linux.git/drivers/staging/media, branch v6.17

Merge tag 'media/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2025-07-31T20:16:09+00:00

Pull media updates from Mauro Carvalho Chehab:

 - v4l2 core:
     - sub-device framework routing improvements
     - NV12M tiled variants added to v4l2_format_info
     - some fixes at control handler freeing logic
     - fixed H264 SEPARATE_COLOUR_PLANE check

 - new staging driver: Intel IPU7 PCI

 - Rockchip video decoder driver got promoted from staging

 - iris: added HEVC/VP9 encoder/decoder support

 - vsp1: driver has gained Renesas VSPX support

 - uvc:
     - switched to vb2 ioctl helpers
     - added MSXU 1.5 metadata support

 - atomisp: GC0310 sensor driver cleanups in preparation for moving it
   out of staging

 - Lots of cleanup, fixes and improvements

* tag 'media/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (310 commits)
  media: rkvdec: Unstage the driver
  media: rkvdec: Remove TODO file
  media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings
  media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings
  media: amphion: Support dmabuf and v4l2 buffer without binding
  media: verisilicon: postproc: 4K support
  media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
  media: uvcvideo: Use a count variable for meta_formats instead of 0 terminating
  media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META
  media: uvcvideo: Introduce V4L2_META_FMT_UVC_MSXU_1_5
  media: uvcvideo: Introduce dev->meta_formats
  media: Documentation: Add note about UVCH length field
  media: uvcvideo: Do not mark valid metadata as invalid
  media: uvcvideo: uvc_v4l2_unlocked_ioctl: Invert PM logic
  media: core: export v4l2_translate_cmd
  media: uvcvideo: Turn on the camera if V4L2_EVENT_SUB_FL_SEND_INITIAL
  media: uvcvideo: Remove stream->is_streaming field
  media: uvcvideo: Split uvc_stop_streaming()
  media: uvcvideo: Handle locks in uvc_queue_return_buffers
  media: uvcvideo: Use vb2 ioctl and fop helpers
  ...

staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()

2025-07-29T00:48:41+00:00

When gmin_get_config_var() calls efi.get_variable() and the EFI variable
is larger than the expected buffer size, two behaviors combine to create
a stack buffer overflow:

1. gmin_get_config_var() does not return the proper error code when
   efi.get_variable() fails. It returns the stale 'ret' value from
   earlier operations instead of indicating the EFI failure.

2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates
   *out_len to the required buffer size but writes no data to the output
   buffer. However, due to bug #1, gmin_get_var_int() believes the call
   succeeded.

The caller gmin_get_var_int() then performs:
- Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack
- Calls gmin_get_config_var(dev, is_gmin, var, val, &len) with len=64
- If EFI variable is >64 bytes, efi.get_variable() sets len=required_size
- Due to bug #1, thinks call succeeded with len=required_size
- Executes val[len] = 0, writing past end of 65-byte stack buffer

This creates a stack buffer overflow when EFI variables are larger than
64 bytes. Since EFI variables can be controlled by firmware or system
configuration, this could potentially be exploited for code execution.

Fix the bug by returning proper error codes from gmin_get_config_var()
based on EFI status instead of stale 'ret' value.

The gmin_get_var_int() function is called during device initialization
for camera sensor configuration on Intel Bay Trail and Cherry Trail
platforms using the atomisp camera stack.

Reported-by: zepta 
Closes: https://lore.kernel.org/all/CAPBS6KoQyM7FMdPwOuXteXsOe44X4H3F8Fw+y_qWq6E+OdmxQA@mail.gmail.com
Fixes: 38d4f74bc148 ("media: atomisp_gmin_platform: stop abusing efivar API")
Reviewed-by: Hans de Goede 
Link: https://lore.kernel.org/r/20250724080756.work.741-kees@kernel.org
Signed-off-by: Kees Cook

media: rkvdec: Unstage the driver

2025-07-12T06:34:48+00:00

The TODO list for unstaging being empty, the driver can now be moved to the
main media folder.

Also add myself as maintainer.

Signed-off-by: Detlev Casanova 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Nicolas Dufresne 
Signed-off-by: Hans Verkuil

media: rkvdec: Remove TODO file

2025-07-12T06:34:48+00:00

2 items are present in the TODO file:
 - HEVC support
 - Evaluate adding helper for rkvdec_request_validate

Missing HEVC support is not a reason for a driver to be in staging,
support for different features of the hardware can be added in drivers
in the main tree.

The rkvdec_request_validate function was simplified in
commit 54676d5f5630 ("media: rkvdec: Do not require all controls to be present in every request")
by not setting controls that have not changed.
As it now basically just calls vb2_request_validate(), there is no need
for a helper.

Signed-off-by: Detlev Casanova 
Reviewed-by: Nicolas Dufresne 
Signed-off-by: Nicolas Dufresne 
Signed-off-by: Hans Verkuil

media: staging/ipu7: add CONFIG_PCI dependency

2025-07-10T09:32:26+00:00

This driver fails to build when PCI is disabled:

drivers/staging/media/ipu7/ipu7.c: In function 'ipu7_pci_config_setup':
drivers/staging/media/ipu7/ipu7.c:2260:15: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Wimplicit-function-declaration]
drivers/staging/media/ipu7/ipu7.c:2775:1: error: data definition has no type or storage class [-Werror]
driver(ipu7_pci_driver);
drivers/staging/media/ipu7/ipu7.c:2764:26: error: 'ipu7_pci_driver' defined but not used [-Werror=unused-variable]

Add the required Kconfig dependency.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil

media: staging/ipu7: avoid division by 64-bit value

2025-07-10T09:32:26+00:00

On 32-bit targets, this causes a link failure:

x86_64-linux-ld: drivers/staging/media/ipu7/ipu7-isys-csi-phy.o: in function `ipu7_isys_phy_config':
ipu7-isys-csi-phy.c:(.text+0x1509): undefined reference to `__udivdi3'

Note that this does not divide a 64-bit number by a 32-bit one as usual,
but the other way round, which is something that the compiler should
really be able to figure out but does not (as of gcc-15).

A few lines higher, a similar division is done using the incorrect div_u64()
that truncates the 64-bit divisor to 32 bits.

Change both to use the safe but slow div64_u64() helper.

Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil

media: atomisp: Remove custom sysfs attributes from atomisp_drvfs.c

2025-07-08T06:43:33+00:00

Continue the cleanup of the AtomISP driver, as discussed with Hans and Andy
in [1].

Tackle TODO item: "Remove custom sysfs files created by atomisp_drvfs.c":
- Remove the sysfs attributes `dbglvl`, `dbgfun`, and `dbgopt`.
- Delete their associated show/store handler functions.
- Remove the corresponding attribute group definitions.

Link: https://lore.kernel.org/all/836dc6b6-2821-47fc-8f24-0838f979af76@kernel.org/ [1]
Suggested-by: Hans de Goede 
Reviewed-by: Andy Shevchenko 
Signed-off-by: Abdelrahman Fekry 
Link: https://lore.kernel.org/r/20250704161051.16733-1-abdelrahmanfekry375@gmail.com
[hansg@kernel.org: Completely remove the now empty atomisp_drvfs files]
Reviewed-by: Hans de Goede 
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab

media: atomisp: Fix premature setting of HMM_BO_DEVICE_INITED flag

2025-07-08T06:43:33+00:00

The HMM_BO_DEVICE_INITED flag was being set in hmm_bo_device_init()
before key initialization steps like kmem_cache_create(),
kmem_cache_alloc(), and __bo_init().

This means that if any of these steps fail, the flag remains set,
misleading other parts of the driver (e.g. hmm_bo_alloc())
into thinking the device is initialized. This could lead
to undefined behavior or invalid memory use.

Additionally, since __bo_init() is called from inside
hmm_bo_device_init() after the flag was already set, its internal
check for HMM_BO_DEVICE_INITED is redundant.

- Move the flag assignment to the end after all allocations succeed.
- Remove redundant check of the flag inside __bo_init()

See the link [1] below for a backtrace which happens when deliberately
triggering the problem of the flag getting set too early.

Link: https://lore.kernel.org/linux-media/CAGn2d8ONZpOHXex8kjeUDgRPiMqKp8vZ=xhGbEDGphV1t7ZEFw@mail.gmail.com/ [1]
Signed-off-by: Abdelrahman Fekry 
Link: https://lore.kernel.org/r/20250628052536.43737-1-abdelrahmanfekry375@gmail.com
Reviewed-by: Hans de Goede 
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab

media: atomisp: Remove debug sysfs attributes active_bo and free_bo

2025-07-08T06:43:33+00:00

The sysfs attributes active_bo and free_bo expose internal buffer
state used only for debugging purposes. These are not part of
any standard kernel ABI, and need to be removed before this
driver may be moved out of drivers/staging.

- Remove active_bo and free_bo attributes
- Remove group registration calls form hmm_init() and hmm_cleanup()

Suggested-by: Hans de Goede 
Signed-off-by: Abdelrahman Fekry 
Reviewed-by: Andy Shevchenko 
Reviewed-by: Dan Carpenter 
Link: https://lore.kernel.org/r/20250627100604.29061-1-abdelrahmanfekry375@gmail.com
Reviewed-by: Hans de Goede 
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab

media: atomisp: Remove no more used macros from math_support.h

2025-07-08T06:43:33+00:00

After recent cleanups the few macros become unused. Remove them.

Signed-off-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20250519155028.526453-4-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede 
Tested-by: Hans de Goede 
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab