linux.git/drivers/media, branch v5.15.185

media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available

2025-06-04T12:38:03+00:00

[ Upstream commit 2f1361f862a68063f37362f1beb400e78e289581 ]

There is no CSID TPG on some SoCs, so the v4l2 ctrl in CSID driver
shouldn't be registered. Checking the supported TPG modes to indicate
if the TPG hardware exists or not and only registering v4l2 ctrl for
CSID only when the TPG hardware is present.

Signed-off-by: Depeng Shao 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: v4l: Memset argument to 0 before calling get_mbus_config pad op

2025-06-04T12:38:02+00:00

[ Upstream commit 91d6a99acfa5ce9f95ede775074b80f7193bd717 ]

Memset the config argument to get_mbus_config V4L2 sub-device pad
operation to zero before calling the operation. This ensures the callers
don't need to bother with it nor the implementations need to set all
fields that may not be relevant to them.

Signed-off-by: Sakari Ailus 
Reviewed-by: Tomi Valkeinen 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map

2025-06-04T12:37:59+00:00

[ Upstream commit 990262fdfce24d6055df9711424343d94d829e6a ]

Do not process unknown data types.

Tested-by: Yunke Cao 
Reviewed-by: Hans de Goede 
Signed-off-by: Ricardo Ribalda 
Link: https://lore.kernel.org/r/20250203-uvc-roi-v17-15-5900a9fed613@chromium.org
Signed-off-by: Hans de Goede 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: cx231xx: set device_caps for 417

2025-06-04T12:37:58+00:00

[ Upstream commit a79efc44b51432490538a55b9753a721f7d3ea42 ]

The video_device for the MPEG encoder did not set device_caps.

Add this, otherwise the video device can't be registered (you get a
WARN_ON instead).

Not seen before since currently 417 support is disabled, but I found
this while experimenting with it.

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()

2025-06-04T12:37:58+00:00

[ Upstream commit b773530a34df0687020520015057075f8b7b4ac4 ]

An of_node_put(i2c_bus) call was immediately used after a pointer check
for an of_find_i2c_adapter_by_node() call in this function implementation.
Thus call such a function only once instead directly before the check.

This issue was transformed by using the Coccinelle software.

Signed-off-by: Markus Elfring 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: streamzap: fix race between device disconnection and urb callback

2025-05-02T05:44:25+00:00

[ Upstream commit f656cfbc7a293a039d6a0c7100e1c846845148c1 ]

Syzkaller has reported a general protection fault at function
ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer
dereference of dev->raw pointer, even though it is checked for NULL in
the same function, which means there is a race condition. It occurs due
to the incorrect order of actions in the streamzap_disconnect() function:
rc_unregister_device() is called before usb_kill_urb(). The dev->raw
pointer is freed and set to NULL in rc_unregister_device(), and only
after that usb_kill_urb() waits for in-progress requests to finish.

If rc_unregister_device() is called while streamzap_callback() handler is
not finished, this can lead to accessing freed resources. Thus
rc_unregister_device() should be called after usb_kill_urb().

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: 8e9e60640067 ("V4L/DVB: staging/lirc: port lirc_streamzap to ir-core")
Cc: stable@vger.kernel.org
Reported-by: syzbot+34008406ee9a31b13c73@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=34008406ee9a31b13c73
Signed-off-by: Murad Masimov 
Signed-off-by: Sean Young 
Signed-off-by: Hans Verkuil 
Signed-off-by: Sasha Levin

media: streamzap: remove unused struct members

2025-05-02T05:44:25+00:00

[ Upstream commit 4df69e46c352df9bdbe859824da33428a3ce8a1d ]

These struct members do not serve any purpose.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Stable-dep-of: f656cfbc7a29 ("media: streamzap: fix race between device disconnection and urb callback")
Signed-off-by: Sasha Levin

media: streamzap: less chatter

2025-05-02T05:44:25+00:00

[ Upstream commit 35088717ad24140b6ab0ec00ef357709be607526 ]

Remove superfluous messages which add no information.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Stable-dep-of: f656cfbc7a29 ("media: streamzap: fix race between device disconnection and urb callback")
Signed-off-by: Sasha Levin

media: streamzap: no need for usb pid/vid in device name

2025-05-02T05:44:25+00:00

[ Upstream commit 7a25e6849ad73de5aa01d62da43071bc02b8530c ]

The usb pid/vid can be found elsewhere, the idVendor/idProduct usb sysfs
files for example.

Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Stable-dep-of: f656cfbc7a29 ("media: streamzap: fix race between device disconnection and urb callback")
Signed-off-by: Sasha Levin

media: streamzap: remove unnecessary ir_raw_event_reset and handle

2025-05-02T05:44:25+00:00

[ Upstream commit 4bed9306050497f49cbe77b842f0d812f4f27593 ]

There is no reason to have a reset after an IR timeout.
Calling ir_raw_event_handle() twice for the same interrupt has no
affect.

Fixes: 56b0ec30c4bc ("[media] rc/streamzap: fix reporting response times")
Signed-off-by: Sean Young 
Signed-off-by: Mauro Carvalho Chehab 
Stable-dep-of: f656cfbc7a29 ("media: streamzap: fix race between device disconnection and urb callback")
Signed-off-by: Sasha Levin