linux-toradex.git/drivers/media/mc, branch v6.19

media: mc: fix potential use-after-free in media_request_alloc()

2025-12-15T14:12:28+00:00

Commit 6f504cbf108a ("media: convert media_request_alloc() to
FD_PREPARE()") moved the call to fd_install() (now hidden in
fd_publish()) before the snprintf(), making the later write to
potentially already freed memory, as userland is free to call
close() concurrently right after the call to fd_install() which
may end up in the request_fops.release() handler freeing 'req'.

Fixes: 6f504cbf108a ("media: convert media_request_alloc() to FD_PREPARE()")
Signed-off-by: Mathias Krause 
Link: https://patch.msgid.link/20251209210903.603958-1-minipli@grsecurity.net
Signed-off-by: Christian Brauner

media: convert media_request_alloc() to FD_PREPARE()

2025-11-28T11:42:35+00:00

Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-40-b6efa1706cfd@kernel.org
Signed-off-by: Christian Brauner

media: mc: Clear minor number before put device

2025-09-10T08:42:13+00:00

The device minor should not be cleared after the device is released.

Fixes: 9e14868dc952 ("media: mc: Clear minor number reservation at unregistration time")
Cc: stable@vger.kernel.org
Reported-by: syzbot+031d0cfd7c362817963f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=031d0cfd7c362817963f
Tested-by: syzbot+031d0cfd7c362817963f@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis 
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil

media: mc: Clear minor number reservation at unregistration time

2025-09-09T13:59:16+00:00

Clear the media device's minor number reservation at unregister time as
there's no need to keep it reserved for longer. This makes it possible to
reserve the same minor right after unregistration.

Signed-off-by: Sakari Ailus 
Acked-by: Hans Verkuil 
Signed-off-by: Hans Verkuil

media: update Hans Verkuil's email address

2025-09-09T13:58:44+00:00

Replace hansverk@cisco.com by hverkuil@kernel.org.

Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab

media: mc: Improve unconnected pads debugging message in link exploration

2025-08-25T13:40:44+00:00

When exploring links, a message is printed to indicate unconnected pads
being added. The message prints the entity name only. Print the origin
pad number as well to help with debugging pipeline start issues. While
at it, get the entity name from origin->entity instead of local->entity.
Both point to the same entity, but the former conveys the meaning
better.

Signed-off-by: Laurent Pinchart 
Acked-by: Sakari Ailus 
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil

media: mc: Fix MUST_CONNECT handling for pads with no links

2025-08-25T13:40:44+00:00

Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always
require an enabled link") expanded the meaning of the MUST_CONNECT flag
to require an enabled link in all cases. To do so, the link exploration
code was expanded to cover unconnected pads, in order to reject those
that have the MUST_CONNECT flag set. The implementation was however
incorrect, ignoring unconnected pads instead of ignoring connected pads.
Fix it.

Reported-by: Martin Kepplinger-Novaković 
Closes: https://lore.kernel.org/linux-media/20250205172957.182362-1-martink@posteo.de
Reported-by: Maud Spierings 
Closes: https://lore.kernel.org/linux-media/20250818-imx8_isi-v1-1-e9cfe994c435@gocontroll.com
Fixes: b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link")
Cc: stable@vger.kernel.org # 6.1
Signed-off-by: Laurent Pinchart 
Tested-by: Maud Spierings 
Tested-by: Martin Kepplinger-Novaković 
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil

Merge tag 'media/v6.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2024-11-20T22:01:15+00:00

Pull media updates from Mauro Carvalho Chehab:

 - removal of the old omap4iss media driver

 - mantis: remove orphan mantis_core.h

 - add support for Raspberypi CFE

 - uvc driver got a co-maintainer

 - main media tree moved to git://linuxtv.org/media.git

 - lots of driver cleanups, updates and fixes

* tag 'media/v6.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (233 commits)
  docs: media: update location of the media patches
  MAINTAINERS: update location of media main tree
  media: MAINTAINERS: Add Hans de Goede as USB VIDEO CLASS co-maintainer
  media: platform: samsung: s5p-jpeg: Remove deadcode
  media: qcom: camss: Add MSM8953 resources
  media: dt-bindings: Add qcom,msm8953-camss
  media: qcom: camss: implement pm domain ops for VFE v4.1
  media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available
  media: adv7180: Also check for "adi,force-bt656-4"
  media: dt-bindings: adv7180: Document 'adi,force-bt656-4'
  media: mgb4: Fix inconsistent input/output alignment in loopback mode
  media: replace obsolete hans.verkuil@cisco.com alias
  Documentation: media: improve V4L2_CID_MIN_BUFFERS_FOR_*, doc
  media: vicodec: add V4L2_CID_MIN_BUFFERS_FOR_* controls
  media: atomisp: Add check for rgby_data memory allocation failure
  media: atomisp: remove redundant re-checking of err
  media: atomisp: Fix spelling errors reported by codespell
  media: atomisp: Remove License information boilerplate
  media: atomisp: Fix typos in comment
  media: atomisp: hmm_bo: Fix spelling errors in hmm_bo.h
  ...

media: replace obsolete hans.verkuil@cisco.com alias

2024-11-08T12:38:09+00:00

The old hans.verkuil@cisco.com email address was discontinued years ago.

Replace it with the correct hansverk@cisco.com email.

Signed-off-by: Hans Verkuil

media: mc: Rename pad as origin in __media_pipeline_start()

2024-11-07T08:05:58+00:00

Rename the pad field in __media_pipeline_start() to both better describe
what it is and avoid masking it during the loop.

Signed-off-by: Sakari Ailus 
Reviewed-by: Laurent Pinchart 
Signed-off-by: Hans Verkuil