linux-stable.git/drivers/media, branch v5.16.2

media: uvcvideo: fix division by zero at stream start

2022-01-20T08:12:21+00:00

commit 8aa637bf6d70d2fb2ad4d708d8b9dd02b1c095df upstream.

Add the missing bulk-endpoint max-packet sanity check to
uvc_video_start_transfer() to avoid division by zero in
uvc_alloc_urb_buffers() in case a malicious device has broken
descriptors (or when doing descriptor fuzz testing).

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
Cc: stable@vger.kernel.org      # 2.6.26
Signed-off-by: Johan Hovold 
Reviewed-by: Kieran Bingham 
Signed-off-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

media: Revert "media: uvcvideo: Set unique vdev name based in type"

2022-01-16T08:11:14+00:00

commit f66dcb32af19faf49cc4a9222c3152b10c6ec84a upstream.

A lot of userspace depends on a descriptive name for vdev. Without this
patch, users have a hard time figuring out which camera shall they use
for their video conferencing.

This reverts commit e3f60e7e1a2b451f538f9926763432249bcf39c4.

Link: https://lore.kernel.org/linux-media/20211207003840.1212374-2-ribalda@chromium.org
Cc: 
Fixes: e3f60e7e1a2b ("media: uvcvideo: Set unique vdev name based in type")
Reported-by: Nicolas Dufresne 
Signed-off-by: Ricardo Ribalda 
Reviewed-by: Laurent Pinchart 
Reviewed-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'media/v5.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2021-11-22T22:58:57+00:00

Pull media fixes from Mauro Carvalho Chehab:

 - fix VIDIOC_DQEVENT ioctl handling for 32-bit userspace with a 64-bit
   kernel

 - regression fix for videobuf2 core

 - fix for CEC core when handling non-block transmit

 - hi846: fix a clang warning

* tag 'media/v5.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: hi846: remove the of_match_ptr macro
  media: hi846: include property.h instead of of_graph.h
  media: cec: copy sequence field for the reply
  media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference
  media: v4l2-core: fix VIDIOC_DQEVENT handling on non-x86

media: hi846: remove the of_match_ptr macro

2021-11-19T05:56:07+00:00

Similar to other drivers, this should fix a Clang compilar warning when
building without CONFIG_OF in which case of_match_ptr() is NULL and
the const struct we would use otherwise is unused.

Signed-off-by: Martin Kepplinger 
Reported-by: kernel test robot 
Signed-off-by: Sakari Ailus 
Signed-off-by: Mauro Carvalho Chehab

media: hi846: include property.h instead of of_graph.h

2021-11-19T05:55:45+00:00

Include the more portable property.h instead of the OF specific of_graph.h

Signed-off-by: Martin Kepplinger 
Signed-off-by: Sakari Ailus 
Signed-off-by: Mauro Carvalho Chehab

Merge tag 'acpi-5.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2021-11-10T19:52:40+00:00

Pull more ACPI updates from Rafael Wysocki:
 "These add support for a new ACPI device configuration object called
  _DSC, fix some issues including one recent regression, add two new
  items to quirk lists and clean up assorted pieces of code.

  Specifics:

   - Add support for new ACPI device configuration object called _DSC
     ("Deepest State for Configuration") to allow certain devices to be
     probed without changing their power states, document it and make
     two drivers use it (Sakari Ailus, Rajmohan Mani).

   - Fix device wakeup power reference counting broken recently by
     mistake (Rafael Wysocki).

   - Drop unused symbol and macros depending on it from acgcc.h (Rafael
     Wysocki).

   - Add HP ZHAN 66 Pro to the "no EC wakeup" quirk list (Binbin Zhou).

   - Add Xiaomi Mi Pad 2 to the backlight quirk list and drop an unused
     piece of data from all of the list entries (Hans de Goede).

   - Fix register read accesses handling in the Intel PMIC operation
     region driver (Hans de Goede).

   - Clean up static variables initialization in the EC driver
     (wangzhitong)"

* tag 'acpi-5.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Documentation: ACPI: Fix non-D0 probe _DSC object example
  ACPI: Drop ACPI_USE_BUILTIN_STDARG ifdef from acgcc.h
  ACPI: PM: Fix device wakeup power reference counting error
  ACPI: video: use platform backlight driver on Xiaomi Mi Pad 2
  ACPI: video: Drop dmi_system_id.ident settings from video_detect_dmi_table[]
  ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
  ACPI: EC: Remove initialization of static variables to false
  ACPI: EC: Use ec_no_wakeup on HP ZHAN 66 Pro
  at24: Support probing while in non-zero ACPI D state
  media: i2c: imx319: Support device probe in non-zero ACPI D state
  ACPI: Add a convenience function to tell a device is in D0 state
  Documentation: ACPI: Document _DSC object usage for enum power state
  i2c: Allow an ACPI driver to manage the device's power state during probe
  ACPI: scan: Obtain device's desired enumeration power state

media: cec: copy sequence field for the reply

2021-11-10T11:39:08+00:00

When the reply for a non-blocking transmit arrives, the sequence
field for that reply was never filled in, so userspace would have no
way of associating the reply to the original transmit.

Copy the sequence field to ensure that this is now possible.

Signed-off-by: Hans Verkuil 
Fixes: 0dbacebede1e ([media] cec: move the CEC framework out of staging and to media)
Cc: 
Signed-off-by: Mauro Carvalho Chehab

media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference

2021-11-10T11:38:48+00:00

Commit a4b83deb3e76 ("media: videobuf2: rework vb2_mem_ops API")
added a new vb member to struct vb2_dma_sg_buf, but it only added
code setting this to the vb2_dma_sg_alloc() function and not to the
vb2_dma_sg_get_userptr() and vb2_dma_sg_attach_dmabuf() which also
create vb2_dma_sg_buf objects.

This is causing a crash due to a NULL pointer deref when using
libcamera on devices with an Intel IPU3 (qcam app).

Fix these crashes by assigning buf->vb in the other 2 functions too,
note libcamera tests the vb2_dma_sg_get_userptr() path, the change
to the vb2_dma_sg_attach_dmabuf() path is untested.

Fixes: a4b83deb3e76 ("media: videobuf2: rework vb2_mem_ops API")
Cc: Sergey Senozhatsky 
Signed-off-by: Hans de Goede 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: v4l2-core: fix VIDIOC_DQEVENT handling on non-x86

2021-11-10T11:38:26+00:00

My previous bugfix addressed an API inconsistency found by syzbot,
and it correctly fixed the issue on x86-64 machines, which now behave
correctly for both native and compat tasks.

Unfortunately, John found that the patch broke compat mode on all other
architectures, as they can no longer rely on the VIDIOC_DQEVENT_TIME32
code from the native handler as a fallback in the compat code.

The best way I can see for addressing this is to generalize the
VIDIOC_DQEVENT32_TIME32 code from x86 and use that for all architectures,
leaving only the VIDIOC_DQEVENT32 variant as x86 specific. The original
code was trying to be clever and use the same conversion helper for native
32-bit code and compat mode, but that turned out to be too obscure so
even I missed that bit I had introduced myself when I made the fix.

Fixes: c344f07aa1b4 ("media: v4l2-core: ignore native time32 ioctls on 64-bit")
Reported-by: John Stultz 
Signed-off-by: Arnd Bergmann 
Tested-by: John Stultz 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

Merge branch 'akpm' (patches from Andrew)

2021-11-09T18:11:53+00:00

Merge more updates from Andrew Morton:
 "87 patches.

  Subsystems affected by this patch series: mm (pagecache and hugetlb),
  procfs, misc, MAINTAINERS, lib, checkpatch, binfmt, kallsyms, ramfs,
  init, codafs, nilfs2, hfs, crash_dump, signals, seq_file, fork,
  sysvfs, kcov, gdb, resource, selftests, and ipc"

* emailed patches from Andrew Morton : (87 commits)
  ipc/ipc_sysctl.c: remove fallback for !CONFIG_PROC_SYSCTL
  ipc: check checkpoint_restore_ns_capable() to modify C/R proc files
  selftests/kselftest/runner/run_one(): allow running non-executable files
  virtio-mem: disallow mapping virtio-mem memory via /dev/mem
  kernel/resource: disallow access to exclusive system RAM regions
  kernel/resource: clean up and optimize iomem_is_exclusive()
  scripts/gdb: handle split debug for vmlinux
  kcov: replace local_irq_save() with a local_lock_t
  kcov: avoid enable+disable interrupts if !in_task()
  kcov: allocate per-CPU memory on the relevant node
  Documentation/kcov: define `ip' in the example
  Documentation/kcov: include types.h in the example
  sysv: use BUILD_BUG_ON instead of runtime check
  kernel/fork.c: unshare(): use swap() to make code cleaner
  seq_file: fix passing wrong private data
  seq_file: move seq_escape() to a header
  signal: remove duplicate include in signal.h
  crash_dump: remove duplicate include in crash_dump.h
  crash_dump: fix boolreturn.cocci warning
  hfs/hfsplus: use WARN_ON for sanity check
  ...