kernel/git/stable/linux.git/drivers/media/dvb-frontends, branch linux-6.15.y

media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar

2025-08-20T16:36:21+00:00

[ Upstream commit ed0234c8458b3149f15e496b48a1c9874dd24a1b ] In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Alex Guo Link: https://lore.kernel.org/r/20250616013353.738790-1-alexguo1023@gmail.com Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()

2025-08-20T16:36:21+00:00

[ Upstream commit ce5cac69b2edac3e3246fee03e8f4c2a1075238b ] In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1]. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Alex Guo Link: https://lore.kernel.org/r/20250616013231.730221-1-alexguo1023@gmail.com Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

Merge tag 'objtool-urgent-2025-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2025-04-02T17:30:10+00:00

Pull objtool fixes from Ingo Molnar: "These are objtool fixes and updates by Josh Poimboeuf, centered around the fallout from the new CONFIG_OBJTOOL_WERROR=y feature, which, despite its default-off nature, increased the profile/impact of objtool warnings: - Improve error handling and the presentation of warnings/errors - Revert the new summary warning line that some test-bot tools interpreted as new regressions - Fix a number of objtool warnings in various drivers, core kernel code and architecture code. About half of them are potential problems related to out-of-bounds accesses or potential undefined behavior, the other half are additional objtool annotations - Update objtool to latest (known) compiler quirks and objtool bugs triggered by compiler code generation - Misc fixes" * tag 'objtool-urgent-2025-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (36 commits) objtool/loongarch: Add unwind hints in prepare_frametrace() rcu-tasks: Always inline rcu_irq_work_resched() context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() sched/smt: Always inline sched_smt_active() objtool: Fix verbose disassembly if CROSS_COMPILE isn't set objtool: Change "warning:" to "error: " for fatal errors objtool: Always fail on fatal errors Revert "objtool: Increase per-function WARN_FUNC() rate limit" objtool: Append "()" to function name in "unexpected end of section" warning objtool: Ignore end-of-section jumps for KCOV/GCOV objtool: Silence more KCOV warnings, part 2 objtool, drm/vmwgfx: Don't ignore vmw_send_msg() for ORC objtool: Fix STACK_FRAME_NON_STANDARD for cold subfunctions objtool: Fix segfault in ignore_unreachable_insn() objtool: Fix NULL printf() '%s' argument in builtin-check.c:save_argv() objtool, lkdtm: Obfuscate the do_nothing() pointer objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc() objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler() objtool, Input: cyapa - Remove undefined behavior in cyapa_update_fw_store() objtool, panic: Disable SMAP in __stack_chk_fail() ...

Merge tag 'media/v6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2025-03-26T04:00:31+00:00

Pull media updates from Mauro Carvalho Chehab: - platform: synopsys: hdmirx: Fix 64-bit division for 32-bit targets - vim2m: print device name after registering device - Synopsys DesignWare HDMI RX Driver and various fixes - cec/printk fixes and the removal of the vidioc_g/s_ctrl and vidioc_queryctrl callbacks - AVerMedia H789-C PCIe support and rc-core structs padding - Several camera sensor patches - uvcvideo improvements - visl: Fix ERANGE error when setting enum controls - codec fixes - V4L2 camera sensor patches mostly - chips-media: wave5: Fixes - Add SDM670 camera subsystem - Qualcomm iris video decoder driver - dt-bindings: update clocks for sc7280-camss - various fixes and enhancements * tag 'media/v6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (264 commits) media: pci: mgb4: include linux/errno.h media: synopsys: hdmirx: Fix signedness bug in hdmirx_parse_dt() media: platform: synopsys: hdmirx: Fix 64-bit division for 32-bit targets media: vim2m: print device name after registering device media: vivid: Introduce VIDEO_VIVID_OSD media: vivid: Move all fb_info references into vivid-osd media: platform: synopsys: hdmirx: Optimize struct snps_hdmirx_dev media: platform: synopsys: hdmirx: Remove unused HDMI audio CODEC relics media: platform: synopsys: hdmirx: Remove duplicated header inclusion media: qcom: Clean up Kconfig dependencies media: dvb-frontends: tda10048: Make the range of z explicit. media: platform: stm32: Add check for clk_enable() media: xilinx-tpg: fix double put in xtpg_parse_of() media: siano: Fix error handling in smsdvb_module_init() media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() media: i2c: tda1997x: Call of_node_put(ep) only once in tda1997x_parse_dt() dt-bindings: media: mediatek,vcodec: Revise description dt-bindings: media: mediatek,jpeg: Relax IOMMU max item count media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() media: rockchip: rga: fix rga offset lookup ...

objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()

2025-03-25T22:00:15+00:00

If dib8000_set_dds()'s call to dib8000_read32() returns zero, the result is a divide-by-zero. Prevent that from happening. Fixes the following warning with an UBSAN kernel: drivers/media/dvb-frontends/dib8000.o: warning: objtool: dib8000_tune() falls through to next function dib8096p_cfg_DibRx() Fixes: 173a64cb3fcf ("[media] dib8000: enhancement") Reported-by: kernel test robot Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Mauro Carvalho Chehab Cc: Linus Torvalds Link: https://lore.kernel.org/r/bd1d504d930ae3f073b1e071bcf62cae7708773c.1742852847.git.jpoimboe@kernel.org Closes: https://lore.kernel.org/r/202503210602.fvH5DO1i-lkp@intel.com/

media: rtl2832_sdr: assign vb2 lock before vb2_queue_init

2025-03-12T15:43:51+00:00

Commit c780d01cf1a6 ("media: vb2: vb2_core_queue_init(): sanity check lock and wait_prepare/finish") added a sanity check to ensure that if there are no wait_prepare/finish callbacks set by the driver, then the vb2_queue lock must be set, since otherwise the vb2 core cannot do correct locking. The rtl2832_sdr.c triggered this warning: it turns out that while the driver does set this lock, it sets it too late. So move it up to before the vb2_queue_init() call. Reported-by: Arthur Marsh Closes: https://lore.kernel.org/linux-media/20241211042355.8479-1-user@am64/ Fixes: 8fcd2795d22a ("media: rtl2832_sdr: drop vb2_ops_wait_prepare/finish") Cc: stable@vger.kernel.org Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Hans Verkuil

media: dvb-frontends: tda10048: Make the range of z explicit.

2025-03-06T16:28:30+00:00

The datasheet recommends 55MHz frequency sampling, with a max of 69 MHz. (Kudos to Kosta Stefanov for the calculations). Replace z with a 32 bit uint, and make the range of the variable explicit. Found by cocci: drivers/media/dvb-frontends/tda10048.c:345:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead. Reviewed-by: Kosta Stefanov Signed-off-by: Ricardo Ribalda Signed-off-by: Hans Verkuil

media: dvb: Fix spelling mistake "ofset" -> "offset"

2025-03-05T16:40:18+00:00

There is a spelling mistake in a dprink message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Hans Verkuil

media: dibx000_common: Constify struct i2c_algorithm

2025-02-21T09:33:10+00:00

'struct i2c_algorithm' is not modified in this driver. Constifying this structure moves some data to a read-only section, so increase overall security, especially when the structure holds some function pointers. To do so, the prototype of i2c_adapter_init() has to be updated as well. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 17213 932 20 18165 46f5 drivers/media/dvb-frontends/dibx000_common.o After: ===== text data bss dec hex filename 17490 660 20 18170 46fa drivers/media/dvb-frontends/dibx000_common.o Signed-off-by: Christophe JAILLET Signed-off-by: Hans Verkuil

Merge tag 'media/v6.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2025-01-25T23:59:46+00:00

Pull media updates from Mauro Carvalho Chehab: - Sensor driver fixes - remove dead TI wl128x FM radio driver - Add support for the imx462 sensor at the IMX290 binding - V4L2 pixel data transmitter and receiver documentation improvements - Add support for MIPI Discovery and Configuration for C-PHY line orders - imx8-isi fixes and improvements - stm32: dcmipp: add core support for the stm32mp25 - qcom: camss: Add sc7280 support - Various fixes and enhancements * tag 'media/v6.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (152 commits) media: nuvoton: Fix an error check in npcm_video_ece_init() media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer media: platform: rzg2l-cru: rzg2l-video: Fix the comment in rzg2l_cru_start_streaming_vq() media: fix secfeed undefined when filter alloc fail media: dt-bindings: trivial white-space and example cleanup MAINTAINERS: repair file entry in MEDIA DRIVERS FOR STM32 - CSI media: solo6x10: Use const 'struct bin_attribute' callback media: saa7164: Remove unused values staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() media: platform: exynos4-is: Remove unused __is_get_frame_size media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread media: mmp: Bring back registration of the device media: cec: include linux/debugfs.h and linux/seq_file.h where needed Revert "media: qcom: camss: Restructure camss_link_entities" media: venus: Remove unused hfi_core_ping() media: dt-bindings: qcom-venus: Deprecate video-decoder and video-encoder where applicable media: venus: Populate video encoder/decoder nodename entries media: venus: Add support for static video encoder/decoder declarations media: venus: match instance creation and destruction order media: venus: destroy hfi session after m2m_ctx release ...