linux-stable.git/drivers/media/platform, branch linux-rolling-lts

media: nxp: imx8-isi: Fix use-after-free on remove

2026-07-24T14:17:22+00:00

[ Upstream commit b670bf89824ede5d07d20bb9bfbafb754846081d ]

KASAN reports a slab-use-after-free in __media_entity_remove_link()
during rmmod of imx8_isi:

  BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650
  Read of size 2 at addr ffff0000d47cb02a by task rmmod/724

  Call trace:
   __media_entity_remove_link+0x608/0x650
   __media_entity_remove_links+0x78/0x144
   __media_device_unregister_entity+0x150/0x280
   media_device_unregister_entity+0x48/0x68
   v4l2_device_unregister_subdev+0x158/0x300
   v4l2_async_unbind_subdev_one+0x22c/0x358
   v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0
   v4l2_async_nf_unregister+0x5c/0x14c
   mxc_isi_remove+0x124/0x2a0 [imx8_isi]

  Allocated by task 249:
   __kmalloc_noprof+0x27c/0x690
   mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]

  Freed by task 724:
   kfree+0x1e4/0x5b0
   mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi]
   mxc_isi_remove+0x11c/0x2a0 [imx8_isi]

The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup()
before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media
entity pads, but the subsequent v4l2 cleanup still tries to remove
media links that reference those pads.

Fix this by calling mxc_isi_v4l2_cleanup() before
mxc_isi_crossbar_cleanup() to ensure all media entities are properly
unregistered while the pads are still valid.

Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaolei Wang 
Reviewed-by: Frank Li 
Reviewed-by: Laurent Pinchart 
Link: https://patch.msgid.link/20260507041318.491594-2-xiaolei.wang@windriver.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code

2026-07-24T14:17:21+00:00

[ Upstream commit 078161dd44d6f848a62a473206d69025607736ec ]

Use devm_pm_runtime_enable() to simplify code. Change to use
dev_err_probe() because previous goto change to return.

No functional change.

Signed-off-by: Frank Li 
Reviewed-by: Laurent Pinchart 
Link: https://patch.msgid.link/20260116-cam_cleanup-v4-2-29ce01640443@nxp.com
Signed-off-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil 
Stable-dep-of: b670bf89824e ("media: nxp: imx8-isi: Fix use-after-free on remove")
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

media: qcom: venus: relax encoder frame/blur step size on v6

2026-07-24T14:15:56+00:00

[ Upstream commit c53e0550288b2e08b984b24035c471941b7820c7 ]

Encoder HFI capabilities on v6 enforce a 16-pixel step for frame and blur
dimensions, which does not reflect actual hardware requirements and can
reject valid userspace configurations.

Relax the step size to 1 while leaving min/max limits unchanged.

Fixes: 869d77e706290 ("media: venus: hfi_plat_v6: Populate capabilities for v6")
Signed-off-by: Renjiang Han 
Reviewed-by: Dikshita Agarwal 
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Sasha Levin

media: qcom: venus: relax encoder frame/blur dimension steps on v4

2026-07-24T14:15:56+00:00

[ Upstream commit 35428ae3a6a40912f1f7b47bb6c65f1a63d0b8f8 ]

Encoder HFI capabilities on v4 advertise a 16-pixel step for frame and
blur dimensions. This is overly restrictive and can cause userspace caps
negotiation to fail even for valid resolutions.

Relax the advertised step size to 1 and keep alignment enforcement in
buffer layout and size calculations.

Fixes: 8b88cabef404e ("media: venus: hfi_plat_v4: Populate codecs and capabilities for v4")
Signed-off-by: Renjiang Han 
Reviewed-by: Dikshita Agarwal 
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Sasha Levin

media: qcom: venus: drop extra padding in NV12 raw size calculation

2026-07-24T14:15:56+00:00

[ Upstream commit e1c9adabb268cc5d56723b7df1da49e59070f309 ]

get_framesize_raw_nv12() currently adds SZ_4K to the UV plane size and an
additional SZ_8K to the total buffer size. This inflates the calculated
sizeimage and leads userspace to over-allocate buffers without a clear
requirement.

Remove the extra SZ_4K/SZ_8K padding and compute the NV12 size as the sum
of Y and UV planes, keeping the final ALIGN(size, SZ_4K) intact.

Fixes: e1cb72de702ad ("media: venus: helpers: move frame size calculations on common place")
Signed-off-by: Renjiang Han 
Reviewed-by: Dikshita Agarwal 
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Sasha Levin

Revert "media: venus: hfi_platform: Correct supported codecs for sc7280"

2026-07-24T14:15:56+00:00

[ Upstream commit 3eb9ba0da0ab73e135f93ffccf07381ba11f100e ]

This reverts commit c0ab2901fc68 ("media: venus: hfi_platform: Correct
supported codecs for sc7280"). The codecs might be deprecated, but they
still work (somewhat) perfectly and don't cause any issues with the rest
of the system. Reenable VP8 codecs by reverting the offending commit.

Tested with fluster:

|Test|FFmpeg-VP8-v4l2m2m|GStreamer-VP8-V4L2|
|TOTAL|50/61|50/61|
|TOTAL TIME|12.171s|11.824s|

Fixes: c0ab2901fc68 ("media: venus: hfi_platform: Correct supported codecs for sc7280")
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Sasha Levin

media: rockchip: rga: fix too small buffer size

2026-07-24T14:15:50+00:00

[ Upstream commit 65017e26c065d1240b0512c15867ef1128034fd8 ]

Fix the command buffer size being only a quarter of the actual size.
The RGA_CMDBUF_SIZE macro was potentially intended to specify the length
of the cmdbuf u32 array pointer. But as it's used to specify the size of
the allocation, which is counted in bytes. Therefore adjust the macro
size to bytes as it better matches the variable name and adjust it's
users accordingly.

As the command buffer is relatively small, it probably didn't caused
an issue due to being smaller than a single page.

Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Sven Püschel 
Signed-off-by: Nicolas Dufresne 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: venus: scale MMCX power domain on SM8250

2026-07-24T14:15:47+00:00

[ Upstream commit f45fd3dbb5f6d60a8b31d5cc4affaf1ef40163b3 ]

On SM8250 most of the video clocks are powered by the MMCX domain, while
the PLL is powered on by the MX domain. Extend the driver to support
scaling both power domains, while keeping compatibility with the
existing DTs, which define only the MX domain.

Fixes: 0aeabfa29a9c ("media: venus: core: add sm8250 DT compatible and resource data")
Reviewed-by: Bryan O'Donoghue 
Reviewed-by: Dikshita Agarwal 
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Sasha Levin

media: iris: scale MMCX power domain on SM8250

2026-07-24T14:15:47+00:00

[ Upstream commit 4170e2f25ce40b69f3827fcdabf395380095e136 ]

On SM8250 most of the video clocks are powered by the MMCX domain, while
the PLL is powered on by the MX domain. Extend the driver to support
scaling both power domains, while keeping compatibility with the
existing DTs, which define only the MX domain.

Fixes: 79865252acb6 ("media: iris: enable video driver probe of SM8250 SoC")
Reviewed-by: Dikshita Agarwal 
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Sasha Levin

media: qcom: camss: vfe: fix PIX subdev naming on VFE lite

2026-07-24T14:15:47+00:00

[ Upstream commit c97e797a64cdfe4acecff831b4285418d2815893 ]

VFE lite hardware does not provide a functional PIX path, but after
the per sub-device type resource changes the PIX subdev name is still
assigned unconditionally.

Only assign the PIX subdev name on non-lite VFE variants to avoid
exposing a misleading device name.

Fixes: ae44829a4a97 ("media: qcom: camss: Add per sub-device type resources")
Signed-off-by: Wenmeng Liu 
Reviewed-by: Bryan O'Donoghue 
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Sasha Levin