linux-stable.git/drivers/media, branch v6.6.53

media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse

2024-09-12T09:11:31+00:00

[ Upstream commit 4caf6d93d9f2c11d6441c64e1c549c445fa322ed ]

Add check for the return value of v4l2_fwnode_endpoint_parse() and
return the error if it fails in order to catch the error.

Signed-off-by: Chen Ni 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: vivid: don't set HDMI TX controls if there are no HDMI outputs

2024-09-12T09:11:31+00:00

[ Upstream commit 17763960b1784578e8fe915304b330922f646209 ]

When setting the EDID it would attempt to update two controls
that are only present if there is an HDMI output configured.

If there isn't any (e.g. when the vivid module is loaded with
node_types=1), then calling VIDIOC_S_EDID would crash.

Fix this by first checking if outputs are present.

Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: vivid: fix wrong sizeimage value for mplane

2024-09-12T09:11:30+00:00

[ Upstream commit 0fd7c0c2c156270dceb8c15fad3120cdce03e539 ]

In several places a division by fmt->vdownsampling[p] was
missing in the sizeimage[p] calculation, causing incorrect
behavior for multiplanar formats were some planes are smaller
than the first plane.

Found by new v4l2-compliance tests.

Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: uvcvideo: Enforce alignment of frame and interval

2024-09-08T05:54:49+00:00

[ Upstream commit c8931ef55bd325052ec496f242aea7f6de47dc9c ]

Struct uvc_frame and interval (u32*) are packaged together on
streaming->formats on a single contiguous allocation.

Right now they are allocated right after uvc_format, without taking into
consideration their required alignment.

This is working fine because both structures have a field with a
pointer, but it will stop working when the sizeof() of any of those
structs is not a multiple of the sizeof(void*).

Enforce that alignment during the allocation.

Signed-off-by: Ricardo Ribalda 
Reviewed-by: Laurent Pinchart 
Link: https://lore.kernel.org/r/20240404-uvc-align-v2-1-9e104b0ecfbd@chromium.org
Signed-off-by: Laurent Pinchart 
Signed-off-by: Sasha Levin

media: v4l2-cci: Always assign *val

2024-09-08T05:54:44+00:00

[ Upstream commit 7417b1b1f36cc214dc458e717278a27a912d3b51 ]

Always assign *val to 0 in cci_read(). This has the benefit of not
requiring initialisation of the variables data is read to using
cci_read(). Once smatch is fixed, it could catch the use of uninitialised
reads.

Signed-off-by: Sakari Ailus 
Tested-by: Benjamin Mugnier 
Reviewed-by: Hans de Goede 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: drivers/media/dvb-core: copy user arrays safely

2024-08-29T15:33:34+00:00

[ Upstream commit 102fb77c2deb0df3683ef8ff7a6f4cf91dc456e2 ]

At several positions in dvb_frontend.c, memdup_user() is utilized to
copy userspace arrays. This is done without overflow checks.

Use the new wrapper memdup_array_user() to copy the arrays more safely.

Link: https://lore.kernel.org/linux-media/20231102191633.52592-2-pstanner@redhat.com
Suggested-by: Dave Airlie 
Signed-off-by: Philipp Stanner 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: pci: cx23885: check cx23885_vdev_init() return

2024-08-29T15:33:33+00:00

[ Upstream commit 15126b916e39b0cb67026b0af3c014bfeb1f76b3 ]

cx23885_vdev_init() can return a NULL pointer, but that pointer
is used in the next line without a check.

Add a NULL pointer check and go to the error unwind if it is NULL.

Signed-off-by: Hans Verkuil 
Reported-by: Sicong Huang 
Signed-off-by: Sasha Levin

media: qcom: venus: fix incorrect return value

2024-08-29T15:33:27+00:00

[ Upstream commit 51b74c09ac8c5862007fc2bf0d465529d06dd446 ]

'pd' can be NULL, and in that case it shouldn't be passed to
PTR_ERR. Fixes a smatch warning:

drivers/media/platform/qcom/venus/pm_helpers.c:873 vcodec_domains_get() warn: passing zero to 'PTR_ERR'

Signed-off-by: Hans Verkuil 
Reviewed-by: Bryan O'Donoghue 
Signed-off-by: Sasha Levin

media: s5p-mfc: Fix potential deadlock on condlock

2024-08-29T15:33:26+00:00

[ Upstream commit 04d19e65137e3cd4a5004e624c85c762933d115c ]

As &dev->condlock is acquired under irq context along the following
call chain from s5p_mfc_irq(), other acquisition of the same lock
inside process context or softirq context should disable irq avoid double
lock. enc_post_frame_start() seems to be one such function that execute
under process context or softirq context.



enc_post_frame_start()
--> clear_work_bit()
--> spin_loc(&dev->condlock)

   --> s5p_mfc_irq()
   --> s5p_mfc_handle_frame()
   --> clear_work_bit()
   --> spin_lock(&dev->condlock)

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

To prevent the potential deadlock, the patch change clear_work_bit()
inside enc_post_frame_start() to clear_work_bit_irqsave().

Signed-off-by: Chengfeng Ye 
Acked-by: Marek Szyprowski 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: radio-isa: use dev_name to fill in bus_info

2024-08-29T15:33:25+00:00

[ Upstream commit 8b7f3cf4eb9a95940eaabad3226caeaa0d9aa59d ]

This fixes this warning:

drivers/media/radio/radio-isa.c: In function 'radio_isa_querycap':
drivers/media/radio/radio-isa.c:39:57: warning: '%s' directive output may be truncated writing up to 35 bytes into a region of size 28 [-Wformat-truncation=]
   39 |         snprintf(v->bus_info, sizeof(v->bus_info), "ISA:%s", isa->v4l2_dev.name);
      |                                                         ^~
drivers/media/radio/radio-isa.c:39:9: note: 'snprintf' output between 5 and 40 bytes into a destination of size 32
   39 |         snprintf(v->bus_info, sizeof(v->bus_info), "ISA:%s", isa->v4l2_dev.name);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin