linux-stable.git/drivers/media, branch v6.0

Merge tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2022-10-01T16:27:18+00:00

Pull media fixes from Mauro Carvalho Chehab:

 - some fixes for the v4l2 ioctl handler logic

 - a fix for an out of bound access in the DVB videobuf2 handler

 - three driver fixes (rkvdec, mediatek/vcodek and uvcvideo)

* tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: rkvdec: Disable H.264 error detection
  media: mediatek: vcodec: Drop platform_get_resource(IORESOURCE_IRQ)
  media: dvb_vb2: fix possible out of bound access
  media: v4l2-ioctl.c: fix incorrect error path
  media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args()
  media: uvcvideo: Fix InterfaceProtocol for Quanta camera

media: mediatek: vcodec: Drop platform_get_resource(IORESOURCE_IRQ)

2022-09-27T08:24:44+00:00

Commit a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource
from DT core") removed support for calling platform_get_resource(...,
IORESOURCE_IRQ, ...) on DT-based drivers, but the probe() function of
mtk-vcodec's encoder was still making use of it. This caused the encoder
driver to fail probe.

Since the platform_get_resource() call was only being used to check for
the presence of the interrupt (its returned resource wasn't even used)
and platform_get_irq() was already being used to get the IRQ, simply
drop the use of platform_get_resource(IORESOURCE_IRQ) and handle the
failure of platform_get_irq(), to get the driver probing again.

[hverkuil: drop unused struct resource *res]

Fixes: a1a2b7125e10 ("of/platform: Drop static setup of IRQ resource from DT core")
Signed-off-by: Nícolas F. R. A. Prado 
Reviewed-by: AngeloGioacchino Del Regno 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: dvb_vb2: fix possible out of bound access

2022-09-27T08:24:44+00:00

vb2_core_qbuf and vb2_core_querybuf don't check the range of b->index
controlled by the user.

Fix this by adding range checking code before using them.

Fixes: 57868acc369a ("media: videobuf2: Add new uAPI for DVB streaming I/O")
Signed-off-by: Hangyu Hua 
Reviewed-by: Sergey Senozhatsky 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: v4l2-ioctl.c: fix incorrect error path

2022-09-27T08:24:43+00:00

If allocating array_buf fails, or copying data from userspace into that
buffer fails, then just free memory and return the error. Don't attempt
to call video_put_user() since there is no point, and it would copy back
data on error even if INFO_FL_ALWAYS_COPY wasn't set.

So if writing the array back to userspace fails, then don't go to
out_array_args, instead just continue with the regular code that just
returns the error unless 'always_copy' is set.

Update the VIDIOC_G/S/TRY_EXT_CTRLS ioctls to set the ALWAYS_COPY flag
since they now need it. Before this worked due to this buggy code, but
now that that is fixed these ioctls need to set this flag explicitly.

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args()

2022-09-27T08:24:43+00:00

The v4l2_compat_get_array_args() function can leave uninitialized memory in the
buffer it is passed. So zero it before copying array elements from userspace
into the buffer.

Signed-off-by: Hans Verkuil 
Reported-by: syzbot+ff18193ff05f3f87f226@syzkaller.appspotmail.com
Reviewed-by: Laurent Pinchart 
Signed-off-by: Mauro Carvalho Chehab

media: flexcop-usb: fix endpoint type check

2022-09-22T08:40:57+00:00

Commit d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint
type") tried to add an endpoint type sanity check for the single
isochronous endpoint but instead broke the driver by checking the wrong
descriptor or random data beyond the last endpoint descriptor.

Make sure to check the right endpoint descriptor.

Fixes: d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type")
Cc: Oliver Neukum 
Cc: stable@vger.kernel.org	# 5.9
Reported-by: Dongliang Mu 
Signed-off-by: Johan Hovold 
Link: https://lore.kernel.org/r/20220822151027.27026-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman

media: uvcvideo: Fix InterfaceProtocol for Quanta camera

2022-08-31T08:19:47+00:00

The Quanta 0408:4034 camera implements UVC 1.5, and thus sets
bInterfaceProtocol to UVC_PC_PROTOCOL_15. Commit 95f03d973478 ("media:
uvcvideo: Limit power line control for Quanta cameras") added a quirk
for the device that incorrectly specified the UVC 1.0 protocol,
rendering the quirk inoperative. Fix it.

Link: https://lore.kernel.org/linux-media/20220822131754.102393-1-ribalda@chromium.org
Fixes: 95f03d973478 ("media: uvcvideo: Limit power line control for Quanta cameras")
Reviewed-by: Laurent Pinchart 
Signed-off-by: Ricardo Ribalda 
Signed-off-by: Mauro Carvalho Chehab

media: mceusb: Use new usb_control_msg_*() routines

2022-08-30T13:32:07+00:00

Automatic kernel fuzzing led to a WARN about invalid pipe direction in
the mceusb driver:

------------[ cut here ]------------
usb 6-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType 40
WARNING: CPU: 0 PID: 2465 at drivers/usb/core/urb.c:410
usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410
Modules linked in:
CPU: 0 PID: 2465 Comm: kworker/0:2 Not tainted 5.19.0-rc4-00208-g69cb6c6556ad #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410
Code: 7c 24 40 e8 ac 23 91 fd 48 8b 7c 24 40 e8 b2 70 1b ff 45 89 e8
44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 a0 30 a9 86 e8 48 07 11 02 <0f> 0b
e9 1c f0 ff ff e8 7e 23 91 fd 0f b6 1d 63 22 83 05 31 ff 41
RSP: 0018:ffffc900032becf0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881100f3058 RCX: 0000000000000000
RDX: ffffc90004961000 RSI: ffff888114c6d580 RDI: fffff52000657d90
RBP: ffff888105ad90f0 R08: ffffffff812c3638 R09: 0000000000000000
R10: 0000000000000005 R11: ffffed1023504ef1 R12: ffff888105ad9000
R13: 0000000000000040 R14: 0000000080000380 R15: ffff88810ba96500
FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe810bda58 CR3: 000000010b720000 CR4: 0000000000350ef0
Call Trace:

usb_start_wait_urb+0x101/0x4c0 drivers/usb/core/message.c:58
usb_internal_control_msg drivers/usb/core/message.c:102 [inline]
usb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:153
mceusb_gen1_init drivers/media/rc/mceusb.c:1431 [inline]
mceusb_dev_probe+0x258e/0x33f0 drivers/media/rc/mceusb.c:1807

The reason for the warning is clear enough; the driver sends an
unusual read request on endpoint 0 but does not set the USB_DIR_IN bit
in the bRequestType field.

More importantly, the whole situation can be avoided and the driver
simplified by converting it over to the relatively new
usb_control_msg_recv() and usb_control_msg_send() routines.  That's
what this fix does.

Link: https://lore.kernel.org/all/CAB7eexLLApHJwZfMQ=X-PtRhw0BgO+5KcSMS05FNUYejJXqtSA@mail.gmail.com/
Cc: Mauro Carvalho Chehab 
Cc: stable@vger.kernel.org
Reported-and-tested-by: Rondreis 
Signed-off-by: Alan Stern 
Link: https://lore.kernel.org/r/YwkfnBFCSEVC6XZu@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman

Merge tag 'pm-5.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2022-08-08T21:29:00+00:00

Pull more power management updates from Rafael Wysocki:
 "These are ARM cpufreq updates and operating performance points (OPP)
  updates plus one cpuidle update adding a new trace point.

  Specifics:

   - Fix return error code in mtk_cpu_dvfs_info_init (Yang Yingliang).

   - Minor cleanups and support for new boards for Qcom cpufreq drivers
     (Bryan O'Donoghue, Konrad Dybcio, Pierre Gondois, and Yicong Yang).

   - Fix sparse warnings for Tegra cpufreq driver (Viresh Kumar).

   - Make dev_pm_opp_set_regulators() accept NULL terminated list
     (Viresh Kumar).

   - Add dev_pm_opp_set_config() and friends and migrate other users and
     helpers to using them (Viresh Kumar).

   - Add support for multiple clocks for a device (Viresh Kumar and
     Krzysztof Kozlowski).

   - Configure resources before adding OPP table for Venus (Stanimir
     Varbanov).

   - Keep reference count up for opp->np and opp_table->np while they
     are still in use (Liang He).

   - Minor OPP cleanups (Viresh Kumar and Yang Li).

   - Add a trace event for cpuidle to track missed (too deep or too
     shallow) wakeups (Kajetan Puchalski)"

* tag 'pm-5.20-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (55 commits)
  cpuidle: Add cpu_idle_miss trace event
  venus: pm_helpers: Fix warning in OPP during probe
  OPP: Don't drop opp->np reference while it is still in use
  OPP: Don't drop opp_table->np reference while it is still in use
  cpufreq: tegra194: Staticize struct tegra_cpufreq_soc instances
  dt-bindings: cpufreq: cpufreq-qcom-hw: Add SM6375 compatible
  dt-bindings: opp: Add msm8939 to the compatible list
  dt-bindings: opp: Add missing compat devices
  dt-bindings: opp: opp-v2-kryo-cpu: Fix example binding checks
  cpufreq: Change order of online() CB and policy->cpus modification
  cpufreq: qcom-hw: Remove deprecated irq_set_affinity_hint() call
  cpufreq: qcom-hw: Disable LMH irq when disabling policy
  cpufreq: qcom-hw: Reset cancel_throttle when policy is re-enabled
  cpufreq: qcom-cpufreq-hw: use HZ_PER_KHZ macro in units.h
  cpufreq: mediatek: fix error return code in mtk_cpu_dvfs_info_init()
  OPP: Remove dev{m}_pm_opp_of_add_table_noclk()
  PM / devfreq: tegra30: Register config_clks helper
  OPP: Allow config_clks helper for single clk case
  OPP: Provide a simple implementation to configure multiple clocks
  OPP: Assert clk_count == 1 for single clk helpers
  ...

Merge tag 'sound-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

2022-08-06T17:19:51+00:00

Pull sound updates from Takashi Iwai:
 "As the diffstat shows, we've had lots of developments in a wide range
  at this time; the majority of changes are about ASoC, including
  subsystem-wide cleanups, continued SOF / Intel updates and a bunch of
  new drivers (as usual), while there have been some significant (but
  almost invisible) improvements in ALSA core side, too.

  Below are some highlights:

  Core:

   - Faster lookups of control elements with Xarray; normal user won't
     notice, but on the devices with tons of control elements, it can be
     visibly faster

   - Support for input validation for controls; this will harden for
     badly written drivers in general with a slight overhead

   - Deferred async signal handling for working around the potential
     deadlocks

   - Cleanup / refactoring raw MIDI locking code

  ASoC:

   - Restructing of the set_fmt() callbacks for making things clearer in
     situations like CODEC to CODEC links

   - Clean up and modernizing the DAI naming scheme setups

   - Merge of more of the Intel AVS driver stack, including some board
     integrations

   - New version 4 mechanism for communication with SOF DSPs

   - Suppoort for dynamically selecting the PLL to use at runtime on
     i.MX platforms

   - Improvements for CODEC to CODEC support in the generic cards

   - Support for AMD Jadeite and various machines, AMD RPL, Intel
     MetorLake DSPs, Mediatek MT8186 DSPs and MT6366, nVidia Tegra
     MDDRC, OPE and PEQ, NXP TFA9890, Qualcomm SDM845, WCD9335 and
     WAS883x, and Texas Instruments TAS2780

  HD- and USB-audio:

   - Continued improvement for CS35L41 (sub)codec support

   - More quirks for various devices (HP, Lenovo, Dell, Clevo)"

* tag 'sound-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (778 commits)
  ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx
  ALSA: line6: Replace sprintf() with sysfs_emit()
  ALSA: hda: Replace sprintf() with sysfs_emit()
  ALSA: pcm: Replace sprintf() with sysfs_emit()
  ALSA: core: Replace scnprintf() with sysfs_emit()
  ALSA: control-led: Replace sprintf() with sysfs_emit()
  ALSA: aoa: Replace sprintf() with sysfs_emit()
  ALSA: ac97: Replace sprintf() with sysfs_emit()
  ALSA: hda/realtek: Add quirk for Clevo NV45PZ
  ALSA: hda/realtek: Add quirk for Lenovo Yoga9 14IAP7
  ALSA: control: Use deferred fasync helper
  ALSA: pcm: Use deferred fasync helper
  ALSA: timer: Use deferred fasync helper
  ALSA: core: Add async signal helpers
  ASoC: q6asm: use kcalloc() instead of kzalloc()
  ACPI: scan: Add CLSA0101 Laptop Support
  ALSA: hda: cs35l41: Support CLSA0101
  ALSA: hda: cs35l41: Use the CS35L41 HDA internal define
  ASoC: dt-bindings: use spi-peripheral-props.yaml
  ASoC: codecs: va-macro: use fsgen as clock
  ...