summaryrefslogtreecommitdiffstats
path: root/drivers/media/usb
Commit message (Collapse)AuthorAgeFilesLines
...
* media: usb: usbtv: Stop direct calls to queue num_buffers fieldBenjamin Gaignard2023-11-231-2/+3
| | | | | | | | | | | Use vb2_get_num_buffers() to avoid using queue num_buffers field directly. This allows us to change how the number of buffers is computed in the future. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: usb: hackrf: Stop direct calls to queue num_buffers fieldBenjamin Gaignard2023-11-231-2/+3
| | | | | | | | | | | | Use vb2_get_num_buffers() to avoid using queue num_buffers field directly. This allows us to change how the number of buffers is computed in the future. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> CC: Antti Palosaari <crope@iki.fi> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: usb: cx231xx: Stop direct calls to queue num_buffers fieldBenjamin Gaignard2023-11-232-4/+6
| | | | | | | | | | | Use vb2_get_num_buffers() to avoid using queue num_buffers field directly. This allows us to change how the number of buffers is computed in the future. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: usb: airspy: Stop direct calls to queue num_buffers fieldBenjamin Gaignard2023-11-231-2/+3
| | | | | | | | | | | Use vb2_get_num_buffers() to avoid using queue num_buffers field directly. This allows us to change how the number of buffers is computed in the future. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: cx231xx: Use EP5_BUF_SIZE macroJinjie Ruan2023-10-132-6/+5
| | | | | | | | | As Andrzej suggested, use EP5_BUF_SIZE macro to replace the other three places of 4096 in cx231xx with EP5_BUF_SIZE. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Suggested-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: dvb-usb-v2: af9035: fix missing unlockHans Verkuil2023-10-131-4/+9
| | | | | | | | | | | | | | | Instead of returning an error, goto the mutex unlock at the end of the function. Fixes smatch warning: drivers/media/usb/dvb-usb-v2/af9035.c:467 af9035_i2c_master_xfer() warn: inconsistent returns '&d->i2c_mutex'. Locked on : 326,387 Unlocked on: 465,467 Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Fixes: 7bf744f2de0a ("media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer") Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: cx231xx: Add EP5_BUF_SIZE and EP5_TIMEOUT_MS macrosJinjie Ruan2023-09-272-2/+5
| | | | | | | | | Define EP5_BUF_SIZE and EP5_TIMEOUT_MS macros to make the code more readable. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Suggested-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: cx231xx: Switch to use kmemdup() helperJinjie Ruan2023-09-271-2/+1
| | | | | | | | Use kmemdup() helper instead of open-coding to simplify the code. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: gspca: cpia1: shift-out-of-bounds in set_flickerRajeshwar R Shinde2023-09-271-0/+3
| | | | | | | | | | | | | | | | | | Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int' When the value of the variable "sd->params.exposure.gain" exceeds the number of bits in an integer, a shift-out-of-bounds error is reported. It is triggered because the variable "currentexp" cannot be left-shifted by more than the number of bits in an integer. In order to avoid invalid range during left-shift, the conditional expression is added. Reported-by: syzbot+e27f3dbdab04e43b9f73@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73 Signed-off-by: Rajeshwar R Shinde <coolrrsh@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: usb: siano: Use kmemdup to simplify kmalloc and memcpy logicChen Jiahao2023-09-271-3/+1
| | | | | | | | | Using kmemdup() helper function rather than implementing it again with kmalloc() + memcpy(), which improves the code readability. Signed-off-by: Chen Jiahao <chenjiahao16@huawei.com> Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: dvb-usb: gp8psk: Remove an unnecessary ternary operatorRuan Jinjie2023-09-271-1/+1
| | | | | | | | There is a ternary operator, the true or false judgement of which is unnecessary in C language semantics. Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: uvcvideo: Fix OOB readRicardo Ribalda2023-09-141-0/+3
| | | | | | | | | | | | | | If the index provided by the user is bigger than the mask size, we might do an out of bound read. CC: stable@kernel.org Fixes: 40140eda661e ("media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU") Reported-by: Zubin Mithra <zsm@chromium.org> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* media: v4l: Use correct dependency for camera sensor driversSakari Ailus2023-09-142-3/+3
| | | | | | | | | | | | | | The Kconfig option that enables compiling camera sensor drivers is VIDEO_CAMERA_SENSOR rather than MEDIA_CAMERA_SUPPORT as it was previously. Fix this. Also select VIDEO_OV7670 for marvell platform drivers only if MEDIA_SUBDRV_AUTOSELECT and VIDEO_CAMERA_SENSOR are enabled. Reported-by: Randy Dunlap <rdunlap@infradead.org> Fixes: 7d3c7d2a2914 ("media: i2c: Add a camera sensor top level menu") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* Merge tag 'media/v6.6-1' of ↵Linus Torvalds2023-09-0113-40/+85
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - new i2c drivers: ds90ub913, ds90ub953, ds90ub960, dw9719, ds90ub913 - new Intel IVSC MEI drivers - some Mediatek platform drivers were moved to a common location - Intel atomisp2 driver is now working with the main ov2680 driver. Due to that, the atomisp2 ov2680 staging one was removed - the bttv driver was finally converted to videobuf2 framework. This was the last one upstream using videobuf version 1 core. We'll likely remove the old videobuf framework on 6.7 - lots of improvements at atomisp driver: it now works with normal I2C sensors. Several compile-mode dependecies to select between ISP2400 and ISP2401 are now solved in runtime - a new ipu-bridge logic was added to work with IVSC MEI drivers - venus driver gained better support for new VPU versions - the v4l core async framework has gained lots of improvements and cleanups - lots of other cleanups, improvements and driver fixes * tag 'media/v6.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (358 commits) media: ivsc: Add ACPI dependency media: bttv: convert to vb2 media: bttv: use audio defaults for winfast2000 media: bttv: refactor bttv_set_dma() media: bttv: move vbi_skip/vbi_count out of buffer media: bttv: remove crop info from bttv_buffer media: bttv: remove tvnorm field from bttv_buffer media: bttv: remove format field from bttv_buffer media: bttv: move do_crop flag out of bttv_fh media: bttv: copy vbi_fmt from bttv_fh media: bttv: copy vid fmt/width/height from fh media: bttv: radio use v4l2_fh instead of bttv_fh media: bttv: replace BUG with WARN_ON media: bttv: use video_drvdata to get bttv media: i2c: rdacm21: Fix uninitialized value media: coda: Remove duplicated include media: vivid: fix the racy dev->radio_tx_rds_owner media: i2c: ccs: Check rules is non-NULL media: i2c: ds90ub960: Fix PLL config for 1200 MHz CSI rate media: i2c: ds90ub953: Fix use of uninitialized variables ...
| * media: usb: pvrusb2: fix inconsistent indentingHans Verkuil2023-08-101-2/+4
| | | | | | | | | | | | | | | | This resolves a new smatch warning; drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3293 pvr2_hdw_get_tuner_status() warn: inconsistent indenting Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * media: go7007: Remove redundant if statementColin Ian King2023-08-101-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The if statement that compares msgs[i].len != 3 is always false because it is in a code block where msg[i].len is equal to 3. The check is redundant and can be removed. As detected by cppcheck static analysis: drivers/media/usb/go7007/go7007-i2c.c:168:20: warning: Opposite inner 'if' condition leads to a dead code block. [oppositeInnerCondition] Link: https://lore.kernel.org/linux-media/20230727174007.635572-1-colin.i.king@gmail.com Fixes: 866b8695d67e ("Staging: add the go7007 video driver") Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
| * media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xferZhang Shurong2023-07-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * media: dvb-usb: opera1: fix uninit-value in dvb_usb_adapter_dvb_initZhang Shurong2023-07-191-2/+7
| | | | | | | | | | | | | | | | | | | | | | If opera1_xilinx_rw fails, the mac address is not initialized. And opera1_read_mac_address does not handle this failure, which leads to the uninit-value in dvb_usb_adapter_dvb_init. Fix this by handling the failure of opera1_xilinx_rw. Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()Zhang Shurong2023-07-191-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * media: anysee: fix null-ptr-deref in anysee_master_xferZhang Shurong2023-07-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In anysee_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach anysee_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil: add spaces around +]
| * media: af9005: Fix null-ptr-deref in af9005_i2c_xferZhang Shurong2023-07-191-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9005_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()Zhang Shurong2023-07-191-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach dw2102_i2c_transfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 950e252cb469 ("[media] dw2102: limit messages to buffer size") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xferZhang Shurong2023-07-191-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()Christophe JAILLET2023-07-191-2/+3
| | | | | | | | | | | | | | | | | | | | | | 'read' is freed when it is known to be NULL, but not when a read error occurs. Revert the logic to avoid a small leak, should a m920x_read() call fail. Fixes: a2ab06d7c4d6 ("media: m920x: don't use stack on USB reads") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * media: ttusb-dec: remove unnecessary (void*) conversionsYu Zhe2023-07-191-6/+6
| | | | | | | | | | | | | | Pointer variables of void * type do not require type cast. Signed-off-by: Yu Zhe <yuzhe@nfschina.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * drivers: usb: smsusb: fix error handling code in smsusb_init_deviceDongliang Mu2023-07-191-10/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The previous commit 4b208f8b561f ("[media] siano: register media controller earlier")moves siano_media_device_register before smscore_register_device, and adds corresponding error handling code if smscore_register_device fails. However, it misses the following error handling code of smsusb_init_device. Fix this by moving error handling code at the end of smsusb_init_device and adding a goto statement in the following error handling parts. Fixes: 4b208f8b561f ("[media] siano: register media controller earlier") Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| * media: pvrusb2: use sysfs_emit() to instead of scnprintf()ye xingchen2023-07-191-10/+10
| | | | | | | | | | | | | | | | | | | | Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen <ye.xingchen@zte.com.cn> Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* | media: uvcvideo: Fix menu count handling for userspace XU mappingsLaurent Pinchart2023-07-281-1/+1
|/ | | | | | | | | | | | | | | | | When commit 716c330433e3 ("media: uvcvideo: Use standard names for menus") reworked the handling of menu controls, it inadvertently replaced a GENMASK(n - 1, 0) with a BIT_MASK(n). The latter isn't equivalent to the former, which broke adding XU mappings from userspace. Fix it. Link: https://lore.kernel.org/linux-media/468a36ec-c3ac-cb47-e12f-5906239ae3cd@spahan.ch/ Cc: stable@vger.kernel.org Reported-by: Poncho <poncho@spahan.ch> Fixes: 716c330433e3 ("media: uvcvideo: Use standard names for menus") Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: usb: as102: drop as102_dev NULL checkHans Verkuil2023-06-091-4/+2
| | | | | | | | | | | Fixes this smatch warning: drivers/media/usb/as102/as102_usb_drv.c:306 as102_usb_release() warn: can 'as102_dev' even be NULL? And indeed, as102_dev can never be NULL, so just drop the NULL check. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: uvcvideo: Constify descriptor buffersLaurent Pinchart2023-06-091-3/+3
| | | | | | | | | | There is no need to modify the content of UVC descriptor buffers during parsing. Make all the corresponding pointers const to avoid unintended modifications. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: uvcvideo: Constify formats, frames and intervalsLaurent Pinchart2023-06-094-33/+34
| | | | | | | | | | | The formats, frames and intervals stored in the uvc_streaming structure are not meant to change after being parsed at probe time. Make them const to prevent unintended modifications, and adapt the probe code accordingly to use non-const pointers during parsing. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: uvcvideo: Increment intervals pointer at end of parsingLaurent Pinchart2023-06-091-4/+13
| | | | | | | | | | | | | | | | The intervals pointer is incremented for each interval when parsing the format descriptor. This doesn't cause any issue as such, but gets in the way of constifying some pointers. Modify the parsing code to index the intervals pointer as an array and increment it in one go at end of parsing. Careful readers will notice that the maxIntervalIndex variable is set to 1 instead of n - 2 when bFrameIntervalType has a zero value. This is functionally equivalent, as n is equal to 3 in that case. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: uvcvideo: Reorganize format descriptor parsingLaurent Pinchart2023-06-091-15/+25
| | | | | | | | | | | Format descriptor parsing has grown over time and now mixes parsing of frame intervals with various quirk handling. Reorganize it to make the code easier to follow, by parsing frame intervals first, and then applying fixes and quirks. No functional change is intended. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: uvcvideo: Use clamp() to replace manual implementationLaurent Pinchart2023-06-091-3/+3
| | | | | | | | | | The kernel has a nice clamp() macro, use it to replace a manual implementation based on min() and max(). No functional change is intended. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: uvcvideo: Rename uvc_format 'frame' field to 'frames'Laurent Pinchart2023-06-094-24/+24
| | | | | | | | | The uvc_format 'frame' field points to an array of frames. Rename it to 'frames' to make this clearer. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: uvcvideo: Rename uvc_streaming 'format' field to 'formats'Laurent Pinchart2023-06-094-14/+14
| | | | | | | | | The uvc_streaming 'format' field points to an array of formats. Rename it to 'formats' to make this clearer. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: uvcvideo: Enable Intel RealSense metadata for devicesDmitry Perchanov2023-06-091-0/+63
| | | | | | | | | | | | | | Intel RealSense UVC Depth cameras produce metadata in a vendor-specific format that is already supported by the uvcvideo driver. Enable handling of this metadata for 7 additional RealSense devices. Co-developed-by: Yu MENG <yu1.meng@intel.com> Co-developed-by: Evgeni Raikhel <evgeni.raikhel@intel.com> Signed-off-by: Dmitry Perchanov <dmitry.perchanov@intel.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* Revert "media: uvcvideo: Limit power line control for Acer EasyCamera"Sakari Ailus2023-06-091-9/+0
| | | | | | | | | | | | | | | This reverts commit 5dd0eab84ae9a4b292baf1ad02e1a273c475cd04. Revert this patch as it has been merged twice. The earlier merged commit is 81e78a6fc320 ("media: uvcvideo: Limit power line control for Acer EasyCamera"). Reported-by: Dmitry Perchanov <dmitry.perchanov@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* Merge tag 'v6.4-rc5' into media_stageMauro Carvalho Chehab2023-06-091-5/+11
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux 6.4-rc5 * tag 'v6.4-rc5': (919 commits) Linux 6.4-rc5 leds: qcom-lpg: Fix PWM period limits selftests/ftrace: Choose target function for filter test from samples KVM: selftests: Add test for race in kvm_recalculate_apic_map() KVM: x86: Bail from kvm_recalculate_phys_map() if x2APIC ID is out-of-bounds KVM: x86: Account fastpath-only VM-Exits in vCPU stats KVM: SVM: vNMI pending bit is V_NMI_PENDING_MASK not V_NMI_BLOCKING_MASK KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker tpm, tpm_tis: correct tpm_tis_flags enumeration values Revert "ext4: remove ac->ac_found > sbi->s_mb_min_to_scan dead check in ext4_mb_check_limits" media: uvcvideo: Don't expose unsupported formats to userspace media: v4l2-subdev: Fix missing kerneldoc for client_caps media: staging: media: imx: initialize hs_settle to avoid warning media: v4l2-mc: Drop subdev check in v4l2_create_fwnode_links_to_pad() riscv: Implement missing huge_ptep_get riscv: Fix huge_ptep_set_wrprotect when PTE is a NAPOT module/decompress: Fix error checking on zstd decompression fork, vhost: Use CLONE_THREAD to fix freezer/ps regression dt-bindings: serial: 8250_omap: add rs485-rts-active-high selinux: don't use make's grouped targets feature yet ...
| * media: uvcvideo: Don't expose unsupported formats to userspaceLaurent Pinchart2023-06-021-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the uvcvideo driver encounters a format descriptor with an unknown format GUID, it creates a corresponding struct uvc_format instance with the fcc field set to 0. Since commit 50459f103edf ("media: uvcvideo: Remove format descriptions"), the driver relies on the V4L2 core to provide the format description string, which the V4L2 core can't do without a valid 4CC. This triggers a WARN_ON. As a format with a zero 4CC can't be selected, it is unusable for applications. Ignore the format completely without creating a uvc_format instance, which fixes the warning. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217252 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2180107 Fixes: 50459f103edf ("media: uvcvideo: Remove format descriptions") Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* | media: mc: Make media_get_pad_index() use pad type flagSakari Ailus2023-05-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | Use the pad flag specifying the pad type instead of a boolean in preparation for internal source pads. Also make the loop variable unsigned. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* | media: Switch i2c drivers back to use .probe()Uwe Kleine-König2023-05-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | After commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new() call-back type"), all drivers being converted to .probe_new() and then commit 03c835f498b5 ("i2c: Switch .probe() to not take an id parameter") convert back to (the new) .probe() to be able to eventually drop .probe_new() from struct i2c_driver. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* | media: usb: siano: Fix warning due to null work_func_t function pointerDuoming Zhou2023-05-251-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The previous commit ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb") adds cancel_work_sync() in smsusb_stop_streaming(). But smsusb_stop_streaming() may be called, even if the work_struct surb->wq has not been initialized. As a result, the warning will occur. One of the processes that could lead to warning is shown below: smsusb_probe() smsusb_init_device() if (!dev->in_ep || !dev->out_ep || align < 0) { smsusb_term_device(intf); smsusb_stop_streaming() cancel_work_sync(&dev->surbs[i].wq); __cancel_work_timer() __flush_work() if (WARN_ON(!work->func)) // work->func is null The log reported by syzbot is shown below: WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063 Modules linked in: CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0 RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066 ... RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246 RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8 RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8 R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160 smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline] smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344 smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419 smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567 ... This patch adds check before cancel_work_sync(). If surb->wq has not been initialized, the cancel_work_sync() will not be executed. Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* | media: usb: remove unnecessary (void*) conversionsSu Hui2023-05-252-9/+9
| | | | | | | | | | | | | | | | | | No need cast (void*) to (struct dvb_usb_device *) or (struct filter_info *). Signed-off-by: Su Hui <suhui@nfschina.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil: drop the obsolete dvb-usb/az6027.c and dvb-usb/pctv452e.c changes]
* | media: stk1160: Simplify the build config definitionLukas Bulwahn2023-05-251-9/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit dfb9f94e8e5e ("[media] stk1160: Build as a module if SND is m and audio support is selected") had to introduce some complex config dependency handling to compile for all combinations of configs VIDEO_STK1160 and VIDEO_STK1160_AC97. Later, commit e36e6b5f26c1 ("[media] stk1160: Remove stk1160-mixer and setup internal AC97 codec automatically") removes the config VIDEO_STK1160_AC97, which renders the previous dependency handling unnecessary. The commit already simplified the dependency of the remaining config VIDEO_STK1160, but it misses the opportunity to merge VIDEO_STK1160 and VIDEO_STK1160_COMMON. So, do that now and simplify the build config definition of the STK1160 USB video capture support. Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* | media: usb: Check az6007_read() return valueDaniil Dulov2023-05-251-1/+2
| | | | | | | | | | | | | | | | | | | | If az6007_read() returns error, there is no sence to continue. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter") Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
* | media: dw2102: return -EIO instead of -1 for mac address read errorsMauro Carvalho Chehab2023-05-141-3/+3
| | | | | | | | | | | | | | | | | | The dvb-usb core function only checks if the returned value is zero, so it doesn't actually matter the error code. Still, returning -1 as an error condition is something that we don't do upstream. So, change the logic to return -EIO in case of I2C transfer failures. Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* | media: dvb-usb: remove unnecessary (void*) conversionsYu Zhe2023-05-146-44/+38
|/ | | | | | | | Pointer variables of void * type do not require type cast. Link: https://lore.kernel.org/linux-media/20230320064039.5670-1-yuzhe@nfschina.com Signed-off-by: Yu Zhe <yuzhe@nfschina.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()Hyunwoo Kim2023-05-141-2/+1
| | | | | | | | | | | | | | | Since dvb_frontend_detach() is not called in ttusb_dec_exit_dvb(), which is called when the device is disconnected, dvb_frontend_free() is not finally called. This causes a memory leak just by repeatedly plugging and unplugging the device. Fix this issue by adding dvb_frontend_detach() to ttusb_dec_exit_dvb(). Link: https://lore.kernel.org/linux-media/20221117045925.14297-5-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
* media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_addressWei Chen2023-05-141-1/+1
| | | | | | | | | | | | | In su3000_read_mac_address, if i2c_transfer fails to execute two messages, array mac address will not be initialized. Without handling such error, later in function dvb_usb_adapter_dvb_init, proposed_mac is accessed before initialization. Fix this error by returning a negative value if message execution fails. Link: https://lore.kernel.org/linux-media/20230328124416.560889-1-harperchen1110@gmail.com Signed-off-by: Wei Chen <harperchen1110@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-13 16:27:54 +0000