linux.git/drivers/staging/media, branch v6.12

Merge tag 'media/v6.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2024-11-08T17:41:27+00:00

Pull media fixes from Mauro Carvalho Chehab:

 - dvb-core fixes for vb2 check and device registration

 - v4l2-core: fix an issue with error handling for VIDIOC_G_CTRL

 - vb2 core: fix an issue with vb plane copy logic

 - videobuf2-core: copy vb planes unconditionally

 - vivid: fix buffer overwrite when using > 32 buffers

 - vivid: fix a potential division by zero due to an issue at v4l2-tpg

 - some spectre vulnerability fixes

 - several OOM access fixes

 - some buffer overflow fixes

* tag 'media/v6.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: videobuf2-core: copy vb planes unconditionally
  media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
  media: vivid: fix buffer overwrite when using > 32 buffers
  media: pulse8-cec: fix data timestamp at pulse8_setup()
  media: cec: extron-da-hd-4k-plus: don't use -1 as an error code
  media: stb0899_algo: initialize cfr before using it
  media: adv7604: prevent underflow condition when reporting colorspace
  media: cx24116: prevent overflows on SNR calculus
  media: ar0521: don't overflow when checking PLL values
  media: s5p-jpeg: prevent buffer overflows
  media: av7110: fix a spectre vulnerability
  media: mgb4: protect driver against spectre
  media: dvb_frontend: don't play tricks with underflow values
  media: dvbdev: prevent the risk of out of memory access
  media: v4l2-tpg: prevent the risk of a division by zero
  media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl()
  media: dvb-core: add missing buffer index check

media: av7110: fix a spectre vulnerability

2024-10-18T08:43:03+00:00

As warned by smatch:
	drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap)

There is a spectre-related vulnerability at the code. Fix it.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab

move asm/unaligned.h to linux/unaligned.h

2024-10-02T21:23:23+00:00

asm/unaligned.h is always an include of asm-generic/unaligned.h;
might as well move that thing to linux/unaligned.h and include
that - there's nothing arch-specific in that header.

auto-generated by the following:

for i in `git grep -l -w asm/unaligned.h`; do
	sed -i -e "s/asm\/unaligned.h/linux\/unaligned.h/" $i
done
for i in `git grep -l -w asm-generic/unaligned.h`; do
	sed -i -e "s/asm-generic\/unaligned.h/linux\/unaligned.h/" $i
done
git mv include/asm-generic/unaligned.h include/linux/unaligned.h
git mv tools/include/asm-generic/unaligned.h tools/include/linux/unaligned.h
sed -i -e "/unaligned.h/d" include/asm-generic/Kbuild
sed -i -e "s/__ASM_GENERIC/__LINUX/" include/linux/unaligned.h tools/include/linux/unaligned.h

Merge tag 'staging-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2024-09-26T17:04:35+00:00

Pull staging driver updates from Greg KH:
 "Here is the big set of staging driver cleanups and removals for
  6.12-rc1.

  Nothing exciting here, just slow, constant, forward progress in
  removing code and cleaning up some old drivers, along with removing
  one of them that was not being used anymore at all. In discussions
  with some developers this past week, even more deletions will be
  happening for the next major merge window, as we seems to have code
  here that obviously no one is using anymore.

  Along with the normal cleanups is the good vme_user code forward
  progress, the one major bright spot in the staging subsystem for code
  that people rely on, and is getting good development behind it.
  Hopefully it can graduate out of staging "soon".

  All of these changes have been in linux-next for a long time with no
  reported problems"

* tag 'staging-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (141 commits)
  staging: vt6655: Rename variable apTD1Rings
  staging: vt6655: Rename variable apTD0Rings
  staging: rtl8723bs: remove unused 'poll_cnt' from rtw_set_rpwm()
  staging: rtl8723bs: remove unused cnt from recv_func()
  staging: rtl8723bs: remove unused efuseValue from efuse_OneByteWrite()
  staging: rtl8712: remove unused drvinfo_sz from update_recvframe_attrib
  staging: vt6655: mac.h: Fix possible precedence issue in macros
  staging: rtl8723bs: include: Remove spaces before tabs in rtw_security.h
  staging: rtl8723bs: include: Fix trailing */ position in rtw_security.h
  staging: rtl8723bs: include: Fix indent for else block struct in rtw_security.h
  staging: rtl8723bs: include: Fix indent for struct _byte_ in rtw_security.h
  staging: rtl8723bs: include: Fix use of tabs for indent in rtw_security.h
  staging: rtl8723bs: include: Fix indent for switch block in rtw_security.h
  staging: rtl8723bs: include: Fix indent for switch case in rtw_security.h
  staging: rtl8723bs: include: Fix open brace position in rtw_security.h
  staging: nvec: Use IRQF_NO_AUTOEN flag in request_irq()
  staging: rtl8723bs: Remove unused file rtw_rf.c
  staging: rtl8723bs: Remove unused function rtw_ch2freq
  staging: rtl8723bs: Remove unused files rtw_debug.c and rtw_debug.h
  staging: rtl8723bs: Remove unused function dump_4_regs
  ...

Merge tag 'media/v6.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2024-09-23T22:27:58+00:00

Pull media updates from Mauro Carvalho Chehab:

 - New CEC driver: Extron DA HD 4K Plus

 - Lots of driver fixes, cleanups and improvements

* tag 'media/v6.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (179 commits)
  media: atomisp: Use clamp() in ia_css_eed1_8_vmem_encode()
  media: atomisp: Fix eed1_8 code assigning signed values to an unsigned variable
  media: atomisp: set lock before calling vb2_queue_init()
  media: atomisp: Improve binary finding debug logging
  media: atomisp: Drop dev_dbg() calls from hmm_[alloc|free]()
  media: atomisp: csi2-bridge: Add DMI quirk for t4ka3 on Xiaomi Mipad2
  media: atomisp: add missing wait_prepare/finish ops
  media: atomisp: Remove unused declaration
  media: atomisp: use clamp() in compute_coring()
  media: atomisp: use clamp() in ia_css_eed1_8_encode()
  media: atomisp: Simplify ia_css_pipe_create_cas_scaler_desc_single_output()
  media: atomisp: Replace rarely used macro from math_support.h
  media: atomisp: Remove duplicated leftover, i.e. sh_css_dvs_info.h
  media: atomisp: bnr: fix trailing statement
  media: atomisp: move trailing */ to separate lines
  media: atomisp: move trailing statement to next line.
  media: atomisp: Fix trailing statement in ia_css_de.host.c
  media: atomisp: Fix spelling mistakes in atomisp.h
  media: atomisp: Fix spelling mistakes in atomisp_platform.h
  media: atomisp: Fix spelling mistake in csi_rx_public.h
  ...

minmax: reduce min/max macro expansion in atomisp driver

2024-09-11T18:07:47+00:00

Avoid unnecessary nested min()/max() which results in egregious macro
expansion.

Use clamp_t() as this introduces the least possible expansion, and turn
the {s,u}DIGIT_FITTING() macros into inline functions to avoid the
nested expansion.

This resolves an issue with slackware 15.0 32-bit compilation as
reported by Richard Narron.

Presumably the min/max fixups would be difficult to backport, this patch
should be easier and fix's Richard's problem in 5.15.

Reported-by: Richard Narron 
Reviewed-by: Hans de Goede 
Closes: https://lore.kernel.org/all/4a5321bd-b1f-1832-f0c-cea8694dc5aa@aaazen.com/
Fixes: 867046cc7027 ("minmax: relax check to allow comparison between unsigned arguments and signed constants")
Cc: stable@vger.kernel.org
Signed-off-by: Lorenzo Stoakes 
Signed-off-by: Linus Torvalds

media: atomisp: Use clamp() in ia_css_eed1_8_vmem_encode()

2024-09-10T05:30:36+00:00

Using clamp() instead of min_t(max_t()) is easier to read.

It also reduces the size of the preprocessed files by ~ 193 ko.
(see [1] for a discussion about it)

$ ls -l ia_css_eed1_8.host*.i
 4829993 27 juil. 14:36 ia_css_eed1_8.host.old.i
 4636649 27 juil. 14:42 ia_css_eed1_8.host.new.i

[1]: https://lore.kernel.org/all/23bdb6fc8d884ceebeb6e8b8653b8cfe@AcuMS.aculab.com/

Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/155aba6ab759e98f66349e6bb4f69e2410486c09.1722084704.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab

media: atomisp: Fix eed1_8 code assigning signed values to an unsigned variable

2024-09-10T05:29:44+00:00

ia_css_eed1_8_vmem_encode() is assigning values with a range of -8192 -
8191 to e_dew_enh_y and e_dew_enh_a both of which are of the VMEM_ARRAY
type which maps to u16.

This causes the following smatch warnings:

drivers/staging/media/atomisp/pci/isp/kernels/eed1_8/ia_css_eed1_8.host.c: drivers/staging/media/atomisp/pci/isp/kernels/eed1_8/ia_css_eed1_8.host.c:177 ia_css_eed1_8_vmem_encode() warn: assigning (-8192) to unsigned variable 'to->e_dew_enh_y[0][base + j]'
drivers/staging/media/atomisp/pci/isp/kernels/eed1_8/ia_css_eed1_8.host.c: drivers/staging/media/atomisp/pci/isp/kernels/eed1_8/ia_css_eed1_8.host.c:182 ia_css_eed1_8_vmem_encode() warn: assigning (-8192) to unsigned variable 'to->e_dew_enh_a[0][base + j]'

Convert the e_dew_enh_y and e_dew_enh_a arrays to a new SVMEM_ARRAY type
which maps to s16 to fix this.

Link: https://lore.kernel.org/linux-media/20240907111701.8493-1-hdegoede@redhat.com
Reported-by: Mauro Carvalho Chehab 
Closes: https://lore.kernel.org/linux-media/20240906081542.5cb0c142@foz.lan/
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab

media: atomisp: set lock before calling vb2_queue_init()

2024-09-06T09:56:54+00:00

The vb2_queue_init() will expect the vb2_queue lock pointer to be set in
the future. So for those drivers that set the lock later, move it up to
before the vb2_queue_init() call.

Signed-off-by: Hans Verkuil 
Link: https://lore.kernel.org/r/90b8e7a40c3ed306cbeb96c2f4dad97eb7e53bfd.1725285495.git.hverkuil-cisco@xs4all.nl
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab

media: atomisp: Improve binary finding debug logging

2024-09-06T09:56:54+00:00

The atomisp firmware contains a number of different pipeline binaries
inside its firmware file and the driver selects the right one depending
on the selected pipeline configuration.

Sometimes (e.g. when the selected output resolution is too big) it fails
to find a binary. This happens especially when adding support for new
sensors.

Improve the logging when this happens to make debugging easier:

1. Replace ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, ...) with standard
   dev_dbg() calls so that the logs can be enabled with dyndbg

2. Do not dump_stack() when this fails, doing so adds no useful extra
   info

3. With the dump_stack() call gone, remove the wrapper and rename
   __ia_css_binary_find() to ia_css_binary_find()

4. On error use dev_err() instead of dev_dbg() so that when things
   fail it is clear why they fail without needing to enable dyndbg

Signed-off-by: Hans de Goede 
Link: https://lore.kernel.org/r/20240902095229.59059-3-hdegoede@redhat.com
Signed-off-by: Mauro Carvalho Chehab