linux-stable.git/drivers/media/platform, branch linux-6.14.y

media: qcom: camss: Add default case in vfe_src_pad_code

2025-05-29T09:13:37+00:00

[ Upstream commit 2f4204bb00b32eca3391a468d3b37e87feb96fa9 ]

Add a default case in vfe_src_pad_code to get rid of a compile
warning if a new hw enum is added.

Signed-off-by: Depeng Shao 
Reviewed-by: Bryan O'Donoghue 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available

2025-05-29T09:13:37+00:00

[ Upstream commit 2f1361f862a68063f37362f1beb400e78e289581 ]

There is no CSID TPG on some SoCs, so the v4l2 ctrl in CSID driver
shouldn't be registered. Checking the supported TPG modes to indicate
if the TPG hardware exists or not and only registering v4l2 ctrl for
CSID only when the TPG hardware is present.

Signed-off-by: Depeng Shao 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: stm32: csi: add missing pm_runtime_put on error

2025-05-29T09:13:21+00:00

[ Upstream commit f7cd9c94959e7a5b8c4eca33e20bd6ba1b048a64 ]

Within the stm32_csi_start function, pm_runtime_put should
be called upon error following pm_runtime_get_sync.
Rework the function error handling by putting a label in
order to have common error handling for all calls requiring
pm_runtime_put.

Signed-off-by: Alain Volmat 
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: stm32: csi: use ARRAY_SIZE to search D-PHY table

2025-05-29T09:13:21+00:00

[ Upstream commit a3a91b6e62be24c5df47a800c367504cb41e502b ]

Within stm32_csi_start, use ARRAY_SIZE loop in order to search
for the right setting.
Avoid useless init of lanes_ie / lanes_en.

Signed-off-by: Alain Volmat 
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()

2025-05-29T09:12:54+00:00

[ Upstream commit b773530a34df0687020520015057075f8b7b4ac4 ]

An of_node_put(i2c_bus) call was immediately used after a pointer check
for an of_find_i2c_adapter_by_node() call in this function implementation.
Thus call such a function only once instead directly before the check.

This issue was transformed by using the Coccinelle software.

Signed-off-by: Markus Elfring 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster

2025-04-20T08:22:54+00:00

commit 035371c9e5098018b8512efc6a8812912469480c upstream.

The Wave5 521C variant does not support 10 bit decoding. When 10 bit
decoding support was added for the 515 variant, a section of the code
was removed which returned an error. This removal causes a timeout for
the 521 variant, which was discovered during HEVC 10-bit decoding tests.

Fixes: 143e7ab4d9a0 ("media: chips-media: wave5: support decoding HEVC Main10 profile")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson.lee 
Signed-off-by: Nas Chung 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Sebastian Fricke 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: chips-media: wave5: Fix a hang after seeking

2025-04-20T08:22:54+00:00

commit a2c75e964e51b096e9fe6adfa3eaed53594a668b upstream.

While seeking, the driver calls the flush command. Before the flush
command is sent to the VPU, the driver should handle the display buffer
flags and should get all decoded information from the VPU if the VCORE
is running.

Fixes: 9707a6254a8a ("media: chips-media: wave5: Add the v4l2 layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson.lee 
Signed-off-by: Nas Chung 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Sebastian Fricke 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: chips-media: wave5: Avoid race condition in the interrupt handler

2025-04-20T08:22:54+00:00

commit ac35f768986610480a1c01323d9cf9f5eaf3ee9b upstream.

In case of multiple active instances, new interrupts can occur as soon
as the current interrupt is cleared. If the driver reads the
instance_info after clearing the interrupt, then there is no guarantee,
that the instance_info is still valid for the current interrupt.

Read the instance_info register for each interrupt before clearing the
interrupt.

Fixes: ed7276ed2fd0 ("media: chips-media: wave5: Add hrtimer based polling support")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson.lee 
Signed-off-by: Nas Chung 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Sebastian Fricke 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: chips-media: wave5: Fix gray color on screen

2025-04-20T08:22:54+00:00

commit 6bae4d5053da634eecb611118e7cd91a677a4bbf upstream.

When a decoder instance is created, the W5_CMD_ERR_CONCEAL register
should be initialized to 0. Otherwise, gray color is occasionally
displayed on the screen while decoding.

Fixes: 45d1a2b93277 ("media: chips-media: wave5: Add vpuapi layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson.lee 
Signed-off-by: Nas Chung 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Sebastian Fricke 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: venus: hfi_parser: refactor hfi packet parsing logic

2025-04-20T08:22:53+00:00

commit 9edaaa8e3e15aab1ca413ab50556de1975bcb329 upstream.

words_count denotes the number of words in total payload, while data
points to payload of various property within it. When words_count
reaches last word, data can access memory beyond the total payload. This
can lead to OOB access. With this patch, the utility api for handling
individual properties now returns the size of data consumed. Accordingly
remaining bytes are calculated before parsing the payload, thereby
eliminates the OOB access possibilities.

Cc: stable@vger.kernel.org
Fixes: 1a73374a04e5 ("media: venus: hfi_parser: add common capability parser")
Signed-off-by: Vikash Garodia 
Reviewed-by: Bryan O'Donoghue 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman