summaryrefslogtreecommitdiff
path: root/drivers/media/usb
AgeCommit message (Collapse)Author
2 daysMerge tag 'media/v7.3-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2-core: added ISP statistics support and per-block validation - v4l2-core: Allow unknown HDR10 white point and luminance - New camera sensors: Sony IMX678 and IMX471m, Himax HM1092 IR sensor - New codec: Milos: VPU v2.0 codec support - isp driver: gained support for Dreamchip RPPX1 ISP framework - vsp1 driver: gained support for RZ/T2H and RZ/N2H - Novalake driver: gained CVS support for new NVL hardware - dvb-core: fix feed leak on failed DMX_ADD_PID - several driver fixes, cleanups and minor improvements * tag 'media/v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (308 commits) media: ipu-bridge: check all DMI entries when overriding sensor rotation media: v4l2-async: avoid deleting unlinked ASC entry on link error media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement media: intel/ipu6: fix async notifier cleanup leak on parse error media: staging/ipu7: fix async notifier UAF on probe error path media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() media: rcar-isp: Fix VSPX reference leaks media: rcar-isp: Release ISPCORE resources media: i2c: imx415: Release runtime PM reference on VBLANK error media: i2c: imx415: Return test pattern write errors media: renesas: vsp1: Declare index variables in for loop statement media: renesas: vsp1: Make reset control optional to support platforms without a reset line media: dt-bindings: media: renesas,vsp1: Document RZ/T2H and RZ/N2H SoCs media: dt-bindings: media: renesas,fcp: Document RZ/T2H and RZ/N2H SoCs media: nxp: imx8-isi: Add additional 32-bit RGB format support media: nxp: imx8-isi: Add 16-bit raw Bayer format support media: nxp: imx8-isi: Implement per-stream reference counting for multiplexed streams media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks media: nxp: imx8-isi: Correct color map between V4L2 and ISI ...
2026-07-28media: em28xx: defer audio-only extension registrationDiego Fernando Mancera Gomez
The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before dev_next is created. The duplicate device inherits is_audio_only and is then independently inserted into em28xx_devlist. The list is intended to contain only primary devices: extension operations reach the secondary device through dev_next. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free. Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through dev_next. Fixes: 4a089668ef22 ("media: em28xx-cards: rework the em28xx probing code") Cc: stable@vger.kernel.org Reported-by: syzbot+a11c46f37ee083a73deb@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/66ec3c83.050a0220.29194.002f.GAE@google.com/T/ Suggested-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: remove conditional return with no effectSang-Heon Jeon
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: usbtv: Fix V4L2 refcount leak on probe failureGuangshuo Li
usbtv_probe() allocates usbtv before usbtv_video_init() registers its embedded v4l2_device. v4l2_device_register() initializes the reference count to one, with usbtv_release() providing the final cleanup. If video_register_device() fails, usbtv_video_init() unregisters the V4L2 device and returns an error without dropping the initial v4l2_device reference. The probe error path then calls kfree() on usbtv directly, leaving the reference stranded and bypassing usbtv_release(). Leave the initialized V4L2 device intact on this failure path. After releasing the USB reference, call v4l2_device_put() so the final reference invokes usbtv_release(). Retain the direct kfree() path for failures that occur before v4l2_device_register(). This issue was found by a static analysis tool I am developing. Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: bound JPEG frame size before copying into the bufferHyeongJun An
s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpg_size is taken verbatim from the S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame()) and, unlike the frame payload length just above it, is never bounded: payload = le32_to_cpu(pdword[3]); if (payload > vc->req_image_size) /* payload is checked ... */ return -EINVAL; vc->pkt_size = payload; vc->jpg_size = le32_to_cpu(pdword[4]); /* ... jpg_size is not */ A malicious or malfunctioning device can therefore report a jpg_size larger than the destination vb2 plane, and the memcpy() writes past it. jpg_size is a signed int, so a value with the top bit set also turns into a huge length. Reject a frame whose jpg_size is negative or exceeds the plane size before copying it. Fixes: 38f993ad8b1f ("V4L/DVB (8125): This driver adds support for the Sensoray 2255 devices.") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: go7007: s2250: propagate control I/O failuresYousef Alhouseen
The brightness and contrast paths use oldvalue after read_reg_fp() without checking whether the read succeeded. A failed read leaves oldvalue uninitialized and can write arbitrary reserved register bits. Return read and write errors from every control path so failed hardware access cannot be reported as a successful control update. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Replace bare 'unsigned' with 'unsigned int'Lei Huang
Fix 'WARNING: Prefer 'unsigned int' to bare use of 'unsigned'' reported by checkpatch.pl in s2255drv.c. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary braces from single-statement blocksLei Huang
Fix all 4 'WARNING: braces {} are not necessary for single statement blocks' issues reported by checkpatch.pl in s2255drv.c. Remove braces from single-statement if blocks where they are not needed. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary debug logging and out-of-memory messagesLei Huang
Fix all 5 'WARNING: Unnecessary ftrace-like logging - prefer using ftrace' issues reported by checkpatch.pl in s2255drv.c. Remove dprintk/dev_info calls that only print the function name, as ftrace can provide the same function tracing information. Fix all 3 'WARNING: Possible unnecessary 'out of memory' message' issues reported by checkpatch.pl in s2255drv.c. The kernel's memory allocator already prints a warning on allocation failure, making these messages redundant. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary return statements from void functionsLei Huang
Fix all 7 'WARNING: void function return statements are not generally useful' issues reported by checkpatch.pl in s2255drv.c. Remove trailing 'return;' statements that immediately precede the closing brace in void functions. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Fix block comment style to kernel formatLei Huang
Fix all 'WARNING: Block comments use * on subsequent lines' and 'WARNING: Block comments use a trailing */ on a separate line' issues reported by checkpatch.pl in s2255drv.c. Convert block comments to kernel-style format with leading '*' on continuation lines and '*/' on its own line. Convert banner-style separator comments to single-line format. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Add blank lines after variable declarationsLei Huang
Fix all 22 'WARNING: Missing a blank line after declarations' issues reported by checkpatch.pl in s2255drv.c. Insert a blank line between local variable declarations and the first statement in each function. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Parenthesize macro argument to avoid precedence issuesLei Huang
Fix 'CHECK: Macro argument 'dev' may be better as '(dev)' to avoid precedence issues' reported by checkpatch.pl in s2255drv.c. Wrap the 'dev' macro argument in parentheses in the dprintk macro. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary parentheses around conditionsLei Huang
Fix all 11 'CHECK: Unnecessary parentheses around' issues reported by checkpatch.pl in s2255drv.c. Remove redundant inner parentheses from if-condition expressions where operator precedence already guarantees the correct evaluation order. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Add spaces around multiplication operatorsLei Huang
Fix all 3 'CHECK: spaces preferred around that '*' (ctx:VxV)' issues reported by checkpatch.pl in s2255drv.c. Add spaces around the multiplication operators in the SYS_FRAMES_MAXSIZE macro. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Add blank lines after function/struct/enum declarationsLei Huang
Fix all 2 'CHECK: Please use a blank line after function/struct/union/enum declarations' issues reported by checkpatch.pl in s2255drv.c. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove multiple blank lines and before close bracesLei Huang
Remove all 9 instances of double blank lines: 'CHECK: Please don't use multiple blank lines' reported by checkpatch.pl in s2255drv.c. Fix all 3 'CHECK: Blank lines aren't necessary before a close brace' issues reported by checkpatch.pl in s2255drv.c. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Fix alignment to match open parenthesisLei Huang
Fix all 16 'CHECK: Alignment should match open parenthesis' issues reported by checkpatch.pl in s2255drv.c. Adjust continuation line indentation in function declarations, if-conditions, function calls, and block comments to properly align with the opening parenthesis. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Replace NULL comparisons with ! notationLei Huang
Fix all 15 'CHECK: Comparison to NULL could be written' issues reported by checkpatch.pl in s2255drv.c. Replace 'x == NULL' with '!x' for pointer NULL checks. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Use consistent braces on all arms of if/else statementsLei Huang
Fix all 5 'CHECK: braces {} should be used on all arms of this statement' issues reported by checkpatch.pl in s2255drv.c. Add braces to else and else-if branches that were missing them for consistency with other branches. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Remove unnecessary spaces after castsLei Huang
Fix all 8 'CHECK: No space is necessary after a cast' issues reported by checkpatch.pl in s2255drv.c. Remove the space between the cast type and the value being cast. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Rename remaining CamelCase identifiers to snake_caseLei Huang
Rename CamelCase identifiers throughout s2255drv.c to comply with the Linux kernel coding style. All identifiers are local to this file (no header file or cross-file references). Struct members: ulState -> state dwFrames -> num_frames Function parameters (s2255_vendor_req, also updating the forward declaration to match): Request -> req Index -> index Value -> value TransferBuffer -> xfer_buf TransferBufferLength -> xfer_buf_len bOut -> is_out Local variables: pY/pCb/pCr -> p_y/p_cb/p_cr linesPerFrame -> lines_per_frame pixelsPerLine -> pixels_per_line outImageSize -> out_image_size usbInSize -> usb_in_size transBuffer -> trans_buf pRel -> p_rel No functional changes. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-27media: s2255: Rename CamelCase goto labels to snake_caseLei Huang
Rename the error-path goto labels in s2255_probe() from CamelCase to snake_case to comply with the Linux kernel coding style: errorBOARDINIT -> err_boardinit errorFWMARKER -> err_fwmarker errorREQFW -> err_reqfw errorFWDATA2 -> err_fwdata2 errorFWURB -> err_fwurb errorEP -> err_ep errorUDEV -> err_udev errorFWDATA1 -> err_fwdata1 No functional changes; all label definitions and goto references are updated consistently. Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: go7007: fix memory leaks on probe error pathsChen Changcheng
In go7007_register_encoder(), if any step after v4l2_device_register() fails (go7007_init_encoder, go7007_v4l2_ctrl_init, go7007_i2c_init, go7007_v4l2_init), the function returns directly without cleanup, leaking the registered V4L2 device and the control handler (if already initialized). Add cascade error labels that properly release resources according to how far initialization has progressed: - err_free_controls: frees the control handler - err_unregister_v4l2_dev: unregisters the V4L2 device (reached from any failure after v4l2_device_register) Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: s2255: check firmware size before reading trailing markerLei Huang
s2255_probe() reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows and the access reads out of bounds. Validate the firmware size before indexing. Fixes: 14d962602c8b ("V4L/DVB (8752): s2255drv: firmware improvement patch") Cc: stable@vger.kernel.org Signed-off-by: Lei Huang <huanglei@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: stk1160: handle ESHUTDOWN gracefullyOliver Neukum
Give it its own error message. Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: stk1160: cleanup error handling in probeOliver Neukum
Do not replicate cleanup code. Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: go7007: defer the ALSA v4l2 put until card releaseShuangpeng Bai
go7007_snd_init() already takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). That is too early when a userspace process still has the capture PCM open. The ALSA card and its PCM callbacks remain alive until the last file is closed, so the release path can still reach struct go7007 through pcm->private_data and call go7007_snd_hw_free() after the V4L2 release path has freed the object. Move the matching v4l2_device_put() to the ALSA card private_free callback so the existing ALSA reference covers the whole deferred card lifetime. Closes: https://lore.kernel.org/r/178144969601.60470.6005237146425573205@gmail.com Fixes: d5d3a7cc127d ("[media] go7007: fix unregister/disconnect handling") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: usbtv: keep device alive while ALSA card existsShuangpeng Bai
The ALSA PCM callbacks store the driver state in pcm->private_data. An open PCM file can outlive USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can then drop the V4L2 device reference and free struct usbtv before ALSA releases the substream, so a later close dereferences freed memory in snd_usbtv_pcm_close(). Take a V4L2 device reference for the ALSA card and drop it from the card private_free callback. This keeps struct usbtv valid until ALSA has closed the remaining files and freed the card. Closes: https://lore.kernel.org/r/178144969601.60470.4852887710381872458@gmail.com Fixes: 63ddf68de52e ("[media] usbtv: add audio support") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: au0828: add support for Monoprice 106456 USB ATSC/QAM tunerJoseph Breihan
The Monoprice 106456 (board rev TV22AD-A, also sold as the AnyTV AUTV002) is a USB ATSC/QAM tuner that enumerates as 05e1:0400 and reports itself as a "Syntek Semiconductor USB 2.0 Video Capture Controller". The hardware is an Auvitek AU0828A bridge with an AU8522 demodulator and an NXP TDA18271HDC2 tuner at I2C address 0x60 -- the same demod/tuner combination as the existing Hauppauge Woodbury board. Adds board profile and the USB ID so the device binds. The digital frontend is electrically identical to the Woodbury, so share that board's au8522/tda18271 configuration and attach path rather than duplicating it. Tested with over-the-air 8VSB ATSC: it locks and streams a live 720p transport stream. Some 05e1:0400 units reportedly ship a Microtune MT2131 tuner with an AU8502 demodulator instead. This patch does not handle that variant, but it can't regress it either: 05e1:0400 matches no driver today, and on the MT2131 units tda18271_attach() just fails, so no frontend is registered. Signed-off-by: Joseph Breihan <linux@josephbreihan.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: em28xx: fix use-after-free of dev_next->devlist on disconnectJiangong.Han
When a device with has_dual_ts=1 is probed and the is_audio_only path is taken, both dev and dev->dev_next are added to the global em28xx_devlist via em28xx_init_extension(). However, during disconnect, em28xx_close_extension(dev) only calls list_del(&dev->devlist), leaving dev->dev_next->devlist still linked in the global list. When dev_next is subsequently freed via kref_put(), its devlist entry becomes a dangling pointer in em28xx_devlist. The next device probe that calls em28xx_init_extension() triggers a list corruption BUG when list_add_tail detects the freed node. This bug was exposed by commit a368ecde8a50 ("USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor") which clears reserved bits in bEndpointAddress during endpoint parsing. This causes fuzzed endpoint addresses like 0xf3 to be normalized to 0x83, which em28xx interprets as a vendor audio endpoint, enabling the is_audio_only + has_dual_ts code path that was previously unreachable with such descriptors. Fix this by removing dev->dev_next->devlist from the global list in em28xx_close_extension() before the device is freed. Fixes: f410b4093fdd ("media: em28xx: split up em28xx_dvb_init to reduce stack size") Cc: stable@vger.kernel.org Reported-by: syzbot+99d6c66dbbc484f50e1c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=99d6c66dbbc484f50e1c Signed-off-by: Jiangong.Han <jiangong.han@windriver.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15media: go7007: avoid undefined shifts in MPEG-4 headersYousef Alhouseen
The byte-alignment paths can call CODE_ADD() with a zero bit length. The macro then shifts an int by name.b, which can be 32 after the preceding bit was flushed. vti_bitlen() can likewise shift a signed int into its sign bit while searching for the bit length, and the package mask construction can shift by the full type width. Make zero-length additions a no-op, derive the bit length with fls(), and build the mask with GENMASK(). Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-14media: em28xx: requeue buffers if start_streaming failsHans Verkuil
If start_streaming fails, then all queued buffers must be returned to vb2 in state QUEUED. Otherwise it will trigger a WARN_ON. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-14media: em28xx: dev_info->pr_info since dev has been freedHans Verkuil
In em28xx_free_device() dev_info passed &dev->intf->dev, but that device can be freed already. Just use pr_info instead. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-14media: em28xx: use vb2_video_unregister_deviceHans Verkuil
Use vb2_video_unregister_device instead of video_unregister_device to ensure any streaming is correctly stopped at unregister time. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-14media: em28xx: drop 'users' fieldHans Verkuil
Drop the em28xx_v4l2 'users' field, use v4l2_fh_is_singular_file() instead. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-14media: em28xx: use v4l2_device release callbackHans Verkuil
The em28xx driver creates a lot of video devices, but life-time management is really bad. Instead use the struct v4l2_device release() callback to have a single place where memory can be freed once the last user has gone. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-07-10media: em28xx-video: Remove unneeded semicolonsRicardo Ribalda
There is no need to add a semicolon after a switch statement. It also makes cocci a bit uneasy. It triggers the following warnings: ./usb/em28xx/em28xx-cards.c:4085:2-3: Unneeded semicolon ./usb/em28xx/em28xx-core.c:635:2-3: Unneeded semicolon Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-10media: replace linux/gpio.h inclusionsArnd Bergmann
linux/gpio.h should no longer be used, convert these instead to either linux/gpio/consumer.h or linux/gpio/legacy.h as needed. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-10media: cx231xx: reject geometry changes while the VBI queue is busyBryam Vargas
vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the *video* queue (dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry: cx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm, the VBI videobuf2 plane is sized from dev->width / dev->norm in vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then recomputes the destination offset from the *live* dev->width and the latched lines_per_field on every URB completion: offset = lines_completed * (dev->width << 1) + ...; if (dma_q->current_field == 2) offset += dev->width * 2 * dma_q->lines_per_field; memcpy(plane + offset, p_buffer, lencopy); Because the VBI node shares video_ioctl_ops with the video node, an application can size a small VBI plane (REQBUFS/QBUF with a small width, or with the NTSC standard), then enlarge dev->width (or switch dev->norm to PAL) through the video node while the VBI stream is running -- the change is allowed because only dev->vidq is checked -- and let the device deliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the offset with the larger geometry and memcpy()s past the end of the smaller plane that was already allocated, a heap out-of-bounds write whose offset is attacker-chosen and whose contents come from the device. The per-field guard in cx231xx_copy_vbi_line() does not help: it bounds the copy against the latched lines_per_field, not the plane's real capacity, and vb2 does not re-run buf_prepare() for an already prepared buffer. Refuse the format/standard change when the VBI queue is busy as well, so the geometry cannot change underneath an allocated VBI buffer. Fixes: 7c617138b825 ("media: cx231xx: convert to the vb2 framework") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-10media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL derefValery Borovsky
airspy_disconnect() clears s->udev under v4l2_lock, but airspy_stop_streaming() unconditionally calls airspy_ctrl_msg() and airspy_free_stream_bufs() afterwards. If a streaming user closes the device after disconnect, stop_streaming() runs and dereferences the NULL s->udev: airspy_stop_streaming() airspy_ctrl_msg(s, CMD_RECEIVER_MODE, 0, 0, NULL, 0) usb_sndctrlpipe(s->udev, 0) /* NULL deref */ airspy_free_stream_bufs(s) usb_free_coherent(s->udev, ...) /* NULL deref */ The airspy driver uses vb2_fop_release() in its file_operations, so replace video_unregister_device(&s->vdev) with vb2_video_unregister_device(&s->vdev) and move it before clearing s->udev. vb2_video_unregister_device() releases the vb2 queue, which synchronously runs airspy_stop_streaming() if streaming is active, so the URBs, coherent DMA stream buffers and the hardware stop control message all execute while s->udev is still valid. vb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock) internally, and stop_streaming() locks v4l2_lock, so the previous outer mutex_lock(&s->vb_queue_lock) / mutex_lock(&s->v4l2_lock) pair around the unregister sequence would self-deadlock and has been removed. A short v4l2_lock critical section around s->udev = NULL remains so any ioctl path that still holds the file descriptor sees coherent state. Issue identified by automated review of the INV-003 series at https://sashiko.dev/ Fixes: 634fe5033951 ("[media] airspy: AirSpy SDR driver") Cc: stable@vger.kernel.org Suggested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Valery Borovsky <vebohr@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-10media: cx231xx: fix null pointer deref in snd_cx231xx_pcm_closeAshwin Gundarapu
Add a null check for the dev pointer after retrieving it from the substream. Without this, a use-after-free or null pointer dereference can occur when closing the audio device, causing a kernel page fault. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2365068 Signed-off-by: Ashwin Gundarapu <linuxuser509@zohomail.in> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-10media: em28xx: Add StarTech SVID2USB232Luciano Ciccariello
Add support for the StarTech SVID2USB232 USB analog video grabber (USB ID eb1a:8286). The device uses the Empia EM28281 bridge, a member of the em2828X family with an integrated video decoder. Reuses the EM28XX_BUILTIN decoder path introduced in commit 8e53399c63c3 ("media: em28xx: Add support for Empia em2828X bridge"). The standard PAL/NTSC switching and composite/S-Video input switching in em2828X_decoder_set_std() handle this board without board-specific code. Inputs: - Composite video - S-Video - Analog stereo audio (line in) Tested on hardware with a PAL signal on both S-Video and composite inputs (ffplay -f v4l2 /dev/video0). This supersedes an earlier RFC posting from before EM28XX_BUILTIN was available, which proposed a custom EM28XX_I2C_ALGO_EM28281_INTEGRATED TVP5150-bridge algorithm. That approach is no longer necessary now that the em2828X bridge support landed. Link: https://lore.kernel.org/all/20260119185921.575666-1-xeeynamo@hotmail.com/ Signed-off-by: Luciano Ciccariello <xeeynamo@hotmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-03media: em28xx: Add include for struct usb_device_idUwe Kleine-König (The Capable Hub)
Traditionally <linux/mod_devicetable.h> was a header defining a plethora of structs, among them struct usb_device_id. This was split now with the objective that only the relevant bits are included. Currently <linux/mod_devicetable.h> is transitively included in drivers/media/usb/em28xx/em28xx.h via: drivers/media/usb/em28xx/em28xx.h -> <linux/i2c.h> -> <linux/acpi.h> -> <linux/device.h> -> <linux/device/driver.h> -> <linux/mod_devicetable.h To keep struct usb_device_id available once <linux/device/driver.h> stops including <linux/mod_devicetable.h>, include it the header providing that struct explictly. Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Link: https://patch.msgid.link/e72de5b4b9f1aa77a3c19a5e698a195dfd81ae0b.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-06-18Merge tag 'media/v7.2-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2: - core: fix subdev sensor ownership - subdev: Allow accessing routes with STREAMS client capability - ctrls: Add validation for HEVC active reference counts and background detection control - common: Add YUV24 format info and has_alpha helper - vb2: Change vb2_read() and vb2_write() return types to ssize_t - i2c: cvs: Add driver of Intel Computer Vision Sensing Controller(CVS) - atmel-isc: remove deprecated driver - cec: Add CEC Latency Indication Protocol (LIP) support - imon: Add iMON VFD HID OEM v1.2 key mappings - AVMatrix: new HWS capture driver - isp4: new AMD capture driver - qcom: - iris: Add hierarchical coding, B-frame, and Long-Term Reference support for encoder - camss: Add SM6350 platform support - venus: Add SM6115 platform support - chips-media: wave5: Add support for Packed YUV422, CBP profile, and background detection - csi2rx: Add multistream support and 32 dma chans - Several cleanups and fixes * tag 'media/v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (394 commits) media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() media: qcom: iris: vdec: allow GEN2 decoding into 10bit format media: qcom: iris: vdec: update find_format to handle 8bit and 10bit formats media: qcom: iris: vdec: update size and stride calculations for 10bit formats media: qcom: iris: gen2: add support for 10bit decoding media: qcom: iris: add QC10C & P010 buffer size calculations media: qcom: iris: add helpers for 8bit and 10bit formats media: qcom: iris: Fix FPS calculation and VPP FW overhead media: qcom: camss: vfe-340: Support for PIX client media: qcom: camss: vfe-340: Proper client handling media: qcom: camss: csid-340: Enable PIX interface routing media: qcom: camss: csid-340: Add port-to-interface mapping media: qcom: camss: csid-340: Switch to generic CSID_CFG/CTRL registers media: iris: Initialize HFI ops after firmware load in core init media: iris: drop struct iris_fmt media: iris: Add platform data for X1P42100 media: iris: Add hardware power on/off ops for X1P42100 media: iris: optimize COMV buffer allocation for VPU3x and VPU4x media: iris: add FPS calculation and VPP FW overhead in frequency formula media: qcom: iris: Simplify COMV size calculation ...
2026-05-21media: uvcvideo: Only do uvc_video_get_time() if neededRicardo Ribalda
There is no need to calculate the current time if the sample is going to be filtered. Move the assignment close to uvc_video_clock_add_sample(). Suggested-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Tested-by: Yunke Cao <yunkec@google.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-6-7a64838b0b02@chromium.org Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-21media: uvcvideo: Do not add samples if dev_sof has not changedRicardo Ribalda
We only save relevant samples into the circular buffer. If the data is very similar to the previous one, exit early, this allows us to avoid some expensive operations such as usb_get_current_frame_number(). Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Tested-by: Yunke Cao <yunkec@google.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-5-7a64838b0b02@chromium.org Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-21media: uvcvideo: Do not add clock samples with small sof deltaRicardo Ribalda
Some UVC 1.1 cameras running in fast isochronous mode tend to spam the USB host with a lot of empty packets. These packets contain clock information and are added to the clock buffer but do not add any accuracy to the calculation. In fact, it is quite the opposite, in our calculations, only the first and the last timestamp is used, and we only have 32 slots. Ignore the samples that will produce less than MIN_HW_TIMESTAMP_DIFF data. Fixes: 141270bd95d4 ("media: uvcvideo: Refactor clock circular buffer") Cc: stable@vger.kernel.org Tested-by: Yunke Cao <yunkec@google.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-4-7a64838b0b02@chromium.org Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-21media: uvcvideo: Relax the constrains for interpolating the hw clockRicardo Ribalda
In the initial version we set the min value to 250msec. Looks like 100msec can also provide a good value. Now that we are at it, add a macro to make it cleaner. Fixes: 6243c83be6ee8 ("media: uvcvideo: Allow hw clock updates with buffers not full") Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Tested-by: Yunke Cao <yunkec@google.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-3-7a64838b0b02@chromium.org Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-21media: uvcvideo: Use hw timestaming if the clock buffer is fullRicardo Ribalda
In some situations, even with a full clock buffer, it does not contain 250msec of data. This results in the driver jumping back from software to hardware timestapsing creating a nasty artifact in the video. If the clock buffer is full, use it to calculate the timestamp instead of defaulting to software stamps, the reduced accuracy is less visible than jumping from one timestamping mechanism to the other. Fixes: 6243c83be6ee8 ("media: uvcvideo: Allow hw clock updates with buffers not full") Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Tested-by: Yunke Cao <yunkec@google.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-2-7a64838b0b02@chromium.org Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
generated by cgit v1.2.3 (git 2.0.4) at 2026-08-21 22:26:42 +0000