linux-stable.git/drivers/media, branch linux-6.13.y

media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster

2025-04-20T08:18:04+00:00

commit 035371c9e5098018b8512efc6a8812912469480c upstream.

The Wave5 521C variant does not support 10 bit decoding. When 10 bit
decoding support was added for the 515 variant, a section of the code
was removed which returned an error. This removal causes a timeout for
the 521 variant, which was discovered during HEVC 10-bit decoding tests.

Fixes: 143e7ab4d9a0 ("media: chips-media: wave5: support decoding HEVC Main10 profile")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson.lee 
Signed-off-by: Nas Chung 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Sebastian Fricke 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: chips-media: wave5: Fix a hang after seeking

2025-04-20T08:18:04+00:00

commit a2c75e964e51b096e9fe6adfa3eaed53594a668b upstream.

While seeking, the driver calls the flush command. Before the flush
command is sent to the VPU, the driver should handle the display buffer
flags and should get all decoded information from the VPU if the VCORE
is running.

Fixes: 9707a6254a8a ("media: chips-media: wave5: Add the v4l2 layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson.lee 
Signed-off-by: Nas Chung 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Sebastian Fricke 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: chips-media: wave5: Avoid race condition in the interrupt handler

2025-04-20T08:18:04+00:00

commit ac35f768986610480a1c01323d9cf9f5eaf3ee9b upstream.

In case of multiple active instances, new interrupts can occur as soon
as the current interrupt is cleared. If the driver reads the
instance_info after clearing the interrupt, then there is no guarantee,
that the instance_info is still valid for the current interrupt.

Read the instance_info register for each interrupt before clearing the
interrupt.

Fixes: ed7276ed2fd0 ("media: chips-media: wave5: Add hrtimer based polling support")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson.lee 
Signed-off-by: Nas Chung 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Sebastian Fricke 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: chips-media: wave5: Fix gray color on screen

2025-04-20T08:18:04+00:00

commit 6bae4d5053da634eecb611118e7cd91a677a4bbf upstream.

When a decoder instance is created, the W5_CMD_ERR_CONCEAL register
should be initialized to 0. Otherwise, gray color is occasionally
displayed on the screen while decoding.

Fixes: 45d1a2b93277 ("media: chips-media: wave5: Add vpuapi layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson.lee 
Signed-off-by: Nas Chung 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Sebastian Fricke 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: i2c: imx214: Rectify probe error handling related to runtime PM

2025-04-20T08:18:04+00:00

commit ccc888d1698b6f42d52ddf5cecfe50fe925c95e5 upstream.

There were multiple issues in the driver's probe function related to
error handling:

- Device's PM runtime status wasn't reverted to suspended on some errors
  in probe.

- Runtime PM was left enabled for the device on some probe errors.

- Device was left powered on if a probe failure happened or when it
  was removed when it was powered on.

- An extra pm_runtime_set_suspended() was issued in driver's remove
  function when the device was suspended.

Fix these bugs.

Fixes: 436190596241 ("media: imx214: Add imx214 camera sensor driver")
Cc: stable@vger.kernel.org # for >= v6.12
Signed-off-by: Sakari Ailus 
Acked-by: André Apitzsch 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: i2c: imx219: Rectify runtime PM handling in probe and remove

2025-04-20T08:18:03+00:00

commit 42eceae9793566d0df53d509be3e416465c347f5 upstream.

Set the device's runtime PM status and enable runtime PM before
registering the async sub-device. This is needed to avoid the case where
the device is runtime PM resumed while runtime PM has not been enabled
yet.

Also set the device's runtime PM status to suspended in remove only if it
wasn't so already.

Fixes: 1283b3b8f82b ("media: i2c: Add driver for Sony IMX219 sensor")
Cc: stable@vger.kernel.org # for >= v6.6
Reviewed-by: Bingbu Cao 
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: i2c: imx319: Rectify runtime PM handling probe and remove

2025-04-20T08:18:03+00:00

commit 5f5ffd3bc62b2e6c478061918b10473d8b90ac2d upstream.

Idle the device only after the async sub-device has been successfully
registered. In error handling, set the device's runtime PM status to
suspended only if it has been set to active previously in probe.

Also set the device's runtime PM status to suspended in remove only if it
wasn't so already.

Fixes: 8a89dc62f28c ("media: add imx319 camera sensor driver")
Cc: stable@vger.kernel.org # for >= v6.12
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: venus: hfi_parser: refactor hfi packet parsing logic

2025-04-20T08:18:03+00:00

commit 9edaaa8e3e15aab1ca413ab50556de1975bcb329 upstream.

words_count denotes the number of words in total payload, while data
points to payload of various property within it. When words_count
reaches last word, data can access memory beyond the total payload. This
can lead to OOB access. With this patch, the utility api for handling
individual properties now returns the size of data consumed. Accordingly
remaining bytes are calculated before parsing the payload, thereby
eliminates the OOB access possibilities.

Cc: stable@vger.kernel.org
Fixes: 1a73374a04e5 ("media: venus: hfi_parser: add common capability parser")
Signed-off-by: Vikash Garodia 
Reviewed-by: Bryan O'Donoghue 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: venus: hfi_parser: add check to avoid out of bound access

2025-04-20T08:18:03+00:00

commit 172bf5a9ef70a399bb227809db78442dc01d9e48 upstream.

There is a possibility that init_codecs is invoked multiple times during
manipulated payload from video firmware. In such case, if codecs_count
can get incremented to value more than MAX_CODEC_NUM, there can be OOB
access. Reset the count so that it always starts from beginning.

Cc: stable@vger.kernel.org
Fixes: 1a73374a04e5 ("media: venus: hfi_parser: add common capability parser")
Reviewed-by: Bryan O'Donoghue 
Signed-off-by: Vikash Garodia 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: nuvoton: Fix reference handling of ece_pdev

2025-04-20T08:18:03+00:00

commit 453d5cadab1bde8e6fdd5bd05f4200338cb21e72 upstream.

When we obtain a reference to of a platform_device, we need to release
it via put_device.

Found by cocci:
./platform/nuvoton/npcm-video.c:1677:3-9: ERROR: missing put_device; call of_find_device_by_node on line 1667, but without a corresponding object release within this function.
./platform/nuvoton/npcm-video.c:1684:3-9: ERROR: missing put_device; call of_find_device_by_node on line 1667, but without a corresponding object release within this function.
./platform/nuvoton/npcm-video.c:1690:3-9: ERROR: missing put_device; call of_find_device_by_node on line 1667, but without a corresponding object release within this function.
./platform/nuvoton/npcm-video.c:1694:1-7: ERROR: missing put_device; call of_find_device_by_node on line 1667, but without a corresponding object release within this function.

Instead of manually calling put_device, use the __free macros.

Cc: stable@vger.kernel.org
Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine")
Signed-off-by: Ricardo Ribalda 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman