Pull media updates from Mauro Carvalho Chehab:

 - v4l2 core:
     - improve subdev and pixformat kAPI;
     - fix P010 format info and add Y12 format info;
     - add fwnode_graph_for_each_endpoint_scoped();

 - New sensor drivers:
     - Sony IMX576
     - OmniVision OS02G10, OV05C10 and OG0VA1B
     - Samsung S5KJN5
     - Himax HM1246

 - Maxim GMSL2/3: add support for MAX9296A, MAX96717, and MAX96724

 - Intel IPU6: add support for IPU7, IPU7.5 and IPU8

 - NXP: add support for i.MX95 CSI pixel formatter driver

 - ITE: add driver for IT6625/IT6626 HDMI bridge

 - Qualcomm: add CSI2 3ph DPHY driver

 - Rockchip: add rk3576 MIPI capture vicap driver

 - STM32 DCMIPP: Add STM32MP25 subdevices

 - Lots of driver fixes and cleanups

* tag 'media/v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (596 commits)
  media: i2c: imx576: Fix line length register
  media: ov05c10: Remove duplicated writes to analogue gain register
  media: ov05c10: Power management fixes
  media: ov05c10: Set reset GPIO high when acquiring it
  media: ov05c10: Small cleanups
  media: maxim-serdes: Disable test pattern generator for now
  media: mc: Keep INTERNAL pad flags just for the kernel, for now
  media: i2c: imx576: select VIDEO_CCS_PLL to repair build error
  media: Documentation: mc: Fix Stream reference
  media: i2c: add imx576 image sensor driver
  dt-bindings: media: i2c: Add imx576 sensor
  media: i2c: maxim-serdes: add MAX9296A driver
  media: i2c: remove MAX96714 driver
  media: i2c: maxim-serdes: add MAX96724 driver
  staging: media: remove MAX96712 driver
  arm64: defconfig: disable deprecated MAX96712 driver
  media: i2c: maxim-serdes: add MAX96717 driver
  media: i2c: remove MAX96717 driver
  media: i2c: add Maxim GMSL2/3 deserializer framework
  media: i2c: add Maxim GMSL2/3 serializer framework
  ...

ictx->dev is a raw pointer to the usb_interface's embedded device.
On disconnect, usb_disconnect() can drop the last reference on the
interface and free it while a userspace fd for /dev/lcd0 is still
open. When that fd is later closed, display_close() dereferences
the now-freed ictx->dev via dev_dbg(), causing a use-after-free.

Remove the dev_dbg() calls that dereference ictx->dev in
display_close() and free_imon_context(), rather than taking a
reference on the device.

Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")
Cc: stable@vger.kernel.org
Reported-by: syzbot+9bfac891bdd42eb708fc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bfac891bdd42eb708fc
Link: https://lore.kernel.org/all/20260918054851.26083-1-kartikey406@gmail.com/T/ [v1]
Link: https://lore.kernel.org/all/20260928121230.35359-1-kartikey406@gmail.com/T/ [v2]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>

fintek_get_rx_ir_data() drains the CIR RX FIFO into fintek->buf[], which
holds RX_BUF_LEN (32) bytes, for as long as CIR_STATUS reports pending
RX data:

	do {
		sample = fintek_cir_reg_read(fintek, CIR_RX_DATA);
		...
		fintek->buf[fintek->pkts] = sample;
		fintek->pkts++;
		...
	} while (status & rx_irqs);

Nothing bounds fintek->pkts. If the hardware reports data for more than
RX_BUF_LEN reads in one interrupt, the loop writes past the end of
buf[], starting with the pkts counter that follows it in struct
fintek_dev.

Hand a full buffer to fintek_process_rx_ir_data(), which parses the
samples and resets fintek->pkts, before storing the next sample. This
keeps the parser state consistent and drops no samples. The loop still
relies on the status register to terminate.

The driver does not document the hardware FIFO depth, so it is not
known whether a working device can trigger this.

Found by static analysis tool CodeQL.

Fixes: 9bdc79ea07d9 ("[media] fintek-cir: new driver for Fintek LPC SuperIO CIR function")
Cc: stable@vger.kernel.org
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>

commit 37efd09ba2c6 ("media: rc: Ensure registered is cleared in error
path") broke the build if CONFIG_LIRC was not enabled.

Fixes: 37efd09ba2c6 ("media: rc: Ensure registered is cleared in error path")
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202609230511.Em5Osw74-lkp@intel.com
Signed-off-by: Sean Young <sean@mess.org>

If an excesively high carrier is set, meson_irtx_prepare_pulse() will
cause a divide by zero if tb_us is 0. Prevent such a carrier from being
set.

Fixes: 49be1c78d575 ("media: rc: introduce Meson IR TX driver")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Reject any carrier the hardware cannot generate. This also fixes
a divide by zero if a carrier of U32_MAX/16 is set.

Fixes: 8bff1386d62d ("media: ir_toy: allow tx carrier to be set")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Ensure that the low value of the carrier range is smaller than the
high value. This fixes an underflow in ite_set_rx_carrier_range().

Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>

If rc_keydown() is called after rc_register_device(), then the timers
can be re-armed. Delete them again for a final time.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Ensure the timer cannot be re-armed.

Fixes: 2940c7e49775 ("[media] serial_ir: generate timeout")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Never assigned or read.

Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>