linux.git/drivers/staging/media/atomisp, branch v6.17 Linux kernel source tree Merge tag 'media/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 2025-07-31T20:16:09+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-07-31T20:16:09+00:00 0cdee263bc5e7b20f657ea09f9272f50c568f35b Pull media updates from Mauro Carvalho Chehab: - v4l2 core: - sub-device framework routing improvements - NV12M tiled variants added to v4l2_format_info - some fixes at control handler freeing logic - fixed H264 SEPARATE_COLOUR_PLANE check - new staging driver: Intel IPU7 PCI - Rockchip video decoder driver got promoted from staging - iris: added HEVC/VP9 encoder/decoder support - vsp1: driver has gained Renesas VSPX support - uvc: - switched to vb2 ioctl helpers - added MSXU 1.5 metadata support - atomisp: GC0310 sensor driver cleanups in preparation for moving it out of staging - Lots of cleanup, fixes and improvements * tag 'media/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (310 commits) media: rkvdec: Unstage the driver media: rkvdec: Remove TODO file media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings media: amphion: Support dmabuf and v4l2 buffer without binding media: verisilicon: postproc: 4K support media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() media: uvcvideo: Use a count variable for meta_formats instead of 0 terminating media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META media: uvcvideo: Introduce V4L2_META_FMT_UVC_MSXU_1_5 media: uvcvideo: Introduce dev->meta_formats media: Documentation: Add note about UVCH length field media: uvcvideo: Do not mark valid metadata as invalid media: uvcvideo: uvc_v4l2_unlocked_ioctl: Invert PM logic media: core: export v4l2_translate_cmd media: uvcvideo: Turn on the camera if V4L2_EVENT_SUB_FL_SEND_INITIAL media: uvcvideo: Remove stream->is_streaming field media: uvcvideo: Split uvc_stop_streaming() media: uvcvideo: Handle locks in uvc_queue_return_buffers media: uvcvideo: Use vb2 ioctl and fop helpers ... 
Pull media updates from Mauro Carvalho Chehab:

 - v4l2 core:
     - sub-device framework routing improvements
     - NV12M tiled variants added to v4l2_format_info
     - some fixes at control handler freeing logic
     - fixed H264 SEPARATE_COLOUR_PLANE check

 - new staging driver: Intel IPU7 PCI

 - Rockchip video decoder driver got promoted from staging

 - iris: added HEVC/VP9 encoder/decoder support

 - vsp1: driver has gained Renesas VSPX support

 - uvc:
     - switched to vb2 ioctl helpers
     - added MSXU 1.5 metadata support

 - atomisp: GC0310 sensor driver cleanups in preparation for moving it
   out of staging

 - Lots of cleanup, fixes and improvements

* tag 'media/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (310 commits)
  media: rkvdec: Unstage the driver
  media: rkvdec: Remove TODO file
  media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings
  media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings
  media: amphion: Support dmabuf and v4l2 buffer without binding
  media: verisilicon: postproc: 4K support
  media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
  media: uvcvideo: Use a count variable for meta_formats instead of 0 terminating
  media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META
  media: uvcvideo: Introduce V4L2_META_FMT_UVC_MSXU_1_5
  media: uvcvideo: Introduce dev->meta_formats
  media: Documentation: Add note about UVCH length field
  media: uvcvideo: Do not mark valid metadata as invalid
  media: uvcvideo: uvc_v4l2_unlocked_ioctl: Invert PM logic
  media: core: export v4l2_translate_cmd
  media: uvcvideo: Turn on the camera if V4L2_EVENT_SUB_FL_SEND_INITIAL
  media: uvcvideo: Remove stream->is_streaming field
  media: uvcvideo: Split uvc_stop_streaming()
  media: uvcvideo: Handle locks in uvc_queue_return_buffers
  media: uvcvideo: Use vb2 ioctl and fop helpers
  ...
staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() 2025-07-29T00:48:41+00:00 Kees Cook kees@kernel.org 2025-07-24T08:08:05+00:00 ee4cf798202d285dcbe85e4467a094c44f5ed8e6 When gmin_get_config_var() calls efi.get_variable() and the EFI variable is larger than the expected buffer size, two behaviors combine to create a stack buffer overflow: 1. gmin_get_config_var() does not return the proper error code when efi.get_variable() fails. It returns the stale 'ret' value from earlier operations instead of indicating the EFI failure. 2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates *out_len to the required buffer size but writes no data to the output buffer. However, due to bug #1, gmin_get_var_int() believes the call succeeded. The caller gmin_get_var_int() then performs: - Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack - Calls gmin_get_config_var(dev, is_gmin, var, val, &len) with len=64 - If EFI variable is >64 bytes, efi.get_variable() sets len=required_size - Due to bug #1, thinks call succeeded with len=required_size - Executes val[len] = 0, writing past end of 65-byte stack buffer This creates a stack buffer overflow when EFI variables are larger than 64 bytes. Since EFI variables can be controlled by firmware or system configuration, this could potentially be exploited for code execution. Fix the bug by returning proper error codes from gmin_get_config_var() based on EFI status instead of stale 'ret' value. The gmin_get_var_int() function is called during device initialization for camera sensor configuration on Intel Bay Trail and Cherry Trail platforms using the atomisp camera stack. Reported-by: zepta <z3ptaa@gmail.com> Closes: https://lore.kernel.org/all/CAPBS6KoQyM7FMdPwOuXteXsOe44X4H3F8Fw+y_qWq6E+OdmxQA@mail.gmail.com Fixes: 38d4f74bc148 ("media: atomisp_gmin_platform: stop abusing efivar API") Reviewed-by: Hans de Goede <hansg@kernel.org> Link: https://lore.kernel.org/r/20250724080756.work.741-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org> 
When gmin_get_config_var() calls efi.get_variable() and the EFI variable
is larger than the expected buffer size, two behaviors combine to create
a stack buffer overflow:

1. gmin_get_config_var() does not return the proper error code when
   efi.get_variable() fails. It returns the stale 'ret' value from
   earlier operations instead of indicating the EFI failure.

2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates
   *out_len to the required buffer size but writes no data to the output
   buffer. However, due to bug #1, gmin_get_var_int() believes the call
   succeeded.

The caller gmin_get_var_int() then performs:
- Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack
- Calls gmin_get_config_var(dev, is_gmin, var, val, &len) with len=64
- If EFI variable is >64 bytes, efi.get_variable() sets len=required_size
- Due to bug #1, thinks call succeeded with len=required_size
- Executes val[len] = 0, writing past end of 65-byte stack buffer

This creates a stack buffer overflow when EFI variables are larger than
64 bytes. Since EFI variables can be controlled by firmware or system
configuration, this could potentially be exploited for code execution.

Fix the bug by returning proper error codes from gmin_get_config_var()
based on EFI status instead of stale 'ret' value.

The gmin_get_var_int() function is called during device initialization
for camera sensor configuration on Intel Bay Trail and Cherry Trail
platforms using the atomisp camera stack.

Reported-by: zepta <z3ptaa@gmail.com>
Closes: https://lore.kernel.org/all/CAPBS6KoQyM7FMdPwOuXteXsOe44X4H3F8Fw+y_qWq6E+OdmxQA@mail.gmail.com
Fixes: 38d4f74bc148 ("media: atomisp_gmin_platform: stop abusing efivar API")
Reviewed-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250724080756.work.741-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
media: atomisp: Remove custom sysfs attributes from atomisp_drvfs.c 2025-07-08T06:43:33+00:00 Abdelrahman Fekry abdelrahmanfekry375@gmail.com 2025-07-04T16:10:51+00:00 54d32a9754a096b2d449588f89c38d5dec52eb49 Continue the cleanup of the AtomISP driver, as discussed with Hans and Andy in [1]. Tackle TODO item: "Remove custom sysfs files created by atomisp_drvfs.c": - Remove the sysfs attributes `dbglvl`, `dbgfun`, and `dbgopt`. - Delete their associated show/store handler functions. - Remove the corresponding attribute group definitions. Link: https://lore.kernel.org/all/836dc6b6-2821-47fc-8f24-0838f979af76@kernel.org/ [1] Suggested-by: Hans de Goede <hansg@kernel.org> Reviewed-by: Andy Shevchenko <andy@kernel.org> Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@gmail.com> Link: https://lore.kernel.org/r/20250704161051.16733-1-abdelrahmanfekry375@gmail.com [hansg@kernel.org: Completely remove the now empty atomisp_drvfs files] Reviewed-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> 
Continue the cleanup of the AtomISP driver, as discussed with Hans and Andy
in [1].

Tackle TODO item: "Remove custom sysfs files created by atomisp_drvfs.c":
- Remove the sysfs attributes `dbglvl`, `dbgfun`, and `dbgopt`.
- Delete their associated show/store handler functions.
- Remove the corresponding attribute group definitions.

Link: https://lore.kernel.org/all/836dc6b6-2821-47fc-8f24-0838f979af76@kernel.org/ [1]
Suggested-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@gmail.com>
Link: https://lore.kernel.org/r/20250704161051.16733-1-abdelrahmanfekry375@gmail.com
[hansg@kernel.org: Completely remove the now empty atomisp_drvfs files]
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: Fix premature setting of HMM_BO_DEVICE_INITED flag 2025-07-08T06:43:33+00:00 Abdelrahman Fekry abdelrahmanfekry375@gmail.com 2025-06-28T05:25:36+00:00 bd290dddb0d74b3cd34d2cca15d66105dc4a00d4 The HMM_BO_DEVICE_INITED flag was being set in hmm_bo_device_init() before key initialization steps like kmem_cache_create(), kmem_cache_alloc(), and __bo_init(). This means that if any of these steps fail, the flag remains set, misleading other parts of the driver (e.g. hmm_bo_alloc()) into thinking the device is initialized. This could lead to undefined behavior or invalid memory use. Additionally, since __bo_init() is called from inside hmm_bo_device_init() after the flag was already set, its internal check for HMM_BO_DEVICE_INITED is redundant. - Move the flag assignment to the end after all allocations succeed. - Remove redundant check of the flag inside __bo_init() See the link [1] below for a backtrace which happens when deliberately triggering the problem of the flag getting set too early. Link: https://lore.kernel.org/linux-media/CAGn2d8ONZpOHXex8kjeUDgRPiMqKp8vZ=xhGbEDGphV1t7ZEFw@mail.gmail.com/ [1] Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@gmail.com> Link: https://lore.kernel.org/r/20250628052536.43737-1-abdelrahmanfekry375@gmail.com Reviewed-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> 
The HMM_BO_DEVICE_INITED flag was being set in hmm_bo_device_init()
before key initialization steps like kmem_cache_create(),
kmem_cache_alloc(), and __bo_init().

This means that if any of these steps fail, the flag remains set,
misleading other parts of the driver (e.g. hmm_bo_alloc())
into thinking the device is initialized. This could lead
to undefined behavior or invalid memory use.

Additionally, since __bo_init() is called from inside
hmm_bo_device_init() after the flag was already set, its internal
check for HMM_BO_DEVICE_INITED is redundant.

- Move the flag assignment to the end after all allocations succeed.
- Remove redundant check of the flag inside __bo_init()

See the link [1] below for a backtrace which happens when deliberately
triggering the problem of the flag getting set too early.

Link: https://lore.kernel.org/linux-media/CAGn2d8ONZpOHXex8kjeUDgRPiMqKp8vZ=xhGbEDGphV1t7ZEFw@mail.gmail.com/ [1]
Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@gmail.com>
Link: https://lore.kernel.org/r/20250628052536.43737-1-abdelrahmanfekry375@gmail.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: Remove debug sysfs attributes active_bo and free_bo 2025-07-08T06:43:33+00:00 Abdelrahman Fekry abdelrahmanfekry375@gmail.com 2025-06-27T10:06:04+00:00 5e2330ef08f4d7c7692ee55d272c0bb489258915 The sysfs attributes active_bo and free_bo expose internal buffer state used only for debugging purposes. These are not part of any standard kernel ABI, and need to be removed before this driver may be moved out of drivers/staging. - Remove active_bo and free_bo attributes - Remove group registration calls form hmm_init() and hmm_cleanup() Suggested-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@gmail.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/20250627100604.29061-1-abdelrahmanfekry375@gmail.com Reviewed-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> 
The sysfs attributes active_bo and free_bo expose internal buffer
state used only for debugging purposes. These are not part of
any standard kernel ABI, and need to be removed before this
driver may be moved out of drivers/staging.

- Remove active_bo and free_bo attributes
- Remove group registration calls form hmm_init() and hmm_cleanup()

Suggested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/20250627100604.29061-1-abdelrahmanfekry375@gmail.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: Remove no more used macros from math_support.h 2025-07-08T06:43:33+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2025-05-19T15:46:49+00:00 379f5e1587310b7a0b12b2cd515b66271a1dfc5c After recent cleanups the few macros become unused. Remove them. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20250519155028.526453-4-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede <hansg@kernel.org> Tested-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> 
After recent cleanups the few macros become unused. Remove them.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20250519155028.526453-4-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Tested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: Replace macros from math_support.h 2025-07-08T06:43:32+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2025-05-19T15:46:48+00:00 782fc724bfa44daa2e69e364426ea67b66deb1b3 Replace rarely used macros by generic ones from Linux kernel headers. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20250519155028.526453-3-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede <hansg@kernel.org> Tested-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> 
Replace rarely used macros by generic ones from Linux kernel headers.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20250519155028.526453-3-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Tested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: Remove unused header 2025-07-08T06:43:32+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2025-05-19T15:46:47+00:00 58913d96525b266d7cf9e6ec787ad1c7df355b2b There are some unused definitions that are using macros from math_support.h. In order to have cleaner future changes, remove them first. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20250519155028.526453-2-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede <hansg@kernel.org> Tested-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> 
There are some unused definitions that are using macros from
math_support.h. In order to have cleaner future changes, remove them first.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20250519155028.526453-2-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Tested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: ov2722: Fix struct definition style 2025-07-08T06:43:32+00:00 Thomas Andreatta thomas.andreatta2000@gmail.com 2025-06-19T08:44:24+00:00 3c92c08cd413ef87ae68785cd09a2a9f940521fc Reorder const qualifier in array declaration. Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com> Link: https://lore.kernel.org/r/20250619084420.146151-4-thomas.andreatta2000@gmail.com Reviewed-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> 
Reorder const qualifier in array declaration.

Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
Link: https://lore.kernel.org/r/20250619084420.146151-4-thomas.andreatta2000@gmail.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: atomisp: gc2235: Fix struct definition style 2025-07-08T06:43:32+00:00 Thomas Andreatta thomas.andreatta2000@gmail.com 2025-06-19T08:44:22+00:00 51c19651a7dc74a255041acc0b1c91a197088f0e Reorder const qualifier in array declaration. Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com> Link: https://lore.kernel.org/r/20250619084420.146151-3-thomas.andreatta2000@gmail.com Reviewed-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> 
Reorder const qualifier in array declaration.

Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
Link: https://lore.kernel.org/r/20250619084420.146151-3-thomas.andreatta2000@gmail.com
Reviewed-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>