquired) {
		/*
		 * Call driver-specific initialization on the newly acquired buffer,
		 * if provided.
		 */
		ret = call_vb_qop(vb, buf_init, vb);
		if (ret) {
			dprintk(q, 1, "buffer initialization failed\n");
			goto err_put_vb2_buf;
		}
	}

	ret = call_vb_qop(vb, buf_prepare, vb);
	if (ret) {
		dprintk(q, 1, "buffer preparation failed\n");
		call_void_vb_qop(vb, buf_cleanup, vb);
		goto err_put_vb2_buf;
	}

	return 0;

err_put_planes:
	for (plane = 0; plane < vb->num_planes; ++plane) {
		if (!IS_ERR_OR_NULL(planes[plane].dbuf))
			dma_buf_put(planes[plane].dbuf);
	}
err_put_vb2_buf:
	/* In case of errors, release planes that were already acquired */
	__vb2_buf_dmabuf_put(vb);

	return ret;
}

/*
 * __enqueue_in_driver() - enqueue a vb2_buffer in driver for processing
 */
static void __enqueue_in_driver(struct vb2_buffer *vb)
{
	struct vb2_queue *q = vb->vb2_queue;

	vb->state = VB2_BUF_STATE_ACTIVE;
	atomic_inc(&q->owned_by_drv_count);

	trace_vb2_buf_queue(q, vb);

	call_void_vb_qop(vb, buf_queue, vb);
}

static int __buf_prepare(struct vb2_buffer *vb)
{
	struct vb2_queue *q = vb->vb2_queue;
	enum vb2_buffer_state orig_state = vb->state;
	int ret;

	if (q->error) {
		dprintk(q, 1, "fatal error occurred on queue\n");
		return -EIO;
	}

	if (vb->prepared)
		return 0;
	WARN_ON(vb->synced);

	if (q->is_output) {
		ret = call_vb_qop(vb, buf_out_validate, vb);
		if (ret) {
			dprintk(q, 1, "buffer validation failed\n");
			return ret;
		}
	}

	vb->state = VB2_BUF_STATE_PREPARING;

	switch (q->memory) {
	case VB2_MEMORY_MMAP:
		ret = __prepare_mmap(vb);
		break;
	case VB2_MEMORY_USERPTR:
		ret = __prepare_userptr(vb);
		break;
	case VB2_MEMORY_DMABUF:
		ret = __prepare_dmabuf(vb);
		break;
	default:
		WARN(1, "Invalid queue type\n");
		ret = -EINVAL;
		break;
	}

	if (ret) {
		dprintk(q, 1, "buffer preparation failed: %d\n", ret);
		vb->state = orig_state;
		return ret;
	}

	__vb2_buf_mem_prepare(vb);
	vb->prepared = 1;
	vb->state = orig_state;

	return 0;
}

static int vb2_req_prepare(struct media_request_object *obj)
{
	struct vb2_buffer *vb = container_of(obj, struct vb2_buffer, req_obj);
	int ret;

	if (WARN_ON(vb->state != VB2_BUF_STATE_IN_REQUEST))
		return -EINVAL;

	mutex_lock(vb->vb2_queue->lock);
	ret = __buf_prepare(vb);
	mutex_unlock(vb->vb2_queue->lock);
	return ret;
}

static void __vb2_dqbuf(struct vb2_buffer *vb);

static void vb2_req_unprepare(struct media_request_object *obj)
{
	struct vb2_buffer *vb = container_of(obj, struct vb2_buffer, req_obj);

	mutex_lock(vb->vb2_queue->lock);
	__vb2_dqbuf(vb);
	vb->state = VB2_BUF_STATE_IN_REQUEST;
	mutex_unlock(vb->vb2_queue->lock);
	WARN_ON(!vb->req_obj.req);
}

static void vb2_req_queue(struct media_request_object *obj)
{
	struct vb2_buffer *vb = container_of(obj, struct vb2_buffer, req_obj);
	int err;

	mutex_lock(vb->vb2_queue->lock);
	/*
	 * There is no method to propagate an error from vb2_core_qbuf(),
	 * so if this returns a non-0 value, then WARN.
	 *
	 * The only exception is -EIO which is returned if q->error is
	 * set. We just ignore that, and expect this will be caught the
	 * next time vb2_req_prepare() is called.
	 */
	err = vb2_core_qbuf(vb->vb2_queue, vb, NULL, NULL);
	WARN_ON_ONCE(err && err != -EIO);
	mutex_unlock(vb->vb2_queue->lock);
}

static void vb2_req_unbind(struct media_request_object *obj)
{
	struct vb2_buffer *vb = container_of(obj, struct vb2_buffer, req_obj);

	if (vb->state == VB2_BUF_STATE_IN_REQUEST)
		call_void_bufop(vb->vb2_queue, init_buffer, vb);
}

static void vb2_req_release(struct media_request_object *obj)
{
	struct vb2_buffer *vb = container_of(obj, struct vb2_buffer, req_obj);

	if (vb->state == VB2_BUF_STATE_IN_REQUEST) {
		vb->state = VB2_BUF_STATE_DEQUEUED;
		if (vb->request)
			media_request_put(vb->request);
		vb->request = NULL;
	}
}

static const struct media_request_object_ops vb2_core_req_ops = {
	.prepare = vb2_req_prepare,
	.unprepare = vb2_req_unprepare,
	.queue = vb2_req_queue,
	.unbind = vb2_req_unbind,
	.release = vb2_req_release,
};

bool vb2_request_object_is_buffer(struct media_request_object *obj)
{
	return obj->ops == &vb2_core_req_ops;
}
EXPORT_SYMBOL_GPL(vb2_request_object_is_buffer);

unsigned int vb2_request_buffer_cnt(struct media_request *req)
{
	struct media_request_object *obj;
	unsigned long flags;
	unsigned int buffer_cnt = 0;

	spin_lock_irqsave(&req->lock, flags);
	list_for_each_entry(obj, &req->objects, list)
		if (vb2_request_object_is_buffer(obj))
			buffer_cnt++;
	spin_unlock_irqrestore(&req->lock, flags);

	return buffer_cnt;
}
EXPORT_SYMBOL_GPL(vb2_request_buffer_cnt);

int vb2_core_prepare_buf(struct vb2_queue *q, struct vb2_buffer *vb, void *pb)
{
	int ret;

	if (vb->state != VB2_BUF_STATE_DEQUEUED) {
		dprintk(q, 1, "invalid buffer state %s\n",
			vb2_state_name(vb->state));
		return -EINVAL;
	}
	if (vb->prepared) {
		dprintk(q, 1, "buffer already prepared\n");
		return -EINVAL;
	}

	ret = __buf_prepare(vb);
	if (ret)
		return ret;

	/* Fill buffer information for the userspace */
	call_void_bufop(q, fill_user_buffer, vb, pb);

	dprintk(q, 2, "prepare of buffer %d succeeded\n", vb->index);

	return 0;
}
EXPORT_SYMBOL_GPL(vb2_core_prepare_buf);

int vb2_core_remove_bufs(struct vb2_queue *q, unsigned int start, unsigned int count)
{
	unsigned int i, ret = 0;
	unsigned int q_num_bufs = vb2_get_num_buffers(q);

	if (count == 0)
		return 0;

	if (count > q_num_bufs)
		return -EINVAL;

	if (start > q->max_num_buffers - count)
		return -EINVAL;

	mutex_lock(&q->mmap_lock);

	/* Check that all buffers in the range exist */
	for (i = start; i < start + count; i++) {
		struct vb2_buffer *vb = vb2_get_buffer(q, i);

		if (!vb) {
			ret = -EINVAL;
			goto unlock;
		}
		if (vb->state != VB2_BUF_STATE_DEQUEUED) {
			ret = -EBUSY;
			goto unlock;
		}
	}
	__vb2_queue_free(q, start, count);
	dprintk(q, 2, "%u buffers removed\n", count);

unlock:
	mutex_unlock(&q->mmap_lock);
	return ret;
}
EXPORT_SYMBOL_GPL(vb2_core_remove_bufs);

/*
 * vb2_start_streaming() - Attempt to start streaming.
 * @q:		videobuf2 queue
 *
 * Attempt to start streaming. When this function is called there must be
 * at least q->min_queued_buffers queued up (i.e. the minimum
 * number of buffers required for the DMA engine to function). If the
 * @start_streaming op fails it is supposed to return all the driver-owned
 * buffers back to vb2 in state QUEUED. Check if that happened and if
 * not warn and reclaim them forcefully.
 */
static int vb2_start_streaming(struct vb2_queue *q)
{
	struct vb2_buffer *vb;
	int ret;

	/*
	 * If any buffers were queued before streamon,
	 * we can now pass them to driver for processing.
	 */
	list_for_each_entry(vb, &q->queued_list, queued_entry)
		__enqueue_in_driver(vb);

	/* Tell the driver to start streaming */
	q->start_streaming_called = 1;
	ret = call_qop(q, start_streaming, q,
		       atomic_read(&q->owned_by_drv_count));
	if (!ret)
		return 0;

	q->start_streaming_called = 0;

	dprintk(q, 1, "driver refused to start streaming\n");
	/*
	 * If you see this warning, then the driver isn't cleaning up properly
	 * after a failed start_streaming(). See the start_streaming()
	 * documentation in videobuf2-core.h for more information how buffers
	 * should be returned to vb2 in start_streaming().
	 */
	if (WARN_ON(atomic_read(&q->owned_by_drv_count))) {
		unsigned i;

		/*
		 * Forcefully reclaim buffers if the driver did not
		 * correctly return them to vb2.
		 */
		for (i = 0; i < q->max_num_buffers; ++i) {
			vb = vb2_get_buffer(q, i);

			if (!vb)
				continue;

			if (vb->state == VB2_BUF_STATE_ACTIVE)
				vb2_buffer_done(vb, VB2_BUF_STATE_QUEUED);
		}
		/* Must be zero now */
		WARN_ON(atomic_read(&q->owned_by_drv_count));
	}
	/*
	 * If done_list is not empty, then start_streaming() didn't call
	 * vb2_buffer_done(vb, VB2_BUF_STATE_QUEUED) but STATE_ERROR or
	 * STATE_DONE.
	 */
	WARN_ON(!list_empty(&q->done_list));
	return ret;
}

int vb2_core_qbuf(struct vb2_queue *q, struct vb2_buffer *vb, void *pb,
		  struct media_request *req)
{
	enum vb2_buffer_state orig_state;
	int ret;

	if (q->error) {
		dprintk(q, 1, "fatal error occurred on queue\n");
		return -EIO;
	}

	if (!req && vb->state != VB2_BUF_STATE_IN_REQUEST &&
	    q->requires_requests) {
		dprintk(q, 1, "qbuf requires a request\n");
		return -EBADR;
	}

	if ((req && q->uses_qbuf) ||
	    (!req && vb->state != VB2_BUF_STATE_IN_REQUEST &&
	     q->uses_requests)) {
		dprintk(q, 1, "queue in wrong mode (qbuf vs requests)\n");
		return -EBUSY;
	}

	if (req) {
		int ret;

		q->uses_requests = 1;
		if (vb->state != VB2_BUF_STATE_DEQUEUED) {
			dprintk(q, 1, "buffer %d not in dequeued state\n",
				vb->index);
			return -EINVAL;
		}

		if (q->is_output && !vb->prepared) {
			ret = call_vb_qop(vb, buf_out_validate, vb);
			if (ret) {
				dprintk(q, 1, "buffer validation failed\n");
				return ret;
			}
		}

		media_request_object_init(&vb->req_obj);

		/* Make sure the request is in a safe state for updating. */
		ret = media_request_lock_for_update(req);
		if (ret)
			return ret;
		ret = media_request_object_bind(req, &vb2_core_req_ops,
						q, true, &vb->req_obj);
		media_request_unlock_for_update(req);
		if (ret)
			return ret;

		vb->state = VB2_BUF_STATE_IN_REQUEST;

		/*
		 * Increment the refcount and store the request.
		 * The request refcount is decremented again when the
		 * buffer is dequeued. This is to prevent vb2_buffer_done()
		 * from freeing the request from interrupt context, which can
		 * happen if the application closed the request fd after
		 * queueing the request.
		 */
		media_request_get(req);
		vb->request = req;

		/* Fill buffer information for the userspace */
		if (pb) {
			call_void_bufop(q, copy_timestamp, vb, pb);
			call_void_bufop(q, fill_user_buffer, vb, pb);
		}

		dprintk(q, 2, "qbuf of buffer %d succeeded\n", vb->index);
		return 0;
	}

	if (vb->state != VB2_BUF_STATE_IN_REQUEST)
		q->uses_qbuf = 1;

	switch (vb->state) {
	case VB2_BUF_STATE_DEQUEUED:
	case VB2_BUF_STATE_IN_REQUEST:
		if (!vb->prepared) {
			ret = __buf_prepare(vb);
			if (ret)
				return ret;
		}
		break;
	case VB2_BUF_STATE_PREPARING:
		dprintk(q, 1, "buffer still being prepared\n");
		return -EINVAL;
	default:
		dprintk(q, 1, "invalid buffer state %s\n",
			vb2_state_name(vb->state));
		return -EINVAL;
	}

	/*
	 * Add to the queued buffers list, a buffer will stay on it until
	 * dequeued in dqbuf.
	 */
	orig_state = vb->state;
	list_add_tail(&vb->queued_entry, &q->queued_list);
	q->queued_count++;
	q->waiting_for_buffers = false;
	vb->state = VB2_BUF_STATE_QUEUED;

	if (pb)
		call_void_bufop(q, copy_timestamp, vb, pb);

	trace_vb2_qbuf(q, vb);

	/*
	 * If already streaming, give the buffer to driver for processing.
	 * If not, the buffer will be given to driver on next streamon.
	 */
	if (q->start_streaming_called)
		__enqueue_in_driver(vb);

	/* Fill buffer information for the userspace */
	if (pb)
		call_void_bufop(q, fill_user_buffer, vb, pb);

	/*
	 * If streamon has been called, and we haven't yet called
	 * start_streaming() since not enough buffers were queued, and
	 * we now have reached the minimum number of queued buffers,
	 * then we can finally call start_streaming().
	 */
	if (q->streaming && !q->start_streaming_called &&
	    q->queued_count >= q->min_queued_buffers) {
		ret = vb2_start_streaming(q);
		if (ret) {
			/*
			 * Since vb2_core_qbuf will return with an error,
			 * we should return it to state DEQUEUED since
			 * the error indicates that the buffer wasn't queued.
			 */
			list_del(&vb->queued_entry);
			q->queued_count--;
			vb->state = orig_state;
			return ret;
		}
	}

	dprintk(q, 2, "qbuf of buffer %d succeeded\n", vb->index);
	return 0;
}
EXPORT_SYMBOL_GPL(vb2_core_qbuf);

/*
 * __vb2_wait_for_done_vb() - wait for a buffer to become available
 * for dequeuing
 *
 * Will sleep if required for nonblocking == false.
 */
static int __vb2_wait_for_done_vb(struct vb2_queue *q, int nonblocking)
{
	/*
	 * All operations on vb_done_list are performed under done_lock
	 * spinlock protection. However, buffers may be removed from
	 * it and returned to userspace only while holding both driver's
	 * lock and the done_lock spinlock. Thus we can be sure that as
	 * long as we hold the driver's lock, the list will remain not
	 * empty if list_empty() check succeeds.
	 */

	for (;;) {
		int ret;

		if (q->waiting_in_dqbuf) {
			dprintk(q, 1, "another dup()ped fd is waiting for a buffer\n");
			return -EBUSY;
		}

		if (!q->streaming) {
			dprintk(q, 1, "streaming off, will not wait for buffers\n");
			return -EINVAL;
		}

		if (q->error) {
			dprintk(q, 1, "Queue in error state, will not wait for buffers\n");
			return -EIO;
		}

		if (q->last_buffer_dequeued) {
			dprintk(q, 3, "last buffer dequeued already, will not wait for buffers\n");
			return -EPIPE;
		}

		if (!list_empty(&q->done_list)) {
			/*
			 * Found a buffer that we were waiting for.
			 */
			break;
		}

		if (nonblocking) {
			dprintk(q, 3, "nonblocking and no buffers to dequeue, will not wait\n");
			return -EAGAIN;
		}

		q->waiting_in_dqbuf = 1;
		/*
		 * We are streaming and blocking, wait for another buffer to
		 * become ready or for streamoff. Driver's lock is released to
		 * allow streamoff or qbuf to be called while waiting.
		 */
		mutex_unlock(q->lock);

		/*
		 * All locks have been released, it is safe to sleep now.
		 */
		dprintk(q, 3, "will sleep waiting for buffers\n");
		ret = wait_event_interruptible(q->done_wq,
				!list_empty(&q->done_list) || !q->streaming ||
				q->error);

		mutex_lock(q->lock);

		q->waiting_in_dqbuf = 0;
		/*
		 * We need to reevaluate both conditions again after reacquiring
		 * the locks or return an error if one occurred.
		 */
		if (ret) {
			dprintk(q, 1, "sleep was interrupted\n");
			return ret;
		}
	}
	return 0;
}

/*
 * __vb2_get_done_vb() - get a buffer ready for dequeuing
 *
 * Will sleep if required for nonblocking == false.
 */
static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,
			     void *pb, int nonblocking)
{
	unsigned long flags;
	int ret = 0;

	/*
	 * Wait for at least one buffer to become available on the done_list.
	 */
	ret = __vb2_wait_for_done_vb(q, nonblocking);
	if (ret)
		return ret;

	/*
	 * Driver's lock has been held since we last verified that done_list
	 * is not empty, so no need for another list_empty(done_list) check.
	 */
	spin_lock_irqsave(&q->done_lock, flags);
	*vb = list_first_entry(&q->done_list, struct vb2_buffer, done_entry);
	/*
	 * Only remove the buffer from done_list if all planes can be
	 * handled. Some cases such as V4L2 file I/O and DVB have pb
	 * == NULL; skip the check then as there's nothing to verify.
	 */
	if (pb)
		ret = call_bufop(q, verify_planes_array, *vb, pb);
	if (!ret)
		list_del(&(*vb)->done_entry);
	spin_unlock_irqrestore(&q->done_lock, flags);

	return ret;
}

int vb2_wait_for_all_buffers(struct vb2_queue *q)
{
	if (!q->streaming) {
		dprintk(q, 1, "streaming off, will not wait for buffers\n");
		return -EINVAL;
	}

	if (q->start_streaming_called)
		wait_event(q->done_wq, !atomic_read(&q->owned_by_drv_count));
	return 0;
}
EXPORT_SYMBOL_GPL(vb2_wait_for_all_buffers);

/*
 * __vb2_dqbuf() - bring back the buffer to the DEQUEUED state
 */
static void __vb2_dqbuf(struct vb2_buffer *vb)
{
	struct vb2_queue *q = vb->vb2_queue;

	/* nothing to do if the buffer is already dequeued */
	if (vb->state == VB2_BUF_STATE_DEQUEUED)
		return;

	vb->state = VB2_BUF_STATE_DEQUEUED;

	call_void_bufop(q, init_buffer, vb);
}

int vb2_core_dqbuf(struct vb2_queue *q, unsigned int *pindex, void *pb,
		   bool nonblocking)
{
	struct vb2_buffer *vb = NULL;
	int ret;

	ret = __vb2_get_done_vb(q, &vb, pb, nonblocking);
	if (ret < 0)
		return ret;

	switch (vb->state) {
	case VB2_BUF_STATE_DONE:
		dprintk(q, 3, "returning done buffer\n");
		break;
	case VB2_BUF_STATE_ERROR:
		dprintk(q, 3, "returning done buffer with errors\n");
		break;
	default:
		dprintk(q, 1, "invalid buffer state %s\n",
			vb2_state_name(vb->state));
		return -EINVAL;
	}

	call_void_vb_qop(vb, buf_finish, vb);
	vb->prepared = 0;

	if (pindex)
		*pindex = vb->index;

	/* Fill buffer information for the userspace */
	if (pb)
		call_void_bufop(q, fill_user_buffer, vb, pb);

	/* Remove from vb2 queue */
	list_del(&vb->queued_entry);
	q->queued_count--;

	trace_vb2_dqbuf(q, vb);

	/* go back to dequeued state */
	__vb2_dqbuf(vb);

	if (WARN_ON(vb->req_obj.req)) {
		media_request_object_unbind(&vb->req_obj);
		media_request_object_put(&vb->req_obj);
	}
	if (vb->request)
		media_request_put(vb->request);
	vb->request = NULL;

	dprintk(q, 2, "dqbuf of buffer %d, state: %s\n",
		vb->index, vb2_state_name(vb->state));

	return 0;

}
EXPORT_SYMBOL_GPL(vb2_core_dqbuf);

/*
 * __vb2_queue_cancel() - cancel and stop (pause) streaming
 *
 * Removes all queued buffers from driver's queue and all buffers queued by
 * userspace from vb2's queue. Returns to state after reqbufs.
 */
static void __vb2_queue_cancel(struct vb2_queue *q)
{
	unsigned int i;

	/*
	 * Tell driver to stop all transactions and release all queued
	 * buffers.
	 */
	if (q->start_streaming_called)
		call_void_qop(q, stop_streaming, q);

	if (q->streaming)
		call_void_qop(q, unprepare_streaming, q);

	/*
	 * If you see this warning, then the driver isn't cleaning up properly
	 * in stop_streaming(). See the stop_streaming() documentation in
	 * videobuf2-core.h for more information how buffers should be returned
	 * to vb2 in stop_streaming().
	 */
	if (WARN_ON(atomic_read(&q->owned_by_drv_count))) {
		for (i = 0; i < q->max_num_buffers; i++) {
			struct vb2_buffer *vb = vb2_get_buffer(q, i);

			if (!vb)
				continue;

			if (vb->state == VB2_BUF_STATE_ACTIVE) {
				pr_warn("driver bug: stop_streaming operation is leaving buffer %u in active state\n",
					vb->index);
				vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
			}
		}
		/* Must be zero now */
		WARN_ON(atomic_read(&q->owned_by_drv_count));
	}

	q->streaming = 0;
	q->start_streaming_called = 0;
	q->queued_count = 0;
	q->error = 0;
	q->uses_requests = 0;
	q->uses_qbuf = 0;

	/*
	 * Remove all buffers from vb2's list...
	 */
	INIT_LIST_HEAD(&q->queued_list);
	/*
	 * ...and done list; userspace will not receive any buffers it
	 * has not already dequeued before initiating cancel.
	 */
	INIT_LIST_HEAD(&q->done_list);
	atomic_set(&q->owned_by_drv_count, 0);
	wake_up_all(&q->done_wq);

	/*
	 * Reinitialize all buffers for next use.
	 * Make sure to call buf_finish for any queued buffers. Normally
	 * that's done in dqbuf, but that's not going to happen when we
	 * cancel the whole queue. Note: this code belongs here, not in
	 * __vb2_dqbuf() since in vb2_core_dqbuf() there is a critical
	 * call to __fill_user_buffer() after buf_finish(). That order can't
	 * be changed, so we can't move the buf_finish() to __vb2_dqbuf().
	 */
	for (i = 0; i < q->max_num_buffers; i++) {
		struct vb2_buffer *vb;
		struct media_request *req;

		vb = vb2_get_buffer(q, i);
		if (!vb)
			continue;

		req = vb->req_obj.req;
		/*
		 * If a request is associated with this buffer, then
		 * call buf_request_cancel() to give the driver to complete()
		 * related request objects. Otherwise those objects would
		 * never complete.
		 */
		if (req) {
			enum media_request_state state;
			unsigned long flags;

			spin_lock_irqsave(&req->lock, flags);
			state = req->state;
			spin_unlock_irqrestore(&req->lock, flags);

			if (state == MEDIA_REQUEST_STATE_QUEUED)
				call_void_vb_qop(vb, buf_request_complete, vb);
		}

		__vb2_buf_mem_finish(vb);

		if (vb->prepared) {
			call_void_vb_qop(vb, buf_finish, vb);
			vb->prepared = 0;
		}
		__vb2_dqbuf(vb);

		if (vb->req_obj.req) {
			media_request_object_unbind(&vb->req_obj);
			media_request_object_put(&vb->req_obj);
		}
		if (vb->request)
			media_request_put(vb->request);
		vb->request = NULL;
		vb->copied_timestamp = 0;
	}
}

int vb2_core_streamon(struct vb2_queue *q, unsigned int type)
{
	unsigned int q_num_bufs = vb2_get_num_buffers(q);
	int ret;

	if (type != q->type) {
		dprintk(q, 1, "invalid stream type\n");
		return -EINVAL;
	}

	if (q->streaming) {
		dprintk(q, 3, "already streaming\n");
		return 0;
	}

	if (!q_num_bufs) {
		dprintk(q, 1, "no buffers have been allocated\n");
		return -EINVAL;
	}

	if (q_num_bufs < q->min_queued_buffers) {
		dprintk(q, 1, "need at least %u allocated buffers\n",
			q->min_queued_buffers);
		return -EINVAL;
	}

	ret = call_qop(q, prepare_streaming, q);
	if (ret)
		return ret;

	/*
	 * Tell driver to start streaming provided sufficient buffers
	 * are available.
	 */
	if (q->queued_count >= q->min_queued_buffers) {
		ret = vb2_start_streaming(q);
		if (ret)
			goto unprepare;
	}

	q->streaming = 1;

	dprintk(q, 3, "successful\n");
	return 0;

unprepare:
	call_void_qop(q, unprepare_streaming, q);
	return ret;
}
EXPORT_SYMBOL_GPL(vb2_core_streamon);

void vb2_queue_error(struct vb2_queue *q)
{
	q->error = 1;

	wake_up_all(&q->done_wq);
}
EXPORT_SYMBOL_GPL(vb2_queue_error);

int vb2_core_streamoff(struct vb2_queue *q, unsigned int type)
{
	if (type != q->type) {
		dprintk(q, 1, "invalid stream type\n");
		return -EINVAL;
	}

	/*
	 * Cancel will pause streaming and remove all buffers from the driver
	 * and vb2, effectively returning control over them to userspace.
	 *
	 * Note that we do this even if q->streaming == 0: if you prepare or
	 * queue buffers, and then call streamoff without ever having called
	 * streamon, you would still expect those buffers to be returned to
	 * their normal dequeued state.
	 */
	__vb2_queue_cancel(q);
	q->waiting_for_buffers = !q->is_output;
	q->last_buffer_dequeued = false;

	dprintk(q, 3, "successful\n");
	return 0;
}
EXPORT_SYMBOL_GPL(vb2_core_streamoff);

/*
 * __find_plane_by_offset() - find plane associated with the given offset
 */
static int __find_plane_by_offset(struct vb2_queue *q, unsigned long offset,
			struct vb2_buffer **vb, unsigned int *plane)
{
	unsigned int buffer;

	/*
	 * Sanity checks to ensure the lock is held, MEMORY_MMAP is
	 * used and fileio isn't active.
	 */
	lockdep_assert_held(&q->mmap_lock);

	if (q->memory != VB2_MEMORY_MMAP) {
		dprintk(q, 1, "queue is not currently set up for mmap\n");
		return -EINVAL;
	}

	if (vb2_fileio_is_active(q)) {
		dprintk(q, 1, "file io in progress\n");
		return -EBUSY;
	}

	/* Get buffer and plane from the offset */
	buffer = (offset >> PLANE_INDEX_SHIFT) & BUFFER_INDEX_MASK;
	*plane = (offset >> PAGE_SHIFT) & PLANE_INDEX_MASK;

	*vb = vb2_get_buffer(q, buffer);
	if (!*vb)
		return -EINVAL;
	if (*plane >= (*vb)->num_planes)
		return -EINVAL;

	return 0;
}

int vb2_core_expbuf(struct vb2_queue *q, int *fd, unsigned int type,
		    struct vb2_buffer *vb, unsigned int plane, unsigned int flags)
{
	struct vb2_plane *vb_plane;
	int ret;
	struct dma_buf *dbuf;

	if (q->memory != VB2_MEMORY_MMAP) {
		dprintk(q, 1, "queue is not currently set up for mmap\n");
		return -EINVAL;
	}

	if (!q->mem_ops->get_dmabuf) {
		dprintk(q, 1, "queue does not support DMA buffer exporting\n");
		return -EINVAL;
	}

	if (flags & ~(O_CLOEXEC | O_ACCMODE)) {
		dprintk(q, 1, "queue does support only O_CLOEXEC and access mode flags\n");
		return -EINVAL;
	}

	if (type != q->type) {
		dprintk(q, 1, "invalid buffer type\n");
		return -EINVAL;
	}

	if (plane >= vb->num_planes) {
		dprintk(q, 1, "buffer plane out of range\n");
		return -EINVAL;
	}

	if (vb2_fileio_is_active(q)) {
		dprintk(q, 1, "expbuf: file io in progress\n");
		return -EBUSY;
	}

	vb_plane = &vb->planes[plane];

	dbuf = call_ptr_memop(get_dmabuf,
			      vb,
			      vb_plane->mem_priv,
			      flags & O_ACCMODE);
	if (IS_ERR_OR_NULL(dbuf)) {
		dprintk(q, 1, "failed to export buffer %d, plane %d\n",
			vb->index, plane);
		return -EINVAL;
	}

	ret = dma_buf_fd(dbuf, flags & ~O_ACCMODE);
	if (ret < 0) {
		dprintk(q, 3, "buffer %d, plane %d failed to export (%d)\n",
			vb->index, plane, ret);
		dma_buf_put(dbuf);
		return ret;
	}

	dprintk(q, 3, "buffer %d, plane %d exported as %d descriptor\n",
		vb->index, plane, ret);
	*fd = ret;

	return 0;
}
EXPORT_SYMBOL_GPL(vb2_core_expbuf);

int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
{
	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
	struct vb2_buffer *vb;
	unsigned int plane = 0;
	int ret;
	unsigned long length;

	/*
	 * Check memory area access mode.
	 */
	if (!(vma->vm_flags & VM_SHARED)) {
		dprintk(q, 1, "invalid vma flags, VM_SHARED needed\n");
		return -EINVAL;
	}
	if (q->is_output) {
		if (!(vma->vm_flags & VM_WRITE)) {
			dprintk(q, 1, "invalid vma flags, VM_WRITE needed\n");
			return -EINVAL;
		}
	} else {
		if (!(vma->vm_flags & VM_READ)) {
			dprintk(q, 1, "invalid vma flags, VM_READ needed\n");
			return -EINVAL;
		}
	}

	mutex_lock(&q->mmap_lock);

	/*
	 * Find the plane corresponding to the offset passed by userspace. This
	 * will return an error if not MEMORY_MMAP or file I/O is in progress.
	 */
	ret = __find_plane_by_offset(q, offset, &vb, &plane);
	if (ret)
		goto unlock;

	/*
	 * MMAP requires page_aligned buffers.
	 * The buffer length was page_aligned at __vb2_buf_mem_alloc(),
	 * so, we need to do the same here.
	 */
	length = PAGE_ALIGN(vb->planes[plane].length);
	if (length < (vma->vm_end - vma->vm_start)) {
		dprintk(q, 1,
			"MMAP invalid, as it would overflow buffer length\n");
		ret = -EINVAL;
		goto unlock;
	}

	/*
	 * vm_pgoff is treated in V4L2 API as a 'cookie' to select a buffer,
	 * not as a in-buffer offset. We always want to mmap a whole buffer
	 * from its beginning.
	 */
	vma->vm_pgoff = 0;

	ret = call_memop(vb, mmap, vb->planes[plane].mem_priv, vma);

unlock:
	mutex_unlock(&q->mmap_lock);
	if (ret)
		return ret;

	dprintk(q, 3, "buffer %u, plane %d successfully mapped\n", vb->index, plane);
	return 0;
}
EXPORT_SYMBOL_GPL(vb2_mmap);

#ifndef CONFIG_MMU
unsigned long vb2_get_unmapped_area(struct vb2_queue *q,
				    unsigned long addr,
				    unsigned long len,
				    unsigned long pgoff,
				    unsigned long flags)
{
	unsigned long offset = pgoff << PAGE_SHIFT;
	struct vb2_buffer *vb;
	unsigned int plane;
	void *vaddr;
	int ret;

	mutex_lock(&q->mmap_lock);

	/*
	 * Find the plane corresponding to the offset passed by userspace. This
	 * will return an error if not MEMORY_MMAP or file I/O is in progress.
	 */
	ret = __find_plane_by_offset(q, offset, &vb, &plane);
	if (ret)
		goto unlock;

	vaddr = vb2_plane_vaddr(vb, plane);
	mutex_unlock(&q->mmap_lock);
	return vaddr ? (unsigned long)vaddr : -EINVAL;

unlock:
	mutex_unlock(&q->mmap_lock);
	return ret;
}
EXPORT_SYMBOL_GPL(vb2_get_unmapped_area);
#endif

int vb2_core_queue_init(struct vb2_queue *q)
{
	/*
	 * Sanity check
	 */
	/*
	 * For drivers who don't support max_num_buffers ensure
	 * a backward compatibility.
	 */
	if (!q->max_num_buffers)
		q->max_num_buffers = VB2_MAX_FRAME;

	/* The maximum is limited by offset cookie encoding pattern */
	q->max_num_buffers = min_t(unsigned int, q->max_num_buffers, MAX_BUFFER_INDEX);

	if (WARN_ON(!q)			  ||
	    WARN_ON(!q->ops)		  ||
	    WARN_ON(!q->mem_ops)	  ||
	    WARN_ON(!q->type)		  ||
	    WARN_ON(!q->io_modes)	  ||
	    WARN_ON(!q->ops->queue_setup) ||
	    WARN_ON(!q->ops->buf_queue))
		return -EINVAL;

	if (WARN_ON(q->max_num_buffers < VB2_MAX_FRAME) ||
	    WARN_ON(q->min_queued_buffers > q->max_num_buffers))
		return -EINVAL;

	if (WARN_ON(q->requires_requests && !q->supports_requests))
		return -EINVAL;

	/*
	 * This combination is not allowed since a non-zero value of
	 * q->min_queued_buffers can cause vb2_core_qbuf() to fail if
	 * it has to call start_streaming(), and the Request API expects
	 * that queueing a request (and thus queueing a buffer contained
	 * in that request) will always succeed. There is no method of
	 * propagating an error back to userspace.
	 */
	if (WARN_ON(q->supports_requests && q->min_queued_buffers))
		return -EINVAL;

	/*
	 * If the driver needs 'min_queued_buffers' in the queue before
	 * calling start_streaming() then the minimum requirement is
	 * 'min_queued_buffers + 1' to keep at least one buffer available
	 * for userspace.
	 */
	if (q->min_reqbufs_allocation < q->min_queued_buffers + 1)
		q->min_reqbufs_allocation = q->min_queued_buffers + 1;

	if (WARN_ON(q->min_reqbufs_allocation > q->max_num_buffers))
		return -EINVAL;

	/* Warn if q->lock is NULL */
	if (WARN_ON(!q->lock))
		return -EINVAL;

	INIT_LIST_HEAD(&q->queued_list);
	INIT_LIST_HEAD(&q->done_list);
	spin_lock_init(&q->done_lock);
	mutex_init(&q->mmap_lock);
	init_waitqueue_head(&q->done_wq);

	q->memory = VB2_MEMORY_UNKNOWN;

	if (q->buf_struct_size == 0)
		q->buf_struct_size = sizeof(struct vb2_buffer);

	if (q->bidirectional)
		q->dma_dir = DMA_BIDIRECTIONAL;
	else
		q->dma_dir = q->is_output ? DMA_TO_DEVICE : DMA_FROM_DEVICE;

	if (q->name[0] == '\0')
		snprintf(q->name, sizeof(q->name), "%s-%p",
			 q->is_output ? "out" : "cap", q);

	return 0;
}
EXPORT_SYMBOL_GPL(vb2_core_queue_init);

static int __vb2_init_fileio(struct vb2_queue *q, int read);
static int __vb2_cleanup_fileio(struct vb2_queue *q);
void vb2_core_queue_release(struct vb2_queue *q)
{
	__vb2_cleanup_fileio(q);
	__vb2_queue_cancel(q);
	mutex_lock(&q->mmap_lock);
	__vb2_queue_free(q, 0, q->max_num_buffers);
	vb2_core_free_buffers_storage(q);
	q->is_busy = 0;
	mutex_unlock(&q->mmap_lock);
}
EXPORT_SYMBOL_GPL(vb2_core_queue_release);

__poll_t vb2_core_poll(struct vb2_queue *q, struct file *file,
		poll_table *wait)
{
	__poll_t req_events = poll_requested_events(wait);
	struct vb2_buffer *vb = NULL;
	unsigned long flags;

	/*
	 * poll_wait() MUST be called on the first invocation on all the
	 * potential queues of interest, even if we are not interested in their
	 * events during this first call. Failure to do so will result in
	 * queue's events to be ignored because the poll_table won't be capable
	 * of adding new wait queues thereafter.
	 */
	poll_wait(file, &q->done_wq, wait);

	if (!q->is_output && !(req_events & (EPOLLIN | EPOLLRDNORM)))
		return 0;
	if (q->is_output && !(req_events & (EPOLLOUT | EPOLLWRNORM)))
		return 0;

	/*
	 * Start file I/O emulator only if streaming API has not been used yet.
	 */
	if (vb2_get_num_buffers(q) == 0 && !vb2_fileio_is_active(q)) {
		if (!q->is_output && (q->io_modes & VB2_READ) &&
				(req_events & (EPOLLIN | EPOLLRDNORM))) {
			if (__vb2_init_fileio(q, 1))
				return EPOLLERR;
		}
		if (q->is_output && (q->io_modes & VB2_WRITE) &&
				(req_events & (EPOLLOUT | EPOLLWRNORM))) {
			if (__vb2_init_fileio(q, 0))
				return EPOLLERR;
			/*
			 * Write to OUTPUT queue can be done immediately.
			 */
			return EPOLLOUT | EPOLLWRNORM;
		}
	}

	/*
	 * There is nothing to wait for if the queue isn't streaming, or if the
	 * error flag is set.
	 */
	if (!vb2_is_streaming(q) || q->error)
		return EPOLLERR;

	/*
	 * If this quirk is set and QBUF hasn't been called yet then
	 * return EPOLLERR as well. This only affects capture queues, output
	 * queues will always initialize waiting_for_buffers to false.
	 * This quirk is set by V4L2 for backwards compatibility reasons.
	 */
	if (q->quirk_poll_must_check_waiting_for_buffers &&
	    q->waiting_for_buffers && (req_events & (EPOLLIN | EPOLLRDNORM)))
		return EPOLLERR;

	/*
	 * For output streams you can call write() as long as there are fewer
	 * buffers queued than there are buffers available.
	 */
	if (q->is_output && q->fileio && q->queued_count < vb2_get_num_buffers(q))
		return EPOLLOUT | EPOLLWRNORM;

	if (list_empty(&q->done_list)) {
		/*
		 * If the last buffer was dequeued from a capture queue,
		 * return immediately. DQBUF will return -EPIPE.
		 */
		if (q->last_buffer_dequeued)
			return EPOLLIN | EPOLLRDNORM;
	}

	/*
	 * Take first buffer available for dequeuing.
	 */
	spin_lock_irqsave(&q->done_lock, flags);
	if (!list_empty(&q->done_list))
		vb = list_first_entry(&q->done_list, struct vb2_buffer,
					done_entry);
	spin_unlock_irqrestore(&q->done_lock, flags);

	if (vb && (vb->state == VB2_BUF_STATE_DONE
			|| vb->state == VB2_BUF_STATE_ERROR)) {
		return (q->is_output) ?
				EPOLLOUT | EPOLLWRNORM :
				EPOLLIN | EPOLLRDNORM;
	}
	return 0;
}
EXPORT_SYMBOL_GPL(vb2_core_poll);

/*
 * struct vb2_fileio_buf - buffer context used by file io emulator
 *
 * vb2 provides a compatibility layer and emulator of file io (read and
 * write) calls on top of streaming API. This structure is used for
 * tracking context related to the buffers.
 */
struct vb2_fileio_buf {
	void *vaddr;
	unsigned int size;
	unsigned int pos;
	unsigned int queued:1;
};

/*
 * struct vb2_fileio_data - queue context used by file io emulator
 *
 * @cur_index:	the index of the buffer currently being read from or
 *		written to. If equal to number of buffers in the vb2_queue
 *		then a new buffer must be dequeued.
 * @initial_index: in the read() case all buffers are queued up immediately
 *		in __vb2_init_fileio() and __vb2_perform_fileio() just cycles
 *		buffers. However, in the write() case no buffers are initially
 *		queued, instead whenever a buffer is full it is queued up by
 *		__vb2_perform_fileio(). Only once all available buffers have
 *		been queued up will __vb2_perform_fileio() start to dequeue
 *		buffers. This means that initially __vb2_perform_fileio()
 *		needs to know what buffer index to use when it is queuing up
 *		the buffers for the first time. That initial index is stored
 *		in this field. Once it is equal to number of buffers in the
 *		vb2_queue all available buffers have been queued and
 *		__vb2_perform_fileio() should start the normal dequeue/queue cycle.
 *
 * vb2 provides a compatibility layer and emulator of file io (read and
 * write) calls on top of streaming API. For proper operation it required
 * this structure to save the driver state between each call of the read
 * or write function.
 */
struct vb2_fileio_data {
	unsigned int count;
	unsigned int type;
	unsigned int memory;
	struct vb2_fileio_buf bufs[VB2_MAX_FRAME];
	unsigned int cur_index;
	unsigned int initial_index;
	unsigned int q_count;
	unsigned int dq_count;
	unsigned read_once:1;
	unsigned write_immediately:1;
};

/*
 * __vb2_init_fileio() - initialize file io emulator
 * @q:		videobuf2 queue
 * @read:	mode selector (1 means read, 0 means write)
 */
static int __vb2_init_fileio(struct vb2_queue *q, int read)
{
	struct vb2_fileio_data *fileio;
	struct vb2_buffer *vb;
	int i, ret;

	/*
	 * Sanity check
	 */
	if (WARN_ON((read && !(q->io_modes & VB2_READ)) ||
		    (!read && !(q->io_modes & VB2_WRITE))))
		return -EINVAL;

	/*
	 * Check if device supports mapping buffers to kernel virtual space.
	 */
	if (!q->mem_ops->vaddr)
		return -EBUSY;

	/*
	 * Check if streaming api has not been already activated.
	 */
	if (q->streaming || vb2_get_num_buffers(q) > 0)
		return -EBUSY;

	dprintk(q, 3, "setting up file io: mode %s, count %d, read_once %d, write_immediately %d\n",
		(read) ? "read" : "write", q->min_reqbufs_allocation, q->fileio_read_once,
		q->fileio_write_immediately);

	fileio = kzalloc_obj(*fileio);
	if (fileio == NULL)
		return -ENOMEM;

	fileio->read_once = q->fileio_read_once;
	fileio->write_immediately = q->fileio_write_immediately;

	/*
	 * Request buffers and use MMAP type to force driver
	 * to allocate buffers by itself.
	 */
	fileio->count = q->min_reqbufs_allocation;
	fileio->memory = VB2_MEMORY_MMAP;
	fileio->type = q->type;
	q->fileio = fileio;
	ret = vb2_core_reqbufs(q, fileio->memory, 0, &fileio->count);
	if (ret)
		goto err_kfree;
	/* vb2_fileio_data supports max VB2_MAX_FRAME buffers */
	if (fileio->count > VB2_MAX_FRAME) {
		dprintk(q, 1, "fileio: more than VB2_MAX_FRAME buffers requested\n");
		ret = -ENOSPC;
		goto err_reqbufs;
	}

	/*
	 * Userspace can never add or delete buffers later, so there
	 * will never be holes. It is safe to assume that vb2_get_buffer(q, 0)
	 * will always return a valid vb pointer
	 */
	vb = vb2_get_buffer(q, 0);

	/*
	 * Check if plane_count is correct
	 * (multiplane buffers are not supported).
	 */
	if (vb->num_planes != 1) {
		ret = -EBUSY;
		goto err_reqbufs;
	}

	/*
	 * Get kernel address of each buffer.
	 */
	for (i = 0; i < vb2_get_num_buffers(q); i++) {
		/* vb can never be NULL when using fileio. */
		vb = vb2_get_buffer(q, i);

		fileio->bufs[i].vaddr = vb2_plane_vaddr(vb, 0);
		if (fileio->bufs[i].vaddr == NULL) {
			ret = -EINVAL;
			goto err_reqbufs;
		}
		fileio->bufs[i].size = vb2_plane_size(vb, 0);
	}

	/*
	 * Read mode requires pre queuing of all buffers.
	 */
	if (read) {
		/*
		 * Queue all buffers.
		 */
		for (i = 0; i < vb2_get_num_buffers(q); i++) {
			struct vb2_buffer *vb2 = vb2_get_buffer(q, i);

			if (!vb2)
				continue;

			ret = vb2_core_qbuf(q, vb2, NULL, NULL);
			if (ret)
				goto err_reqbufs;
			fileio->bufs[i].queued = 1;
		}
		/*
		 * All buffers have been queued, so mark that by setting
		 * initial_index to the number of buffers in the vb2_queue
		 */
		fileio->initial_index = vb2_get_num_buffers(q);
		fileio->cur_index = fileio->initial_index;
	}

	/*
	 * Start streaming.
	 */
	ret = vb2_core_streamon(q, q->type);
	if (ret)
		goto err_reqbufs;

	return ret;

err_reqbufs:
	fileio->count = 0;
	vb2_core_reqbufs(q, fileio->memory, 0, &fileio->count);

err_kfree:
	q->fileio = NULL;
	kfree(fileio);
	return ret;
}

/*
 * __vb2_cleanup_fileio() - free resourced used by file io emulator
 * @q:		videobuf2 queue
 */
static int __vb2_cleanup_fileio(struct vb2_queue *q)
{
	struct vb2_fileio_data *fileio = q->fileio;

	if (fileio) {
		vb2_core_streamoff(q, q->type);
		q->fileio = NULL;
		fileio->count = 0;
		vb2_core_reqbufs(q, fileio->memory, 0, &fileio->count);
		kfree(fileio);
		dprintk(q, 3, "file io emulator closed\n");
	}
	return 0;
}

/*
 * __vb2_perform_fileio() - perform a single file io (read or write) operation
 * @q:		videobuf2 queue
 * @data:	pointed to target userspace buffer
 * @count:	number of bytes to read or write
 * @ppos:	file handle position tracking pointer
 * @nonblock:	mode selector (1 means blocking calls, 0 means nonblocking)
 * @read:	access mode selector (1 means read, 0 means write)
 */
static size_t __vb2_perform_fileio(struct vb2_queue *q, char __user *data, size_t count,
		loff_t *ppos, int nonblock, int read)
{
	struct vb2_fileio_data *fileio;
	struct vb2_fileio_buf *buf;
	bool is_multiplanar = q->is_multiplanar;
	/*
	 * When using write() to write data to an output video node the vb2 core
	 * should copy timestamps if V4L2_BUF_FLAG_TIMESTAMP_COPY is set. Nobody
	 * else is able to provide this information with the write() operation.
	 */
	bool copy_timestamp = !read && q->copy_timestamp;
	unsigned index;
	int ret;

	dprintk(q, 3, "mode %s, offset %ld, count %zd, %sblocking\n",
		read ? "read" : "write", (long)*ppos, count,
		nonblock ? "non" : "");

	if (!data)
		return -EINVAL;

	if (q->waiting_in_dqbuf) {
		dprintk(q, 3, "another dup()ped fd is %s\n",
			read ? "reading" : "writing");
		return -EBUSY;
	}

	/*
	 * Initialize emulator on first call.
	 */
	if (!vb2_fileio_is_active(q)) {
		ret = __vb2_init_fileio(q, read);
		dprintk(q, 3, "vb2_init_fileio result: %d\n", ret);
		if (ret)
			return ret;
	}
	fileio = q->fileio;

	/*
	 * Check if we need to dequeue the buffer.
	 */
	index = fileio->cur_index;
	if (index >= vb2_get_num_buffers(q)) {
		struct vb2_buffer *b;

		/*
		 * Call vb2_dqbuf to get buffer back.
		 */
		ret = vb2_core_dqbuf(q, &index, NULL, nonblock);
		dprintk(q, 5, "vb2_dqbuf result: %d\n", ret);
		if (ret)
			return ret;
		fileio->dq_count += 1;

		fileio->cur_index = index;
		buf = &fileio->bufs[index];

		/* b can never be NULL when using fileio. */
		b = vb2_get_buffer(q, index);

		/*
		 * Get number of bytes filled by the driver
		 */
		buf->pos = 0;
		buf->queued = 0;
		buf->size = read ? vb2_get_plane_payload(b, 0)
				 : vb2_plane_size(b, 0);
		/* Compensate for data_offset on read in the multiplanar case. */
		if (is_multiplanar && read &&
				b->planes[0].data_offset < buf->size) {
			buf->pos = b->planes[0].data_offset;
			buf->size -= buf->pos;
		}
	} else {
		buf = &fileio->bufs[index];
	}

	/*
	 * Limit count on last few bytes of the buffer.
	 */
	if (buf->pos + count > buf->size) {
		count = buf->size - buf->pos;
		dprintk(q, 5, "reducing read count: %zd\n", count);
	}

	/*
	 * Transfer data to userspace.
	 */
	dprintk(q, 3, "copying %zd bytes - buffer %d, offset %u\n",
		count, index, buf->pos);
	if (read)
		ret = copy_to_user(data, buf->vaddr + buf->pos, count);
	else
		ret = copy_from_user(buf->vaddr + buf->pos, data, count);
	if (ret) {
		dprintk(q, 3, "error copying data\n");
		return -EFAULT;
	}

	/*
	 * Update counters.
	 */
	buf->pos += count;
	*ppos += count;

	/*
	 * Queue next buffer if required.
	 */
	if (buf->pos == buf->size || (!read && fileio->write_immediately)) {
		/* b can never be NULL when using fileio. */
		struct vb2_buffer *b = vb2_get_buffer(q, index);

		/*
		 * Check if this is the last buffer to read.
		 */
		if (read && fileio->read_once && fileio->dq_count == 1) {
			dprintk(q, 3, "read limit reached\n");
			return __vb2_cleanup_fileio(q);
		}

		/*
		 * Call vb2_qbuf and give buffer to the driver.
		 */
		b->planes[0].bytesused = buf->pos;

		if (copy_timestamp)
			b->timestamp = ktime_get_ns();
		ret = vb2_core_qbuf(q, b, NULL, NULL);
		dprintk(q, 5, "vb2_qbuf result: %d\n", ret);
		if (ret)
			return ret;

		/*
		 * Buffer has been queued, update the status
		 */
		buf->pos = 0;
		buf->queued = 1;
		buf->size = vb2_plane_size(b, 0);
		fileio->q_count += 1;
		/*
		 * If we are queuing up buffers for the first time, then
		 * increase initial_index by one.
		 */
		if (fileio->initial_index < vb2_get_num_buffers(q))
			fileio->initial_index++;
		/*
		 * The next buffer to use is either a buffer that's going to be
		 * queued for the first time (initial_index < number of buffers in the vb2_queue)
		 * or it is equal to the number of buffers in the vb2_queue,
		 * meaning that the next time we need to dequeue a buffer since
		 * we've now queued up all the 'first time' buffers.
		 */
		fileio->cur_index = fileio->initial_index;
	}

	/*
	 * Return proper number of bytes processed.
	 */
	if (ret == 0)
		ret = count;
	return ret;
}

size_t vb2_read(struct vb2_queue *q, char __user *data, size_t count,
		loff_t *ppos, int nonblocking)
{
	return __vb2_perform_fileio(q, data, count, ppos, nonblocking, 1);
}
EXPORT_SYMBOL_GPL(vb2_read);

size_t vb2_write(struct vb2_queue *q, const char __user *data, size_t count,
		loff_t *ppos, int nonblocking)
{
	return __vb2_perform_fileio(q, (char __user *) data, count,
							ppos, nonblocking, 0);
}
EXPORT_SYMBOL_GPL(vb2_write);

struct vb2_threadio_data {
	struct task_struct *thread;
	vb2_thread_fnc fnc;
	void *priv;
	bool stop;
};

static int vb2_thread(void *data)
{
	struct vb2_queue *q = data;
	struct vb2_threadio_data *threadio = q->threadio;
	bool copy_timestamp = false;
	unsigned prequeue = 0;
	unsigned index = 0;
	int ret = 0;

	if (q->is_output) {
		prequeue = vb2_get_num_buffers(q);
		copy_timestamp = q->copy_timestamp;
	}

	set_freezable();

	for (;;) {
		struct vb2_buffer *vb;

		/*
		 * Call vb2_dqbuf to get buffer back.
		 */
		if (prequeue) {
			vb = vb2_get_buffer(q, index++);
			if (!vb)
				continue;
			prequeue--;
		} else {
			mutex_lock(q->lock);
			if (!threadio->stop)
				ret = vb2_core_dqbuf(q, &index, NULL, 0);
			mutex_unlock(q->lock);
			dprintk(q, 5, "file io: vb2_dqbuf result: %d\n", ret);
			if (!ret)
				vb = vb2_get_buffer(q, index);
		}
		if (ret || threadio->stop)
			break;
		try_to_freeze();

		if (vb->state != VB2_BUF_STATE_ERROR)
			if (threadio->fnc(vb, threadio->priv))
				break;
		if (copy_timestamp)
			vb->timestamp = ktime_get_ns();
		if (!threadio->stop) {
			mutex_lock(q->lock);
			ret = vb2_core_qbuf(q, vb, NULL, NULL);
			mutex_unlock(q->lock);
		}
		if (ret || threadio->stop)
			break;
	}

	/* Hmm, linux becomes *very* unhappy without this ... */
	while (!kthread_should_stop()) {
		set_current_state(TASK_INTERRUPTIBLE);
		schedule();
	}
	return 0;
}

/*
 * This function should not be used for anything else but the videobuf2-dvb
 * support. If you think you have another good use-case for this, then please
 * contact the linux-media mailinglist first.
 */
int vb2_thread_start(struct vb2_queue *q, vb2_thread_fnc fnc, void *priv,
		     const char *thread_name)
{
	struct vb2_threadio_data *threadio;
	int ret = 0;

	if (q->threadio)
		return -EBUSY;
	if (vb2_is_busy(q))
		return -EBUSY;
	if (WARN_ON(q->fileio))
		return -EBUSY;

	threadio = kzalloc_obj(*threadio);
	if (threadio == NULL)
		return -ENOMEM;
	threadio->fnc = fnc;
	threadio->priv = priv;

	ret = __vb2_init_fileio(q, !q->is_output);
	dprintk(q, 3, "file io: vb2_init_fileio result: %d\n", ret);
	if (ret)
		goto nomem;
	q->threadio = threadio;
	threadio->thread = kthread_run(vb2_thread, q, "vb2-%s", thread_name);
	if (IS_ERR(threadio->thread)) {
		ret = PTR_ERR(threadio->thread);
		threadio->thread = NULL;
		goto nothread;
	}
	return 0;

nothread:
	__vb2_cleanup_fileio(q);
nomem:
	kfree(threadio);
	return ret;
}
EXPORT_SYMBOL_GPL(vb2_thread_start);

int vb2_thread_stop(struct vb2_queue *q)
{
	struct vb2_threadio_data *threadio = q->threadio;
	int err;

	if (threadio == NULL)
		return 0;
	threadio->stop = true;
	/* Wake up all pending sleeps in the thread */
	vb2_queue_error(q);
	err = kthread_stop(threadio->thread);
	__vb2_cleanup_fileio(q);
	threadio->thread = NULL;
	kfree(threadio);
	q->threadio = NULL;
	return err;
}
EXPORT_SYMBOL_GPL(vb2_thread_stop);

MODULE_DESCRIPTION("Media buffer core framework");
MODULE_AUTHOR("Pawel Osciak <pawel@osciak.com>, Marek Szyprowski");
MODULE_LICENSE("GPL");
MODULE_IMPORT_NS("DMA_BUF");
]

map[File:drivers/media/common/videobuf2/videobuf2-v4l2.c]

map[Contents:/*
 * videobuf2-v4l2.c - V4L2 driver helper framework
 *
 * Copyright (C) 2010 Samsung Electronics
 *
 * Author: Pawel Osciak <pawel@osciak.com>
 *	   Marek Szyprowski <m.szyprowski@samsung.com>
 *
 * The vb2_thread implementation was based on code from videobuf-dvb.c:
 *	(c) 2004 Gerd Knorr <kraxel@bytesex.org> [SUSE Labs]
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation.
 */

#include <linux/device.h>
#include <linux/err.h>
#include <linux/freezer.h>
#include <linux/kernel.h>
#include <linux/kthread.h>
#include <linux/mm.h>
#include <linux/module.h>
#include <linux/poll.h>
#include <linux/sched.h>
#include <linux/slab.h>

#include <media/v4l2-common.h>
#include <media/v4l2-dev.h>
#include <media/v4l2-device.h>
#include <media/v4l2-event.h>
#include <media/v4l2-fh.h>

#include <media/videobuf2-v4l2.h>

static int debug;
module_param(debug, int, 0644);

#define dprintk(q, level, fmt, arg...)					      \
	do {								      \
		if (debug >= level)					      \
			pr_info("vb2-v4l2: [%p] %s: " fmt,		      \
				(q)->name, __func__, ## arg);		      \
	} while (0)

/* Flags that are set by us */
#define V4L2_BUFFER_MASK_FLAGS	(V4L2_BUF_FLAG_MAPPED | V4L2_BUF_FLAG_QUEUED | \
				 V4L2_BUF_FLAG_DONE | V4L2_BUF_FLAG_ERROR | \
				 V4L2_BUF_FLAG_PREPARED | \
				 V4L2_BUF_FLAG_IN_REQUEST | \
				 V4L2_BUF_FLAG_REQUEST_FD | \
				 V4L2_BUF_FLAG_TIMESTAMP_MASK)
/* Output buffer flags that should be passed on to the driver */
#define V4L2_BUFFER_OUT_FLAGS	(V4L2_BUF_FLAG_PFRAME | \
				 V4L2_BUF_FLAG_BFRAME | \
				 V4L2_BUF_FLAG_KEYFRAME | \
				 V4L2_BUF_FLAG_TIMECODE | \
				 V4L2_BUF_FLAG_M2M_HOLD_CAPTURE_BUF)

/*
 * __verify_planes_array() - verify that the planes array passed in struct
 * v4l2_buffer from userspace can be safely used
 */
static int __verify_planes_array(struct vb2_buffer *vb, const struct v4l2_buffer *b)
{
	if (!V4L2_TYPE_IS_MULTIPLANAR(b->type))
		return 0;

	/* Is memory for copying plane information present? */
	if (b->m.planes == NULL) {
		dprintk(vb->vb2_queue, 1,
			"multi-planar buffer passed but planes array not provided\n");
		return -EINVAL;
	}

	if (b->length < vb->num_planes || b->length > VB2_MAX_PLANES) {
		dprintk(vb->vb2_queue, 1,
			"incorrect planes array length, expected %d, got %d\n",
			vb->num_planes, b->length);
		return -EINVAL;
	}

	return 0;
}

static int __verify_planes_array_core(struct vb2_buffer *vb, const void *pb)
{
	return __verify_planes_array(vb, pb);
}

/*
 * __verify_length() - Verify that the bytesused value for each plane fits in
 * the plane length and that the data offset doesn't exceed the bytesused value.
 */
static int __verify_length(struct vb2_buffer *vb, const struct v4l2_buffer *b)
{
	unsigned int length;
	unsigned int bytesused;
	unsigned int plane;

	if (V4L2_TYPE_IS_CAPTURE(b->type))
		return 0;

	if (V4L2_TYPE_IS_MULTIPLANAR(b->type)) {
		for (plane = 0; plane < vb->num_planes; ++plane) {
			length = (b->memory == VB2_MEMORY_USERPTR ||
				  b->memory == VB2_MEMORY_DMABUF)
			       ? b->m.planes[plane].length
				: vb->planes[plane].length;
			bytesused = b->m.planes[plane].bytesused
				  ? b->m.planes[plane].bytesused : length;

			if (b->m.planes[plane].bytesused > length)
				return -EINVAL;

			if (b->m.planes[plane].data_offset > 0 &&
			    b->m.planes[plane].data_offset >= bytesused)
				return -EINVAL;
		}
	} else {
		length = (b->memory == VB2_MEMORY_USERPTR)
			? b->length : vb->planes[0].length;

		if (b->bytesused > length)
			return -EINVAL;
	}

	return 0;
}

/*
 * __init_vb2_v4l2_buffer() - initialize the vb2_v4l2_buffer struct
 */
static void __init_vb2_v4l2_buffer(struct vb2_buffer *vb)
{
	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);

	vbuf->request_fd = -1;
}

static void __copy_timestamp(struct vb2_buffer *vb, const void *pb)
{
	const struct v4l2_buffer *b = pb;
	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
	struct vb2_queue *q = vb->vb2_queue;

	if (q->is_output) {
		/*
		 * For output buffers copy the timestamp if needed,
		 * and the timecode field and flag if needed.
		 */
		if (q->copy_timestamp)
			vb->timestamp = v4l2_buffer_get_timestamp(b);
		vbuf->flags |= b->flags & V4L2_BUF_FLAG_TIMECODE;
		if (b->flags & V4L2_BUF_FLAG_TIMECODE)
			vbuf->timecode = b->timecode;
	}
};

static void vb2_warn_zero_bytesused(struct vb2_buffer *vb)
{
	static bool check_once;

	if (check_once)
		return;

	check_once = true;

	pr_warn("use of bytesused == 0 is deprecated and will be removed in the future,\n");
	if (vb->vb2_queue->allow_zero_bytesused)
		pr_warn("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n");
	else
		pr_warn("use the actual size instead.\n");
}

static int vb2_fill_vb2_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
{
	struct vb2_queue *q = vb->vb2_queue;
	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
	struct vb2_plane *planes = vbuf->planes;
	unsigned int plane;
	int ret;

	ret = __verify_length(vb, b);
	if (ret < 0) {
		dprintk(q, 1, "plane parameters verification failed: %d\n", ret);
		return ret;
	}
	if (b->field == V4L2_FIELD_ALTERNATE && q->is_output) {
		/*
		 * If the format's field is ALTERNATE, then the buffer's field
		 * should be either TOP or BOTTOM, not ALTERNATE since that
		 * makes no sense. The driver has to know whether the
		 * buffer represents a top or a bottom field in order to
		 * program any DMA correctly. Using ALTERNATE is wrong, since
		 * that just says that it is either a top or a bottom field,
		 * but not which of the two it is.
		 */
		dprintk(q, 1, "the field is incorrectly set to ALTERNATE for an output buffer\n");
		return -EINVAL;
	}
	vbuf->sequence = 0;
	vbuf->request_fd = -1;
	vbuf->is_held = false;

	if (V4L2_TYPE_IS_MULTIPLANAR(b->type)) {
		switch (b->memory) {
		case VB2_MEMORY_USERPTR:
			for (plane = 0; plane < vb->num_planes; ++plane) {
				planes[plane].m.userptr =
					b->m.planes[plane].m.userptr;
				planes[plane].length =
					b->m.planes[plane].length;
			}
			break;
		case VB2_MEMORY_DMABUF:
			for (plane = 0; plane < vb->num_planes; ++plane) {
				planes[plane].m.fd =
					b->m.planes[plane].m.fd;
				planes[plane].length =
					b->m.planes[plane].length;
			}
			break;
		default:
			for (plane = 0; plane < vb->num_planes; ++plane) {
				planes[plane].m.offset =
					vb->planes[plane].m.offset;
				planes[plane].length =
					vb->planes[plane].length;
			}
			break;
		}

		/* Fill in user-provided information for OUTPUT types */
		if (V4L2_TYPE_IS_OUTPUT(b->type)) {
			/*
			 * Will have to go up to b->length when API starts
			 * accepting variable number of planes.
			 *
			 * If bytesused == 0 for the output buffer, then fall
			 * back to the full buffer size. In that case
			 * userspace clearly never bothered to set it and
			 * it's a safe assumption that they really meant to
			 * use the full plane sizes.
			 *
			 * Some drivers, e.g. old codec drivers, use bytesused == 0
			 * as a way to indicate that streaming is finished.
			 * In that case, the driver should use the
			 * allow_zero_bytesused flag to keep old userspace
			 * applications working.
			 */
			for (plane = 0; plane < vb->num_planes; ++plane) {
				struct vb2_plane *pdst = &planes[plane];
				struct v4l2_plane *psrc = &b->m.planes[plane];

				if (psrc->bytesused == 0)
					vb2_warn_zero_bytesused(vb);

				if (vb->vb2_queue->allow_zero_bytesused)
					pdst->bytesused = psrc->bytesused;
				else
					pdst->bytesused = psrc->bytesused ?
						psrc->bytesused : pdst->length;
				pdst->data_offset = psrc->data_offset;
			}
		}
	} else {
		/*
		 * Single-planar buffers do not use planes array,
		 * so fill in relevant v4l2_buffer struct fields instead.
		 * In vb2 we use our internal V4l2_planes struct for
		 * single-planar buffers as well, for simplicity.
		 *
		 * If bytesused == 0 for the output buffer, then fall back
		 * to the full buffer size as that's a sensible default.
		 *
		 * Some drivers, e.g. old codec drivers, use bytesused == 0 as
		 * a way to indicate that streaming is finished. In that case,
		 * the driver should use the allow_zero_bytesused flag to keep
		 * old userspace applications working.
		 */
		switch (b->memory) {
		case VB2_MEMORY_USERPTR:
			planes[0].m.userptr = b->m.userptr;
			planes[0].length = b->length;
			break;
		case VB2_MEMORY_DMABUF:
			planes[0].m.fd = b->m.fd;
			planes[0].length = b->length;
			break;
		default:
			planes[0].m.offset = vb->planes[0].m.offset;
			planes[0].length = vb->planes[0].length;
			break;
		}

		planes[0].data_offset = 0;
		if (V4L2_TYPE_IS_OUTPUT(b->type)) {
			if (b->bytesused == 0)
				vb2_warn_zero_bytesused(vb);

			if (vb->vb2_queue->allow_zero_bytesused)
				planes[0].bytesused = b->bytesused;
			else
				planes[0].bytesused = b->bytesused ?
					b->bytesused : planes[0].length;
		} else
			planes[0].bytesused = 0;

	}

	/* Zero flags that we handle */
	vbuf->flags = b->flags & ~V4L2_BUFFER_MASK_FLAGS;
	if (!vb->vb2_queue->copy_timestamp || V4L2_TYPE_IS_CAPTURE(b->type)) {
		/*
		 * Non-COPY timestamps and non-OUTPUT queues will get
		 * their timestamp and timestamp source flags from the
		 * queue.
		 */
		vbuf->flags &= ~V4L2_BUF_FLAG_TSTAMP_SRC_MASK;
	}

	if (V4L2_TYPE_IS_OUTPUT(b->type)) {
		/*
		 * For output buffers mask out the timecode flag:
		 * this will be handled later in vb2_qbuf().
		 * The 'field' is valid metadata for this output buffer
		 * and so that needs to be copied here.
		 */
		vbuf->flags &= ~V4L2_BUF_FLAG_TIMECODE;
		vbuf->field = b->field;
		if (!(q->subsystem_flags & VB2_V4L2_FL_SUPPORTS_M2M_HOLD_CAPTURE_BUF))
			vbuf->flags &= ~V4L2_BUF_FLAG_M2M_HOLD_CAPTURE_BUF;
	} else {
		/* Zero any output buffer flags as this is a capture buffer */
		vbuf->flags &= ~V4L2_BUFFER_OUT_FLAGS;
		/* Zero last flag, this is a signal from driver to userspace */
		vbuf->flags &= ~V4L2_BUF_FLAG_LAST;
	}

	return 0;
}

static void set_buffer_cache_hints(struct vb2_queue *q,
				   struct vb2_buffer *vb,
				   struct v4l2_buffer *b)
{
	if (!vb2_queue_allows_cache_hints(q)) {
		/*
		 * Clear buffer cache flags if queue does not support user
		 * space hints. That's to indicate to userspace that these
		 * flags won't work.
		 */
		b->flags &= ~V4L2_BUF_FLAG_NO_CACHE_INVALIDATE;
		b->flags &= ~V4L2_BUF_FLAG_NO_CACHE_CLEAN;
		return;
	}

	if (b->flags & V4L2_BUF_FLAG_NO_CACHE_INVALIDATE)
		vb->skip_cache_sync_on_finish = 1;

	if (b->flags & V4L2_BUF_FLAG_NO_CACHE_CLEAN)
		vb->skip_cache_sync_on_prepare = 1;
}

static int vb2_queue_or_prepare_buf(struct vb2_queue *q, struct media_device *mdev,
				    struct vb2_buffer *vb, struct v4l2_buffer *b,
				    bool is_prepare, struct media_request **p_req)
{
	const char *opname = is_prepare ? "prepare_buf" : "qbuf";
	struct media_request *req;
	struct vb2_v4l2_buffer *vbuf;
	int ret;

	if (b->type != q->type) {
		dprintk(q, 1, "%s: invalid buffer type\n", opname);
		return -EINVAL;
	}

	if (b->memory != q->memory) {
		dprintk(q, 1, "%s: invalid memory type\n", opname);
		return -EINVAL;
	}

	vbuf = to_vb2_v4l2_buffer(vb);
	ret = __verify_planes_array(vb, b);
	if (ret)
		return ret;

	if (!is_prepare && (b->flags & V4L2_BUF_FLAG_REQUEST_FD) &&
	    vb->state != VB2_BUF_STATE_DEQUEUED) {
		dprintk(q, 1, "%s: buffer is not in dequeued state\n", opname);
		return -EINVAL;
	}

	if (!vb->prepared) {
		set_buffer_cache_hints(q, vb, b);
		/* Copy relevant information provided by the userspace */
		memset(vbuf->planes, 0,
		       sizeof(vbuf->planes[0]) * vb->num_planes);
		ret = vb2_fill_vb2_v4l2_buffer(vb, b);
		if (ret)
			return ret;
	}

	if (is_prepare)
		return 0;

	if (!(b->flags & V4L2_BUF_FLAG_REQUEST_FD)) {
		if (q->requires_requests) {
			dprintk(q, 1, "%s: queue requires requests\n", opname);
			return -EBADR;
		}
		if (q->uses_requests) {
			dprintk(q, 1, "%s: queue uses requests\n", opname);
			return -EBUSY;
		}
		return 0;
	} else if (!q->supports_requests) {
		dprintk(q, 1, "%s: queue does not support requests\n", opname);
		return -EBADR;
	} else if (q->uses_qbuf) {
		dprintk(q, 1, "%s: queue does not use requests\n", opname);
		return -EBUSY;
	}

	/*
	 * For proper locking when queueing a request you need to be able
	 * to lock access to the vb2 queue, so check that there is a lock
	 * that we can use. In addition p_req must be non-NULL.
	 */
	if (WARN_ON(!q->lock || !p_req))
		return -EINVAL;

	/*
	 * Make sure this op is implemented by the driver. It's easy to forget
	 * this callback, but is it important when canceling a buffer in a
	 * queued request.
	 */
	if (WARN_ON(!q->ops->buf_request_complete))
		return -EINVAL;
	/*
	 * Make sure this op is implemented by the driver for the output queue.
	 * It's easy to forget this callback, but is it important to correctly
	 * validate the 'field' value at QBUF time.
	 */
	if (WARN_ON((q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT ||
		     q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) &&
		    !q->ops->buf_out_validate))
		return -EINVAL;

	req = media_request_get_by_fd(mdev, b->request_fd);
	if (IS_ERR(req)) {
		dprintk(q, 1, "%s: invalid request_fd\n", opname);
		return PTR_ERR(req);
	}

	/*
	 * Early sanity check. This is checked again when the buffer
	 * is bound to the request in vb2_core_qbuf().
	 */
	if (req->state != MEDIA_REQUEST_STATE_IDLE &&
	    req->state != MEDIA_REQUEST_STATE_UPDATING) {
		dprintk(q, 1, "%s: request is not idle\n", opname);
		media_request_put(req);
		return -EBUSY;
	}

	*p_req = req;
	vbuf->request_fd = b->request_fd;

	return 0;
}

/*
 * __fill_v4l2_buffer() - fill in a struct v4l2_buffer with information to be
 * returned to userspace
 */
static void __fill_v4l2_buffer(struct vb2_buffer *vb, void *pb)
{
	struct v4l2_buffer *b = pb;
	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
	struct vb2_queue *q = vb->vb2_queue;
	unsigned int plane;

	/* Copy back data such as timestamp, flags, etc. */
	b->index = vb->index;
	b->type = vb->type;
	b->memory = vb->memory;
	b->bytesused = 0;

	b->flags = vbuf->flags;
	b->field = vbuf->field;
	v4l2_buffer_set_timestamp(b, vb->timestamp);
	b->timecode = vbuf->timecode;
	b->sequence = vbuf->sequence;
	b->reserved2 = 0;
	b->request_fd = 0;

	if (q->is_multiplanar) {
		/*
		 * Fill in plane-related data if userspace provided an array
		 * for it. The caller has already verified memory and size.
		 */
		b->length = vb->num_planes;
		for (plane = 0; plane < vb->num_planes; ++plane) {
			struct v4l2_plane *pdst = &b->m.planes[plane];
			struct vb2_plane *psrc = &vb->planes[plane];

			pdst->bytesused = psrc->bytesused;
			pdst->length = psrc->length;
			if (q->memory == VB2_MEMORY_MMAP)
				pdst->m.mem_offset = psrc->m.offset;
			else if (q->memory == VB2_MEMORY_USERPTR)
				pdst->m.userptr = psrc->m.userptr;
			else if (q->memory == VB2_MEMORY_DMABUF)
				pdst->m.fd = psrc->m.fd;
			pdst->data_offset = psrc->data_offset;
			memset(pdst->reserved, 0, sizeof(pdst->reserved));
		}
	} else {
		/*
		 * We use length and offset in v4l2_planes array even for
		 * single-planar buffers, but userspace does not.
		 */
		b->length = vb->planes[0].length;
		b->bytesused = vb->planes[0].bytesused;
		if (q->memory == VB2_MEMORY_MMAP)
			b->m.offset = vb->planes[0].m.offset;
		else if (q->memory == VB2_MEMORY_USERPTR)
			b->m.userptr = vb->planes[0].m.userptr;
		else if (q->memory == VB2_MEMORY_DMABUF)
			b->m.fd = vb->planes[0].m.fd;
	}

	/*
	 * Clear any buffer state related flags.
	 */
	b->flags &= ~V4L2_BUFFER_MASK_FLAGS;
	b->flags |= q->timestamp_flags & V4L2_BUF_FLAG_TIMESTAMP_MASK;
	if (!q->copy_timestamp) {
		/*
		 * For non-COPY timestamps, drop timestamp source bits
		 * and obtain the timestamp source from the queue.
		 */
		b->flags &= ~V4L2_BUF_FLAG_TSTAMP_SRC_MASK;
		b->flags |= q->timestamp_flags & V4L2_BUF_FLAG_TSTAMP_SRC_MASK;
	}

	switch (vb->state) {
	case VB2_BUF_STATE_QUEUED:
	case VB2_BUF_STATE_ACTIVE:
		b->flags |= V4L2_BUF_FLAG_QUEUED;
		break;
	case VB2_BUF_STATE_IN_REQUEST:
		b->flags |= V4L2_BUF_FLAG_IN_REQUEST;
		break;
	case VB2_BUF_STATE_ERROR:
		b->flags |= V4L2_BUF_FLAG_ERROR;
		fallthrough;
	case VB2_BUF_STATE_DONE:
		b->flags |= V4L2_BUF_FLAG_DONE;
		break;
	case VB2_BUF_STATE_PREPARING:
	case VB2_BUF_STATE_DEQUEUED:
		/* nothing */
		break;
	}

	if ((vb->state == VB2_BUF_STATE_DEQUEUED ||
	     vb->state == VB2_BUF_STATE_IN_REQUEST) &&
	    vb->synced && vb->prepared)
		b->flags |= V4L2_BUF_FLAG_PREPARED;

	if (vb2_buffer_in_use(q, vb))
		b->flags |= V4L2_BUF_FLAG_MAPPED;
	if (vbuf->request_fd >= 0) {
		b->flags |= V4L2_BUF_FLAG_REQUEST_FD;
		b->request_fd = vbuf->request_fd;
	}
}

/*
 * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a
 * v4l2_buffer by the userspace. It also verifies that struct
 * v4l2_buffer has a valid number of planes.
 */
static int __fill_vb2_buffer(struct vb2_buffer *vb, struct vb2_plane *planes)
{
	struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
	unsigned int plane;

	if (!vb->vb2_queue->copy_timestamp)
		vb->timestamp = 0;

	for (plane = 0; plane < vb->num_planes; ++plane) {
		if (vb->vb2_queue->memory != VB2_MEMORY_MMAP) {
			planes[plane].m = vbuf->planes[plane].m;
			planes[plane].length = vbuf->planes[plane].length;
		}
		planes[plane].bytesused = vbuf->planes[plane].bytesused;
		planes[plane].data_offset = vbuf->planes[plane].data_offset;
	}
	return 0;
}

static const struct vb2_buf_ops v4l2_buf_ops = {
	.verify_planes_array	= __verify_planes_array_core,
	.init_buffer		= __init_vb2_v4l2_buffer,
	.fill_user_buffer	= __fill_v4l2_buffer,
	.fill_vb2_buffer	= __fill_vb2_buffer,
	.copy_timestamp		= __copy_timestamp,
};

struct vb2_buffer *vb2_find_buffer(struct vb2_queue *q, u64 timestamp)
{
	unsigned int i;
	struct vb2_buffer *vb2;

	/*
	 * This loop doesn't scale if there is a really large number of buffers.
	 * Maybe something more efficient will be needed in this case.
	 */
	for (i = 0; i < q->max_num_buffers; i++) {
		vb2 = vb2_get_buffer(q, i);

		if (!vb2)
			continue;

		if (vb2->copied_timestamp &&
		    vb2->timestamp == timestamp)
			return vb2;
	}
	return NULL;
}
EXPORT_SYMBOL_GPL(vb2_find_buffer);

/*
 * vb2_querybuf() - query video buffer information
 * @q:		vb2 queue
 * @b:		buffer struct passed from userspace to vidioc_querybuf handler
 *		in driver
 *
 * Should be called from vidioc_querybuf ioctl handler in driver.
 * This function will verify the passed v4l2_buffer structure and fill the
 * relevant information for the userspace.
 *
 * The return values from this function are intended to be directly returned
 * from vidioc_querybuf handler in driver.
 */
int vb2_querybuf(struct vb2_queue *q, struct v4l2_buffer *b)
{
	struct vb2_buffer *vb;
	int ret;

	if (b->type != q->type) {
		dprintk(q, 1, "wrong buffer type\n");
		return -EINVAL;
	}

	vb = vb2_get_buffer(q, b->index);
	if (!vb) {
		dprintk(q, 1, "can't find the requested buffer %u\n", b->index);
		return -EINVAL;
	}

	ret = __verify_planes_array(vb, b);
	if (!ret)
		vb2_core_querybuf(q, vb, b);
	return ret;
}
EXPORT_SYMBOL(vb2_querybuf);

static void vb2_set_flags_and_caps(struct vb2_queue *q, u32 memory,
				   u32 *flags, u32 *caps, u32 *max_num_bufs)
{
	if (!q->allow_cache_hints || memory != V4L2_MEMORY_MMAP) {
		/*
		 * This needs to clear V4L2_MEMORY_FLAG_NON_COHERENT only,
		 * but in order to avoid bugs we zero out all bits.
		 */
		*flags = 0;
	} else {
		/* Clear all unknown flags. */
		*flags &= V4L2_MEMORY_FLAG_NON_COHERENT;
	}

	*caps |= V4L2_BUF_CAP_SUPPORTS_ORPHANED_BUFS;
	if (q->io_modes & VB2_MMAP)
		*caps |= V4L2_BUF_CAP_SUPPORTS_MMAP;
	if (q->io_modes & VB2_USERPTR)
		*caps |= V4L2_BUF_CAP_SUPPORTS_USERPTR;
	if (q->io_modes & VB2_DMABUF)
		*caps |= V4L2_BUF_CAP_SUPPORTS_DMABUF;
	if (q->subsystem_flags & VB2_V4L2_FL_SUPPORTS_M2M_HOLD_CAPTURE_BUF)
		*caps |= V4L2_BUF_CAP_SUPPORTS_M2M_HOLD_CAPTURE_BUF;
	if (q->allow_cache_hints && q->io_modes & VB2_MMAP)
		*caps |= V4L2_BUF_CAP_SUPPORTS_MMAP_CACHE_HINTS;
	if (q->supports_requests)
		*caps |= V4L2_BUF_CAP_SUPPORTS_REQUESTS;
	if (max_num_bufs) {
		*max_num_bufs = q->max_num_buffers;
		*caps |= V4L2_BUF_CAP_SUPPORTS_MAX_NUM_BUFFERS;
	}
}

int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
{
	int ret = vb2_verify_memory_type(q, req->memory, req->type);
	u32 flags = req->flags;

	vb2_set_flags_and_caps(q, req->memory, &flags,
			       &req->capabilities, NULL);
	req->flags = flags;
	return ret ? ret : vb2_core_reqbufs(q, req->memory,
					    req->flags, &req->count);
}
EXPORT_SYMBOL_GPL(vb2_reqbufs);

int vb2_prepare_buf(struct vb2_queue *q, struct media_device *mdev,
		    struct v4l2_buffer *b)
{
	struct vb2_buffer *vb;
	int ret;

	if (vb2_fileio_is_active(q)) {
		dprintk(q, 1, "file io in progress\n");
		return -EBUSY;
	}

	if (b->flags & V4L2_BUF_FLAG_REQUEST_FD)
		return -EINVAL;

	vb = vb2_get_buffer(q, b->index);
	if (!vb) {
		dprintk(q, 1, "can't find the requested buffer %u\n", b->index);
		return -EINVAL;
	}

	ret = vb2_queue_or_prepare_buf(q, mdev, vb, b, true, NULL);

	return ret ? ret : vb2_core_prepare_buf(q, vb, b);
}
EXPORT_SYMBOL_GPL(vb2_prepare_buf);

int vb2_create_bufs(struct vb2_queue *q, struct v4l2_create_buffers *create)
{
	unsigned requested_planes = 1;
	unsigned requested_sizes[VIDEO_MAX_PLANES];
	struct v4l2_format *f = &create->format;
	int ret = vb2_verify_memory_type(q, create->memory, f->type);
	unsigned i;

	create->index = vb2_get_num_buffers(q);
	vb2_set_flags_and_caps(q, create->memory, &create->flags,
			       &create->capabilities, &create->max_num_buffers);
	if (create->count == 0)
		return ret != -EBUSY ? ret : 0;

	switch (f->type) {
	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
		requested_planes = f->fmt.pix_mp.num_planes;
		if (requested_planes == 0 ||
		    requested_planes > VIDEO_MAX_PLANES)
			return -EINVAL;
		for (i = 0; i < requested_planes; i++)
			requested_sizes[i] =
				f->fmt.pix_mp.plane_fmt[i].sizeimage;
		break;
	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
		requested_sizes[0] = f->fmt.pix.sizeimage;
		break;
	case V4L2_BUF_TYPE_VBI_CAPTURE:
	case V4L2_BUF_TYPE_VBI_OUTPUT:
		requested_sizes[0] = f->fmt.vbi.samples_per_line *
			(f->fmt.vbi.count[0] + f->fmt.vbi.count[1]);
		break;
	case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
	case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
		requested_sizes[0] = f->fmt.sliced.io_size;
		break;
	case V4L2_BUF_TYPE_SDR_CAPTURE:
	case V4L2_BUF_TYPE_SDR_OUTPUT:
		requested_sizes[0] = f->fmt.sdr.buffersize;
		break;
	case V4L2_BUF_TYPE_META_CAPTURE:
	case V4L2_BUF_TYPE_META_OUTPUT:
		requested_sizes[0] = f->fmt.meta.buffersize;
		break;
	default:
		return -EINVAL;
	}
	for (i = 0; i < requested_planes; i++)
		if (requested_sizes[i] == 0)
			return -EINVAL;
	if (ret)
		return ret;

	return vb2_core_create_bufs(q, create->memory,
				    create->flags,
				    &create->count,
				    requested_planes,
				    requested_sizes,
				    &create->index);
}
EXPORT_SYMBOL_GPL(vb2_create_bufs);

int vb2_qbuf(struct vb2_queue *q, struct media_device *mdev,
	     struct v4l2_buffer *b)
{
	struct media_request *req = NULL;
	struct vb2_buffer *vb;
	int ret;

	if (vb2_fileio_is_active(q)) {
		dprintk(q, 1, "file io in progress\n");
		return -EBUSY;
	}

	vb = vb2_get_buffer(q, b->index);
	if (!vb) {
		dprintk(q, 1, "can't find the requested buffer %u\n", b->index);
		return -EINVAL;
	}

	ret = vb2_queue_or_prepare_buf(q, mdev, vb, b, false, &req);
	if (ret)
		return ret;
	ret = vb2_core_qbuf(q, vb, b, req);
	if (req)
		media_request_put(req);
	return ret;
}
EXPORT_SYMBOL_GPL(vb2_qbuf);

int vb2_dqbuf(struct vb2_queue *q, struct v4l2_buffer *b, bool nonblocking)
{
	int ret;

	if (vb2_fileio_is_active(q)) {
		dprintk(q, 1, "file io in progress\n");
		return -EBUSY;
	}

	if (b->type != q->type) {
		dprintk(q, 1, "invalid buffer type\n");
		return -EINVAL;
	}

	ret = vb2_core_dqbuf(q, NULL, b, nonblocking);

	if (!q->is_output &&
	    b->flags & V4L2_BUF_FLAG_DONE &&
	    b->flags & V4L2_BUF_FLAG_LAST)
		q->last_buffer_dequeued = true;

	/*
	 *  After calling the VIDIOC_DQBUF V4L2_BUF_FLAG_DONE must be
	 *  cleared.
	 */
	b->flags &= ~V4L2_BUF_FLAG_DONE;

	return ret;
}
EXPORT_SYMBOL_GPL(vb2_dqbuf);

int vb2_streamon(struct vb2_queue *q, enum v4l2_buf_type type)
{
	if (vb2_fileio_is_active(q)) {
		dprintk(q, 1, "file io in progress\n");
		return -EBUSY;
	}
	return vb2_core_streamon(q, type);
}
EXPORT_SYMBOL_GPL(vb2_streamon);

int vb2_streamoff(struct vb2_queue *q, enum v4l2_buf_type type)
{
	if (vb2_fileio_is_active(q)) {
		dprintk(q, 1, "file io in progress\n");
		return -EBUSY;
	}
	return vb2_core_streamoff(q, type);
}
EXPORT_SYMBOL_GPL(vb2_streamoff);

int vb2_expbuf(struct vb2_queue *q, struct v4l2_exportbuffer *eb)
{
	struct vb2_buffer *vb;

	vb = vb2_get_buffer(q, eb->index);
	if (!vb) {
		dprintk(q, 1, "can't find the requested buffer %u\n", eb->index);
		return -EINVAL;
	}

	return vb2_core_expbuf(q, &eb->fd, eb->type, vb,
				eb->plane, eb->flags);
}
EXPORT_SYMBOL_GPL(vb2_expbuf);

int vb2_queue_init_name(struct vb2_queue *q, const char *name)
{
	/* vb2_memory should match with v4l2_memory */
	BUILD_BUG_ON(VB2_MEMORY_MMAP != (int)V4L2_MEMORY_MMAP);
	BUILD_BUG_ON(VB2_MEMORY_USERPTR != (int)V4L2_MEMORY_USERPTR);
	BUILD_BUG_ON(VB2_MEMORY_DMABUF != (int)V4L2_MEMORY_DMABUF);

	/*
	 * Sanity check
	 */
	if (WARN_ON(!q)			  ||
	    WARN_ON(q->timestamp_flags &
		    ~(V4L2_BUF_FLAG_TIMESTAMP_MASK |
		      V4L2_BUF_FLAG_TSTAMP_SRC_MASK)))
		return -EINVAL;

	/* Warn that the driver should choose an appropriate timestamp type */
	WARN_ON((q->timestamp_flags & V4L2_BUF_FLAG_TIMESTAMP_MASK) ==
		V4L2_BUF_FLAG_TIMESTAMP_UNKNOWN);

	if (q->buf_struct_size == 0)
		q->buf_struct_size = sizeof(struct vb2_v4l2_buffer);

	q->buf_ops = &v4l2_buf_ops;
	q->is_multiplanar = V4L2_TYPE_IS_MULTIPLANAR(q->type);
	q->is_output = V4L2_TYPE_IS_OUTPUT(q->type);
	q->copy_timestamp = (q->timestamp_flags & V4L2_BUF_FLAG_TIMESTAMP_MASK)
			== V4L2_BUF_FLAG_TIMESTAMP_COPY;
	/*
	 * For compatibility with vb1: if QBUF hasn't been called yet, then
	 * return EPOLLERR as well. This only affects capture queues, output
	 * queues will always initialize waiting_for_buffers to false.
	 */
	q->quirk_poll_must_check_waiting_for_buffers = true;

	if (name)
		strscpy(q->name, name, sizeof(q->name));
	else
		q->name[0] = '\0';

	return vb2_core_queue_init(q);
}
EXPORT_SYMBOL_GPL(vb2_queue_init_name);

int vb2_queue_init(struct vb2_queue *q)
{
	return vb2_queue_init_name(q, NULL);
}
EXPORT_SYMBOL_GPL(vb2_queue_init);

void vb2_queue_release(struct vb2_queue *q)
{
	vb2_core_queue_release(q);
}
EXPORT_SYMBOL_GPL(vb2_queue_release);

int vb2_queue_change_type(struct vb2_queue *q, unsigned int type)
{
	if (type == q->type)
		return 0;

	if (vb2_is_busy(q))
		return -EBUSY;

	q->type = type;

	return 0;
}
EXPORT_SYMBOL_GPL(vb2_queue_change_type);

__poll_t vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
{
	struct v4l2_fh *fh = file_to_v4l2_fh(file);
	__poll_t res;

	res = vb2_core_poll(q, file, wait);

	poll_wait(file, &fh->wait, wait);
	if (v4l2_event_pending(fh))
		res |= EPOLLPRI;

	return res;
}
EXPORT_SYMBOL_GPL(vb2_poll);

/*
 * The following functions are not part of the vb2 core API, but are helper
 * functions that plug into struct v4l2_ioctl_ops, struct v4l2_file_operations
 * and struct vb2_ops.
 * They contain boilerplate code that most if not all drivers have to do
 * and so they simplify the driver code.
 */

/* vb2 ioctl helpers */

int vb2_ioctl_remove_bufs(struct file *file, void *priv,
			  struct v4l2_remove_buffers *d)
{
	struct video_device *vdev = video_devdata(file);

	if (vdev->queue->type != d->type)
		return -EINVAL;

	if (d->count == 0)
		return 0;

	if (vb2_queue_is_busy(vdev->queue, file))
		return -EBUSY;

	if (vb2_fileio_is_active(vdev->queue)) {
		dprintk(vdev->queue, 1, "file io in progress\n");
		return -EBUSY;
	}

	return vb2_core_remove_bufs(vdev->queue, d->index, d->count);
}
EXPORT_SYMBOL_GPL(vb2_ioctl_remove_bufs);

int vb2_ioctl_reqbufs(struct file *file, void *priv,
			  struct v4l2_requestbuffers *p)
{
	struct video_device *vdev = video_devdata(file);
	int res = vb2_verify_memory_type(vdev->queue, p->memory, p->type);
	u32 flags = p->flags;

	vb2_set_flags_and_caps(vdev->queue, p->memory, &flags,
			       &p->capabilities, NULL);
	p->flags = flags;
	if (res)
		return res;
	if (vb2_queue_is_busy(vdev->queue, file))
		return -EBUSY;
	res = vb2_core_reqbufs(vdev->queue, p->memory, p->flags, &p->count);
	/* If count == 0, then the owner has released all buffers and he
	   is no longer owner of the queue. Otherwise we have a new owner. */
	if (res == 0)
		vdev->queue->owner = p->count ? file->private_data : NULL;
	return res;
}
EXPORT_SYMBOL_GPL(vb2_ioctl_reqbufs);

int vb2_ioctl_create_bufs(struct file *file, void *priv,
			  struct v4l2_create_buffers *p)
{
	struct video_device *vdev = video_devdata(file);
	int res = vb2_verify_memory_type(vdev->queue, p->memory, p->format.type);

	p->index = vb2_get_num_buffers(vdev->queue);
	vb2_set_flags_and_caps(vdev->queue, p->memory, &p->flags,
			       &p->capabilities, &p->max_num_buffers);
	/*
	 * If count == 0, then just check if memory and type are valid.
	 * Any -EBUSY result from vb2_verify_memory_type can be mapped to 0.
	 */
	if (p->count == 0)
		return res != -EBUSY ? res : 0;
	if (res)
		return res;
	if (vb2_queue_is_busy(vdev->queue, file))
		return -EBUSY;

	res = vb2_create_bufs(vdev->queue, p);
	if (res == 0)
		vdev->queue->owner = file->private_data;
	return res;
}
EXPORT_SYMBOL_GPL(vb2_ioctl_create_bufs);

int vb2_ioctl_prepare_buf(struct file *file, void *priv,
			  struct v4l2_buffer *p)
{
	struct video_device *vdev = video_devdata(file);

	if (vb2_queue_is_busy(vdev->queue, file))
		return -EBUSY;
	return vb2_prepare_buf(vdev->queue, vdev->v4l2_dev->mdev, p);
}
EXPORT_SYMBOL_GPL(vb2_ioctl_prepare_buf);

int vb2_ioctl_querybuf(struct file *file, void *priv, struct v4l2_buffer *p)
{
	struct video_device *vdev = video_devdata(file);

	/* No need to call vb2_queue_is_busy(), anyone can query buffers. */
	return vb2_querybuf(vdev->queue, p);
}
EXPORT_SYMBOL_GPL(vb2_ioctl_querybuf);

int vb2_ioctl_qbuf(struct file *file, void *priv, struct v4l2_buffer *p)
{
	struct video_device *vdev = video_devdata(file);

	if (vb2_queue_is_busy(vdev->queue, file))
		return -EBUSY;
	return vb2_qbuf(vdev->queue, vdev->v4l2_dev->mdev, p);
}
EXPORT_SYMBOL_GPL(vb2_ioctl_qbuf);

int vb2_ioctl_dqbuf(struct file *file, void *priv, struct v4l2_buffer *p)
{
	struct video_device *vdev = video_devdata(file);

	if (vb2_queue_is_busy(vdev->queue, file))
		return -EBUSY;
	return vb2_dqbuf(vdev->queue, p, file->f_flags & O_NONBLOCK);
}
EXPORT_SYMBOL_GPL(vb2_ioctl_dqbuf);

int vb2_ioctl_streamon(struct file *file, void *priv, enum v4l2_buf_type i)
{
	struct video_device *vdev = video_devdata(file);

	if (vb2_queue_is_busy(vdev->queue, file))
		return -EBUSY;
	return vb2_streamon(vdev->queue, i);
}
EXPORT_SYMBOL_GPL(vb2_ioctl_streamon);

int vb2_ioctl_streamoff(struct file *file, void *priv, enum v4l2_buf_type i)
{
	struct video_device *vdev = video_devdata(file);

	if (vb2_queue_is_busy(vdev->queue, file))
		return -EBUSY;
	return vb2_streamoff(vdev->queue, i);
}
EXPORT_SYMBOL_GPL(vb2_ioctl_streamoff);

int vb2_ioctl_expbuf(struct file *file, void *priv, struct v4l2_exportbuffer *p)
{
	struct video_device *vdev = video_devdata(file);

	if (vb2_queue_is_busy(vdev->queue, file))
		return -EBUSY;
	return vb2_expbuf(vdev->queue, p);
}
EXPORT_SYMBOL_GPL(vb2_ioctl_expbuf);

/* v4l2_file_operations helpers */

int vb2_fop_mmap(struct file *file, struct vm_area_struct *vma)
{
	struct video_device *vdev = video_devdata(file);

	return vb2_mmap(vdev->queue, vma);
}
EXPORT_SYMBOL_GPL(vb2_fop_mmap);

int _vb2_fop_release(struct file *file, struct mutex *lock)
{
	struct video_device *vdev = video_devdata(file);

	if (lock)
		mutex_lock(lock);
	if (!vdev->queue->owner || file->private_data == vdev->queue->owner) {
		vb2_queue_release(vdev->queue);
		vdev->queue->owner = NULL;
	}
	if (lock)
		mutex_unlock(lock);
	return v4l2_fh_release(file);
}
EXPORT_SYMBOL_GPL(_vb2_fop_release);

int vb2_fop_release(struct file *file)
{
	struct video_device *vdev = video_devdata(file);
	struct mutex *lock = vdev->queue->lock ? vdev->queue->lock : vdev->lock;

	return _vb2_fop_release(file, lock);
}
EXPORT_SYMBOL_GPL(vb2_fop_release);

ssize_t vb2_fop_write(struct file *file, const char __user *buf,
		size_t count, loff_t *ppos)
{
	struct video_device *vdev = video_devdata(file);
	struct mutex *lock = vdev->queue->lock ? vdev->queue->lock : vdev->lock;
	int err = -EBUSY;

	if (!(vdev->queue->io_modes & VB2_WRITE))
		return -EINVAL;
	if (lock && mutex_lock_interruptible(lock))
		return -ERESTARTSYS;
	if (vb2_queue_is_busy(vdev->queue, file))
		goto exit;
	err = vb2_write(vdev->queue, buf, count, ppos,
		       file->f_flags & O_NONBLOCK);
	if (vdev->queue->fileio)
		vdev->queue->owner = file->private_data;
exit:
	if (lock)
		mutex_unlock(lock);
	return err;
}
EXPORT_SYMBOL_GPL(vb2_fop_write);

ssize_t vb2_fop_read(struct file *file, char __user *buf,
		size_t count, loff_t *ppos)
{
	struct video_device *vdev = video_devdata(file);
	struct mutex *lock = vdev->queue->lock ? vdev->queue->lock : vdev->lock;
	int err = -EBUSY;

	if (!(vdev->queue->io_modes & VB2_READ))
		return -EINVAL;
	if (lock && mutex_lock_interruptible(lock))
		return -ERESTARTSYS;
	if (vb2_queue_is_busy(vdev->queue, file))
		goto exit;
	vdev->queue->owner = file->private_data;
	err = vb2_read(vdev->queue, buf, count, ppos,
		       file->f_flags & O_NONBLOCK);
	if (!vdev->queue->fileio)
		vdev->queue->owner = NULL;
exit:
	if (lock)
		mutex_unlock(lock);
	return err;
}
EXPORT_SYMBOL_GPL(vb2_fop_read);

__poll_t vb2_fop_poll(struct file *file, poll_table *wait)
{
	struct video_device *vdev = video_devdata(file);
	struct vb2_queue *q = vdev->queue;
	struct mutex *lock = q->lock ? q->lock : vdev->lock;
	__poll_t res;
	void *fileio;

	/*
	 * If this helper doesn't know how to lock, then you shouldn't be using
	 * it but you should write your own.
	 */
	WARN_ON(!lock);

	if (lock && mutex_lock_interruptible(lock))
		return EPOLLERR;

	fileio = q->fileio;

	res = vb2_poll(vdev->queue, file, wait);

	/* If fileio was started, then we have a new queue owner. */
	if (!fileio && q->fileio)
		q->owner = file->private_data;
	if (lock)
		mutex_unlock(lock);
	return res;
}
EXPORT_SYMBOL_GPL(vb2_fop_poll);

#ifndef CONFIG_MMU
unsigned long vb2_fop_get_unmapped_area(struct file *file, unsigned long addr,
		unsigned long len, unsigned long pgoff, unsigned long flags)
{
	struct video_device *vdev = video_devdata(file);

	return vb2_get_unmapped_area(vdev->queue, addr, len, pgoff, flags);
}
EXPORT_SYMBOL_GPL(vb2_fop_get_unmapped_area);
#endif

void vb2_video_unregister_device(struct video_device *vdev)
{
	/* Check if vdev was ever registered at all */
	if (!vdev || !video_is_registered(vdev))
		return;

	/*
	 * Calling this function only makes sense if vdev->queue is set.
	 * If it is NULL, then just call video_unregister_device() instead.
	 */
	WARN_ON(!vdev->queue);

	/*
	 * Take a reference to the device since video_unregister_device()
	 * calls device_unregister(), but we don't want that to release
	 * the device since we want to clean up the queue first.
	 */
	get_device(&vdev->dev);
	video_unregister_device(vdev);
	if (vdev->queue) {
		struct mutex *lock = vdev->queue->lock ?
			vdev->queue->lock : vdev->lock;

		if (lock)
			mutex_lock(lock);
		vb2_queue_release(vdev->queue);
		vdev->queue->owner = NULL;
		if (lock)
			mutex_unlock(lock);
	}
	/*
	 * Now we put the device, and in most cases this will release
	 * everything.
	 */
	put_device(&vdev->dev);
}
EXPORT_SYMBOL_GPL(vb2_video_unregister_device);

/*
 * Note that this function is called during validation time and
 * thus the req_queue_mutex is held to ensure no request objects
 * can be added or deleted while validating. So there is no need
 * to protect the objects list.
 */
int vb2_request_validate(struct media_request *req)
{
	struct media_request_object *obj;
	int ret = 0;

	if (!vb2_request_buffer_cnt(req))
		return -ENOENT;

	list_for_each_entry(obj, &req->objects, list) {
		if (!obj->ops->prepare)
			continue;

		ret = obj->ops->prepare(obj);
		if (ret)
			break;
	}

	if (ret) {
		list_for_each_entry_continue_reverse(obj, &req->objects, list)
			if (obj->ops->unprepare)
				obj->ops->unprepare(obj);
		return ret;
	}
	return 0;
}
EXPORT_SYMBOL_GPL(vb2_request_validate);

void vb2_request_queue(struct media_request *req)
{
	struct media_request_object *obj, *obj_safe;

	/*
	 * Queue all objects. Note that buffer objects are at the end of the
	 * objects list, after all other object types. Once buffer objects
	 * are queued, the driver might delete them immediately (if the driver
	 * processes the buffer at once), so we have to use
	 * list_for_each_entry_safe() to handle the case where the object we
	 * queue is deleted.
	 */
	list_for_each_entry_safe(obj, obj_safe, &req->objects, list)
		if (obj->ops->queue)
			obj->ops->queue(obj);
}
EXPORT_SYMBOL_GPL(vb2_request_queue);

MODULE_DESCRIPTION("Driver helper framework for Video for Linux 2");
MODULE_AUTHOR("Pawel Osciak <pawel@osciak.com>, Marek Szyprowski");
MODULE_LICENSE("GPL");
]

gemini-3-flash-preview

							input: 76538
							output: 41
							thoughts: 837
						

**Analyzing the Allocation, Free, and Access Patterns**

Right, let's dive into this code and trace the memory management. I've got the source at my fingertips, so I can start dissecting these stacks. I'm seeing a potential issue, and I need to pinpoint where it lies.

First, I'm examining the allocation in `hackrf_probe`. The report points to line 1351 in `hackrf.c` with the call to `kzalloc_obj(*dev)`. Wait a minute... looking at my local copy, line 1351 is just declaring `struct hackrf_dev *dev;`. The actual allocation is a few lines later, maybe the report is off by a few lines or a slight code variant. Okay, line 1355 is `dev = kzalloc_obj(*dev);` in my version. The report says `hackrf_probe+0xcf/0x5d0 drivers/media/usb/hackrf/hackrf.c:1351`, so that's where `dev` is being initialized.

Next, the free in `hackrf_probe`... It's in the `err_kfree` label, which is reached if there's an error. The report shows the free occurring at `hackrf_probe.cold+0x40/0x12f9 drivers/media/usb/hackrf/hackrf.c:1523`, and my local copy of `hackrf.c` confirms this as `kfree(dev);`. So if the probe fails, the allocated `dev` is freed. That seems right.

Now, the interesting bit: the access. The report's highlighting `vb2_core_queue_release+0x150/0x190 drivers/media/common/videobuf2/videobuf2-core.c:2679`. That line in the `videobuf2-core.c` is the call to `__vb2_queue_free()`. The access is a read, and the address is within `kmalloc-8k`. This is where my suspicion is raised. The report says the read is of size 4 at addr ffff88802d000f48. Since the `hackrf_dev` struct is likely large, this is where it's interesting.

So, the issue is potentially within a `videobuf2` context, and it's accessing something that was previously freed. Now, I need to figure out what's going on.

My next step is to use a tool like `codesearch-struct-layout` to determine the size of the `hackrf_dev` struct. I'll also check where `rx_vb2_queue` or `tx_vb2_queue` is located inside the struct to determine if the access is in those or not. This will either confirm a heap-use-after-free issue, or guide me to look in some other part of the codebase.

map[ContextFile:drivers/media/usb/hackrf/hackrf.c Name:hackrf_dev]

map[Fields:[map[Name:flags OffsetBits:0 SizeBits:64] map[Name:intf OffsetBits:64 SizeBits:64] map[Name:dev OffsetBits:128 SizeBits:64] map[Name:udev OffsetBits:192 SizeBits:64] map[Name:rx_vdev OffsetBits:256 SizeBits:13440] map[Name:tx_vdev OffsetBits:13696 SizeBits:13440] map[Name:v4l2_dev OffsetBits:27136 SizeBits:1472] map[Name:rx_vb2_queue OffsetBits:28608 SizeBits:4672] map[Name:tx_vb2_queue OffsetBits:33280 SizeBits:4672] map[Name:rx_buffer_list OffsetBits:37952 SizeBits:128] map[Name:tx_buffer_list OffsetBits:38080 SizeBits:128] map[Name:buffer_list_lock OffsetBits:38208 SizeBits:512] map[Name:sequence OffsetBits:38720 SizeBits:32] map[Name:vb_full OffsetBits:38752 SizeBits:32] map[Name:vb_empty OffsetBits:38784 SizeBits:32] map[Name:v4l2_lock OffsetBits:38848 SizeBits:1152] map[Name:vb_queue_lock OffsetBits:40000 SizeBits:1152] map[Name:urb_list OffsetBits:41152 SizeBits:384] map[Name:buf_num OffsetBits:41536 SizeBits:32] map[Name:buf_size OffsetBits:41600 SizeBits:64] map[Name:buf_list OffsetBits:41664 SizeBits:384] map[Name:dma_addr OffsetBits:42048 SizeBits:384] map[Name:urbs_initialized OffsetBits:42432 SizeBits:32] map[Name:urbs_submitted OffsetBits:42464 SizeBits:32] map[Name:buf OffsetBits:42496 SizeBits:192] map[Name:f_adc OffsetBits:42688 SizeBits:32] map[Name:f_dac OffsetBits:42720 SizeBits:32] map[Name:f_rx OffsetBits:42752 SizeBits:32] map[Name:f_tx OffsetBits:42784 SizeBits:32] map[Name:pixelformat OffsetBits:42816 SizeBits:32] map[Name:buffersize OffsetBits:42848 SizeBits:32] map[Name:rx_ctrl_handler OffsetBits:42880 SizeBits:2560] map[Name:rx_bandwidth_auto OffsetBits:45440 SizeBits:64] map[Name:rx_bandwidth OffsetBits:45504 SizeBits:64] map[Name:rx_rf_gain OffsetBits:45568 SizeBits:64] map[Name:rx_lna_gain OffsetBits:45632 SizeBits:64] map[Name:rx_if_gain OffsetBits:45696 SizeBits:64] map[Name:tx_ctrl_handler OffsetBits:45760 SizeBits:2560] map[Name:tx_bandwidth_auto OffsetBits:48320 SizeBits:64] map[Name:tx_bandwidth OffsetBits:48384 SizeBits:64] map[Name:tx_rf_gain OffsetBits:48448 SizeBits:64] map[Name:tx_lna_gain OffsetBits:48512 SizeBits:64] map[Name:jiffies_next OffsetBits:48576 SizeBits:64] map[Name:sample OffsetBits:48640 SizeBits:32] map[Name:sample_measured OffsetBits:48672 SizeBits:32]]]

gemini-3-flash-preview

							input: 79163
							output: 37
							thoughts: 364
						

**Analyzing the HackRF Device Structure and a Potential Memory Corruption**

Okay, so I'm digging into this `hackrf_dev` structure and trying to understand a possible memory issue. Let's see... the `sample_measured` field, which seems to be the last one, kicks in at bit 48672 and occupies 32 bits. That means the total size of the structure should be 48672 + 32 = 48704 bits. Dividing that by 8 gives us 6088 bytes, which nicely fits within a `kmalloc-8k` allocation of 8192 bytes. That's good, no immediate red flags there regarding size.

Now, the debugger pointed me to address `ffff88802d000f48`. The base object starts at `ffff88802d000000`, so we're looking at an offset of `0xf48` – which is 3912 bytes. Hmm, 3912 bytes * 8 bits/byte gets me 31296 bits from the start of the object.

Okay, let's see what's at bit offset 31296 within the `hackrf_dev` structure. Going through the layout… `v4l2_dev` starts at 27136 bits and spans 1472 bits, ending at bit 28608. Following that, `rx_vb2_queue` immediately succeeds, starting at bit 28608 and going on for 4672 bits, ending at bit 33280. So, 31296 clearly falls inside `rx_vb2_queue`.

Now, the important part: the offset within `rx_vb2_queue` itself is 31296 - 28608 = 2688 bits, or 336 bytes. That looks like a useful starting point... I'll need to dive into the definition and layout of `struct vb2_queue` to determine what's actually at that offset within the `rx_vb2_queue` structure. From there, I should be able to deduce the cause of this bug.

map[ContextFile:media/videobuf2-core.h Name:vb2_queue]

map[Fields:[map[Name:type OffsetBits:0 SizeBits:32] map[Name:io_modes OffsetBits:32 SizeBits:32] map[Name:dev OffsetBits:64 SizeBits:64] map[Name:dma_attrs OffsetBits:128 SizeBits:64] map[Name:bidirectional OffsetBits:192 SizeBits:1] map[Name:fileio_read_once OffsetBits:193 SizeBits:1] map[Name:fileio_write_immediately OffsetBits:194 SizeBits:1] map[Name:allow_zero_bytesused OffsetBits:195 SizeBits:1] map[Name:quirk_poll_must_check_waiting_for_buffers OffsetBits:196 SizeBits:1] map[Name:supports_requests OffsetBits:197 SizeBits:1] map[Name:requires_requests OffsetBits:198 SizeBits:1] map[Name:uses_qbuf OffsetBits:199 SizeBits:1] map[Name:uses_requests OffsetBits:200 SizeBits:1] map[Name:allow_cache_hints OffsetBits:201 SizeBits:1] map[Name:non_coherent_mem OffsetBits:202 SizeBits:1] map[Name:lock OffsetBits:256 SizeBits:64] map[Name:owner OffsetBits:320 SizeBits:64] map[Name:ops OffsetBits:384 SizeBits:64] map[Name:mem_ops OffsetBits:448 SizeBits:64] map[Name:buf_ops OffsetBits:512 SizeBits:64] map[Name:drv_priv OffsetBits:576 SizeBits:64] map[Name:subsystem_flags OffsetBits:640 SizeBits:32] map[Name:buf_struct_size OffsetBits:672 SizeBits:32] map[Name:timestamp_flags OffsetBits:704 SizeBits:32] map[Name:gfp_flags OffsetBits:736 SizeBits:32] map[Name:min_queued_buffers OffsetBits:768 SizeBits:32] map[Name:min_reqbufs_allocation OffsetBits:800 SizeBits:32] map[Name:alloc_devs OffsetBits:832 SizeBits:512] map[Name:mmap_lock OffsetBits:1344 SizeBits:1152] map[Name:memory OffsetBits:2496 SizeBits:32] map[Name:dma_dir OffsetBits:2528 SizeBits:32] map[Name:bufs OffsetBits:2560 SizeBits:64] map[Name:bufs_bitmap OffsetBits:2624 SizeBits:64] map[Name:max_num_buffers OffsetBits:2688 SizeBits:32] map[Name:queued_list OffsetBits:2752 SizeBits:128] map[Name:queued_count OffsetBits:2880 SizeBits:32] map[Name:owned_by_drv_count OffsetBits:2912 SizeBits:32] map[Name:done_list OffsetBits:2944 SizeBits:128] map[Name:done_lock OffsetBits:3072 SizeBits:512] map[Name:done_wq OffsetBits:3584 SizeBits:640] map[Name:streaming OffsetBits:4224 SizeBits:1] map[Name:start_streaming_called OffsetBits:4225 SizeBits:1] map[Name:error OffsetBits:4226 SizeBits:1] map[Name:waiting_for_buffers OffsetBits:4227 SizeBits:1] map[Name:waiting_in_dqbuf OffsetBits:4228 SizeBits:1] map[Name:is_multiplanar OffsetBits:4229 SizeBits:1] map[Name:is_output OffsetBits:4230 SizeBits:1] map[Name:is_busy OffsetBits:4231 SizeBits:1] map[Name:copy_timestamp OffsetBits:4232 SizeBits:1] map[Name:last_buffer_dequeued OffsetBits:4233 SizeBits:1] map[Name:fileio OffsetBits:4288 SizeBits:64] map[Name:threadio OffsetBits:4352 SizeBits:64] map[Name:name OffsetBits:4416 SizeBits:256]]]

gemini-3-flash-preview

							input: 81229
							output: 22
							thoughts: 3808
						

**Vulnerability Deep Dive: HackRF Driver Use-After-Free**

Okay, I've got this. The core of the problem lies in a use-after-free vulnerability within the HackRF driver. I can see it clearly now, the driver allocates the `hackrf_dev` structure, registers a V4L2 device, but then proceeds to free this structure prematurely under certain error conditions in the probe function, before userspace has a chance to close the device. This creates a classic race condition.

I can see where the critical read happens - `vb2_core_queue_release` is reading `q->max_num_buffers`. This `vb2_queue` (`dev->rx_vb2_queue`) is part of the freed `hackrf_dev`. The crash report aligns perfectly with the code.

Here's the sequence:

1.  `hackrf_probe` allocates `hackrf_dev`.
2.  It initializes and registers a V4L2 video device (`dev->rx_vdev`). Notably, this registration allows userspace to open the device. The problem starts if registering a second device fails.
3.  The crucial flaw: If any subsequent initialization step fails *after* `video_register_device` has succeeded, the error path is triggered. This path *immediately* calls `kfree(dev)`, freeing the entire `hackrf_dev` structure, even if a user has the device open.
4.  Later, when a user closes the device (either normally or if the driver unloads), the `v4l2_release` function is called.
5.  `v4l2_release` calls `vb2_fop_release`, which eventually calls `vb2_core_queue_release`. This routine attempts to access freed memory (`dev->rx_vb2_queue`). This causes the use-after-free, which in this case is the `q->max_num_buffers` field.

The root cause is the incorrect refcounting. The `video_register_device` call takes some form of reference, but the driver doesn't properly track this and guarantee the structure stays valid until all userspace references are gone. The `video_device` struct doesn't have a specific `release` callback that would prevent the `kfree`. The `v4l2_device` refcounting is also incorrect. The code should use the correct refcounting.

The fix is obvious, and the report makes it perfectly clear: in the `hackrf_probe` error path, the driver must *not* `kfree(dev)` directly if `video_register_device` has succeeded. Instead, it must ensure that the `dev` structure is only freed when the last userspace process has closed the device. The recommended approach is to use refcounting that mirrors the one used in `hackrf_disconnect`.

map[Expression:v4l2_device_put]

map[Output:Documentation/driver-api/media/v4l2-device.rst=133=or:
Documentation/driver-api/media/v4l2-device.rst-134-
Documentation/driver-api/media/v4l2-device.rst:135:	:c:func:`v4l2_device_put`
Documentation/driver-api/media/v4l2-device.rst-136-	(:c:type:`v4l2_dev <v4l2_device>`).
--
Documentation/driver-api/media/v4l2-device.rst=138=Since the initial refcount is 1 you also need to call
Documentation/driver-api/media/v4l2-device.rst:139::c:func:`v4l2_device_put` in the ``disconnect()`` callback (for USB devices)
Documentation/driver-api/media/v4l2-device.rst-140-or in the ``remove()`` callback (for e.g. PCI devices), otherwise the refcount
--
Documentation/translations/zh_CN/video4linux/v4l2-framework.txt=199=void v4l2_device_get(struct v4l2_device *v4l2_dev);
--
Documentation/translations/zh_CN/video4linux/v4l2-framework.txt-202-
Documentation/translations/zh_CN/video4linux/v4l2-framework.txt:203:int v4l2_device_put(struct v4l2_device *v4l2_dev);
Documentation/translations/zh_CN/video4linux/v4l2-framework.txt-204-
Documentation/translations/zh_CN/video4linux/v4l2-framework.txt-205-由于引用技术初始化为 1 ，你也需要在 disconnect() 回调（对于 USB 设备）中
Documentation/translations/zh_CN/video4linux/v4l2-framework.txt:206:调用 v4l2_device_put，或者 remove() 回调（例如对于 PCI 设备），否则
Documentation/translations/zh_CN/video4linux/v4l2-framework.txt-207-引用计数将永远不会为 0 。
--
drivers/media/dvb-frontends/rtl2832_sdr.c=1465=static void rtl2832_sdr_remove(struct platform_device *pdev)
--
drivers/media/dvb-frontends/rtl2832_sdr.c-1478-	mutex_unlock(&dev->vb_queue_lock);
drivers/media/dvb-frontends/rtl2832_sdr.c:1479:	v4l2_device_put(&dev->v4l2_dev);
drivers/media/dvb-frontends/rtl2832_sdr.c-1480-	module_put(pdev->dev.parent->driver->owner);
--
drivers/media/pci/saa7134/saa7134-go7007.c=473=static int saa7134_go7007_fini(struct saa7134_dev *dev)
--
drivers/media/pci/saa7134/saa7134-go7007.c-492-
drivers/media/pci/saa7134/saa7134-go7007.c:493:	v4l2_device_put(&go->v4l2_dev);
drivers/media/pci/saa7134/saa7134-go7007.c-494-	dev->empress_dev = NULL;
--
drivers/media/pci/tw686x/tw686x-core.c=364=static void tw686x_remove(struct pci_dev *pci_dev)
--
drivers/media/pci/tw686x/tw686x-core.c-396-	 */
drivers/media/pci/tw686x/tw686x-core.c:397:	v4l2_device_put(&dev->v4l2_dev);
drivers/media/pci/tw686x/tw686x-core.c-398-}
--
drivers/media/radio/dsbr100.c=247=static void usb_dsbr100_disconnect(struct usb_interface *intf)
--
drivers/media/radio/dsbr100.c-265-	mutex_unlock(&radio->v4l2_lock);
drivers/media/radio/dsbr100.c:266:	v4l2_device_put(&radio->v4l2_dev);
drivers/media/radio/dsbr100.c-267-}
--
drivers/media/radio/radio-keene.c=134=static void usb_keene_disconnect(struct usb_interface *intf)
--
drivers/media/radio/radio-keene.c-142-	mutex_unlock(&radio->lock);
drivers/media/radio/radio-keene.c:143:	v4l2_device_put(&radio->v4l2_dev);
drivers/media/radio/radio-keene.c-144-}
--
drivers/media/radio/radio-ma901.c=173=static void usb_ma901radio_disconnect(struct usb_interface *intf)
--
drivers/media/radio/radio-ma901.c-181-	mutex_unlock(&radio->lock);
drivers/media/radio/radio-ma901.c:182:	v4l2_device_put(&radio->v4l2_dev);
drivers/media/radio/radio-ma901.c-183-}
--
drivers/media/radio/radio-mr800.c=241=static void usb_amradio_disconnect(struct usb_interface *intf)
--
drivers/media/radio/radio-mr800.c-250-	mutex_unlock(&radio->lock);
drivers/media/radio/radio-mr800.c:251:	v4l2_device_put(&radio->v4l2_dev);
drivers/media/radio/radio-mr800.c-252-}
--
drivers/media/radio/radio-raremono.c=162=static void usb_raremono_disconnect(struct usb_interface *intf)
--
drivers/media/radio/radio-raremono.c-172-	mutex_unlock(&radio->lock);
drivers/media/radio/radio-raremono.c:173:	v4l2_device_put(&radio->v4l2_dev);
drivers/media/radio/radio-raremono.c-174-}
--
drivers/media/radio/radio-shark.c=290=static void usb_shark_disconnect(struct usb_interface *intf)
--
drivers/media/radio/radio-shark.c-301-
drivers/media/radio/radio-shark.c:302:	v4l2_device_put(&shark->v4l2_dev);
drivers/media/radio/radio-shark.c-303-}
--
drivers/media/radio/radio-shark2.c=256=static void usb_shark_disconnect(struct usb_interface *intf)
--
drivers/media/radio/radio-shark2.c-267-
drivers/media/radio/radio-shark2.c:268:	v4l2_device_put(&shark->v4l2_dev);
drivers/media/radio/radio-shark2.c-269-}
--
drivers/media/radio/si470x/radio-si470x-usb.c=816=static void si470x_usb_driver_disconnect(struct usb_interface *intf)
--
drivers/media/radio/si470x/radio-si470x-usb.c-825-	mutex_unlock(&radio->lock);
drivers/media/radio/si470x/radio-si470x-usb.c:826:	v4l2_device_put(&radio->v4l2_dev);
drivers/media/radio/si470x/radio-si470x-usb.c-827-}
--
drivers/media/radio/si4713/radio-usb-si4713.c=500=static void usb_si4713_disconnect(struct usb_interface *intf)
--
drivers/media/radio/si4713/radio-usb-si4713.c-510-	mutex_unlock(&radio->lock);
drivers/media/radio/si4713/radio-usb-si4713.c:511:	v4l2_device_put(&radio->v4l2_dev);
drivers/media/radio/si4713/radio-usb-si4713.c-512-}
--
drivers/media/test-drivers/vicodec/vicodec-core.c=2203=static void vicodec_remove(struct platform_device *pdev)
--
drivers/media/test-drivers/vicodec/vicodec-core.c-2218-	video_unregister_device(&dev->stateless_dec.vfd);
drivers/media/test-drivers/vicodec/vicodec-core.c:2219:	v4l2_device_put(&dev->v4l2_dev);
drivers/media/test-drivers/vicodec/vicodec-core.c-2220-}
--
drivers/media/test-drivers/vimc/vimc-core.c=387=static void vimc_remove(struct platform_device *pdev)
--
drivers/media/test-drivers/vimc/vimc-core.c-395-	v4l2_device_unregister(&vimc->v4l2_dev);
drivers/media/test-drivers/vimc/vimc-core.c:396:	v4l2_device_put(&vimc->v4l2_dev);
drivers/media/test-drivers/vimc/vimc-core.c-397-}
--
drivers/media/test-drivers/vivid/vivid-core.c=1800=static int vivid_create_instance(struct platform_device *pdev, int inst)
--
drivers/media/test-drivers/vivid/vivid-core.c-2069-free_dev:
drivers/media/test-drivers/vivid/vivid-core.c:2070:	v4l2_device_put(&dev->v4l2_dev);
drivers/media/test-drivers/vivid/vivid-core.c-2071-	return ret;
--
drivers/media/test-drivers/vivid/vivid-core.c=2151=static void vivid_remove(struct platform_device *pdev)
--
drivers/media/test-drivers/vivid/vivid-core.c-2223-			kthread_stop(dev->kthread_cec);
drivers/media/test-drivers/vivid/vivid-core.c:2224:		v4l2_device_put(&dev->v4l2_dev);
drivers/media/test-drivers/vivid/vivid-core.c-2225-		vivid_devs[i] = NULL;
--
drivers/media/usb/airspy/airspy.c=460=static void airspy_disconnect(struct usb_interface *intf)
--
drivers/media/usb/airspy/airspy.c-475-
drivers/media/usb/airspy/airspy.c:476:	v4l2_device_put(&s->v4l2_dev);
drivers/media/usb/airspy/airspy.c-477-}
--
drivers/media/usb/au0828/au0828-video.c=927=int au0828_analog_unregister(struct au0828_dev *dev)
--
drivers/media/usb/au0828/au0828-video.c-940-	v4l2_device_disconnect(&dev->v4l2_dev);
drivers/media/usb/au0828/au0828-video.c:941:	v4l2_device_put(&dev->v4l2_dev);
drivers/media/usb/au0828/au0828-video.c-942-
--
drivers/media/usb/dvb-usb/cxusb-analog.c=1774=int cxusb_medion_register_analog(struct dvb_usb_device *dvbdev)
--
drivers/media/usb/dvb-usb/cxusb-analog.c-1816-ret_unregister:
drivers/media/usb/dvb-usb/cxusb-analog.c:1817:	v4l2_device_put(&cxdev->v4l2dev);
drivers/media/usb/dvb-usb/cxusb-analog.c-1818-	wait_for_completion(&cxdev->v4l2_release);
--
drivers/media/usb/dvb-usb/cxusb-analog.c=1823=void cxusb_medion_unregister_analog(struct dvb_usb_device *dvbdev)
--
drivers/media/usb/dvb-usb/cxusb-analog.c-1831-
drivers/media/usb/dvb-usb/cxusb-analog.c:1832:	v4l2_device_put(&cxdev->v4l2dev);
drivers/media/usb/dvb-usb/cxusb-analog.c-1833-	wait_for_completion(&cxdev->v4l2_release);
--
drivers/media/usb/go7007/go7007-usb.c=1328=static void go7007_usb_disconnect(struct usb_interface *intf)
--
drivers/media/usb/go7007/go7007-usb.c-1343-
drivers/media/usb/go7007/go7007-usb.c:1344:	v4l2_device_put(&go->v4l2_dev);
drivers/media/usb/go7007/go7007-usb.c-1345-}
--
drivers/media/usb/go7007/snd-go7007.c=260=int go7007_snd_remove(struct go7007 *go)
--
drivers/media/usb/go7007/snd-go7007.c-265-	snd_card_free_when_closed(gosnd->card);
drivers/media/usb/go7007/snd-go7007.c:266:	v4l2_device_put(&go->v4l2_dev);
drivers/media/usb/go7007/snd-go7007.c-267-	return 0;
--
drivers/media/usb/gspca/gspca.c=1618=void gspca_disconnect(struct usb_interface *intf)
--
drivers/media/usb/gspca/gspca.c-1648-	/* (this will call gspca_release() immediately or on last close) */
drivers/media/usb/gspca/gspca.c:1649:	v4l2_device_put(&gspca_dev->v4l2_dev);
drivers/media/usb/gspca/gspca.c-1650-}
--
drivers/media/usb/hackrf/hackrf.c=705=static void hackrf_disconnect(struct usb_interface *intf)
--
drivers/media/usb/hackrf/hackrf.c-721-
drivers/media/usb/hackrf/hackrf.c:722:	v4l2_device_put(&dev->v4l2_dev);
drivers/media/usb/hackrf/hackrf.c-723-}
--
drivers/media/usb/msi2500/msi2500.c=563=static void msi2500_disconnect(struct usb_interface *intf)
--
drivers/media/usb/msi2500/msi2500.c-580-
drivers/media/usb/msi2500/msi2500.c:581:	v4l2_device_put(&dev->v4l2_dev);
drivers/media/usb/msi2500/msi2500.c-582-}
--
drivers/media/usb/pwc/pwc-if.c=1170=static void usb_pwc_disconnect(struct usb_interface *intf)
--
drivers/media/usb/pwc/pwc-if.c-1191-
drivers/media/usb/pwc/pwc-if.c:1192:	v4l2_device_put(&pdev->v4l2_dev);
drivers/media/usb/pwc/pwc-if.c-1193-}
--
drivers/media/usb/stk1160/stk1160-core.c=388=static void stk1160_disconnect(struct usb_interface *interface)
--
drivers/media/usb/stk1160/stk1160-core.c-419-	 */
drivers/media/usb/stk1160/stk1160-core.c:420:	v4l2_device_put(&dev->v4l2_dev);
drivers/media/usb/stk1160/stk1160-core.c-421-}
--
drivers/media/usb/usbtv/usbtv-core.c=128=static void usbtv_disconnect(struct usb_interface *intf)
--
drivers/media/usb/usbtv/usbtv-core.c-144-	   done using it */
drivers/media/usb/usbtv/usbtv-core.c:145:	v4l2_device_put(&usbtv->v4l2_dev);
drivers/media/usb/usbtv/usbtv-core.c-146-}
--
drivers/media/usb/usbtv/usbtv-video.c=966=void usbtv_video_free(struct usbtv *usbtv)
--
drivers/media/usb/usbtv/usbtv-video.c-970-
drivers/media/usb/usbtv/usbtv-video.c:971:	v4l2_device_put(&usbtv->v4l2_dev);
drivers/media/usb/usbtv/usbtv-video.c-972-}
--
drivers/media/v4l2-core/v4l2-dev.c=177=static void v4l2_device_release(struct device *cd)
--
drivers/media/v4l2-core/v4l2-dev.c-211-
drivers/media/v4l2-core/v4l2-dev.c:212:	/* Do not call v4l2_device_put if there is no release callback set.
drivers/media/v4l2-core/v4l2-dev.c-213-	 * Drivers that have no v4l2_device release callback might free the
--
drivers/media/v4l2-core/v4l2-dev.c-228-	if (v4l2_dev)
drivers/media/v4l2-core/v4l2-dev.c:229:		v4l2_device_put(v4l2_dev);
drivers/media/v4l2-core/v4l2-dev.c-230-}
--
drivers/media/v4l2-core/v4l2-device.c=45=static void v4l2_device_release(struct kref *ref)
--
drivers/media/v4l2-core/v4l2-device.c-53-
drivers/media/v4l2-core/v4l2-device.c:54:int v4l2_device_put(struct v4l2_device *v4l2_dev)
drivers/media/v4l2-core/v4l2-device.c-55-{
--
drivers/media/v4l2-core/v4l2-device.c-57-}
drivers/media/v4l2-core/v4l2-device.c:58:EXPORT_SYMBOL_GPL(v4l2_device_put);
drivers/media/v4l2-core/v4l2-device.c-59-
--
drivers/staging/media/tegra-video/video.c=110=static void host1x_video_remove(struct host1x_device *dev)
--
drivers/staging/media/tegra-video/video.c-119-	/* This calls v4l2_dev release callback on last reference */
drivers/staging/media/tegra-video/video.c:120:	v4l2_device_put(&vid->v4l2_dev);
drivers/staging/media/tegra-video/video.c-121-}
--
drivers/staging/most/video/video.c=454=static int comp_probe_channel(struct most_interface *iface, int channel_idx,
--
drivers/staging/most/video/video.c-508-	v4l2_device_disconnect(&mdev->v4l2_dev);
drivers/staging/most/video/video.c:509:	v4l2_device_put(&mdev->v4l2_dev);
drivers/staging/most/video/video.c-510-	return ret;
--
drivers/staging/most/video/video.c=513=static int comp_disconnect_channel(struct most_interface *iface,
--
drivers/staging/most/video/video.c-528-	v4l2_device_disconnect(&mdev->v4l2_dev);
drivers/staging/most/video/video.c:529:	v4l2_device_put(&mdev->v4l2_dev);
drivers/staging/most/video/video.c-530-	return 0;
--
drivers/staging/most/video/video.c=556=static void __exit comp_exit(void)
--
drivers/staging/most/video/video.c-574-		v4l2_device_disconnect(&mdev->v4l2_dev);
drivers/staging/most/video/video.c:575:		v4l2_device_put(&mdev->v4l2_dev);
drivers/staging/most/video/video.c-576-	}
--
include/media/v4l2-device.h=67=static inline void v4l2_device_get(struct v4l2_device *v4l2_dev)
--
include/media/v4l2-device.h-72-/**
include/media/v4l2-device.h:73: * v4l2_device_put - puts a V4L2 device reference
include/media/v4l2-device.h-74- *
--
include/media/v4l2-device.h-79- */
include/media/v4l2-device.h:80:int v4l2_device_put(struct v4l2_device *v4l2_dev);
include/media/v4l2-device.h-81-
]

gemini-3-flash-preview

							input: 91695
							output: 56
							thoughts: 688
						

**Analyzing the `v4l2_device` Lifecycle in `hackrf.c`**

Okay, so I'm looking at how the `v4l2_device` structure is managed in `hackrf.c`. My understanding is that `v4l2_device_put` is the critical function here, used for handling the lifetime and releasing the resource when the structure is no longer needed.

I see that `hackrf_probe` registers the `v4l2_device` using `v4l2_device_register`. Specifically, it sets the `release` function and then calls `v4l2_device_register`, which initializes the refcount, presumably to 1. This means, if `hackrf_probe` fails after this point, then I should be calling `v4l2_device_put` to decrement the reference count, releasing the resource. However, there may be some caveats.

Initially, I thought just using `v4l2_device_put` was sufficient. However, it seems like I actually need to first call `v4l2_device_unregister`, and *then* call `v4l2_device_put`. This is to ensure that the unregistration is clean. I need to make sure the device is completely unregistered and that the V4L2 core knows that it is no longer being used.

The `video_register_device` function, if called, adds a reference to `v4l2_device`. Then, when `video_unregister_device` is called, it *eventually* decrements the refcount via `v4l2_device_put` when the last user of the `video_device` closes it.

So, the ideal error handling flow, after `v4l2_device_register` succeeds in `hackrf_probe`, looks like this:

1.  Unregister any registered `video_device`s using `video_unregister_device`.
2.  Unregister the v4l2 device with `v4l2_device_unregister`.
3.  Decrement the refcount with `v4l2_device_put`.

Looking at the current error handling in `hackrf.c`, I see a section where it handles various failures. Currently, it unregisters the video device (if registered), unregisters the `v4l2_device`, frees control handlers, and *finally* calls `kfree(dev)`. This is where the problem lies. Instead of `kfree(dev)`, it should be calling `v4l2_device_put(&dev->v4l2_dev)` because that's the proper way to manage the lifetime of the `v4l2_device` structure.

However, I'm now pausing to reconsider the code flow. If `v4l2_device_register` *fails*, then I'm questioning if `v4l2_device_put` needs to be called at all. The refcount might not have been initialized if `v4l2_device_register` returns an error. I should really check the implementation of `v4l2_device_register` to confirm how it handles failures and whether it increments the refcount in the event of failure.

map[ContextFile:drivers/media/v4l2-core/v4l2-device.c IncludeLines:true Name:v4l2_device_register]

map[SourceCode:  17:	int v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev)
  18:	{
  19:		if (v4l2_dev == NULL)
  20:			return -EINVAL;
  21:	
  22:		INIT_LIST_HEAD(&v4l2_dev->subdevs);
  23:		spin_lock_init(&v4l2_dev->lock);
  24:		v4l2_prio_init(&v4l2_dev->prio);
  25:		kref_init(&v4l2_dev->ref);
  26:		get_device(dev);
  27:		v4l2_dev->dev = dev;
  28:		if (dev == NULL) {
  29:			/* If dev == NULL, then name must be filled in by the caller */
  30:			if (WARN_ON(!v4l2_dev->name[0]))
  31:				return -EINVAL;
  32:			return 0;
  33:		}
  34:	
  35:		/* Set name to driver name + device name if it is empty. */
  36:		if (!v4l2_dev->name[0])
  37:			snprintf(v4l2_dev->name, sizeof(v4l2_dev->name), "%s %s",
  38:				dev->driver->name, dev_name(dev));
  39:		if (!dev_get_drvdata(dev))
  40:			dev_set_drvdata(dev, v4l2_dev);
  41:		return 0;
  42:	}
 SourceFile:drivers/media/v4l2-core/v4l2-device.c]

gemini-3-flash-preview

							input: 93614
							output: 54
							thoughts: 570
						

**Analyzing the Reference Counting in the V4L2 Device Registration**

Okay, let's break down this `v4l2_device_register` situation. At line 25, it initializes the reference count using `kref_init(&v4l2_dev->ref)`. That sets the initial reference count to 1. The key point is: if this function returns 0, the caller *must* call `v4l2_device_put` at some point. That's how we manage the device's lifecycle.

Now, looking at `hackrf_probe`, things get interesting. In this context:

```c
1484 	ret = v4l2_device_register(&intf->dev, &dev->v4l2_dev);
1485 	if (ret) {
1486 		dev_err(dev->dev, "Failed to register v4l2-device (%d)\n", ret);
1487 		goto err_v4l2_ctrl_handler_free_tx;
1488 	}
```

If `v4l2_device_register` fails, we jump to `err_v4l2_ctrl_handler_free_tx`, which eventually does a `kfree(dev)`. That looks safe enough because it indicates an early failure. While `v4l2_device_register` may have initialized the refcount, the error paths handle the cleanup. It only returns an error if `v4l2_dev` is NULL or `dev` is NULL and `name` is empty.

But here's where it gets problematic: What if `v4l2_device_register` *succeeds*, but `video_register_device` fails?

```c
1500 	ret = video_register_device(&dev->rx_vdev, VFL_TYPE_SDR, -1);
1501 	if (ret) {
1502 		dev_err(dev->dev,
1503 			"Failed to register as video device (%d)\n", ret);
1504 		goto err_v4l2_device_unregister;
1505 	}
```

In this case, we go to `err_v4l2_device_unregister`. This path calls `v4l2_device_unregister`, *then* calls `kfree(dev)`. The problem? `v4l2_device_unregister` *does not* call `v4l2_device_put`.  So, the reference count remains at 1, but we're freeing the `dev` structure. That's a classic memory leak if no other code holds a reference to the `v4l2_device`.

However, the bigger issue here is that `video_register_device` takes a reference to the `v4l2_device`. Because `video_register_device` takes a reference to the device, we have a clear reference that might outlive the call to `v4l2_device_unregister`. We've got a potential dangling pointer here!

I need to go and examine the implementation of `video_register_device` right now.

map[ContextFile:drivers/media/v4l2-core/v4l2-dev.c IncludeLines:true Name:__video_register_device]

map[SourceCode: 910:	int __video_register_device(struct video_device *vdev,
 911:				    enum vfl_devnode_type type,
 912:				    int nr, int warn_if_nr_in_use,
 913:				    struct module *owner)
 914:	{
 915:		int i = 0;
 916:		int ret;
 917:		int minor_offset = 0;
 918:		int minor_cnt = VIDEO_NUM_DEVICES;
 919:		const char *name_base;
 920:	
 921:		/* A minor value of -1 marks this video device as never
 922:		   having been registered */
 923:		vdev->minor = -1;
 924:	
 925:		/* the release callback MUST be present */
 926:		if (WARN_ON(!vdev->release))
 927:			return -EINVAL;
 928:		/* the v4l2_dev pointer MUST be present */
 929:		if (WARN_ON(!vdev->v4l2_dev))
 930:			return -EINVAL;
 931:		/* the device_caps field MUST be set for all but subdevs */
 932:		if (WARN_ON(type != VFL_TYPE_SUBDEV && !vdev->device_caps))
 933:			return -EINVAL;
 934:		/* the open and release file operations are mandatory */
 935:		if (WARN_ON(!vdev->fops || !vdev->fops->open || !vdev->fops->release))
 936:			return -EINVAL;
 937:	
 938:		/* v4l2_fh support */
 939:		spin_lock_init(&vdev->fh_lock);
 940:		INIT_LIST_HEAD(&vdev->fh_list);
 941:	
 942:		/* Part 1: check device type */
 943:		switch (type) {
 944:		case VFL_TYPE_VIDEO:
 945:			name_base = "video";
 946:			break;
 947:		case VFL_TYPE_VBI:
 948:			name_base = "vbi";
 949:			break;
 950:		case VFL_TYPE_RADIO:
 951:			name_base = "radio";
 952:			break;
 953:		case VFL_TYPE_SUBDEV:
 954:			name_base = "v4l-subdev";
 955:			break;
 956:		case VFL_TYPE_SDR:
 957:			/* Use device name 'swradio' because 'sdr' was already taken. */
 958:			name_base = "swradio";
 959:			break;
 960:		case VFL_TYPE_TOUCH:
 961:			name_base = "v4l-touch";
 962:			break;
 963:		default:
 964:			pr_err("%s called with unknown type: %d\n",
 965:			       __func__, type);
 966:			return -EINVAL;
 967:		}
 968:	
 969:		vdev->vfl_type = type;
 970:		vdev->cdev = NULL;
 971:		if (vdev->dev_parent == NULL)
 972:			vdev->dev_parent = vdev->v4l2_dev->dev;
 973:		if (vdev->ctrl_handler == NULL)
 974:			vdev->ctrl_handler = vdev->v4l2_dev->ctrl_handler;
 975:		/* If the prio state pointer is NULL, then use the v4l2_device
 976:		   prio state. */
 977:		if (vdev->prio == NULL)
 978:			vdev->prio = &vdev->v4l2_dev->prio;
 979:	
 980:		/* Part 2: find a free minor, device node number and device index. */
 981:	#ifdef CONFIG_VIDEO_FIXED_MINOR_RANGES
 982:		/* Keep the ranges for the first four types for historical
 983:		 * reasons.
 984:		 * Newer devices (not yet in place) should use the range
 985:		 * of 128-191 and just pick the first free minor there
 986:		 * (new style). */
 987:		switch (type) {
 988:		case VFL_TYPE_VIDEO:
 989:			minor_offset = 0;
 990:			minor_cnt = 64;
 991:			break;
 992:		case VFL_TYPE_RADIO:
 993:			minor_offset = 64;
 994:			minor_cnt = 64;
 995:			break;
 996:		case VFL_TYPE_VBI:
 997:			minor_offset = 224;
 998:			minor_cnt = 32;
 999:			break;
1000:		default:
1001:			minor_offset = 128;
1002:			minor_cnt = 64;
1003:			break;
1004:		}
1005:	#endif
1006:	
1007:		/* Pick a device node number */
1008:		mutex_lock(&videodev_lock);
1009:		nr = devnode_find(vdev, nr == -1 ? 0 : nr, minor_cnt);
1010:		if (nr == minor_cnt)
1011:			nr = devnode_find(vdev, 0, minor_cnt);
1012:		if (nr == minor_cnt) {
1013:			pr_err("could not get a free device node number\n");
1014:			mutex_unlock(&videodev_lock);
1015:			return -ENFILE;
1016:		}
1017:	#ifdef CONFIG_VIDEO_FIXED_MINOR_RANGES
1018:		/* 1-on-1 mapping of device node number to minor number */
1019:		i = nr;
1020:	#else
1021:		/* The device node number and minor numbers are independent, so
1022:		   we just find the first free minor number. */
1023:		for (i = 0; i < VIDEO_NUM_DEVICES; i++)
1024:			if (video_devices[i] == NULL)
1025:				break;
1026:		if (i == VIDEO_NUM_DEVICES) {
1027:			mutex_unlock(&videodev_lock);
1028:			pr_err("could not get a free minor\n");
1029:			return -ENFILE;
1030:		}
1031:	#endif
1032:		vdev->minor = i + minor_offset;
1033:		vdev->num = nr;
1034:	
1035:		/* Should not happen since we thought this minor was free */
1036:		if (WARN_ON(video_devices[vdev->minor])) {
1037:			mutex_unlock(&videodev_lock);
1038:			pr_err("video_device not empty!\n");
1039:			return -ENFILE;
1040:		}
1041:		devnode_set(vdev);
1042:		vdev->index = get_index(vdev);
1043:		video_devices[vdev->minor] = vdev;
1044:		mutex_unlock(&videodev_lock);
1045:	
1046:		if (vdev->ioctl_ops)
1047:			determine_valid_ioctls(vdev);
1048:	
1049:		/* Part 3: Initialize the character device */
1050:		vdev->cdev = cdev_alloc();
1051:		if (vdev->cdev == NULL) {
1052:			ret = -ENOMEM;
1053:			goto cleanup;
1054:		}
1055:		vdev->cdev->ops = &v4l2_fops;
1056:		vdev->cdev->owner = owner;
1057:		ret = cdev_add(vdev->cdev, MKDEV(VIDEO_MAJOR, vdev->minor), 1);
1058:		if (ret < 0) {
1059:			pr_err("%s: cdev_add failed\n", __func__);
1060:			kfree(vdev->cdev);
1061:			vdev->cdev = NULL;
1062:			goto cleanup;
1063:		}
1064:	
1065:		/* Part 4: register the device with sysfs */
1066:		vdev->dev.class = &video_class;
1067:		vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor);
1068:		vdev->dev.parent = vdev->dev_parent;
1069:		vdev->dev.release = v4l2_device_release;
1070:		dev_set_name(&vdev->dev, "%s%d", name_base, vdev->num);
1071:	
1072:		/* Increase v4l2_device refcount */
1073:		v4l2_device_get(vdev->v4l2_dev);
1074:	
1075:		mutex_lock(&videodev_lock);
1076:		ret = device_register(&vdev->dev);
1077:		if (ret < 0) {
1078:			mutex_unlock(&videodev_lock);
1079:			pr_err("%s: device_register failed\n", __func__);
1080:			put_device(&vdev->dev);
1081:			return ret;
1082:		}
1083:	
1084:		if (nr != -1 && nr != vdev->num && warn_if_nr_in_use)
1085:			pr_warn("%s: requested %s%d, got %s\n", __func__,
1086:				name_base, nr, video_device_node_name(vdev));
1087:	
1088:		/* Part 5: Register the entity. */
1089:		ret = video_register_media_controller(vdev);
1090:	
1091:		/* Part 6: Activate this minor. The char device can now be used. */
1092:		set_bit(V4L2_FL_REGISTERED, &vdev->flags);
1093:		mutex_unlock(&videodev_lock);
1094:	
1095:		return 0;
1096:	
1097:	cleanup:
1098:		mutex_lock(&videodev_lock);
1099:		if (vdev->cdev)
1100:			cdev_del(vdev->cdev);
1101:		video_devices[vdev->minor] = NULL;
1102:		devnode_clear(vdev);
1103:		mutex_unlock(&videodev_lock);
1104:		/* Mark this video device as never having been registered. */
1105:		vdev->minor = -1;
1106:		return ret;
1107:	}
 SourceFile:drivers/media/v4l2-core/v4l2-dev.c]

gemini-3-flash-preview

							input: 98125
							output: 18
							thoughts: 3073
						

**Analysis of the UAF in `hackrf_probe`**

Okay, let's break this down. From what I'm seeing, this is a textbook Use-After-Free (UAF) vulnerability within the `hackrf_probe` function. The core issue revolves around a refcounting problem during error handling. Here's my thought process as I've been reviewing this:

First, `hackrf_probe` registers a `v4l2_device` and a `video_device` (specifically, two `video_device` instances - one for rx, one for tx). My initial thought was, "Okay, standard V4L2 setup." Then it hit me: If a later step in the probe fails, the driver *unregisters* these devices and then immediately `kfree`s the allocated `hackrf_dev` structure. That's where things get interesting.

The critical flaw? If userspace has *already* opened the device – which is a very real possibility in a live system – there's an active reference held to the `video_device`, which in turn holds a reference to the `v4l2_device`. The kernel correctly increments the refcount when `video_register_device` succeeds.

When the file descriptor is closed (or when a user is finished with the device), `v4l2_release` is called, and this kicks off the `vb2_core_queue_release` sequence. This function, however, *still* has to access memory associated with the `hackrf_dev` struct. But... that memory has already been freed in the probe function error path, a classic UAF.

The report details that it’s attempting to access the `vb2_queue` structure, which is embedded within the `hackrf_dev` structure. The report is clear on where the read is occurring, and the offset is exactly where the `vb2_queue` is located.

Now, if a subsequent probe attempt fails, `video_unregister_device` and `v4l2_device_unregister` are called. `v4l2_device_unregister` clears some fields but doesn't actually release the object, which is done by `v4l2_device_put`. Since there is a dangling pointer, this results in a UAF.

I can confirm that the access within `vb2_core_queue_release` is perfectly valid. The line number is correct, and I've confirmed in the source that the read happens where the report says it does.

The report explicitly indicates that the access is in `vb2_core_queue_release`, and the offset lines up perfectly.  The call stack information is consistent as well. The "tainted" output and the SOFTLOCKUP are likely secondary effects. The UAF is the primary bug, and the soft lockup is a symptom.

Essentially, I've got a consistent, clear path to a memory safety issue. The allocation and free stacks are in the right places for a device probe and failure. The access stack comes from a userspace process trying to interact with the now-dangling `video_device`.

The solution is straightforward: the error handling in `hackrf_probe` *must* use `v4l2_device_put` instead of `kfree` directly to manage the reference count correctly and avoid the premature free.

Here's the error path that should be in place:
```c
err_video_unregister_device_rx:
	video_unregister_device(&dev->rx_vdev);
err_v4l2_device_unregister:
	v4l2_device_unregister(&dev->v4l2_dev);
...
	v4l2_device_put(&dev->v4l2_dev);
	return ret;
```
By doing it this way, when the device is closed, `hackrf_video_release` is called, and `kfree(dev)` will occur at the proper time.

I also checked to make sure there weren't duplicate calls to `v4l2_device_unregister` and that seems safe because the function is written to handle multiple calls.

I'm comfortable that I've identified the root cause and a clear fix.

map[Expression:kzalloc_obj]

map[Output:
Full output is too long, showing 500 out of 79599 lines.
Use more precise expression if possible.

[Documentation/process/deprecated.rst=393=become, respectively::
 --
 Documentation/process/deprecated.rst-395-	ptr = kmalloc_obj(*ptr, gfp);
 Documentation/process/deprecated.rst:396:	ptr = kzalloc_obj(*ptr, gfp);
 Documentation/process/deprecated.rst-397-	ptr = kmalloc_objs(*ptr, count, gfp);
 Documentation/process/deprecated.rst:398:	ptr = kzalloc_objs(*ptr, count, gfp);
 Documentation/process/deprecated.rst-399-	ptr = kmalloc_flex(*ptr, flex_member, count, gfp);
 --
 arch/alpha/kernel/module.c=64=module_frob_arch_sections(Elf64_Ehdr *hdr, Elf64_Shdr *sechdrs,
 --
 arch/alpha/kernel/module.c-95-	nsyms = symtab->sh_size / sizeof(Elf64_Sym);
 arch/alpha/kernel/module.c:96:	chains = kzalloc_objs(struct got_entry, nsyms);
 arch/alpha/kernel/module.c-97-	if (!chains) {
 --
 arch/alpha/kernel/setup.c=390=register_cpus(void)
 --
 arch/alpha/kernel/setup.c-394-	for_each_possible_cpu(i) {
 arch/alpha/kernel/setup.c:395:		struct cpu *p = kzalloc_obj(*p);
 arch/alpha/kernel/setup.c-396-		if (!p)
 --
 arch/arc/net/bpf_jit_core.c=1131=static int jit_prepare_final_mem_alloc(struct jit_context *ctx)
 --
 arch/arc/net/bpf_jit_core.c-1142-	if (ctx->need_extra_pass) {
 arch/arc/net/bpf_jit_core.c:1143:		ctx->jit_data = kzalloc_obj(*ctx->jit_data);
 arch/arc/net/bpf_jit_core.c-1144-		if (!ctx->jit_data)
 --
 arch/arm/common/locomo.c=220=locomo_init_one_child(struct locomo *lchip, struct locomo_dev_info *info)
 --
 arch/arm/common/locomo.c-224-
 arch/arm/common/locomo.c:225:	dev = kzalloc_obj(struct locomo_dev);
 arch/arm/common/locomo.c-226-	if (!dev) {
 --
 arch/arm/common/locomo.c=356=__locomo_probe(struct device *me, struct resource *mem, int irq)
 --
 arch/arm/common/locomo.c-362-
 arch/arm/common/locomo.c:363:	lchip = kzalloc_obj(struct locomo);
 arch/arm/common/locomo.c-364-	if (!lchip)
 --
 arch/arm/common/sa1111.c=733=sa1111_init_one_child(struct sa1111 *sachip, struct resource *parent,
 --
 arch/arm/common/sa1111.c-739-
 arch/arm/common/sa1111.c:740:	dev = kzalloc_obj(struct sa1111_dev);
 arch/arm/common/sa1111.c-741-	if (!dev) {
 --
 arch/arm/common/scoop.c=178=static int scoop_probe(struct platform_device *pdev)
 --
 arch/arm/common/scoop.c-187-
 arch/arm/common/scoop.c:188:	devptr = kzalloc_obj(struct scoop_dev);
 arch/arm/common/scoop.c-189-	if (!devptr)
 --
 arch/arm/kernel/smp.c=108=static int secondary_biglittle_prepare(unsigned int cpu)
 --
 arch/arm/kernel/smp.c-110-	if (!cpu_vtable[cpu])
 arch/arm/kernel/smp.c:111:		cpu_vtable[cpu] = kzalloc_obj(*cpu_vtable[cpu]);
 arch/arm/kernel/smp.c-112-
 --
 arch/arm/kernel/vdso.c=169=static int __init vdso_init(void)
 --
 arch/arm/kernel/vdso.c-181-	/* Allocate the VDSO text pagelist */
 arch/arm/kernel/vdso.c:182:	vdso_text_pagelist = kzalloc_objs(struct page *, text_pages);
 arch/arm/kernel/vdso.c-183-	if (vdso_text_pagelist == NULL)
 --
 arch/arm/mach-footbridge/dc21285.c=261=int __init dc21285_setup(int nr, struct pci_sys_data *sys)
 --
 arch/arm/mach-footbridge/dc21285.c-264-
 arch/arm/mach-footbridge/dc21285.c:265:	res = kzalloc_objs(struct resource, 2);
 arch/arm/mach-footbridge/dc21285.c-266-	if (!res) {
 --
 arch/arm/mach-footbridge/ebsa285.c=69=static int __init ebsa285_leds_init(void)
 --
 arch/arm/mach-footbridge/ebsa285.c-86-
 arch/arm/mach-footbridge/ebsa285.c:87:		led = kzalloc_obj(*led);
 arch/arm/mach-footbridge/ebsa285.c-88-		if (!led)
 --
 arch/arm/mach-footbridge/netwinder-hw.c=720=static int __init netwinder_leds_init(void)
 --
 arch/arm/mach-footbridge/netwinder-hw.c-729-
 arch/arm/mach-footbridge/netwinder-hw.c:730:		led = kzalloc_obj(*led);
 arch/arm/mach-footbridge/netwinder-hw.c-731-		if (!led)
 --
 arch/arm/mach-imx/mmdc.c=473=static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base,
 --
 arch/arm/mach-imx/mmdc.c-479-
 arch/arm/mach-imx/mmdc.c:480:	pmu_mmdc = kzalloc_obj(*pmu_mmdc);
 arch/arm/mach-imx/mmdc.c-481-	if (!pmu_mmdc) {
 --
 arch/arm/mach-mvebu/board-v7.c=114=static void __init i2c_quirk(void)
 --
 arch/arm/mach-mvebu/board-v7.c-129-
 arch/arm/mach-mvebu/board-v7.c:130:		new_compat = kzalloc_obj(*new_compat);
 arch/arm/mach-mvebu/board-v7.c-131-
 --
 arch/arm/mach-mvebu/coherency.c=168=static void __init armada_375_380_coherency_init(struct device_node *np)
 --
 arch/arm/mach-mvebu/coherency.c-192-
 arch/arm/mach-mvebu/coherency.c:193:		p = kzalloc_obj(*p);
 arch/arm/mach-mvebu/coherency.c-194-		p->name = kstrdup("arm,io-coherent", GFP_KERNEL);
 --
 arch/arm/mach-mvebu/mvebu-soc-id.c=148=static int __init mvebu_soc_device(void)
 --
 arch/arm/mach-mvebu/mvebu-soc-id.c-156-
 arch/arm/mach-mvebu/mvebu-soc-id.c:157:	soc_dev_attr = kzalloc_obj(*soc_dev_attr);
 arch/arm/mach-mvebu/mvebu-soc-id.c-158-	if (!soc_dev_attr)
 --
 arch/arm/mach-mxs/mach-mxs.c=380=static void __init mxs_machine_init(void)
 --
 arch/arm/mach-mxs/mach-mxs.c-389-
 arch/arm/mach-mxs/mach-mxs.c:390:	soc_dev_attr = kzalloc_obj(*soc_dev_attr);
 arch/arm/mach-mxs/mach-mxs.c-391-	if (!soc_dev_attr)
 --
 arch/arm/mach-omap1/dma.c=294=static int __init omap1_system_dma_init(void)
 --
 arch/arm/mach-omap1/dma.c-321-
 arch/arm/mach-omap1/dma.c:322:	d = kzalloc_obj(*d);
 arch/arm/mach-omap1/dma.c-323-	if (!d) {
 --
 arch/arm/mach-omap1/mcbsp.c=292=static void omap_mcbsp_register_board_cfg(struct resource *res, int res_count,
 --
 arch/arm/mach-omap1/mcbsp.c-296-
 arch/arm/mach-omap1/mcbsp.c:297:	omap_mcbsp_devices = kzalloc_objs(struct platform_device *, size);
 arch/arm/mach-omap1/mcbsp.c-298-	if (!omap_mcbsp_devices) {
 --
 arch/arm/mach-omap1/timer.c=51=static int __init omap1_dm_timer_init(void)
 --
 arch/arm/mach-omap1/timer.c-127-
 arch/arm/mach-omap1/timer.c:128:		pdata = kzalloc_obj(*pdata);
 arch/arm/mach-omap1/timer.c-129-		if (!pdata) {
 --
 arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c=230=void omap2xxx_clkt_vps_init(void)
 --
 arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c-239-
 arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c:240:	hw = kzalloc_obj(*hw);
 arch/arm/mach-omap2/clkt2xxx_virt_prcm_set.c-241-	if (!hw)
 --
 arch/arm/mach-omap2/id.c=785=void __init omap_soc_device_init(void)
 --
 arch/arm/mach-omap2/id.c-789-
 arch/arm/mach-omap2/id.c:790:	soc_dev_attr = kzalloc_obj(*soc_dev_attr);
 arch/arm/mach-omap2/id.c-791-	if (!soc_dev_attr)
 --
 arch/arm/mach-omap2/omap_device.c=131=static int omap_device_build_from_dt(struct platform_device *pdev)
 --
 arch/arm/mach-omap2/omap_device.c-158-
 arch/arm/mach-omap2/omap_device.c:159:	hwmods = kzalloc_objs(struct omap_hwmod *, oh_cnt);
 arch/arm/mach-omap2/omap_device.c-160-	if (!hwmods) {
 --
 arch/arm/mach-omap2/omap_device.c=304=static struct omap_device *omap_device_alloc(struct platform_device *pdev,
 --
 arch/arm/mach-omap2/omap_device.c-311-
 arch/arm/mach-omap2/omap_device.c:312:	od = kzalloc_obj(struct omap_device);
 arch/arm/mach-omap2/omap_device.c-313-	if (!od)
 --
 arch/arm/mach-omap2/omap_hwmod.c=3381=static int omap_hwmod_allocate_module(struct device *dev, struct omap_hwmod *oh,
 --
 arch/arm/mach-omap2/omap_hwmod.c-3394-
 arch/arm/mach-omap2/omap_hwmod.c:3395:	sysc = kzalloc_obj(*sysc);
 arch/arm/mach-omap2/omap_hwmod.c-3396-	if (!sysc)
 --
 arch/arm/mach-omap2/omap_hwmod.c-3424-	if (list_empty(&oh->slave_ports)) {
 arch/arm/mach-omap2/omap_hwmod.c:3425:		oi = kzalloc_obj(*oi);
 arch/arm/mach-omap2/omap_hwmod.c-3426-		if (!oi)
 --
 arch/arm/mach-omap2/omap_hwmod.c=3513=int omap_hwmod_init_module(struct device *dev,
 --
 arch/arm/mach-omap2/omap_hwmod.c-3527-	if (!oh) {
 arch/arm/mach-omap2/omap_hwmod.c:3528:		oh = kzalloc_obj(*oh);
 arch/arm/mach-omap2/omap_hwmod.c-3529-		if (!oh)
 --
 arch/arm/mach-omap2/omap_hwmod.c-3538-
 arch/arm/mach-omap2/omap_hwmod.c:3539:		oh->class = kzalloc_obj(*oh->class);
 arch/arm/mach-omap2/omap_hwmod.c-3540-		if (!oh->class) {
 --
 arch/arm/mach-omap2/pm33xx-core.c=379=static int __init amx3_idle_init(struct device_node *cpu_node, int cpu)
 --
 arch/arm/mach-omap2/pm33xx-core.c-412-
 arch/arm/mach-omap2/pm33xx-core.c:413:	idle_states = kzalloc_objs(*idle_states, state_count);
 arch/arm/mach-omap2/pm33xx-core.c-414-	if (!idle_states)
 --
 arch/arm/mach-omap2/sr_device.c=30=static void __init sr_set_nvalues(struct omap_volt_data *volt_data,
 --
 arch/arm/mach-omap2/sr_device.c-41-
 arch/arm/mach-omap2/sr_device.c:42:	nvalue_table = kzalloc_objs(*nvalue_table, count);
 arch/arm/mach-omap2/sr_device.c-43-	if (!nvalue_table)
 --
 arch/arm/mach-orion5x/pci.c=139=static int __init pcie_setup(struct pci_sys_data *sys)
 --
 arch/arm/mach-orion5x/pci.c-171-	 */
 arch/arm/mach-orion5x/pci.c:172:	res = kzalloc_obj(struct resource);
 arch/arm/mach-orion5x/pci.c-173-	if (!res)
 --
 arch/arm/mach-orion5x/pci.c=466=static int __init pci_setup(struct pci_sys_data *sys)
 --
 arch/arm/mach-orion5x/pci.c-492-	 */
 arch/arm/mach-orion5x/pci.c:493:	res = kzalloc_obj(struct resource);
 arch/arm/mach-orion5x/pci.c-494-	if (!res)
 --
 arch/arm/mach-rpc/ecard.c=689=static struct expansion_card *__init ecard_alloc_card(int type, int slot)
 --
 arch/arm/mach-rpc/ecard.c-694-
 arch/arm/mach-rpc/ecard.c:695:	ec = kzalloc_obj(ecard_t);
 arch/arm/mach-rpc/ecard.c-696-	if (!ec) {
 --
 arch/arm/mach-sa1100/clock.c=93=int __init sa11xx_clk_init(void)
 --
 arch/arm/mach-sa1100/clock.c-109-
 arch/arm/mach-sa1100/clock.c:110:	hw = kzalloc_obj(*hw);
 arch/arm/mach-sa1100/clock.c-111-	if (!hw)
 --
 arch/arm/mach-sa1100/clock.c-131-
 arch/arm/mach-sa1100/clock.c:132:	hw = kzalloc_obj(*hw);
 arch/arm/mach-sa1100/clock.c-133-	if (!hw)
 --
 arch/arm/mach-sa1100/generic.c=317=int __init sa11x0_register_fixed_regulator(int n,
 --
 arch/arm/mach-sa1100/generic.c-323-
 arch/arm/mach-sa1100/generic.c:324:	cfg->init_data = id = kzalloc_obj(*cfg->init_data);
 arch/arm/mach-sa1100/generic.c-325-	if (!cfg->init_data)
 --
 arch/arm/mach-sa1100/neponset.c=225=static int neponset_probe(struct platform_device *dev)
 --
 arch/arm/mach-sa1100/neponset.c-278-
 arch/arm/mach-sa1100/neponset.c:279:	d = kzalloc_obj(*d);
 arch/arm/mach-sa1100/neponset.c-280-	if (!d) {
 --
 arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c=141=static int __init rcar_gen2_regulator_quirk(void)
 --
 arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c-166-
 arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c:167:		quirk = kzalloc_obj(*quirk);
 arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c-168-		if (!quirk) {
 --
 arch/arm/mach-versatile/spc.c=393=static int ve_spc_populate_opps(uint32_t cluster)
 --
 arch/arm/mach-versatile/spc.c-397-
 arch/arm/mach-versatile/spc.c:398:	opps = kzalloc_objs(*opps, MAX_OPPS);
 arch/arm/mach-versatile/spc.c-399-	if (!opps)
 --
 arch/arm/mach-versatile/spc.c=442=int __init ve_spc_init(void __iomem *baseaddr, u32 a15_clusid, int irq)
 --
 arch/arm/mach-versatile/spc.c-444-	int ret;
 arch/arm/mach-versatile/spc.c:445:	info = kzalloc_obj(*info);
 arch/arm/mach-versatile/spc.c-446-	if (!info)
 --
 arch/arm/mach-versatile/spc.c=523=static struct clk *ve_spc_clk_register(struct device *cpu_dev)
 --
 arch/arm/mach-versatile/spc.c-527-
 arch/arm/mach-versatile/spc.c:528:	spc = kzalloc_obj(*spc);
 arch/arm/mach-versatile/spc.c-529-	if (!spc)
 --
 arch/arm/mach-versatile/versatile.c=123=static void __init versatile_dt_pci_init(void)
 --
 arch/arm/mach-versatile/versatile.c-144-
 arch/arm/mach-versatile/versatile.c:145:	newprop = kzalloc_obj(*newprop);
 arch/arm/mach-versatile/versatile.c-146-	if (!newprop)
 --
 arch/arm/mach-zynq/common.c=105=static void __init zynq_init_machine(void)
 --
 arch/arm/mach-zynq/common.c-110-
 arch/arm/mach-zynq/common.c:111:	soc_dev_attr = kzalloc_obj(*soc_dev_attr);
 arch/arm/mach-zynq/common.c-112-	if (!soc_dev_attr)
 --
 arch/arm/mm/cache-l2x0-pmu.c=503=static __init int l2x0_pmu_init(void)
 --
 arch/arm/mm/cache-l2x0-pmu.c-509-
 arch/arm/mm/cache-l2x0-pmu.c:510:	l2x0_pmu = kzalloc_obj(*l2x0_pmu);
 arch/arm/mm/cache-l2x0-pmu.c-511-	if (!l2x0_pmu) {
 --
 arch/arm/mm/cache-uniphier.c=315=static int __init __uniphier_cache_init(struct device_node *np,
 --
 arch/arm/mm/cache-uniphier.c-344-
 arch/arm/mm/cache-uniphier.c:345:	data = kzalloc_obj(*data);
 arch/arm/mm/cache-uniphier.c-346-	if (!data)
 --
 arch/arm/mm/dma-mapping.c=533=static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
 --
 arch/arm/mm/dma-mapping.c-560-
 arch/arm/mm/dma-mapping.c:561:	buf = kzalloc_obj(*buf,
 arch/arm/mm/dma-mapping.c-562-			  gfp & ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM));
 --
 arch/arm/mm/dma-mapping.c=1487=arm_iommu_create_mapping(struct device *dev, dma_addr_t base, u64 size)
 --
 arch/arm/mm/dma-mapping.c-1506-
 arch/arm/mm/dma-mapping.c:1507:	mapping = kzalloc_obj(struct dma_iommu_mapping);
 arch/arm/mm/dma-mapping.c-1508-	if (!mapping)
 --
 arch/arm/xen/enlighten.c=314=int __init arch_xen_unpopulated_init(struct resource **res)
 --
 arch/arm/xen/enlighten.c-341-
 arch/arm/xen/enlighten.c:342:	regs = kzalloc_objs(*regs, nr_reg);
 arch/arm/xen/enlighten.c-343-	if (!regs) {
 --
 arch/arm/xen/enlighten.c-385-
 arch/arm/xen/enlighten.c:386:		tmp_res = kzalloc_obj(*tmp_res);
 arch/arm/xen/enlighten.c-387-		if (!tmp_res) {
 --
 arch/arm/xen/p2m.c=150=bool __set_phys_to_machine_multi(unsigned long pfn,
 --
 arch/arm/xen/p2m.c-178-
 arch/arm/xen/p2m.c:179:	p2m_entry = kzalloc_obj(*p2m_entry, GFP_NOWAIT);
 arch/arm/xen/p2m.c-180-	if (!p2m_entry)
 --
 arch/arm64/kernel/vdso.c=68=static int __init __vdso_init(enum vdso_abi abi)
 --
 arch/arm64/kernel/vdso.c-83-
 arch/arm64/kernel/vdso.c:84:	vdso_pagelist = kzalloc_objs(struct page *, vdso_info[abi].vdso_pages);
 arch/arm64/kernel/vdso.c-85-	if (vdso_pagelist == NULL)
 --
 arch/arm64/kvm/mmu.c=477=static int share_pfn_hyp(u64 pfn)
 --
 arch/arm64/kvm/mmu.c-489-
 arch/arm64/kvm/mmu.c:490:	this = kzalloc_obj(*this);
 arch/arm64/kvm/mmu.c-491-	if (!this) {
 --
 arch/arm64/kvm/mmu.c=954=int kvm_init_stage2_mmu(struct kvm *kvm, struct kvm_s2_mmu *mmu, unsigned long type)
 --
 arch/arm64/kvm/mmu.c-980-
 arch/arm64/kvm/mmu.c:981:	pgt = kzalloc_obj(*pgt, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/mmu.c-982-	if (!pgt)
 --
 arch/arm64/kvm/mmu.c=1152=int topup_hyp_memcache(struct kvm_hyp_memcache *mc, unsigned long min_pages)
 --
 arch/arm64/kvm/mmu.c-1157-	if (!mc->mapping) {
 arch/arm64/kvm/mmu.c:1158:		mc->mapping = kzalloc_obj(struct pkvm_mapping,
 arch/arm64/kvm/mmu.c-1159-					  GFP_KERNEL_ACCOUNT);
 --
 arch/arm64/kvm/mmu.c=2300=int __init kvm_mmu_init(u32 hyp_va_bits)
 --
 arch/arm64/kvm/mmu.c-2333-
 arch/arm64/kvm/mmu.c:2334:	hyp_pgtable = kzalloc_obj(*hyp_pgtable);
 arch/arm64/kvm/mmu.c-2335-	if (!hyp_pgtable) {
 --
 arch/arm64/kvm/nested.c=1242=int kvm_vcpu_allocate_vncr_tlb(struct kvm_vcpu *vcpu)
 --
 arch/arm64/kvm/nested.c-1246-
 arch/arm64/kvm/nested.c:1247:	vcpu->arch.vncr_tlb = kzalloc_obj(*vcpu->arch.vncr_tlb,
 arch/arm64/kvm/nested.c-1248-					  GFP_KERNEL_ACCOUNT);
 --
 arch/arm64/kvm/nested.c=1701=int kvm_init_nv_sysregs(struct kvm_vcpu *vcpu)
 --
 arch/arm64/kvm/nested.c-1710-
 arch/arm64/kvm/nested.c:1711:	kvm->arch.sysreg_masks = kzalloc_obj(*(kvm->arch.sysreg_masks),
 arch/arm64/kvm/nested.c-1712-					     GFP_KERNEL_ACCOUNT);
 --
 arch/arm64/kvm/ptdump.c=115=static struct kvm_ptdump_guest_state *kvm_ptdump_parser_create(struct kvm *kvm)
 --
 arch/arm64/kvm/ptdump.c-121-
 arch/arm64/kvm/ptdump.c:122:	st = kzalloc_obj(struct kvm_ptdump_guest_state, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/ptdump.c-123-	if (!st)
 --
 arch/arm64/kvm/vgic/vgic-init.c=195=static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)
 --
 arch/arm64/kvm/vgic/vgic-init.c-201-	dist->active_spis = (atomic_t)ATOMIC_INIT(0);
 arch/arm64/kvm/vgic/vgic-init.c:202:	dist->spis = kzalloc_objs(struct vgic_irq, nr_spis, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/vgic/vgic-init.c-203-	if (!dist->spis)
 --
 arch/arm64/kvm/vgic/vgic-init.c=262=static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu, u32 type)
 --
 arch/arm64/kvm/vgic/vgic-init.c-271-
 arch/arm64/kvm/vgic/vgic-init.c:272:	vgic_cpu->private_irqs = kzalloc_objs(struct vgic_irq,
 arch/arm64/kvm/vgic/vgic-init.c-273-					      VGIC_NR_PRIVATE_IRQS,
 --
 arch/arm64/kvm/vgic/vgic-irqfd.c=136=int kvm_vgic_setup_default_irq_routing(struct kvm *kvm)
 --
 arch/arm64/kvm/vgic/vgic-irqfd.c-142-
 arch/arm64/kvm/vgic/vgic-irqfd.c:143:	entries = kzalloc_objs(*entries, nr, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/vgic/vgic-irqfd.c-144-	if (!entries)
 --
 arch/arm64/kvm/vgic/vgic-its.c=76=static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,
 --
 arch/arm64/kvm/vgic/vgic-its.c-87-
 arch/arm64/kvm/vgic/vgic-its.c:88:	irq = kzalloc_obj(struct vgic_irq, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/vgic/vgic-its.c-89-	if (!irq)
 --
 arch/arm64/kvm/vgic/vgic-its.c=957=static int vgic_its_alloc_collection(struct vgic_its *its,
 --
 arch/arm64/kvm/vgic/vgic-its.c-962-
 arch/arm64/kvm/vgic/vgic-its.c:963:	collection = kzalloc_obj(*collection, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/vgic/vgic-its.c-964-	if (!collection)
 --
 arch/arm64/kvm/vgic/vgic-its.c=1001=static struct its_ite *vgic_its_alloc_ite(struct its_device *device,
 --
 arch/arm64/kvm/vgic/vgic-its.c-1006-
 arch/arm64/kvm/vgic/vgic-its.c:1007:	ite = kzalloc_obj(*ite, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/vgic/vgic-its.c-1008-	if (!ite)
 --
 arch/arm64/kvm/vgic/vgic-its.c=1128=static struct its_device *vgic_its_alloc_device(struct vgic_its *its,
 --
 arch/arm64/kvm/vgic/vgic-its.c-1133-
 arch/arm64/kvm/vgic/vgic-its.c:1134:	device = kzalloc_obj(*device, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/vgic/vgic-its.c-1135-	if (!device)
 --
 arch/arm64/kvm/vgic/vgic-its.c=1841=static int vgic_its_create(struct kvm_device *dev, u32 type)
 --
 arch/arm64/kvm/vgic/vgic-its.c-1848-
 arch/arm64/kvm/vgic/vgic-its.c:1849:	its = kzalloc_obj(struct vgic_its, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/vgic/vgic-its.c-1850-	if (!its)
 --
 arch/arm64/kvm/vgic/vgic-mmio-v3.c=886=static int vgic_v3_alloc_redist_region(struct kvm *kvm, uint32_t index,
 --
 arch/arm64/kvm/vgic/vgic-mmio-v3.c-931-
 arch/arm64/kvm/vgic/vgic-mmio-v3.c:932:	rdreg = kzalloc_obj(*rdreg, GFP_KERNEL_ACCOUNT);
 arch/arm64/kvm/vgic/vgic-mmio-v3.c-933-	if (!rdreg)
 --
 arch/arm64/kvm/vgic/vgic-v4.c=242=int vgic_v4_init(struct kvm *kvm)
 --
 arch/arm64/kvm/vgic/vgic-v4.c-258-
 arch/arm64/kvm/vgic/vgic-v4.c:259:	dist->its_vm.vpes = kzalloc_objs(*dist->its_vm.vpes, nr_vcpus,
 arch/arm64/kvm/vgic/vgic-v4.c-260-					 GFP_KERNEL_ACCOUNT);
 --
 arch/arm64/net/bpf_jit_comp.c=2009=struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
 --
 arch/arm64/net/bpf_jit_comp.c-2042-	if (!jit_data) {
 arch/arm64/net/bpf_jit_comp.c:2043:		jit_data = kzalloc_obj(*jit_data);
 arch/arm64/net/bpf_jit_comp.c-2044-		if (!jit_data) {
 --
 arch/csky/kernel/vdso.c=17=static int __init vdso_init(void)
 --
 arch/csky/kernel/vdso.c-22-	vdso_pagelist =
 arch/csky/kernel/vdso.c:23:		kzalloc_objs(struct page *, vdso_pages);
 arch/csky/kernel/vdso.c-24-	if (unlikely(vdso_pagelist == NULL)) {
 --
 arch/loongarch/kernel/setup.c=466=static int __init add_legacy_isa_io(struct fwnode_handle *fwnode,
 --
 arch/loongarch/kernel/setup.c-472-
 arch/loongarch/kernel/setup.c:473:	range = kzalloc_obj(*range, GFP_ATOMIC);
 arch/loongarch/kernel/setup.c-474-	if (!range)
 --
 arch/loongarch/kernel/vdso.c=44=static int __init init_vdso(void)
 --
 arch/loongarch/kernel/vdso.c-54-	vdso_info.code_mapping.pages =
 arch/loongarch/kernel/vdso.c:55:		kzalloc_objs(struct page *, vdso_info.size / PAGE_SIZE);
 arch/loongarch/kernel/vdso.c-56-
 --
 arch/loongarch/kvm/intc/eiointc.c=614=static int kvm_eiointc_create(struct kvm_device *dev, u32 type)
 --
 arch/loongarch/kvm/intc/eiointc.c-624-
 arch/loongarch/kvm/intc/eiointc.c:625:	s = kzalloc_obj(struct loongarch_eiointc);
 arch/loongarch/kvm/intc/eiointc.c-626-	if (!s)
 --
 arch/loongarch/kvm/intc/ipi.c=394=static int kvm_ipi_create(struct kvm_device *dev, u32 type)
 --
 arch/loongarch/kvm/intc/ipi.c-411-
 arch/loongarch/kvm/intc/ipi.c:412:	s = kzalloc_obj(struct loongarch_ipi);
 arch/loongarch/kvm/intc/ipi.c-413-	if (!s)
 --
 arch/loongarch/kvm/intc/pch_pic.c=399=static int kvm_setup_default_irq_routing(struct kvm *kvm)
 --
 arch/loongarch/kvm/intc/pch_pic.c-404-
 arch/loongarch/kvm/intc/pch_pic.c:405:	entries = kzalloc_objs(*entries, nr);
 arch/loongarch/kvm/intc/pch_pic.c-406-	if (!entries)
 --
 arch/loongarch/kvm/intc/pch_pic.c=421=static int kvm_pch_pic_create(struct kvm_device *dev, u32 type)
 --
 arch/loongarch/kvm/intc/pch_pic.c-434-
 arch/loongarch/kvm/intc/pch_pic.c:435:	s = kzalloc_obj(struct loongarch_pch_pic);
 arch/loongarch/kvm/intc/pch_pic.c-436-	if (!s)
 --
 arch/loongarch/kvm/main.c=349=static int kvm_loongarch_env_init(void)
 --
 arch/loongarch/kvm/main.c-360-
 arch/loongarch/kvm/main.c:361:	kvm_loongarch_ops = kzalloc_obj(*kvm_loongarch_ops);
 arch/loongarch/kvm/main.c-362-	if (!kvm_loongarch_ops) {
 --
 arch/loongarch/kvm/vcpu.c=1531=int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
 --
 arch/loongarch/kvm/vcpu.c-1552-	vcpu->arch.guest_eentry = (unsigned long)kvm_loongarch_ops->exc_entry;
 arch/loongarch/kvm/vcpu.c:1553:	vcpu->arch.csr = kzalloc_obj(struct loongarch_csrs);
 arch/loongarch/kvm/vcpu.c-1554-	if (!vcpu->arch.csr)
 --
 arch/loongarch/net/bpf_jit.c=1923=struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
 --
 arch/loongarch/net/bpf_jit.c-1956-	if (!jit_data) {
 arch/loongarch/net/bpf_jit.c:1957:		jit_data = kzalloc_obj(*jit_data);
 arch/loongarch/net/bpf_jit.c-1958-		if (!jit_data) {
 --
 arch/loongarch/pci/acpi.c=94=static struct pci_config_window *arch_pci_ecam_create(struct device *dev,
 --
 arch/loongarch/pci/acpi.c-103-
 arch/loongarch/pci/acpi.c:104:	cfg = kzalloc_obj(*cfg);
 arch/loongarch/pci/acpi.c-105-	if (!cfg)
 --
 arch/loongarch/pci/acpi.c=193=struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
 --
 arch/loongarch/pci/acpi.c-201-
 arch/loongarch/pci/acpi.c:202:	info = kzalloc_obj(*info);
 arch/loongarch/pci/acpi.c-203-	if (!info) {
 --
 arch/loongarch/pci/acpi.c-207-
 arch/loongarch/pci/acpi.c:208:	root_ops = kzalloc_obj(*root_ops);
 arch/loongarch/pci/acpi.c-209-	if (!root_ops) {
 --
 arch/m68k/amiga/chipram.c=45=void *amiga_chip_alloc(unsigned long size, const char *name)
 --
 arch/m68k/amiga/chipram.c-49-
 arch/m68k/amiga/chipram.c:50:	res = kzalloc_obj(struct resource);
 arch/m68k/amiga/chipram.c-51-	if (!res)
 --
 arch/m68k/atari/stram.c=154=void *atari_stram_alloc(unsigned long size, const char *owner)
 --
 arch/m68k/atari/stram.c-163-
 arch/m68k/atari/stram.c:164:	res = kzalloc_obj(struct resource);
]
]

gemini-3-flash-preview

							input: 113201
							output: 22
							thoughts: 70
						

**Investigating the `kzalloc_obj` Macro**

Okay, so I'm seeing this `kzalloc_obj` macro popping up quite a bit. My initial hunch is that it's a kernel-specific macro, likely defined within one of the slab allocation header files, probably something like `include/linux/slab.h` or somewhere similar within this project's kernel tree. It's a fairly common pattern.

Hmm, this is curious. I don't recall seeing it in the standard upstream kernel source when I glanced at it earlier. That's a bit odd. Just to be certain, I should probably double-check the standard include files before I start assuming this is a local define. Let's start by looking directly at `include/linux/slab.h`. Best to eliminate the obvious.

map[File:include/linux/slab.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0 */
/*
 * Written by Mark Hemment, 1996 (markhe@nextd.demon.co.uk).
 *
 * (C) SGI 2006, Christoph Lameter
 * 	Cleaned up and restructured to ease the addition of alternative
 * 	implementations of SLAB allocators.
 * (C) Linux Foundation 2008-2013
 *      Unified interface for all slab allocators
 */

#ifndef _LINUX_SLAB_H
#define	_LINUX_SLAB_H

#include <linux/bug.h>
#include <linux/cache.h>
#include <linux/gfp.h>
#include <linux/overflow.h>
#include <linux/types.h>
#include <linux/rcupdate.h>
#include <linux/workqueue.h>
#include <linux/percpu-refcount.h>
#include <linux/cleanup.h>
#include <linux/hash.h>

enum _slab_flag_bits {
	_SLAB_CONSISTENCY_CHECKS,
	_SLAB_RED_ZONE,
	_SLAB_POISON,
	_SLAB_KMALLOC,
	_SLAB_HWCACHE_ALIGN,
	_SLAB_CACHE_DMA,
	_SLAB_CACHE_DMA32,
	_SLAB_STORE_USER,
	_SLAB_PANIC,
	_SLAB_TYPESAFE_BY_RCU,
	_SLAB_TRACE,
#ifdef CONFIG_DEBUG_OBJECTS
	_SLAB_DEBUG_OBJECTS,
#endif
	_SLAB_NOLEAKTRACE,
	_SLAB_NO_MERGE,
#ifdef CONFIG_FAILSLAB
	_SLAB_FAILSLAB,
#endif
#ifdef CONFIG_MEMCG
	_SLAB_ACCOUNT,
#endif
#ifdef CONFIG_KASAN_GENERIC
	_SLAB_KASAN,
#endif
	_SLAB_NO_USER_FLAGS,
#ifdef CONFIG_KFENCE
	_SLAB_SKIP_KFENCE,
#endif
#ifndef CONFIG_SLUB_TINY
	_SLAB_RECLAIM_ACCOUNT,
#endif
	_SLAB_OBJECT_POISON,
	_SLAB_CMPXCHG_DOUBLE,
	_SLAB_NO_OBJ_EXT,
#if defined(CONFIG_SLAB_OBJ_EXT) && defined(CONFIG_64BIT)
	_SLAB_OBJ_EXT_IN_OBJ,
#endif
	_SLAB_FLAGS_LAST_BIT
};

#define __SLAB_FLAG_BIT(nr)	((slab_flags_t __force)(1U << (nr)))
#define __SLAB_FLAG_UNUSED	((slab_flags_t __force)(0U))

/*
 * Flags to pass to kmem_cache_create().
 * The ones marked DEBUG need CONFIG_SLUB_DEBUG enabled, otherwise are no-op
 */
/* DEBUG: Perform (expensive) checks on alloc/free */
#define SLAB_CONSISTENCY_CHECKS	__SLAB_FLAG_BIT(_SLAB_CONSISTENCY_CHECKS)
/* DEBUG: Red zone objs in a cache */
#define SLAB_RED_ZONE		__SLAB_FLAG_BIT(_SLAB_RED_ZONE)
/* DEBUG: Poison objects */
#define SLAB_POISON		__SLAB_FLAG_BIT(_SLAB_POISON)
/* Indicate a kmalloc slab */
#define SLAB_KMALLOC		__SLAB_FLAG_BIT(_SLAB_KMALLOC)
/**
 * define SLAB_HWCACHE_ALIGN - Align objects on cache line boundaries.
 *
 * Sufficiently large objects are aligned on cache line boundary. For object
 * size smaller than a half of cache line size, the alignment is on the half of
 * cache line size. In general, if object size is smaller than 1/2^n of cache
 * line size, the alignment is adjusted to 1/2^n.
 *
 * If explicit alignment is also requested by the respective
 * &struct kmem_cache_args field, the greater of both is alignments is applied.
 */
#define SLAB_HWCACHE_ALIGN	__SLAB_FLAG_BIT(_SLAB_HWCACHE_ALIGN)
/* Use GFP_DMA memory */
#define SLAB_CACHE_DMA		__SLAB_FLAG_BIT(_SLAB_CACHE_DMA)
/* Use GFP_DMA32 memory */
#define SLAB_CACHE_DMA32	__SLAB_FLAG_BIT(_SLAB_CACHE_DMA32)
/* DEBUG: Store the last owner for bug hunting */
#define SLAB_STORE_USER		__SLAB_FLAG_BIT(_SLAB_STORE_USER)
/* Panic if kmem_cache_create() fails */
#define SLAB_PANIC		__SLAB_FLAG_BIT(_SLAB_PANIC)
/**
 * define SLAB_TYPESAFE_BY_RCU - **WARNING** READ THIS!
 *
 * This delays freeing the SLAB page by a grace period, it does _NOT_
 * delay object freeing. This means that if you do kmem_cache_free()
 * that memory location is free to be reused at any time. Thus it may
 * be possible to see another object there in the same RCU grace period.
 *
 * This feature only ensures the memory location backing the object
 * stays valid, the trick to using this is relying on an independent
 * object validation pass. Something like:
 *
 * ::
 *
 *  begin:
 *   rcu_read_lock();
 *   obj = lockless_lookup(key);
 *   if (obj) {
 *     if (!try_get_ref(obj)) // might fail for free objects
 *       rcu_read_unlock();
 *       goto begin;
 *
 *     if (obj->key != key) { // not the object we expected
 *       put_ref(obj);
 *       rcu_read_unlock();
 *       goto begin;
 *     }
 *   }
 *  rcu_read_unlock();
 *
 * This is useful if we need to approach a kernel structure obliquely,
 * from its address obtained without the usual locking. We can lock
 * the structure to stabilize it and check it's still at the given address,
 * only if we can be sure that the memory has not been meanwhile reused
 * for some other kind of object (which our subsystem's lock might corrupt).
 *
 * rcu_read_lock before reading the address, then rcu_read_unlock after
 * taking the spinlock within the structure expected at that address.
 *
 * Note that object identity check has to be done *after* acquiring a
 * reference, therefore user has to ensure proper ordering for loads.
 * Similarly, when initializing objects allocated with SLAB_TYPESAFE_BY_RCU,
 * the newly allocated object has to be fully initialized *before* its
 * refcount gets initialized and proper ordering for stores is required.
 * refcount_{add|inc}_not_zero_acquire() and refcount_set_release() are
 * designed with the proper fences required for reference counting objects
 * allocated with SLAB_TYPESAFE_BY_RCU.
 *
 * Note that it is not possible to acquire a lock within a structure
 * allocated with SLAB_TYPESAFE_BY_RCU without first acquiring a reference
 * as described above.  The reason is that SLAB_TYPESAFE_BY_RCU pages
 * are not zeroed before being given to the slab, which means that any
 * locks must be initialized after each and every kmem_struct_alloc().
 * Alternatively, make the ctor passed to kmem_cache_create() initialize
 * the locks at page-allocation time, as is done in __i915_request_ctor(),
 * sighand_ctor(), and anon_vma_ctor().  Such a ctor permits readers
 * to safely acquire those ctor-initialized locks under rcu_read_lock()
 * protection.
 *
 * Note that SLAB_TYPESAFE_BY_RCU was originally named SLAB_DESTROY_BY_RCU.
 */
#define SLAB_TYPESAFE_BY_RCU	__SLAB_FLAG_BIT(_SLAB_TYPESAFE_BY_RCU)
/* Trace allocations and frees */
#define SLAB_TRACE		__SLAB_FLAG_BIT(_SLAB_TRACE)

/* Flag to prevent checks on free */
#ifdef CONFIG_DEBUG_OBJECTS
# define SLAB_DEBUG_OBJECTS	__SLAB_FLAG_BIT(_SLAB_DEBUG_OBJECTS)
#else
# define SLAB_DEBUG_OBJECTS	__SLAB_FLAG_UNUSED
#endif

/* Avoid kmemleak tracing */
#define SLAB_NOLEAKTRACE	__SLAB_FLAG_BIT(_SLAB_NOLEAKTRACE)

/*
 * Prevent merging with compatible kmem caches. This flag should be used
 * cautiously. Valid use cases:
 *
 * - caches created for self-tests (e.g. kunit)
 * - general caches created and used by a subsystem, only when a
 *   (subsystem-specific) debug option is enabled
 * - performance critical caches, should be very rare and consulted with slab
 *   maintainers, and not used together with CONFIG_SLUB_TINY
 */
#define SLAB_NO_MERGE		__SLAB_FLAG_BIT(_SLAB_NO_MERGE)

/* Fault injection mark */
#ifdef CONFIG_FAILSLAB
# define SLAB_FAILSLAB		__SLAB_FLAG_BIT(_SLAB_FAILSLAB)
#else
# define SLAB_FAILSLAB		__SLAB_FLAG_UNUSED
#endif
/**
 * define SLAB_ACCOUNT - Account allocations to memcg.
 *
 * All object allocations from this cache will be memcg accounted, regardless of
 * __GFP_ACCOUNT being or not being passed to individual allocations.
 */
#ifdef CONFIG_MEMCG
# define SLAB_ACCOUNT		__SLAB_FLAG_BIT(_SLAB_ACCOUNT)
#else
# define SLAB_ACCOUNT		__SLAB_FLAG_UNUSED
#endif

#ifdef CONFIG_KASAN_GENERIC
#define SLAB_KASAN		__SLAB_FLAG_BIT(_SLAB_KASAN)
#else
#define SLAB_KASAN		__SLAB_FLAG_UNUSED
#endif

/*
 * Ignore user specified debugging flags.
 * Intended for caches created for self-tests so they have only flags
 * specified in the code and other flags are ignored.
 */
#define SLAB_NO_USER_FLAGS	__SLAB_FLAG_BIT(_SLAB_NO_USER_FLAGS)

#ifdef CONFIG_KFENCE
#define SLAB_SKIP_KFENCE	__SLAB_FLAG_BIT(_SLAB_SKIP_KFENCE)
#else
#define SLAB_SKIP_KFENCE	__SLAB_FLAG_UNUSED
#endif

/* The following flags affect the page allocator grouping pages by mobility */
/**
 * define SLAB_RECLAIM_ACCOUNT - Objects are reclaimable.
 *
 * Use this flag for caches that have an associated shrinker. As a result, slab
 * pages are allocated with __GFP_RECLAIMABLE, which affects grouping pages by
 * mobility, and are accounted in SReclaimable counter in /proc/meminfo
 */
#ifndef CONFIG_SLUB_TINY
#define SLAB_RECLAIM_ACCOUNT	__SLAB_FLAG_BIT(_SLAB_RECLAIM_ACCOUNT)
#else
#define SLAB_RECLAIM_ACCOUNT	__SLAB_FLAG_UNUSED
#endif
#define SLAB_TEMPORARY		SLAB_RECLAIM_ACCOUNT	/* Objects are short-lived */

/* Slab created using create_boot_cache */
#define SLAB_NO_OBJ_EXT		__SLAB_FLAG_BIT(_SLAB_NO_OBJ_EXT)

#if defined(CONFIG_SLAB_OBJ_EXT) && defined(CONFIG_64BIT)
#define SLAB_OBJ_EXT_IN_OBJ	__SLAB_FLAG_BIT(_SLAB_OBJ_EXT_IN_OBJ)
#else
#define SLAB_OBJ_EXT_IN_OBJ	__SLAB_FLAG_UNUSED
#endif

/*
 * ZERO_SIZE_PTR will be returned for zero sized kmalloc requests.
 *
 * Dereferencing ZERO_SIZE_PTR will lead to a distinct access fault.
 *
 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
 * Both make kfree a no-op.
 */
#define ZERO_SIZE_PTR ((void *)16)

#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
				(unsigned long)ZERO_SIZE_PTR)

#include <linux/kasan.h>

struct list_lru;
struct mem_cgroup;
/*
 * struct kmem_cache related prototypes
 */
bool slab_is_available(void);

/**
 * struct kmem_cache_args - Less common arguments for kmem_cache_create()
 *
 * Any uninitialized fields of the structure are interpreted as unused. The
 * exception is @freeptr_offset where %0 is a valid value, so
 * @use_freeptr_offset must be also set to %true in order to interpret the field
 * as used. For @useroffset %0 is also valid, but only with non-%0
 * @usersize.
 *
 * When %NULL args is passed to kmem_cache_create(), it is equivalent to all
 * fields unused.
 */
struct kmem_cache_args {
	/**
	 * @align: The required alignment for the objects.
	 *
	 * %0 means no specific alignment is requested.
	 */
	unsigned int align;
	/**
	 * @useroffset: Usercopy region offset.
	 *
	 * %0 is a valid offset, when @usersize is non-%0
	 */
	unsigned int useroffset;
	/**
	 * @usersize: Usercopy region size.
	 *
	 * %0 means no usercopy region is specified.
	 */
	unsigned int usersize;
	/**
	 * @freeptr_offset: Custom offset for the free pointer
	 * in caches with &SLAB_TYPESAFE_BY_RCU or @ctor
	 *
	 * By default, &SLAB_TYPESAFE_BY_RCU and @ctor caches place the free
	 * pointer outside of the object. This might cause the object to grow
	 * in size. Cache creators that have a reason to avoid this can specify
	 * a custom free pointer offset in their data structure where the free
	 * pointer will be placed.
	 *
	 * For caches with &SLAB_TYPESAFE_BY_RCU, the caller must ensure that
	 * the free pointer does not overlay fields required to guard against
	 * object recycling (See &SLAB_TYPESAFE_BY_RCU for details).
	 *
	 * For caches with @ctor, the caller must ensure that the free pointer
	 * does not overlay fields initialized by the constructor.
	 *
	 * Currently, only caches with &SLAB_TYPESAFE_BY_RCU or @ctor
	 * may specify @freeptr_offset.
	 *
	 * Using %0 as a value for @freeptr_offset is valid. If @freeptr_offset
	 * is specified, @use_freeptr_offset must be set %true.
	 */
	unsigned int freeptr_offset;
	/**
	 * @use_freeptr_offset: Whether a @freeptr_offset is used.
	 */
	bool use_freeptr_offset;
	/**
	 * @ctor: A constructor for the objects.
	 *
	 * The constructor is invoked for each object in a newly allocated slab
	 * page. It is the cache user's responsibility to free object in the
	 * same state as after calling the constructor, or deal appropriately
	 * with any differences between a freshly constructed and a reallocated
	 * object.
	 *
	 * %NULL means no constructor.
	 */
	void (*ctor)(void *);
	/**
	 * @sheaf_capacity: Enable sheaves of given capacity for the cache.
	 *
	 * With a non-zero value, allocations from the cache go through caching
	 * arrays called sheaves. Each cpu has a main sheaf that's always
	 * present, and a spare sheaf that may be not present. When both become
	 * empty, there's an attempt to replace an empty sheaf with a full sheaf
	 * from the per-node barn.
	 *
	 * When no full sheaf is available, and gfp flags allow blocking, a
	 * sheaf is allocated and filled from slab(s) using bulk allocation.
	 * Otherwise the allocation falls back to the normal operation
	 * allocating a single object from a slab.
	 *
	 * Analogically when freeing and both percpu sheaves are full, the barn
	 * may replace it with an empty sheaf, unless it's over capacity. In
	 * that case a sheaf is bulk freed to slab pages.
	 *
	 * The sheaves do not enforce NUMA placement of objects, so allocations
	 * via kmem_cache_alloc_node() with a node specified other than
	 * NUMA_NO_NODE will bypass them.
	 *
	 * Bulk allocation and free operations also try to use the cpu sheaves
	 * and barn, but fallback to using slab pages directly.
	 *
	 * When slub_debug is enabled for the cache, the sheaf_capacity argument
	 * is ignored.
	 *
	 * %0 means no sheaves will be created.
	 */
	unsigned int sheaf_capacity;
};

struct kmem_cache *__kmem_cache_create_args(const char *name,
					    unsigned int object_size,
					    struct kmem_cache_args *args,
					    slab_flags_t flags);
static inline struct kmem_cache *
__kmem_cache_create(const char *name, unsigned int size, unsigned int align,
		    slab_flags_t flags, void (*ctor)(void *))
{
	struct kmem_cache_args kmem_args = {
		.align	= align,
		.ctor	= ctor,
	};

	return __kmem_cache_create_args(name, size, &kmem_args, flags);
}

/**
 * kmem_cache_create_usercopy - Create a kmem cache with a region suitable
 * for copying to userspace.
 * @name: A string which is used in /proc/slabinfo to identify this cache.
 * @size: The size of objects to be created in this cache.
 * @align: The required alignment for the objects.
 * @flags: SLAB flags
 * @useroffset: Usercopy region offset
 * @usersize: Usercopy region size
 * @ctor: A constructor for the objects, or %NULL.
 *
 * This is a legacy wrapper, new code should use either KMEM_CACHE_USERCOPY()
 * if whitelisting a single field is sufficient, or kmem_cache_create() with
 * the necessary parameters passed via the args parameter (see
 * &struct kmem_cache_args)
 *
 * Return: a pointer to the cache on success, NULL on failure.
 */
static inline struct kmem_cache *
kmem_cache_create_usercopy(const char *name, unsigned int size,
			   unsigned int align, slab_flags_t flags,
			   unsigned int useroffset, unsigned int usersize,
			   void (*ctor)(void *))
{
	struct kmem_cache_args kmem_args = {
		.align		= align,
		.ctor		= ctor,
		.useroffset	= useroffset,
		.usersize	= usersize,
	};

	return __kmem_cache_create_args(name, size, &kmem_args, flags);
}

/* If NULL is passed for @args, use this variant with default arguments. */
static inline struct kmem_cache *
__kmem_cache_default_args(const char *name, unsigned int size,
			  struct kmem_cache_args *args,
			  slab_flags_t flags)
{
	struct kmem_cache_args kmem_default_args = {};

	/* Make sure we don't get passed garbage. */
	if (WARN_ON_ONCE(args))
		return ERR_PTR(-EINVAL);

	return __kmem_cache_create_args(name, size, &kmem_default_args, flags);
}

/**
 * kmem_cache_create - Create a kmem cache.
 * @__name: A string which is used in /proc/slabinfo to identify this cache.
 * @__object_size: The size of objects to be created in this cache.
 * @__args: Optional arguments, see &struct kmem_cache_args. Passing %NULL
 *	    means defaults will be used for all the arguments.
 *
 * This is currently implemented as a macro using ``_Generic()`` to call
 * either the new variant of the function, or a legacy one.
 *
 * The new variant has 4 parameters:
 * ``kmem_cache_create(name, object_size, args, flags)``
 *
 * See __kmem_cache_create_args() which implements this.
 *
 * The legacy variant has 5 parameters:
 * ``kmem_cache_create(name, object_size, align, flags, ctor)``
 *
 * The align and ctor parameters map to the respective fields of
 * &struct kmem_cache_args
 *
 * Context: Cannot be called within a interrupt, but can be interrupted.
 *
 * Return: a pointer to the cache on success, NULL on failure.
 */
#define kmem_cache_create(__name, __object_size, __args, ...)           \
	_Generic((__args),                                              \
		struct kmem_cache_args *: __kmem_cache_create_args,	\
		void *: __kmem_cache_default_args,			\
		default: __kmem_cache_create)(__name, __object_size, __args, __VA_ARGS__)

void kmem_cache_destroy(struct kmem_cache *s);
int kmem_cache_shrink(struct kmem_cache *s);

/*
 * Please use this macro to create slab caches. Simply specify the
 * name of the structure and maybe some flags that are listed above.
 *
 * The alignment of the struct determines object alignment. If you
 * f.e. add ____cacheline_aligned_in_smp to the struct declaration
 * then the objects will be properly aligned in SMP configurations.
 */
#define KMEM_CACHE(__struct, __flags)                                   \
	__kmem_cache_create_args(#__struct, sizeof(struct __struct),    \
			&(struct kmem_cache_args) {			\
				.align	= __alignof__(struct __struct), \
			}, (__flags))

/*
 * To whitelist a single field for copying to/from usercopy, use this
 * macro instead for KMEM_CACHE() above.
 */
#define KMEM_CACHE_USERCOPY(__struct, __flags, __field)						\
	__kmem_cache_create_args(#__struct, sizeof(struct __struct),				\
			&(struct kmem_cache_args) {						\
				.align		= __alignof__(struct __struct),			\
				.useroffset	= offsetof(struct __struct, __field),		\
				.usersize	= sizeof_field(struct __struct, __field),	\
			}, (__flags))

/*
 * Common kmalloc functions provided by all allocators
 */
void * __must_check krealloc_node_align_noprof(const void *objp, size_t new_size,
					       unsigned long align,
					       gfp_t flags, int nid) __realloc_size(2);
#define krealloc_noprof(_o, _s, _f)	krealloc_node_align_noprof(_o, _s, 1, _f, NUMA_NO_NODE)
#define krealloc_node_align(...)	alloc_hooks(krealloc_node_align_noprof(__VA_ARGS__))
#define krealloc_node(_o, _s, _f, _n)	krealloc_node_align(_o, _s, 1, _f, _n)
#define krealloc(...)			krealloc_node(__VA_ARGS__, NUMA_NO_NODE)

void kfree(const void *objp);
void kfree_nolock(const void *objp);
void kfree_sensitive(const void *objp);

DEFINE_FREE(kfree, void *, if (!IS_ERR_OR_NULL(_T)) kfree(_T))
DEFINE_FREE(kfree_sensitive, void *, if (_T) kfree_sensitive(_T))

size_t ksize(const void *objp);

#ifdef CONFIG_PRINTK
bool kmem_dump_obj(void *object);
#else
static inline bool kmem_dump_obj(void *object) { return false; }
#endif

/*
 * Some archs want to perform DMA into kmalloc caches and need a guaranteed
 * alignment larger than the alignment of a 64-bit integer.
 * Setting ARCH_DMA_MINALIGN in arch headers allows that.
 */
#ifdef ARCH_HAS_DMA_MINALIGN
#if ARCH_DMA_MINALIGN > 8 && !defined(ARCH_KMALLOC_MINALIGN)
#define ARCH_KMALLOC_MINALIGN ARCH_DMA_MINALIGN
#endif
#endif

#ifndef ARCH_KMALLOC_MINALIGN
#define ARCH_KMALLOC_MINALIGN __alignof__(unsigned long long)
#elif ARCH_KMALLOC_MINALIGN > 8
#define KMALLOC_MIN_SIZE ARCH_KMALLOC_MINALIGN
#define KMALLOC_SHIFT_LOW ilog2(KMALLOC_MIN_SIZE)
#endif

/*
 * Setting ARCH_SLAB_MINALIGN in arch headers allows a different alignment.
 * Intended for arches that get misalignment faults even for 64 bit integer
 * aligned buffers.
 */
#ifndef ARCH_SLAB_MINALIGN
#define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
#endif

/*
 * Arches can define this function if they want to decide the minimum slab
 * alignment at runtime. The value returned by the function must be a power
 * of two and >= ARCH_SLAB_MINALIGN.
 */
#ifndef arch_slab_minalign
static inline unsigned int arch_slab_minalign(void)
{
	return ARCH_SLAB_MINALIGN;
}
#endif

/*
 * kmem_cache_alloc and friends return pointers aligned to ARCH_SLAB_MINALIGN.
 * kmalloc and friends return pointers aligned to both ARCH_KMALLOC_MINALIGN
 * and ARCH_SLAB_MINALIGN, but here we only assume the former alignment.
 */
#define __assume_kmalloc_alignment __assume_aligned(ARCH_KMALLOC_MINALIGN)
#define __assume_slab_alignment __assume_aligned(ARCH_SLAB_MINALIGN)
#define __assume_page_alignment __assume_aligned(PAGE_SIZE)

/*
 * Kmalloc array related definitions
 */

/*
 * SLUB directly allocates requests fitting in to an order-1 page
 * (PAGE_SIZE*2).  Larger requests are passed to the page allocator.
 */
#define KMALLOC_SHIFT_HIGH	(PAGE_SHIFT + 1)
#define KMALLOC_SHIFT_MAX	(MAX_PAGE_ORDER + PAGE_SHIFT)
#ifndef KMALLOC_SHIFT_LOW
#define KMALLOC_SHIFT_LOW	3
#endif

/* Maximum allocatable size */
#define KMALLOC_MAX_SIZE	(1UL << KMALLOC_SHIFT_MAX)
/* Maximum size for which we actually use a slab cache */
#define KMALLOC_MAX_CACHE_SIZE	(1UL << KMALLOC_SHIFT_HIGH)
/* Maximum order allocatable via the slab allocator */
#define KMALLOC_MAX_ORDER	(KMALLOC_SHIFT_MAX - PAGE_SHIFT)

/*
 * Kmalloc subsystem.
 */
#ifndef KMALLOC_MIN_SIZE
#define KMALLOC_MIN_SIZE (1 << KMALLOC_SHIFT_LOW)
#endif

/*
 * This restriction comes from byte sized index implementation.
 * Page size is normally 2^12 bytes and, in this case, if we want to use
 * byte sized index which can represent 2^8 entries, the size of the object
 * should be equal or greater to 2^12 / 2^8 = 2^4 = 16.
 * If minimum size of kmalloc is less than 16, we use it as minimum object
 * size and give up to use byte sized index.
 */
#define SLAB_OBJ_MIN_SIZE      (KMALLOC_MIN_SIZE < 16 ? \
                               (KMALLOC_MIN_SIZE) : 16)

#ifdef CONFIG_RANDOM_KMALLOC_CACHES
#define RANDOM_KMALLOC_CACHES_NR	15 // # of cache copies
#else
#define RANDOM_KMALLOC_CACHES_NR	0
#endif

/*
 * Whenever changing this, take care of that kmalloc_type() and
 * create_kmalloc_caches() still work as intended.
 *
 * KMALLOC_NORMAL can contain only unaccounted objects whereas KMALLOC_CGROUP
 * is for accounted but unreclaimable and non-dma objects. All the other
 * kmem caches can have both accounted and unaccounted objects.
 */
enum kmalloc_cache_type {
	KMALLOC_NORMAL = 0,
#ifndef CONFIG_ZONE_DMA
	KMALLOC_DMA = KMALLOC_NORMAL,
#endif
#ifndef CONFIG_MEMCG
	KMALLOC_CGROUP = KMALLOC_NORMAL,
#endif
	KMALLOC_RANDOM_START = KMALLOC_NORMAL,
	KMALLOC_RANDOM_END = KMALLOC_RANDOM_START + RANDOM_KMALLOC_CACHES_NR,
#ifdef CONFIG_SLUB_TINY
	KMALLOC_RECLAIM = KMALLOC_NORMAL,
#else
	KMALLOC_RECLAIM,
#endif
#ifdef CONFIG_ZONE_DMA
	KMALLOC_DMA,
#endif
#ifdef CONFIG_MEMCG
	KMALLOC_CGROUP,
#endif
	NR_KMALLOC_TYPES
};

typedef struct kmem_cache * kmem_buckets[KMALLOC_SHIFT_HIGH + 1];

extern kmem_buckets kmalloc_caches[NR_KMALLOC_TYPES];

/*
 * Define gfp bits that should not be set for KMALLOC_NORMAL.
 */
#define KMALLOC_NOT_NORMAL_BITS					\
	(__GFP_RECLAIMABLE |					\
	(IS_ENABLED(CONFIG_ZONE_DMA)   ? __GFP_DMA : 0) |	\
	(IS_ENABLED(CONFIG_MEMCG) ? __GFP_ACCOUNT : 0))

extern unsigned long random_kmalloc_seed;

static __always_inline enum kmalloc_cache_type kmalloc_type(gfp_t flags, unsigned long caller)
{
	/*
	 * The most common case is KMALLOC_NORMAL, so test for it
	 * with a single branch for all the relevant flags.
	 */
	if (likely((flags & KMALLOC_NOT_NORMAL_BITS) == 0))
#ifdef CONFIG_RANDOM_KMALLOC_CACHES
		/* RANDOM_KMALLOC_CACHES_NR (=15) copies + the KMALLOC_NORMAL */
		return KMALLOC_RANDOM_START + hash_64(caller ^ random_kmalloc_seed,
						      ilog2(RANDOM_KMALLOC_CACHES_NR + 1));
#else
		return KMALLOC_NORMAL;
#endif

	/*
	 * At least one of the flags has to be set. Their priorities in
	 * decreasing order are:
	 *  1) __GFP_DMA
	 *  2) __GFP_RECLAIMABLE
	 *  3) __GFP_ACCOUNT
	 */
	if (IS_ENABLED(CONFIG_ZONE_DMA) && (flags & __GFP_DMA))
		return KMALLOC_DMA;
	if (!IS_ENABLED(CONFIG_MEMCG) || (flags & __GFP_RECLAIMABLE))
		return KMALLOC_RECLAIM;
	else
		return KMALLOC_CGROUP;
}

/*
 * Figure out which kmalloc slab an allocation of a certain size
 * belongs to.
 * 0 = zero alloc
 * 1 =  65 .. 96 bytes
 * 2 = 129 .. 192 bytes
 * n = 2^(n-1)+1 .. 2^n
 *
 * Note: __kmalloc_index() is compile-time optimized, and not runtime optimized;
 * typical usage is via kmalloc_index() and therefore evaluated at compile-time.
 * Callers where !size_is_constant should only be test modules, where runtime
 * overheads of __kmalloc_index() can be tolerated.  Also see kmalloc_slab().
 */
static __always_inline unsigned int __kmalloc_index(size_t size,
						    bool size_is_constant)
{
	if (!size)
		return 0;

	if (size <= KMALLOC_MIN_SIZE)
		return KMALLOC_SHIFT_LOW;

	if (KMALLOC_MIN_SIZE <= 32 && size > 64 && size <= 96)
		return 1;
	if (KMALLOC_MIN_SIZE <= 64 && size > 128 && size <= 192)
		return 2;
	if (size <=          8) return 3;
	if (size <=         16) return 4;
	if (size <=         32) return 5;
	if (size <=         64) return 6;
	if (size <=        128) return 7;
	if (size <=        256) return 8;
	if (size <=        512) return 9;
	if (size <=       1024) return 10;
	if (size <=   2 * 1024) return 11;
	if (size <=   4 * 1024) return 12;
	if (size <=   8 * 1024) return 13;
	if (size <=  16 * 1024) return 14;
	if (size <=  32 * 1024) return 15;
	if (size <=  64 * 1024) return 16;
	if (size <= 128 * 1024) return 17;
	if (size <= 256 * 1024) return 18;
	if (size <= 512 * 1024) return 19;
	if (size <= 1024 * 1024) return 20;
	if (size <=  2 * 1024 * 1024) return 21;

	if (!IS_ENABLED(CONFIG_PROFILE_ALL_BRANCHES) && size_is_constant)
		BUILD_BUG_ON_MSG(1, "unexpected size in kmalloc_index()");
	else
		BUG();

	/* Will never be reached. Needed because the compiler may complain */
	return -1;
}
static_assert(PAGE_SHIFT <= 20);
#define kmalloc_index(s) __kmalloc_index(s, true)

#include <linux/alloc_tag.h>

/**
 * kmem_cache_alloc - Allocate an object
 * @cachep: The cache to allocate from.
 * @flags: See kmalloc().
 *
 * Allocate an object from this cache.
 * See kmem_cache_zalloc() for a shortcut of adding __GFP_ZERO to flags.
 *
 * Return: pointer to the new object or %NULL in case of error
 */
void *kmem_cache_alloc_noprof(struct kmem_cache *cachep,
			      gfp_t flags) __assume_slab_alignment __malloc;
#define kmem_cache_alloc(...)			alloc_hooks(kmem_cache_alloc_noprof(__VA_ARGS__))

void *kmem_cache_alloc_lru_noprof(struct kmem_cache *s, struct list_lru *lru,
			    gfp_t gfpflags) __assume_slab_alignment __malloc;
#define kmem_cache_alloc_lru(...)	alloc_hooks(kmem_cache_alloc_lru_noprof(__VA_ARGS__))

/**
 * kmem_cache_charge - memcg charge an already allocated slab memory
 * @objp: address of the slab object to memcg charge
 * @gfpflags: describe the allocation context
 *
 * kmem_cache_charge allows charging a slab object to the current memcg,
 * primarily in cases where charging at allocation time might not be possible
 * because the target memcg is not known (i.e. softirq context)
 *
 * The objp should be pointer returned by the slab allocator functions like
 * kmalloc (with __GFP_ACCOUNT in flags) or kmem_cache_alloc. The memcg charge
 * behavior can be controlled through gfpflags parameter, which affects how the
 * necessary internal metadata can be allocated. Including __GFP_NOFAIL denotes
 * that overcharging is requested instead of failure, but is not applied for the
 * internal metadata allocation.
 *
 * There are several cases where it will return true even if the charging was
 * not done:
 * More specifically:
 *
 * 1. For !CONFIG_MEMCG or cgroup_disable=memory systems.
 * 2. Already charged slab objects.
 * 3. For slab objects from KMALLOC_NORMAL caches - allocated by kmalloc()
 *    without __GFP_ACCOUNT
 * 4. Allocating internal metadata has failed
 *
 * Return: true if charge was successful otherwise false.
 */
bool kmem_cache_charge(void *objp, gfp_t gfpflags);
void kmem_cache_free(struct kmem_cache *s, void *objp);

kmem_buckets *kmem_buckets_create(const char *name, slab_flags_t flags,
				  unsigned int useroffset, unsigned int usersize,
				  void (*ctor)(void *));

/*
 * Bulk allocation and freeing operations. These are accelerated in an
 * allocator specific way to avoid taking locks repeatedly or building
 * metadata structures unnecessarily.
 *
 * Note that interrupts must be enabled when calling these functions.
 */
void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p);

int kmem_cache_alloc_bulk_noprof(struct kmem_cache *s, gfp_t flags, size_t size, void **p);
#define kmem_cache_alloc_bulk(...)	alloc_hooks(kmem_cache_alloc_bulk_noprof(__VA_ARGS__))

static __always_inline void kfree_bulk(size_t size, void **p)
{
	kmem_cache_free_bulk(NULL, size, p);
}

void *kmem_cache_alloc_node_noprof(struct kmem_cache *s, gfp_t flags,
				   int node) __assume_slab_alignment __malloc;
#define kmem_cache_alloc_node(...)	alloc_hooks(kmem_cache_alloc_node_noprof(__VA_ARGS__))

struct slab_sheaf *
kmem_cache_prefill_sheaf(struct kmem_cache *s, gfp_t gfp, unsigned int size);

int kmem_cache_refill_sheaf(struct kmem_cache *s, gfp_t gfp,
		struct slab_sheaf **sheafp, unsigned int size);

void kmem_cache_return_sheaf(struct kmem_cache *s, gfp_t gfp,
				       struct slab_sheaf *sheaf);

void *kmem_cache_alloc_from_sheaf_noprof(struct kmem_cache *cachep, gfp_t gfp,
			struct slab_sheaf *sheaf) __assume_slab_alignment __malloc;
#define kmem_cache_alloc_from_sheaf(...)	\
			alloc_hooks(kmem_cache_alloc_from_sheaf_noprof(__VA_ARGS__))

unsigned int kmem_cache_sheaf_size(struct slab_sheaf *sheaf);

/*
 * These macros allow declaring a kmem_buckets * parameter alongside size, which
 * can be compiled out with CONFIG_SLAB_BUCKETS=n so that a large number of call
 * sites don't have to pass NULL.
 */
#ifdef CONFIG_SLAB_BUCKETS
#define DECL_BUCKET_PARAMS(_size, _b)	size_t (_size), kmem_buckets *(_b)
#define PASS_BUCKET_PARAMS(_size, _b)	(_size), (_b)
#define PASS_BUCKET_PARAM(_b)		(_b)
#else
#define DECL_BUCKET_PARAMS(_size, _b)	size_t (_size)
#define PASS_BUCKET_PARAMS(_size, _b)	(_size)
#define PASS_BUCKET_PARAM(_b)		NULL
#endif

/*
 * The following functions are not to be used directly and are intended only
 * for internal use from kmalloc() and kmalloc_node()
 * with the exception of kunit tests
 */

void *__kmalloc_noprof(size_t size, gfp_t flags)
				__assume_kmalloc_alignment __alloc_size(1);

void *__kmalloc_node_noprof(DECL_BUCKET_PARAMS(size, b), gfp_t flags, int node)
				__assume_kmalloc_alignment __alloc_size(1);

void *__kmalloc_cache_noprof(struct kmem_cache *s, gfp_t flags, size_t size)
				__assume_kmalloc_alignment __alloc_size(3);

void *__kmalloc_cache_node_noprof(struct kmem_cache *s, gfp_t gfpflags,
				  int node, size_t size)
				__assume_kmalloc_alignment __alloc_size(4);

void *__kmalloc_large_noprof(size_t size, gfp_t flags)
				__assume_page_alignment __alloc_size(1);

void *__kmalloc_large_node_noprof(size_t size, gfp_t flags, int node)
				__assume_page_alignment __alloc_size(1);

/**
 * kmalloc - allocate kernel memory
 * @size: how many bytes of memory are required.
 * @flags: describe the allocation context
 *
 * kmalloc is the normal method of allocating memory
 * for objects smaller than page size in the kernel.
 *
 * The allocated object address is aligned to at least ARCH_KMALLOC_MINALIGN
 * bytes. For @size of power of two bytes, the alignment is also guaranteed
 * to be at least to the size. For other sizes, the alignment is guaranteed to
 * be at least the largest power-of-two divisor of @size.
 *
 * The @flags argument may be one of the GFP flags defined at
 * include/linux/gfp_types.h and described at
 * :ref:`Documentation/core-api/mm-api.rst <mm-api-gfp-flags>`
 *
 * The recommended usage of the @flags is described at
 * :ref:`Documentation/core-api/memory-allocation.rst <memory_allocation>`
 *
 * Below is a brief outline of the most useful GFP flags
 *
 * %GFP_KERNEL
 *	Allocate normal kernel ram. May sleep.
 *
 * %GFP_NOWAIT
 *	Allocation will not sleep.
 *
 * %GFP_ATOMIC
 *	Allocation will not sleep.  May use emergency pools.
 *
 * Also it is possible to set different flags by OR'ing
 * in one or more of the following additional @flags:
 *
 * %__GFP_ZERO
 *	Zero the allocated memory before returning. Also see kzalloc().
 *
 * %__GFP_HIGH
 *	This allocation has high priority and may use emergency pools.
 *
 * %__GFP_NOFAIL
 *	Indicate that this allocation is in no way allowed to fail
 *	(think twice before using).
 *
 * %__GFP_NORETRY
 *	If memory is not immediately available,
 *	then give up at once.
 *
 * %__GFP_NOWARN
 *	If allocation fails, don't issue any warnings.
 *
 * %__GFP_RETRY_MAYFAIL
 *	Try really hard to succeed the allocation but fail
 *	eventually.
 */
static __always_inline __alloc_size(1) void *kmalloc_noprof(size_t size, gfp_t flags)
{
	if (__builtin_constant_p(size) && size) {
		unsigned int index;

		if (size > KMALLOC_MAX_CACHE_SIZE)
			return __kmalloc_large_noprof(size, flags);

		index = kmalloc_index(size);
		return __kmalloc_cache_noprof(
				kmalloc_caches[kmalloc_type(flags, _RET_IP_)][index],
				flags, size);
	}
	return __kmalloc_noprof(size, flags);
}
#define kmalloc(...)				alloc_hooks(kmalloc_noprof(__VA_ARGS__))

void *kmalloc_nolock_noprof(size_t size, gfp_t gfp_flags, int node);
#define kmalloc_nolock(...)			alloc_hooks(kmalloc_nolock_noprof(__VA_ARGS__))

/**
 * __alloc_objs - Allocate objects of a given type using
 * @KMALLOC: which size-based kmalloc wrapper to allocate with.
 * @GFP: GFP flags for the allocation.
 * @TYPE: type to allocate space for.
 * @COUNT: how many @TYPE objects to allocate.
 *
 * Returns: Newly allocated pointer to (first) @TYPE of @COUNT-many
 * allocated @TYPE objects, or NULL on failure.
 */
#define __alloc_objs(KMALLOC, GFP, TYPE, COUNT)				\
({									\
	const size_t __obj_size = size_mul(sizeof(TYPE), COUNT);	\
	(TYPE *)KMALLOC(__obj_size, GFP);				\
})

/**
 * __alloc_flex - Allocate an object that has a trailing flexible array
 * @KMALLOC: kmalloc wrapper function to use for allocation.
 * @GFP: GFP flags for the allocation.
 * @TYPE: type of structure to allocate space for.
 * @FAM: The name of the flexible array member of @TYPE structure.
 * @COUNT: how many @FAM elements to allocate space for.
 *
 * Returns: Newly allocated pointer to @TYPE with @COUNT-many trailing
 * @FAM elements, or NULL on failure or if @COUNT cannot be represented
 * by the member of @TYPE that counts the @FAM elements (annotated via
 * __counted_by()).
 */
#define __alloc_flex(KMALLOC, GFP, TYPE, FAM, COUNT)			\
({									\
	const size_t __count = (COUNT);					\
	const size_t __obj_size = struct_size_t(TYPE, FAM, __count);	\
	TYPE *__obj_ptr = KMALLOC(__obj_size, GFP);			\
	if (__obj_ptr)							\
		__set_flex_counter(__obj_ptr->FAM, __count);		\
	__obj_ptr;							\
})

/**
 * kmalloc_obj - Allocate a single instance of the given type
 * @VAR_OR_TYPE: Variable or type to allocate.
 * @GFP: GFP flags for the allocation.
 *
 * Returns: newly allocated pointer to a @VAR_OR_TYPE on success, or NULL
 * on failure.
 */
#define kmalloc_obj(VAR_OR_TYPE, ...) \
	__alloc_objs(kmalloc, default_gfp(__VA_ARGS__), typeof(VAR_OR_TYPE), 1)

/**
 * kmalloc_objs - Allocate an array of the given type
 * @VAR_OR_TYPE: Variable or type to allocate an array of.
 * @COUNT: How many elements in the array.
 * @GFP: GFP flags for the allocation.
 *
 * Returns: newly allocated pointer to array of @VAR_OR_TYPE on success,
 * or NULL on failure.
 */
#define kmalloc_objs(VAR_OR_TYPE, COUNT, ...) \
	__alloc_objs(kmalloc, default_gfp(__VA_ARGS__), typeof(VAR_OR_TYPE), COUNT)

/**
 * kmalloc_flex - Allocate a single instance of the given flexible structure
 * @VAR_OR_TYPE: Variable or type to allocate (with its flex array).
 * @FAM: The name of the flexible array member of the structure.
 * @COUNT: How many flexible array member elements are desired.
 * @GFP: GFP flags for the allocation.
 *
 * Returns: newly allocated pointer to @VAR_OR_TYPE on success, NULL on
 * failure. If @FAM has been annotated with __counted_by(), the allocation
 * will immediately fail if @COUNT is larger than what the type of the
 * struct's counter variable can represent.
 */
#define kmalloc_flex(VAR_OR_TYPE, FAM, COUNT, ...) \
	__alloc_flex(kmalloc, default_gfp(__VA_ARGS__), typeof(VAR_OR_TYPE), FAM, COUNT)

/* All kzalloc aliases for kmalloc_(obj|objs|flex). */
#define kzalloc_obj(P, ...) \
	__alloc_objs(kzalloc, default_gfp(__VA_ARGS__), typeof(P), 1)
#define kzalloc_objs(P, COUNT, ...) \
	__alloc_objs(kzalloc, default_gfp(__VA_ARGS__), typeof(P), COUNT)
#define kzalloc_flex(P, FAM, COUNT, ...)		\
	__alloc_flex(kzalloc, default_gfp(__VA_ARGS__), typeof(P), FAM, COUNT)

/* All kvmalloc aliases for kmalloc_(obj|objs|flex). */
#define kvmalloc_obj(P, ...) \
	__alloc_objs(kvmalloc, default_gfp(__VA_ARGS__), typeof(P), 1)
#define kvmalloc_objs(P, COUNT, ...) \
	__alloc_objs(kvmalloc, default_gfp(__VA_ARGS__), typeof(P), COUNT)
#define kvmalloc_flex(P, FAM, COUNT, ...) \
	__alloc_flex(kvmalloc, default_gfp(__VA_ARGS__), typeof(P), FAM, COUNT)

/* All kvzalloc aliases for kmalloc_(obj|objs|flex). */
#define kvzalloc_obj(P, ...) \
	__alloc_objs(kvzalloc, default_gfp(__VA_ARGS__), typeof(P), 1)
#define kvzalloc_objs(P, COUNT, ...) \
	__alloc_objs(kvzalloc, default_gfp(__VA_ARGS__), typeof(P), COUNT)
#define kvzalloc_flex(P, FAM, COUNT, ...) \
	__alloc_flex(kvzalloc, default_gfp(__VA_ARGS__), typeof(P), FAM, COUNT)

#define kmem_buckets_alloc(_b, _size, _flags)	\
	alloc_hooks(__kmalloc_node_noprof(PASS_BUCKET_PARAMS(_size, _b), _flags, NUMA_NO_NODE))

#define kmem_buckets_alloc_track_caller(_b, _size, _flags)	\
	alloc_hooks(__kmalloc_node_track_caller_noprof(PASS_BUCKET_PARAMS(_size, _b), _flags, NUMA_NO_NODE, _RET_IP_))

static __always_inline __alloc_size(1) void *kmalloc_node_noprof(size_t size, gfp_t flags, int node)
{
	if (__builtin_constant_p(size) && size) {
		unsigned int index;

		if (size > KMALLOC_MAX_CACHE_SIZE)
			return __kmalloc_large_node_noprof(size, flags, node);

		index = kmalloc_index(size);
		return __kmalloc_cache_node_noprof(
				kmalloc_caches[kmalloc_type(flags, _RET_IP_)][index],
				flags, node, size);
	}
	return __kmalloc_node_noprof(PASS_BUCKET_PARAMS(size, NULL), flags, node);
}
#define kmalloc_node(...)			alloc_hooks(kmalloc_node_noprof(__VA_ARGS__))

/**
 * kmalloc_array - allocate memory for an array.
 * @n: number of elements.
 * @size: element size.
 * @flags: the type of memory to allocate (see kmalloc).
 */
static inline __alloc_size(1, 2) void *kmalloc_array_noprof(size_t n, size_t size, gfp_t flags)
{
	size_t bytes;

	if (unlikely(check_mul_overflow(n, size, &bytes)))
		return NULL;
	return kmalloc_noprof(bytes, flags);
}
#define kmalloc_array(...)			alloc_hooks(kmalloc_array_noprof(__VA_ARGS__))

/**
 * krealloc_array - reallocate memory for an array.
 * @p: pointer to the memory chunk to reallocate
 * @new_n: new number of elements to alloc
 * @new_size: new size of a single member of the array
 * @flags: the type of memory to allocate (see kmalloc)
 *
 * If __GFP_ZERO logic is requested, callers must ensure that, starting with the
 * initial memory allocation, every subsequent call to this API for the same
 * memory allocation is flagged with __GFP_ZERO. Otherwise, it is possible that
 * __GFP_ZERO is not fully honored by this API.
 *
 * See krealloc_noprof() for further details.
 *
 * In any case, the contents of the object pointed to are preserved up to the
 * lesser of the new and old sizes.
 */
static inline __realloc_size(2, 3) void * __must_check krealloc_array_noprof(void *p,
								       size_t new_n,
								       size_t new_size,
								       gfp_t flags)
{
	size_t bytes;

	if (unlikely(check_mul_overflow(new_n, new_size, &bytes)))
		return NULL;

	return krealloc_noprof(p, bytes, flags);
}
#define krealloc_array(...)			alloc_hooks(krealloc_array_noprof(__VA_ARGS__))

/**
 * kcalloc - allocate memory for an array. The memory is set to zero.
 * @n: number of elements.
 * @size: element size.
 * @flags: the type of memory to allocate (see kmalloc).
 */
#define kcalloc(n, size, flags)		kmalloc_array(n, size, (flags) | __GFP_ZERO)

void *__kmalloc_node_track_caller_noprof(DECL_BUCKET_PARAMS(size, b), gfp_t flags, int node,
					 unsigned long caller) __alloc_size(1);
#define kmalloc_node_track_caller_noprof(size, flags, node, caller) \
	__kmalloc_node_track_caller_noprof(PASS_BUCKET_PARAMS(size, NULL), flags, node, caller)
#define kmalloc_node_track_caller(...)		\
	alloc_hooks(kmalloc_node_track_caller_noprof(__VA_ARGS__, _RET_IP_))

/*
 * kmalloc_track_caller is a special version of kmalloc that records the
 * calling function of the routine calling it for slab leak tracking instead
 * of just the calling function (confusing, eh?).
 * It's useful when the call to kmalloc comes from a widely-used standard
 * allocator where we care about the real place the memory allocation
 * request comes from.
 */
#define kmalloc_track_caller(...)		kmalloc_node_track_caller(__VA_ARGS__, NUMA_NO_NODE)

#define kmalloc_track_caller_noprof(...)	\
		kmalloc_node_track_caller_noprof(__VA_ARGS__, NUMA_NO_NODE, _RET_IP_)

static inline __alloc_size(1, 2) void *kmalloc_array_node_noprof(size_t n, size_t size, gfp_t flags,
							  int node)
{
	size_t bytes;

	if (unlikely(check_mul_overflow(n, size, &bytes)))
		return NULL;
	if (__builtin_constant_p(n) && __builtin_constant_p(size))
		return kmalloc_node_noprof(bytes, flags, node);
	return __kmalloc_node_noprof(PASS_BUCKET_PARAMS(bytes, NULL), flags, node);
}
#define kmalloc_array_node(...)			alloc_hooks(kmalloc_array_node_noprof(__VA_ARGS__))

#define kcalloc_node(_n, _size, _flags, _node)	\
	kmalloc_array_node(_n, _size, (_flags) | __GFP_ZERO, _node)

/*
 * Shortcuts
 */
#define kmem_cache_zalloc(_k, _flags)		kmem_cache_alloc(_k, (_flags)|__GFP_ZERO)

/**
 * kzalloc - allocate memory. The memory is set to zero.
 * @size: how many bytes of memory are required.
 * @flags: the type of memory to allocate (see kmalloc).
 */
static inline __alloc_size(1) void *kzalloc_noprof(size_t size, gfp_t flags)
{
	return kmalloc_noprof(size, flags | __GFP_ZERO);
}
#define kzalloc(...)				alloc_hooks(kzalloc_noprof(__VA_ARGS__))
#define kzalloc_node(_size, _flags, _node)	kmalloc_node(_size, (_flags)|__GFP_ZERO, _node)

void *__kvmalloc_node_noprof(DECL_BUCKET_PARAMS(size, b), unsigned long align,
			     gfp_t flags, int node) __alloc_size(1);
#define kvmalloc_node_align_noprof(_size, _align, _flags, _node)	\
	__kvmalloc_node_noprof(PASS_BUCKET_PARAMS(_size, NULL), _align, _flags, _node)
#define kvmalloc_node_align(...)		\
	alloc_hooks(kvmalloc_node_align_noprof(__VA_ARGS__))
#define kvmalloc_node(_s, _f, _n)		kvmalloc_node_align(_s, 1, _f, _n)
#define kvmalloc(...)				kvmalloc_node(__VA_ARGS__, NUMA_NO_NODE)
#define kvzalloc(_size, _flags)			kvmalloc(_size, (_flags)|__GFP_ZERO)

#define kvzalloc_node(_size, _flags, _node)	kvmalloc_node(_size, (_flags)|__GFP_ZERO, _node)

#define kmem_buckets_valloc(_b, _size, _flags)	\
	alloc_hooks(__kvmalloc_node_noprof(PASS_BUCKET_PARAMS(_size, _b), 1, _flags, NUMA_NO_NODE))

static inline __alloc_size(1, 2) void *
kvmalloc_array_node_noprof(size_t n, size_t size, gfp_t flags, int node)
{
	size_t bytes;

	if (unlikely(check_mul_overflow(n, size, &bytes)))
		return NULL;

	return kvmalloc_node_align_noprof(bytes, 1, flags, node);
}

#define kvmalloc_array_noprof(...)		kvmalloc_array_node_noprof(__VA_ARGS__, NUMA_NO_NODE)
#define kvcalloc_node_noprof(_n,_s,_f,_node)	kvmalloc_array_node_noprof(_n,_s,(_f)|__GFP_ZERO,_node)
#define kvcalloc_noprof(...)			kvcalloc_node_noprof(__VA_ARGS__, NUMA_NO_NODE)

#define kvmalloc_array(...)			alloc_hooks(kvmalloc_array_noprof(__VA_ARGS__))
#define kvcalloc_node(...)			alloc_hooks(kvcalloc_node_noprof(__VA_ARGS__))
#define kvcalloc(...)				alloc_hooks(kvcalloc_noprof(__VA_ARGS__))

void *kvrealloc_node_align_noprof(const void *p, size_t size, unsigned long align,
				  gfp_t flags, int nid) __realloc_size(2);
#define kvrealloc_node_align(...)		\
	alloc_hooks(kvrealloc_node_align_noprof(__VA_ARGS__))
#define kvrealloc_node(_p, _s, _f, _n)		kvrealloc_node_align(_p, _s, 1, _f, _n)
#define kvrealloc(...)				kvrealloc_node(__VA_ARGS__, NUMA_NO_NODE)

extern void kvfree(const void *addr);
DEFINE_FREE(kvfree, void *, if (!IS_ERR_OR_NULL(_T)) kvfree(_T))

extern void kvfree_sensitive(const void *addr, size_t len);

unsigned int kmem_cache_size(struct kmem_cache *s);

#ifndef CONFIG_KVFREE_RCU_BATCHED
static inline void kvfree_rcu_barrier(void)
{
	rcu_barrier();
}

static inline void kvfree_rcu_barrier_on_cache(struct kmem_cache *s)
{
	rcu_barrier();
}

static inline void kfree_rcu_scheduler_running(void) { }
#else
void kvfree_rcu_barrier(void);

void kvfree_rcu_barrier_on_cache(struct kmem_cache *s);

void kfree_rcu_scheduler_running(void);
#endif

/**
 * kmalloc_size_roundup - Report allocation bucket size for the given size
 *
 * @size: Number of bytes to round up from.
 *
 * This returns the number of bytes that would be available in a kmalloc()
 * allocation of @size bytes. For example, a 126 byte request would be
 * rounded up to the next sized kmalloc bucket, 128 bytes. (This is strictly
 * for the general-purpose kmalloc()-based allocations, and is not for the
 * pre-sized kmem_cache_alloc()-based allocations.)
 *
 * Use this to kmalloc() the full bucket size ahead of time instead of using
 * ksize() to query the size after an allocation.
 */
size_t kmalloc_size_roundup(size_t size);

void __init kmem_cache_init_late(void);
void __init kvfree_rcu_init(void);

#endif	/* _LINUX_SLAB_H */
]

gemini-3-flash-preview

							input: 128457
							output: 19
							thoughts: 144
						

**Analyzing the Bug Report**

Okay, so I've confirmed that `kzalloc_obj` is indeed defined in `include/linux/slab.h` – just as I expected. It's a handy macro, nothing out of the ordinary there. Now, getting to the core issue, the bug is definitely confirmed.

This is actionable, and seems pretty consistent with my experience in these types of issues. The root cause appears to be the error path in `hackrf_probe`. Specifically, it uses `kfree(dev)` even when the device might be open by userspace. That’s a classic race condition and memory management issue. The fix is pretty clear: it should be replaced with `v4l2_device_put`.

With this information, I'm confident I have a solid understanding of the problem and can proceed with a solution.

map[Actionable:true Confident:true]

map[Actionable:true Confident:true]

gemini-3-flash-preview

							input: 128818
							output: 711
							thoughts: 396
						

**Actionable and Consistent Vulnerability Report: My Analysis**

Okay, let's break this down. My understanding is that this report details a classic use-after-free vulnerability, specifically a slab-use-after-free, within the `vb2_core_queue_release` function. The core issue revolves around a race condition in the `hackrf_probe` function, specifically related to the V4L2 device.

Here's how I see the access stack: the problem stems from `vb2_core_queue_release` being invoked during the `close()` operation of a V4L2 device. This function then attempts to access `q->max_num_buffers`, where `q` is a member within the `struct hackrf_dev` structure.

Now, tracing the allocation, `struct hackrf_dev` is allocated within `hackrf_probe`, as you'd expect. However, here's where things get interesting and where the free stack is: the crucial error path in `hackrf_probe` is problematic. If `hackrf_probe` encounters an error during device initialization, it calls `kfree(dev)` to free `struct hackrf_dev`, which can cause a problem because of the race.

The race condition plays out like this: `hackrf_probe` registers a video device successfully, and userspace, using something like `v4l_id`, opens it. Then, `hackrf_probe` hits an error (maybe trying to register a second device), unregisters the first video device and immediately calls `kfree(dev)`. However, the userspace process still has the device *open*. When userspace eventually closes the device, the V4L2 core correctly calls the release function, eventually leading to `vb2_core_queue_release` being called, which then accesses the freed memory.

The proposed fix makes perfect sense, of course, using `v4l2_device_put` instead of `kfree(dev)` in the error path of `hackrf_probe`. This leverages the V4L2 device refcounting mechanism, ensuring that the memory isn't freed prematurely. It's freed only after all userspace references are gone, which eliminates the race and resolves the vulnerability.

This looks actionable and consistent to me. The three stacks – access, allocation, and free – all clearly pertain to the `hackrf_dev` object and the `drivers/media` subsystem. The line numbers that I would expect to check align with source code as well. It's a well-defined use-after-free, and the fix seems appropriate, and I would certainly recommend that we implement this fix.

map[Explanation:The bug report describes a slab-use-after-free in `vb2_core_queue_release`,
which is part of the `videobuf2` core framework used by V4L2 drivers. The report
is fully consistent and actionable.

### Analysis of the Report:
1.  **Access Stack**: The crash occurs in `vb2_core_queue_release` at
`drivers/media/common/videobuf2/videobuf2-core.c:2679`. This function is called
during the closing of a file descriptor (`__fput` -> `v4l2_release` ->
`vb2_fop_release`). The specific access is a read of `q->max_num_buffers`, where
`q` is a `struct vb2_queue` embedded within `struct hackrf_dev`.
2.  **Allocation Stack**: The memory was allocated in `hackrf_probe` at
`drivers/media/usb/hackrf/hackrf.c:1351` (using `kzalloc_obj(*dev)`). This
confirms the object is indeed `struct hackrf_dev`.
3.  **Free Stack**: The memory was freed in the error path of `hackrf_probe` at
`drivers/media/usb/hackrf/hackrf.c:1523` (using `kfree(dev)`).

### Root Cause:
The bug is a classic race condition in the driver's `probe` function error
handling. In `hackrf_probe`, the driver registers a video device
(`video_register_device(&dev->rx_vdev, ...)`). Once registered, the device is
visible to userspace. If a subsequent initialization step fails (e.g.,
registering the transmitter device), the driver enters its error cleanup path.

In the error path, the driver calls `video_unregister_device(&dev->rx_vdev)` and
then immediately calls `kfree(dev)`. However, `video_unregister_device` does not
guarantee that no userspace processes have the device open. If a process (like
`v4l_id` mentioned in the report) opened the device after registration but
before unregistration, it holds a reference to the `video_device` and the
underlying `v4l2_device`. When that process later closes the file descriptor,
the V4L2 core attempts to clean up the associated `vb2_queue`, leading to a
use-after-free because the parent `hackrf_dev` has already been freed.

### Conclusion:
The report is actionable because it clearly identifies the faulty error handling
in `hackrf_probe`. The fix involves using proper refcounting (e.g.,
`v4l2_device_put`) instead of direct `kfree(dev)` in the `probe` error path,
ensuring the structure is only freed when its last user (including the probe
function itself) has released it.

The report is self-consistent:
- The object type (`hackrf_dev`) matches across all stacks.
- The offset of the access (3912 bytes) correctly points to the `rx_vb2_queue`
within `hackrf_dev`.
- The tasks involved (`v4l_id` for access, and a kernel worker for
allocation/free) perfectly match the hypothesized race condition.]