linux.git/drivers/media/usb, branch v6.1.2

media: dvb-usb: fix memory leak in dvb_usb_adapter_init()

2022-12-31T12:33:03+00:00

[ Upstream commit 94d90fb06b94a90c176270d38861bcba34ce377d ]

Syzbot reports a memory leak in "dvb_usb_adapter_init()".
The leak is due to not accounting for and freeing current iteration's
adapter->priv in case of an error. Currently if an error occurs,
it will exit before incrementing "num_adapters_initalized",
which is used as a reference counter to free all adap->priv
in "dvb_usb_adapter_exit()". There are multiple error paths that
can exit from before incrementing the counter. Including the
error handling paths for "dvb_usb_adapter_stream_init()",
"dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()"
within "dvb_usb_adapter_init()".

This means that in case of an error in any of these functions the
current iteration is not accounted for and the current iteration's
adap->priv is not freed.

Fix this by freeing the current iteration's adap->priv in the
"stream_init_err:" label in the error path. The rest of the
(accounted for) adap->priv objects are freed in dvb_usb_adapter_exit()
as expected using the num_adapters_initalized variable.

Syzbot report:

BUG: memory leak
unreferenced object 0xffff8881172f1a00 (size 512):
  comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
backtrace:
    [] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline]
    [] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline]
    [] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308
    [] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883
    [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [] call_driver_probe drivers/base/dd.c:542 [inline]
    [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621
    [] really_probe drivers/base/dd.c:583 [inline]
    [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752
    [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782
    [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899
    [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [] __device_attach+0x122/0x260 drivers/base/dd.c:970
    [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
    [] device_add+0x5fb/0xdf0 drivers/base/core.c:3405
    [] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170
    [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
    [] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
    [] call_driver_probe drivers/base/dd.c:542 [inline]
    [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621
    [] really_probe drivers/base/dd.c:583 [inline]
    [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752

Link: https://syzkaller.appspot.com/bug?extid=f66dd31987e6740657be
Reported-and-tested-by: syzbot+f66dd31987e6740657be@syzkaller.appspotmail.com

Link: https://lore.kernel.org/linux-media/20220824012152.539788-1-mazinalhaddad05@gmail.com
Signed-off-by: Mazin Al Haddad 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()

2022-12-31T12:32:16+00:00

[ Upstream commit 0ed554fd769a19ea8464bb83e9ac201002ef74ad ]

Wei Chen reports a kernel bug as blew:

general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
...
Call Trace:

__i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109
i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170
i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297
i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fd834a8bded

In az6027_i2c_xfer(), if msg[i].addr is 0x99,
a null-ptr-deref will caused when accessing msg[i].buf.
For msg[i].len is 0 and msg[i].buf is null.

Fix this by checking msg[i].len in az6027_i2c_xfer().

Link: https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpqV+p8mPLNg-Fok0gw8gZ=zemAfMGTzMg@mail.gmail.com/

Link: https://lore.kernel.org/linux-media/20221120065918.2160782-1-zhongbaisong@huawei.com
Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver")
Reported-by: Wei Chen 
Signed-off-by: Baisong Zhong 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

Merge tag 'media/v6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2022-10-22T22:30:15+00:00

Pull missed media updates from Mauro Carvalho Chehab:
 "It seems I screwed-up my previous pull request: it ends up that only
  half of the media patches that were in linux-next got merged in -rc1.

  The script which creates the signed tags silently failed due to
  5.19->6.0 so it ended generating a tag with incomplete stuff.

  So here are the missing parts:

   - a DVB core security fix

   - lots of fixes and cleanups for atomisp staging driver

   - old drivers that are VB1 are being moved to staging to be
     deprecated

   - several driver updates - mostly for embedded systems, but there are
     also some things addressing issues with some PC webcams, in the UVC
     video driver"

* tag 'media/v6.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (163 commits)
  media: sun6i-csi: Move csi buffer definition to main header file
  media: sun6i-csi: Introduce and use video helper functions
  media: sun6i-csi: Add media ops with link notify callback
  media: sun6i-csi: Remove controls handler from the driver
  media: sun6i-csi: Register the media device after creation
  media: sun6i-csi: Pass and store csi device directly in video code
  media: sun6i-csi: Tidy up video code
  media: sun6i-csi: Tidy up v4l2 code
  media: sun6i-csi: Tidy up Kconfig
  media: sun6i-csi: Use runtime pm for clocks and reset
  media: sun6i-csi: Define and use variant to get module clock rate
  media: sun6i-csi: Always set exclusive module clock rate
  media: sun6i-csi: Tidy up platform code
  media: sun6i-csi: Refactor main driver data structures
  media: sun6i-csi: Define and use driver name and (reworked) description
  media: cedrus: Add a Kconfig dependency on RESET_CONTROLLER
  media: sun8i-rotate: Add a Kconfig dependency on RESET_CONTROLLER
  media: sun8i-di: Add a Kconfig dependency on RESET_CONTROLLER
  media: sun4i-csi: Add a Kconfig dependency on RESET_CONTROLLER
  media: sun6i-csi: Add a Kconfig dependency on RESET_CONTROLLER
  ...

Merge tag 'usb-6.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2022-10-07T23:48:26+00:00

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver changes for 6.1-rc1.

  Nothing major in here, lots of little things with new devices
  supported and updates for a few drivers. Highlights include:

   - thunderbolt/USB4 devices supported a bit better than before, and
     some new ids to enable new hardware devices

   - USB gadget uvc updates for newer video formats and better v4l
     integration (the v4l portions were acked by those maintainers)

   - typec updates for tiny issues and more typec drivers for new chips.

   - xhci tiny updates for minor issues

   - big usb-serial ftdi_sio driver update to handle new devices better

   - lots of tiny dwc3 fixes and updates for the IP block that is
     showing up everywhere these days

   - dts updates for new devices being supported

   - other tiny janitorial and cleanups fixes for lots of different USB
     drivers. Full details are in the shortlog.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-6.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (169 commits)
  usb: gadget: uvc: don't put item still in use
  usb: gadget: uvc: Fix argument to sizeof() in uvc_register_video()
  usb: host: ehci-exynos: switch to using gpiod API
  Revert "usb: dwc3: Don't switch OTG -> peripheral if extcon is present"
  Revert "USB: fixup for merge issue with "usb: dwc3: Don't switch OTG -> peripheral if extcon is present""
  dt-bindings: usb: Convert FOTG210 to dt schema
  usb: mtu3: fix failed runtime suspend in host only mode
  USB: omap_udc: Fix spelling mistake: "tranceiver_ctrl" -> "transceiver_ctrl"
  usb: typec: ucsi_ccg: Disable UCSI ALT support on Tegra
  usb: typec: Replace custom implementation of device_match_fwnode()
  usb: typec: ucsi: Don't warn on probe deferral
  usb: add quirks for Lenovo OneLink+ Dock
  MAINTAINERS: switch dwc3 to Thinh
  usb: idmouse: fix an uninit-value in idmouse_open
  USB: PHY: JZ4770: Switch to use dev_err_probe() helper
  usb: phy: generic: Switch to use dev_err_probe() helper
  usb: ulpi: use DEFINE_SHOW_ATTRIBUTE to simplify ulpi_regs
  usb: cdns3: remove dead code
  usb: cdc-wdm: Use skb_put_data() instead of skb_put/memcpy pair
  usb: musb: sunxi: Switch to use dev_err_probe() helper
  ...

Merge tag 'media/v6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2022-10-07T18:04:35+00:00

Pull media updates from Mauro Carvalho Chehab:

 - New driver for Mediatek MDP V3

 - New driver for NXP i.MX DW100 dewarper

 - Zoran driver got promoted from staging

 - Hantro and related drivers got promoted from staging

 - Several VB1 drivers got moved to staging/deprecated (cpia2, fsl-viu,
   meye, saa7146, av7110, stkwebcam, tm6000, vpfe_capture, davinci,
   zr364xx)

 - Usual set of driver fixes, improvements and cleanups

* tag 'media/v6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (107 commits)
  media: destage Hantro VPU driver
  media: platform: mtk-mdp3: add MediaTek MDP3 driver
  media: dt-binding: mediatek: add bindings for MediaTek CCORR and WDMA
  media: dt-binding: mediatek: add bindings for MediaTek MDP3 components
  media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
  media: xilinx: video: Add 1X12 greyscale format
  media: xilinx: csi2rxss: Add 1X12 greyscale format
  media: staging: media: imx: imx7-media-csi: Increase video mem limit
  media: uvcvideo: Limit power line control for Sonix Technology
  media: uvcvideo: Use entity get_cur in uvc_ctrl_set
  media: uvcvideo: Fix typo 'the the' in comment
  media: uvcvideo: Use indexed loops in uvc_ctrl_init_ctrl()
  media: uvcvideo: Fix memory leak in uvc_gpio_parse
  media: renesas: vsp1: Add support for RZ/G2L VSPD
  media: renesas: vsp1: Add VSP1_HAS_NON_ZERO_LBA feature bit
  media: renesas: vsp1: Add support for VSP software version
  media: renesas: vsp1: Add support to deassert/assert reset line
  media: dt-bindings: media: renesas,vsp1: Document RZ/G2L VSPD bindings
  media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
  media: amphion: fix a bug that vpu core may not resume after suspend
  ...

Merge tag 'i2c-for-6.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

2022-10-05T01:54:33+00:00

Pull i2c updates from Wolfram Sang:

 - 'remove' callback converted to return void. Big change with trivial
   fixes all over the tree. Other subsystems depending on this change
   have been asked to pull an immutable topic branch for this.

 - new driver for Microchip PCI1xxxx switch

 - heavy refactoring of the Mellanox BlueField driver

 - we prefer async probe in the i801 driver now

 - the rest is usual driver updates (support for more SoCs, some
   refactoring, some feature additions)

* tag 'i2c-for-6.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (37 commits)
  i2c: pci1xxxx: prevent signed integer overflow
  i2c: acpi: Replace zero-length array with DECLARE_FLEX_ARRAY() helper
  i2c: i801: Prefer async probe
  i2c: designware-pci: Use standard pattern for memory allocation
  i2c: designware-pci: Group AMD NAVI quirk parts together
  i2c: microchip: pci1xxxx: Add driver for I2C host controller in multifunction endpoint of pci1xxxx switch
  docs: i2c: slave-interface: return errno when handle I2C_SLAVE_WRITE_REQUESTED
  i2c: mlxbf: remove device tree support
  i2c: mlxbf: support BlueField-3 SoC
  i2c: cadence: Add standard bus recovery support
  i2c: mlxbf: add multi slave functionality
  i2c: mlxbf: support lock mechanism
  macintosh/ams: Adapt declaration of ams_i2c_remove() to earlier change
  i2c: riic: Use devm_platform_ioremap_resource()
  i2c: mlxbf: remove IRQF_ONESHOT
  dt-bindings: i2c: rockchip: add rockchip,rk3128-i2c
  dt-bindings: i2c: renesas,rcar-i2c: Add r8a779g0 support
  i2c: tegra: Add GPCDMA support
  i2c: scmi: Convert to be a platform driver
  i2c: rk3x: Add rv1126 support
  ...

Merge tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2022-10-01T16:27:18+00:00

Pull media fixes from Mauro Carvalho Chehab:

 - some fixes for the v4l2 ioctl handler logic

 - a fix for an out of bound access in the DVB videobuf2 handler

 - three driver fixes (rkvdec, mediatek/vcodek and uvcvideo)

* tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: rkvdec: Disable H.264 error detection
  media: mediatek: vcodec: Drop platform_get_resource(IORESOURCE_IRQ)
  media: dvb_vb2: fix possible out of bound access
  media: v4l2-ioctl.c: fix incorrect error path
  media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args()
  media: uvcvideo: Fix InterfaceProtocol for Quanta camera

Merge branch 'master' into i2c/for-mergewindow

2022-09-27T19:33:37+00:00

Merge fixes into media_stage

2022-09-27T08:27:56+00:00

* fixes:
  media: rkvdec: Disable H.264 error detection
  media: mediatek: vcodec: Drop platform_get_resource(IORESOURCE_IRQ)
  media: dvb_vb2: fix possible out of bound access
  media: v4l2-ioctl.c: fix incorrect error path
  media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args()
  media: uvcvideo: Fix InterfaceProtocol for Quanta camera

media: flexcop-usb: use usb_endpoint_maxp()

2022-09-26T08:59:25+00:00

Use the usb_endpoint_maxp() helper instead of open coding.

Signed-off-by: Johan Hovold 
Link: https://lore.kernel.org/r/20220822151456.27178-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman