kernel/git/stable/linux-stable.git/drivers/media/test-drivers, branch linux-6.2.y

Merge tag 'media/v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2022-12-13T19:36:58+00:00

Pull media updates from Mauro Carvalho Chehab: - DVB core changes to avoid refcount troubles and UAF - DVB API/core has gained support for DVB-C2 and DVB-S2X - New sensor drivers: ov08x40, ov4689.c, st-vgxy61 and tc358746.c - Removal of an unused sensor driver: s5k4ecgx - Move microchip_csi2dc to a new directory, named after the manufacturer - Add media controller support to Microship drivers - Old Atmel/Microship drivers that don't use media controler got moved to staging - New drivers added for Renesas RZ/G2L CRU and MIPI CSI-2 support - Allwinner A31 camera sensor driver code was now split into a bridge and a separate processor driver - Added a virtual stateless decoder driver in order to test core support for stateless drivers and test userspace apps using it - removed platform-based support for ov9650, as this is not used anymore - atomisp now uses videobuf2 and supports normal mmap mode - the imx7-media-csi driver got promoted from staging - rcar-vin driver has gained support for gen3 UDS (Up Down Scaler) - most i2c drivers now use I2C .probe_new() kAPI - lots of drivers fixes, cleanups and improvements * tag 'media/v6.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (544 commits) media: s5c73m3: Switch to GPIO descriptors media: i2c: s5k5baf: switch to using gpiod API media: i2c: s5k6a3: switch to using gpiod API media: imx: remove code for non-existing config IMX_GPT_ICAP media: si470x: Fix use-after-free in si470x_int_in_callback() media: staging: stkwebcam: Restore MEDIA_{USB,CAMERA}_SUPPORT dependencies media: coda: Add check for kmalloc media: coda: Add check for dcoda_iram_alloc dt-bindings: media: s5c73m3: Fix reset-gpio descriptor media: dt-bindings: allwinner: h6-vpu-g2: Add IOMMU reference property media: s5k4ecgx: Delete driver media: s5k4ecgx: Switch to GPIO descriptors media: Switch to use dev_err_probe() helper headers: Remove some left-over license text in include/uapi/linux/v4l2-* headers: Remove some left-over license text in include/uapi/linux/dvb/ media: usb: pwc-uncompress: Use flex array destination for memcpy() media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 media: imx: Use get_mbus_config instead of parsing upstream DT endpoints ...

Merge tag 'br-v6.2g' of git://linuxtv.org/hverkuil/media_tree into media_stage

2022-11-25T07:55:21+00:00

Despite being big, the changes here are trivial: they just change the probing method for I2C. So, apply it as a merge. Tag branch * tag 'br-v6.2g' of git://linuxtv.org/hverkuil/media_tree: (96 commits) media: v4l2-core/tuner-core: Convert to i2c's .probe_new() media: usb: go7007: s2250-board: Convert to i2c's .probe_new() media: tuners/tua9001: Convert to i2c's .probe_new() media: tuners/tda18250: Convert to i2c's .probe_new() media: tuners/tda18212: Convert to i2c's .probe_new() media: tuners/qm1d1c0042: Convert to i2c's .probe_new() media: tuners/qm1d1b0004: Convert to i2c's .probe_new() media: tuners/mxl301rf: Convert to i2c's .probe_new() media: tuners/mt2060: Convert to i2c's .probe_new() media: tuners/m88rs6000t: Convert to i2c's .probe_new() media: tuners/fc2580: Convert to i2c's .probe_new() media: tuners/e4000: Convert to i2c's .probe_new() media: vidtv: Convert to i2c's .probe_new() media: radio/tef6862: Convert to i2c's .probe_new() media: radio/saa7706h: Convert to i2c's .probe_new() media: radio/radio-tea5764: Convert to i2c's .probe_new() media: i2c/wm8775: Convert to i2c's .probe_new() media: i2c/wm8739: Convert to i2c's .probe_new() media: i2c/vs6624: Convert to i2c's .probe_new() media: i2c/vpx3220: Convert to i2c's .probe_new() ... Signed-off-by: Mauro Carvalho Chehab

media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()

2022-11-25T07:33:14+00:00

KASAN reports a use-after-free: BUG: KASAN: use-after-free in dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core] Call Trace: ... dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core] vidtv_bridge_probe+0x7bf/0xa40 [dvb_vidtv_bridge] platform_probe+0xb6/0x170 ... Allocated by task 1238: ... dvb_register_device+0x1a7/0xa70 [dvb_core] dvb_dmxdev_init+0x2af/0x4a0 [dvb_core] vidtv_bridge_probe+0x766/0xa40 [dvb_vidtv_bridge] ... Freed by task 1238: dvb_register_device+0x6d2/0xa70 [dvb_core] dvb_dmxdev_init+0x2af/0x4a0 [dvb_core] vidtv_bridge_probe+0x766/0xa40 [dvb_vidtv_bridge] ... It is because the error handling in vidtv_bridge_dvb_init() is wrong. First, vidtv_bridge_dmx(dev)_init() will clean themselves when fail, but goto fail_dmx(_dev): calls release functions again, which causes use-after-free. Also, in fail_fe, fail_tuner_probe and fail_demod_probe, j = i will cause out-of-bound when i finished its loop (i == NUM_FE). And the loop releasing is wrong, although now NUM_FE is 1 so it won't cause problem. Fix this by correctly releasing everything. Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver") Signed-off-by: Chen Zhongjin Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: visl: add virtual stateless decoder driver

2022-11-25T07:32:16+00:00

A virtual stateless device for stateless uAPI development purposes. This tool's objective is to help the development and testing of userspace applications that use the V4L2 stateless API to decode media. A userspace implementation can use visl to run a decoding loop even when no hardware is available or when the kernel uAPI for the codec has not been upstreamed yet. This can reveal bugs at an early stage. This driver can also trace the contents of the V4L2 controls submitted to it. It can also dump the contents of the vb2 buffers through a debugfs interface. This is in many ways similar to the tracing infrastructure available for other popular encode/decode APIs out there and can help develop a userspace application by using another (working) one as a reference. Note that no actual decoding of video frames is performed by visl. The V4L2 test pattern generator is used to write various debug information to the capture buffers instead. Signed-off-by: Daniel Almeida Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: vimc: Fix wrong function called when vimc_init() fails

2022-11-25T07:26:16+00:00

In vimc_init(), when platform_driver_register(&vimc_pdrv) fails, platform_driver_unregister(&vimc_pdrv) is wrongly called rather than platform_device_unregister(&vimc_pdev), which causes kernel warning: Unexpected driver unregister! WARNING: CPU: 1 PID: 14517 at drivers/base/driver.c:270 driver_unregister+0x8f/0xb0 RIP: 0010:driver_unregister+0x8f/0xb0 Call Trace: vimc_init+0x7d/0x1000 [vimc] do_one_initcall+0xd0/0x4e0 do_init_module+0x1cf/0x6b0 load_module+0x65c2/0x7820 Fixes: 4a29b7090749 ("[media] vimc: Subdevices as modules") Signed-off-by: Chen Zhongjin Signed-off-by: Shuah Khan Signed-off-by: Mauro Carvalho Chehab

media: vidtv: Convert to i2c's .probe_new()

2022-11-21T10:04:42+00:00

The probe functions doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Hans Verkuil

treewide: use get_random_u32_below() instead of deprecated function

2022-11-18T01:15:15+00:00

This is a simple mechanical transformation done by: @@ expression E; @@ - prandom_u32_max + get_random_u32_below (E) Reviewed-by: Kees Cook Reviewed-by: Greg Kroah-Hartman Acked-by: Darrick J. Wong # for xfs Reviewed-by: SeongJae Park # for damon Reviewed-by: Jason Gunthorpe # for infiniband Reviewed-by: Russell King (Oracle) # for arm Acked-by: Ulf Hansson # for mmc Signed-off-by: Jason A. Donenfeld

Merge tag 'br-v6.2d' of git://linuxtv.org/hverkuil/media_tree into media_stage

2022-11-15T12:11:46+00:00

Tag branch * tag 'br-v6.2d' of git://linuxtv.org/hverkuil/media_tree: (35 commits) media: saa7164: remove variable cnt atomisp: fix potential NULL pointer dereferences radio-terratec: Remove variable p media: platform: s5p-mfc: Fix spelling mistake "mmaping" -> "mmapping" media: platform: mtk-mdp3: remove unused VIDEO_MEDIATEK_VPU config media: vivid: remove redundant assignment to variable checksum media: cedrus: h264: Optimize mv col buffer allocation media: cedrus: h265: Associate mv col buffers with buffer media: mediatek: vcodec: fix h264 cavlc bitstream fail media: cedrus: hevc: Fix offset adjustments media: imx-jpeg: Fix Coverity issue in probe media: v4l2-ioctl.c: Unify YCbCr/YUV terms in format descriptions media: atomisp: Fix spelling mistake "mis-match" -> "mismatch" media: c8sectpfe: Add missed header(s) media: adv748x: afe: Select input port when initializing AFE media: vimc: Update device configuration in the documentation media: adv748x: Remove dead function declaration media: mxl5005s: Make array RegAddr static const media: atomisp: Fix spelling mistake "modee" -> "mode" media: meson/vdec: always init coef_node_start ...

media: vivid: fix compose size exceed boundary

2022-11-04T15:56:44+00:00

syzkaller found a bug: BUG: unable to handle page fault for address: ffffc9000a3b1000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:memcpy_erms+0x6/0x10 [...] Call Trace: ? tpg_fill_plane_buffer+0x856/0x15b0 vivid_fillbuff+0x8ac/0x1110 vivid_thread_vid_cap_tick+0x361/0xc90 vivid_thread_vid_cap+0x21a/0x3a0 kthread+0x143/0x180 ret_from_fork+0x1f/0x30 This is because we forget to check boundary after adjust compose->height int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem for this case. Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") Signed-off-by: Liu Shixin Signed-off-by: Hans Verkuil

media: vivid: set num_in/outputs to 0 if not supported

2022-10-25T15:43:34+00:00

If node_types does not have video/vbi/meta inputs or outputs, then set num_inputs/num_outputs to 0 instead of 1. Signed-off-by: Hans Verkuil Fixes: 0c90f649d2f5 (media: vivid: add vivid_create_queue() helper) Signed-off-by: Mauro Carvalho Chehab