linux.git/drivers/media/rc, branch v5.15.185

media: streamzap: fix race between device disconnection and urb callback

2025-05-02T05:44:25+00:00

[ Upstream commit f656cfbc7a293a039d6a0c7100e1c846845148c1 ]

Syzkaller has reported a general protection fault at function
ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer
dereference of dev->raw pointer, even though it is checked for NULL in
the same function, which means there is a race condition. It occurs due
to the incorrect order of actions in the streamzap_disconnect() function:
rc_unregister_device() is called before usb_kill_urb(). The dev->raw
pointer is freed and set to NULL in rc_unregister_device(), and only
after that usb_kill_urb() waits for in-progress requests to finish.

If rc_unregister_device() is called while streamzap_callback() handler is
not finished, this can lead to accessing freed resources. Thus
rc_unregister_device() should be called after usb_kill_urb().

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: 8e9e60640067 ("V4L/DVB: staging/lirc: port lirc_streamzap to ir-core")
Cc: stable@vger.kernel.org
Reported-by: syzbot+34008406ee9a31b13c73@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=34008406ee9a31b13c73
Signed-off-by: Murad Masimov 
Signed-off-by: Sean Young 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: streamzap: remove unused struct members

2025-05-02T05:44:25+00:00

[ Upstream commit 4df69e46c352df9bdbe859824da33428a3ce8a1d ]

These struct members do not serve any purpose.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Stable-dep-of: f656cfbc7a29 ("media: streamzap: fix race between device disconnection and urb callback")
Signed-off-by: Sasha Levin

media: streamzap: less chatter

2025-05-02T05:44:25+00:00

[ Upstream commit 35088717ad24140b6ab0ec00ef357709be607526 ]

Remove superfluous messages which add no information.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Stable-dep-of: f656cfbc7a29 ("media: streamzap: fix race between device disconnection and urb callback")
Signed-off-by: Sasha Levin

media: streamzap: no need for usb pid/vid in device name

2025-05-02T05:44:25+00:00

[ Upstream commit 7a25e6849ad73de5aa01d62da43071bc02b8530c ]

The usb pid/vid can be found elsewhere, the idVendor/idProduct usb sysfs
files for example.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Stable-dep-of: f656cfbc7a29 ("media: streamzap: fix race between device disconnection and urb callback")
Signed-off-by: Sasha Levin

media: streamzap: remove unnecessary ir_raw_event_reset and handle

2025-05-02T05:44:25+00:00

[ Upstream commit 4bed9306050497f49cbe77b842f0d812f4f27593 ]

There is no reason to have a reset after an IR timeout.
Calling ir_raw_event_handle() twice for the same interrupt has no
affect.

Fixes: 56b0ec30c4bc ("[media] rc/streamzap: fix reporting response times")
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Stable-dep-of: f656cfbc7a29 ("media: streamzap: fix race between device disconnection and urb callback")
Signed-off-by: Sasha Levin

media: streamzap: prevent processing IR data on URB failure

2025-05-02T05:44:00+00:00

commit 549f6d348167fb2f7800ed7c8d4bce9630c74498 upstream.

If streamzap_callback() receives an urb with any non-critical error
status, i.e. any error code other than -ECONNRESET, -ENOENT or -ESHUTDOWN,
it will try to process IR data, ignoring a possible transfer failure.

Make streamzap_callback() process IR data only when urb->status is 0.
Move processing logic to a separate function to make code cleaner and
more similar to the URB completion handlers in other RC drivers.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: 19770693c354 ("V4L/DVB: staging/lirc: add lirc_streamzap driver")
Cc: stable@vger.kernel.org
Signed-off-by: Murad Masimov 
Signed-off-by: Sean Young 
Signed-off-by: Hans Verkuil 
Signed-off-by: Greg Kroah-Hartman

media: rc: iguanair: handle timeouts

2025-03-13T11:50:08+00:00

[ Upstream commit b98d5000c50544f14bacb248c34e5219fbe81287 ]

In case of a timeout the IO must be cancelled or
the next IO using the URB will fail and/or overwrite
an operational URB.

The automatic bisection fails because it arrives
at a commit that correctly lets the test case run
without an error.

Signed-off-by: Oliver Neukum 
Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for command responses")
Reported-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004.GAE@google.com/
Tested-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

lirc: rc_dev_get_from_fd(): fix file leak

2024-08-19T03:45:25+00:00

[ Upstream commit bba1f6758a9ec90c1adac5dcf78f8a15f1bad65b ]

missing fdput() on a failure exit

Fixes: 6a9d552483d50 "media: rc: bpf attach/detach requires write permission" # v6.9
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin

media: imon: Fix race getting ictx->lock

2024-08-19T03:45:00+00:00

[ Upstream commit 24147897507cd3a7d63745d1518a638bf4132238 ]

Lets fix a race between mutex_is_lock() and mutex_lock().

<-mutex is not locked
if (!mutex_is_locked(&ictx->lock)) {
	unlock = true; <- mutex is locked externaly
	mutex_lock(&ictx->lock);
}

Let's use mutex_trylock() that does mutex_is_lock() and mutex_lock()
atomically.

Fix the following cocci warning:
drivers/media/rc/imon.c:1167:1-7: preceding lock on line 1153

Fixes: 23ef710e1a6c ("[media] imon: add conditional locking in change_protocol")
Signed-off-by: Ricardo Ribalda 
Signed-off-by: Sean Young 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: rc: bpf attach/detach requires write permission

2024-02-23T07:55:07+00:00

commit 6a9d552483d50953320b9d3b57abdee8d436f23f upstream.

Note that bpf attach/detach also requires CAP_NET_ADMIN.

Cc: stable@vger.kernel.org
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman