summaryrefslogtreecommitdiff
path: root/drivers/media/usb
AgeCommit message (Collapse)Author
11 daysMerge tag 'media/v7.4-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2 core: - improve subdev and pixformat kAPI; - fix P010 format info and add Y12 format info; - add fwnode_graph_for_each_endpoint_scoped(); - New sensor drivers: - Sony IMX576 - OmniVision OS02G10, OV05C10 and OG0VA1B - Samsung S5KJN5 - Himax HM1246 - Maxim GMSL2/3: add support for MAX9296A, MAX96717, and MAX96724 - Intel IPU6: add support for IPU7, IPU7.5 and IPU8 - NXP: add support for i.MX95 CSI pixel formatter driver - ITE: add driver for IT6625/IT6626 HDMI bridge - Qualcomm: add CSI2 3ph DPHY driver - Rockchip: add rk3576 MIPI capture vicap driver - STM32 DCMIPP: Add STM32MP25 subdevices - Lots of driver fixes and cleanups * tag 'media/v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (596 commits) media: i2c: imx576: Fix line length register media: ov05c10: Remove duplicated writes to analogue gain register media: ov05c10: Power management fixes media: ov05c10: Set reset GPIO high when acquiring it media: ov05c10: Small cleanups media: maxim-serdes: Disable test pattern generator for now media: mc: Keep INTERNAL pad flags just for the kernel, for now media: i2c: imx576: select VIDEO_CCS_PLL to repair build error media: Documentation: mc: Fix Stream reference media: i2c: add imx576 image sensor driver dt-bindings: media: i2c: Add imx576 sensor media: i2c: maxim-serdes: add MAX9296A driver media: i2c: remove MAX96714 driver media: i2c: maxim-serdes: add MAX96724 driver staging: media: remove MAX96712 driver arm64: defconfig: disable deprecated MAX96712 driver media: i2c: maxim-serdes: add MAX96717 driver media: i2c: remove MAX96717 driver media: i2c: add Maxim GMSL2/3 deserializer framework media: i2c: add Maxim GMSL2/3 serializer framework ...
2026-10-02media: uvcvideo: Force UVC version for Avermedia GC515Ricardo Ribalda
The device announces itself as UVC 1.5, but it only accepts UVC 1.1 controls. The camera can probably be handled by the automatic uvc_version handler, but it is more correct to add a quirk and keep some tracking of what vendors are more or less compliant. Also it might be more robust if we introduce more UVC version-dependent code. Bus 003 Device 021: ID 07ca:1515 AVerMedia Technologies, Inc. X'tra Go GC515 Negotiated speed: High Speed (480Mbps) Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 239 Miscellaneous Device bDeviceSubClass 2 [unknown] bDeviceProtocol 1 Interface Association bMaxPacketSize0 64 idVendor 0x07ca AVerMedia Technologies, Inc. idProduct 0x1515 X'tra Go GC515 bcdDevice 0.10 iManufacturer 1 AVerMedia iProduct 2 X'tra Go GC515 iSerial 3 5313180000221 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x03fd bNumInterfaces 4 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xc0 Self Powered MaxPower 500mA Interface Association: bLength 8 bDescriptorType 11 bFirstInterface 0 bInterfaceCount 2 bFunctionClass 14 Video bFunctionSubClass 3 Video Interface Collection bFunctionProtocol 0 iFunction 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 14 Video bInterfaceSubClass 1 Video Control bInterfaceProtocol 1 iInterface 0 VideoControl Interface Descriptor: bLength 13 bDescriptorType 36 bDescriptorSubtype 1 (HEADER) bcdUVC 1.50 wTotalLength 0x0059 dwClockFrequency 30.000000MHz bInCollection 1 baInterfaceNr( 0) 1 VideoControl Interface Descriptor: bLength 18 bDescriptorType 36 bDescriptorSubtype 2 (INPUT_TERMINAL) bTerminalID 1 wTerminalType 0x0201 Camera Sensor bAssocTerminal 0 iTerminal 0 wObjectiveFocalLengthMin 0 wObjectiveFocalLengthMax 0 wOcularFocalLength 0 bControlSize 3 bmControls 0x00000000 VideoControl Interface Descriptor: bLength 9 bDescriptorType 36 bDescriptorSubtype 3 (OUTPUT_TERMINAL) bTerminalID 2 wTerminalType 0x0101 USB Streaming bAssocTerminal 0 bSourceID 4 iTerminal 0 VideoControl Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 4 (SELECTOR_UNIT) bUnitID 3 bNrInPins 1 baSource( 0) 1 iSelector 0 VideoControl Interface Descriptor: bLength 13 bDescriptorType 36 bDescriptorSubtype 5 (PROCESSING_UNIT) bUnitID 4 bSourceID 3 wMaxMultiplier 0 bControlSize 3 bmControls 0x00000000 iProcessing 0 bmVideoStandards 0x00 VideoControl Interface Descriptor: bLength 29 bDescriptorType 36 bDescriptorSubtype 6 (EXTENSION_UNIT) bUnitID 5 guidExtensionCode {55be8e1c-2fdb-4f7a-bd8d-b9b1108d20c3} bNumControls 24 bNrInPins 1 baSourceID( 0) 4 bControlSize 4 bmControls( 0) 0xff bmControls( 1) 0xff bmControls( 2) 0xff bmControls( 3) 0x00 iExtension 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x85 EP 5 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 1 VideoControl Endpoint Descriptor: bLength 5 bDescriptorType 37 bDescriptorSubtype 3 (EP_INTERRUPT) wMaxTransferSize 64 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 14 Video bInterfaceSubClass 2 Video Streaming bInterfaceProtocol 1 iInterface 0 VideoStreaming Interface Descriptor: bLength 16 bDescriptorType 36 bDescriptorSubtype 1 (INPUT_HEADER) bNumFormats 3 wTotalLength 0x0303 bEndpointAddress 0x81 EP 1 IN bmInfo 0 bTerminalLink 2 bStillCaptureMethod 1 bTriggerSupport 0 bTriggerUsage 0 bControlSize 1 bmaControls( 0) 4 bmaControls( 1) 4 bmaControls( 2) 0 VideoStreaming Interface Descriptor: bLength 28 bDescriptorType 36 bDescriptorSubtype 16 (FORMAT_FRAME_BASED) bFormatIndex 1 bNumFrameDescriptors 8 guidFormat {34363248-0000-0010-8000-00aa00389b71} bBitsPerPixel 24 bDefaultFrameIndex 1 bAspectRatioX 0 bAspectRatioY 0 bmInterlaceFlags 0x00 Interlaced stream or variable: No Fields per frame: 2 fields Field 1 first: No Field pattern: Field 1 only bCopyProtect 1 bVariableSize 1 VideoStreaming Interface Descriptor: bLength 62 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 1 bmCapabilities 0x01 Still image supported wWidth 1920 wHeight 1080 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 9 dwBytesPerLine 0 dwFrameInterval( 0) 83333 dwFrameInterval( 1) 83416 dwFrameInterval( 2) 166666 dwFrameInterval( 3) 166833 dwFrameInterval( 4) 200000 dwFrameInterval( 5) 333333 dwFrameInterval( 6) 333667 dwFrameInterval( 7) 400000 dwFrameInterval( 8) 416666 VideoStreaming Interface Descriptor: bLength 42 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 2 bmCapabilities 0x01 Still image supported wWidth 3840 wHeight 2160 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 333333 bFrameIntervalType 4 dwBytesPerLine 0 dwFrameInterval( 0) 333333 dwFrameInterval( 1) 333667 dwFrameInterval( 2) 400000 dwFrameInterval( 3) 416666 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 3 bmCapabilities 0x01 Still image supported wWidth 2560 wHeight 1440 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 2 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 4 bmCapabilities 0x01 Still image supported wWidth 1280 wHeight 800 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 2 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 VideoStreaming Interface Descriptor: bLength 38 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 5 bmCapabilities 0x01 Still image supported wWidth 1280 wHeight 720 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 3 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 dwFrameInterval( 2) 200000 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 6 bmCapabilities 0x01 Still image supported wWidth 720 wHeight 576 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 200000 bFrameIntervalType 2 dwBytesPerLine 0 dwFrameInterval( 0) 200000 dwFrameInterval( 1) 400000 VideoStreaming Interface Descriptor: bLength 42 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 7 bmCapabilities 0x01 Still image supported wWidth 720 wHeight 480 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 4 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 dwFrameInterval( 2) 333333 dwFrameInterval( 3) 333667 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 8 bmCapabilities 0x01 Still image supported wWidth 640 wHeight 480 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 2 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 VideoStreaming Interface Descriptor: bLength 6 bDescriptorType 36 bDescriptorSubtype 13 (COLORFORMAT) bColorPrimaries 0 (Unspecified) bTransferCharacteristics 0 (Unspecified) bMatrixCoefficients 0 (Unspecified) VideoStreaming Interface Descriptor: bLength 28 bDescriptorType 36 bDescriptorSubtype 16 (FORMAT_FRAME_BASED) bFormatIndex 2 bNumFrameDescriptors 8 guidFormat {43564548-0000-0010-8000-00aa00389b71} bBitsPerPixel 24 bDefaultFrameIndex 1 bAspectRatioX 0 bAspectRatioY 0 bmInterlaceFlags 0x00 Interlaced stream or variable: No Fields per frame: 2 fields Field 1 first: No Field pattern: Field 1 only bCopyProtect 1 bVariableSize 1 VideoStreaming Interface Descriptor: bLength 62 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 1 bmCapabilities 0x01 Still image supported wWidth 1920 wHeight 1080 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 9 dwBytesPerLine 0 dwFrameInterval( 0) 83333 dwFrameInterval( 1) 83416 dwFrameInterval( 2) 166666 dwFrameInterval( 3) 166833 dwFrameInterval( 4) 200000 dwFrameInterval( 5) 333333 dwFrameInterval( 6) 333667 dwFrameInterval( 7) 400000 dwFrameInterval( 8) 416666 VideoStreaming Interface Descriptor: bLength 42 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 2 bmCapabilities 0x01 Still image supported wWidth 3840 wHeight 2160 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 333333 bFrameIntervalType 4 dwBytesPerLine 0 dwFrameInterval( 0) 333333 dwFrameInterval( 1) 333667 dwFrameInterval( 2) 400000 dwFrameInterval( 3) 416666 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 3 bmCapabilities 0x01 Still image supported wWidth 2560 wHeight 1440 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 2 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 4 bmCapabilities 0x01 Still image supported wWidth 1280 wHeight 800 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 2 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 VideoStreaming Interface Descriptor: bLength 38 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 5 bmCapabilities 0x01 Still image supported wWidth 1280 wHeight 720 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 3 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 dwFrameInterval( 2) 200000 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 6 bmCapabilities 0x01 Still image supported wWidth 720 wHeight 576 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 200000 bFrameIntervalType 2 dwBytesPerLine 0 dwFrameInterval( 0) 200000 dwFrameInterval( 1) 400000 VideoStreaming Interface Descriptor: bLength 42 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 7 bmCapabilities 0x01 Still image supported wWidth 720 wHeight 480 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 4 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 dwFrameInterval( 2) 333333 dwFrameInterval( 3) 333667 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 17 (FRAME_FRAME_BASED) bFrameIndex 8 bmCapabilities 0x01 Still image supported wWidth 640 wHeight 480 dwMinBitRate 33554432 dwMaxBitRate 268435456 dwDefaultFrameInterval 166666 bFrameIntervalType 2 dwBytesPerLine 0 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 VideoStreaming Interface Descriptor: bLength 6 bDescriptorType 36 bDescriptorSubtype 13 (COLORFORMAT) bColorPrimaries 0 (Unspecified) bTransferCharacteristics 0 (Unspecified) bMatrixCoefficients 0 (Unspecified) VideoStreaming Interface Descriptor: bLength 11 bDescriptorType 36 bDescriptorSubtype 6 (FORMAT_MJPEG) bFormatIndex 3 bNumFrameDescriptors 1 bFlags 0 Fixed-size samples: No bDefaultFrameIndex 1 bAspectRatioX 0 bAspectRatioY 0 bmInterlaceFlags 0x00 Interlaced stream or variable: No Fields per frame: 1 fields Field 1 first: No Field pattern: Field 1 only bCopyProtect 1 VideoStreaming Interface Descriptor: bLength 30 bDescriptorType 36 bDescriptorSubtype 7 (FRAME_MJPEG) bFrameIndex 1 bmCapabilities 0x01 Still image supported wWidth 1920 wHeight 1080 dwMinBitRate 314572800 dwMaxBitRate 314572800 dwMaxVideoFrameBufferSize 4147200 dwDefaultFrameInterval 166666 bFrameIntervalType 1 dwFrameInterval( 0) 166666 VideoStreaming Interface Descriptor: bLength 6 bDescriptorType 36 bDescriptorSubtype 13 (COLORFORMAT) bColorPrimaries 0 (Unspecified) bTransferCharacteristics 0 (Unspecified) bMatrixCoefficients 0 (Unspecified) Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Interface Association: bLength 8 bDescriptorType 11 bFirstInterface 2 bInterfaceCount 2 bFunctionClass 1 Audio bFunctionSubClass 2 Streaming bFunctionProtocol 0 iFunction 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 2 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 1 Audio bInterfaceSubClass 1 Control Device bInterfaceProtocol 0 iInterface 0 AudioControl Interface Descriptor: bLength 9 bDescriptorType 36 bDescriptorSubtype 1 (HEADER) bcdADC 1.00 wTotalLength 0x0026 bInCollection 1 baInterfaceNr(0) 3 AudioControl Interface Descriptor: bLength 12 bDescriptorType 36 bDescriptorSubtype 2 (INPUT_TERMINAL) bTerminalID 1 wTerminalType 0x0602 Digital Audio Interface bAssocTerminal 0 bNrChannels 2 wChannelConfig 0x0003 Left Front (L) Right Front (R) iChannelNames 0 iTerminal 0 AudioControl Interface Descriptor: bLength 9 bDescriptorType 36 bDescriptorSubtype 3 (OUTPUT_TERMINAL) bTerminalID 2 wTerminalType 0x0101 USB Streaming bAssocTerminal 0 bSourceID 3 iTerminal 0 AudioControl Interface Descriptor: bLength 8 bDescriptorType 36 bDescriptorSubtype 6 (FEATURE_UNIT) bUnitID 3 bSourceID 1 bControlSize 1 bmaControls(0) 0x03 Mute Control Volume Control iFeature 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 1 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 2 bDelay 1 frames wFormatTag 0x0001 PCM AudioStreaming Interface Descriptor: bLength 11 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 1 (FORMAT_TYPE_I) bNrChannels 2 bSubframeSize 2 bBitResolution 16 bSamFreqType 1 Discrete tSamFreq[ 0] 48000 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 5 Transfer Type Isochronous Synch Type Asynchronous Usage Type Data wMaxPacketSize 0x00c4 1x 196 bytes bInterval 4 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 0 Undefined wLockDelay 0x0000 Cc: stable@vger.kernel.org # 5.12.x Reported-by: Edwin Gatier <edwin.gatier@protonmail.com> Closes: https://lore.kernel.org/linux-media/CANiDSCu4AW=JZ9FS+Ny=DK_+LqqytGvSe+V6aVncRiGRiyDMfA@mail.gmail.com/T/#me584c35c4b523ac455925a1590a3de8efc354349 Tested-by: Edwin Gatier <edwin.gatier@protonmail.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260928-uvc-version-v4-5-da0e983fcb95@chromium.org Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Bound uvc_parse_*_control to the control sizeRicardo Ribalda
uvc_parse_control() passes descriptor by descriptor to uvc_parse_standard_control() with the number of bytes remaining in the buffer, not the number of bytes of that descriptor. Because of this, malformed descriptors could leak over the next descriptor, leaving malformed data in our structures. Change the code so we pass the actual length of the descriptor to the parser. Note that this makes the existing check more strict and some devices that are wrongly parsed today will not be probed now. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260911-uvc-ctrl-bound-v1-1-7b5cfc68bae1@chromium.org Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Fix up missing AUTO_UPDATE on the OBSBOT Tail 2Michael Jordan
The OBSBOT Tail 2 has the same defect as the Tiny 2. Add the same fixup entries for it. lsusb -v (device descriptor and Camera Terminal): Bus 002 Device 003: ID 3564:fefc Remo Tech Co., Ltd. OBSBOT Tail 2 Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 3.20 bDeviceClass 239 Miscellaneous Device bDeviceSubClass 2 [unknown] bDeviceProtocol 1 Interface Association bMaxPacketSize0 9 idVendor 0x3564 Remo Tech Co., Ltd. idProduct 0xfefc OBSBOT Tail 2 bcdDevice 4.19 iManufacturer 1 Remo Tech Co., Ltd. iProduct 2 OBSBOT Tail 2 iSerial 0 bNumConfigurations 1 [...] VideoControl Interface Descriptor: bLength 18 bDescriptorType 36 bDescriptorSubtype 2 (INPUT_TERMINAL) bTerminalID 1 wTerminalType 0x0201 Camera Sensor bAssocTerminal 0 iTerminal 0 wObjectiveFocalLengthMin 0 wObjectiveFocalLengthMax 0 wOcularFocalLength 0 bControlSize 3 bmControls 0x00023e3e Auto-Exposure Mode Auto-Exposure Priority Exposure Time (Absolute) Exposure Time (Relative) Focus (Absolute) Zoom (Absolute) Zoom (Relative) PanTilt (Absolute) PanTilt (Relative) Roll (Absolute) Focus, Auto Assisted-by: LLM Signed-off-by: Michael Jordan <jordan.mymail@gmail.com> Link: https://patch.msgid.link/20260928215021.819064-5-jordan.mymail@gmail.com Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Fix up missing AUTO_UPDATE on the OBSBOT Tiny 2Michael Jordan
The OBSBOT Tiny 2 does not set AUTOUPDATE in GET_INFO for its pan/tilt and zoom controls, so reads return the last value written. The camera moves them on its own when tracking a subject, and sends no control change events. Add fixup entries for the three controls. lsusb -v (device descriptor and Camera Terminal): Bus 003 Device 006: ID 3564:fef8 Remo Tech Co., Ltd. OBSBOT Tiny 2 Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.10 bDeviceClass 239 Miscellaneous Device bDeviceSubClass 2 [unknown] bDeviceProtocol 1 Interface Association bMaxPacketSize0 64 idVendor 0x3564 Remo Tech Co., Ltd. idProduct 0xfef8 OBSBOT Tiny 2 bcdDevice 4.09 iManufacturer 1 Remo Tech Co., Ltd. iProduct 2 OBSBOT Tiny 2 iSerial 0 bNumConfigurations 1 [...] VideoControl Interface Descriptor: bLength 18 bDescriptorType 36 bDescriptorSubtype 2 (INPUT_TERMINAL) bTerminalID 1 wTerminalType 0x0201 Camera Sensor bAssocTerminal 0 iTerminal 0 wObjectiveFocalLengthMin 0 wObjectiveFocalLengthMax 0 wOcularFocalLength 0 bControlSize 3 bmControls 0x00023e3e Auto-Exposure Mode Auto-Exposure Priority Exposure Time (Absolute) Exposure Time (Relative) Focus (Absolute) Zoom (Absolute) Zoom (Relative) PanTilt (Absolute) PanTilt (Relative) Roll (Absolute) Focus, Auto Suggested-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Assisted-by: LLM Signed-off-by: Michael Jordan <jordan.mymail@gmail.com> Link: https://patch.msgid.link/20260928215021.819064-4-jordan.mymail@gmail.com Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Generalise the XU flags fixup to all controlsMichael Jordan
The flags fixup table is only applied to extension unit controls. Apply it to all controls, and skip GET_INFO when an entry matches. Suggested-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Assisted-by: LLM Signed-off-by: Michael Jordan <jordan.mymail@gmail.com> Link: https://patch.msgid.link/20260928215021.819064-3-jordan.mymail@gmail.com Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Use uvc_warn_once when it make senseRicardo Ribalda
If there are multiple cameras in the system affected by a compliance error now we only show an error message for one of them. Use uvc_warn_once() to print an error message per device. Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260928-uvc-version-v4-2-da0e983fcb95@chromium.org Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: uvc_warn should warn not infoRicardo Ribalda
Now the uvc_warn_once macro triggers a info message. Use the correct level. Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260928-uvc-version-v4-1-da0e983fcb95@chromium.org Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Fix NULL deref on events for uninitialized controlsWei Jie Law
A null-ptr-deref exists in v6.12.105 and upstream. KASAN crash log: KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087] Workqueue: events uvc_ctrl_status_event_work RIP: 0010:uvc_ctrl_status_event+0x105/0x280 uvc_ctrl_status_event_work+0x82/0x240 process_one_work+0x66f/0x10b0 XU controls are initialized lazily, on the first UVCIOC_CTRL_MAP or UVCIOC_CTRL_QUERY. Until then ctrl->info is all zeroes, so info.mappings is not a valid list head, list_empty() returns false, and uvc_ctrl_status_event() walks it from a NULL next pointer. Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Cc: stable@vger.kernel.org Signed-off-by: Wei Jie Law <98lawweijie@gmail.com> Assisted-by: LLM Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260907121844.2592492-1-98lawweijie@gmail.com Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Add quirk for Luxvisions RGB Camera (30c9:0122)Kean Ren
The device binds cleanly but delivers no image data; USB autosuspend is suspending the streaming endpoint. Disable autosuspend for it. Issue found on Lenovo ThinkPad X13 (codename Zelda, Intel); confirmed working with this quirk. Tested-by: Kean Ren <rh_king@163.com> Signed-off-by: Kean Ren <rh_king@163.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://patch.msgid.link/20260903081145.8382-1-rh_king@163.com Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Make uvc_event_control attribute name array constイムティヤズ
The attrs array in uvc_event_control() is only ever read, never modified. Declare it as static const char *const so the pointer array itself is also immutable. Signed-off-by: イムティヤズ <reza1234khan1234@gmail.com> Assisted-by: LLM Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260805093407.110571-1-reza1234khan1234@gmail.com Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Add quirk for invalid dev_sof in Logitech C925eYunke Cao
Logitech C925e SOF does not increases at a stable rate of 1kHz. Add a quirk for this camera to make hwtimestamp usable. Before applying the quirk: ``` seq: 31 ts: 1075.543294 delta: 29.423 ms fps: 34.94 seq: 32 ts: 1075.573022 delta: 29.728 ms fps: 34.90 seq: 33 ts: 1075.602353 delta: 29.331 ms fps: 34.87 seq: 34 ts: 1075.632031 delta: 29.678 ms fps: 34.84 seq: 35 ts: 1076.177759 delta: 545.728 ms fps: 23.00 seq: 36 ts: 1076.213255 delta: 35.496 ms fps: 23.12 seq: 37 ts: 1076.209371 delta: -3.884 ms fps: 23.82 seq: 38 ts: 1076.232233 delta: 22.862 ms fps: 24.11 seq: 39 ts: 1076.264682 delta: 32.449 ms fps: 24.24 seq: 40 ts: 1076.287318 delta: 22.636 ms fps: 24.52 seq: 41 ts: 1076.285949 delta: -1.369 ms fps: 25.16 seq: 42 ts: 1076.317714 delta: 31.765 ms fps: 25.28 seq: 43 ts: 1076.317085 delta: -0.629 ms fps: 25.89 seq: 44 ts: 1076.339919 delta: 22.834 ms fps: 26.13 seq: 45 ts: 1076.212836 delta: -127.083 ms fps: 28.91 seq: 46 ts: 1076.242494 delta: 29.658 ms fps: 29.00 seq: 47 ts: 1076.271852 delta: 29.358 ms fps: 29.09 seq: 48 ts: 1076.301739 delta: 29.887 ms fps: 29.17 seq: 49 ts: 1076.330887 delta: 29.148 ms fps: 29.26 seq: 50 ts: 1076.360639 delta: 29.752 ms fps: 29.33 seq: 51 ts: 1076.390095 delta: 29.456 ms fps: 29.41 ``` After applying the quirk: ``` seq: 31 ts: 203.782342 delta: 33.460 ms fps: 30.94 seq: 32 ts: 203.815492 delta: 33.150 ms fps: 30.91 seq: 33 ts: 203.849017 delta: 33.525 ms fps: 30.88 seq: 34 ts: 203.882190 delta: 33.173 ms fps: 30.86 seq: 35 ts: 203.915672 delta: 33.482 ms fps: 30.83 seq: 36 ts: 203.948902 delta: 33.230 ms fps: 30.81 seq: 37 ts: 203.982335 delta: 33.433 ms fps: 30.78 seq: 38 ts: 204.015475 delta: 33.140 ms fps: 30.76 seq: 39 ts: 204.048992 delta: 33.517 ms fps: 30.74 seq: 40 ts: 204.082208 delta: 33.216 ms fps: 30.72 seq: 41 ts: 204.115675 delta: 33.467 ms fps: 30.70 seq: 42 ts: 204.148995 delta: 33.320 ms fps: 30.69 seq: 43 ts: 204.182354 delta: 33.359 ms fps: 30.67 seq: 44 ts: 204.215605 delta: 33.251 ms fps: 30.66 seq: 45 ts: 204.249004 delta: 33.399 ms fps: 30.64 seq: 46 ts: 204.282259 delta: 33.255 ms fps: 30.63 seq: 47 ts: 204.315686 delta: 33.427 ms fps: 30.61 seq: 48 ts: 204.348945 delta: 33.259 ms fps: 30.60 seq: 49 ts: 204.382337 delta: 33.392 ms fps: 30.59 seq: 50 ts: 204.415570 delta: 33.233 ms fps: 30.58 seq: 51 ts: 204.449069 delta: 33.499 ms fps: 30.56 seq: 52 ts: 204.482218 delta: 33.149 ms fps: 30.55 seq: 53 ts: 204.515706 delta: 33.488 ms fps: 30.54 seq: 54 ts: 204.548940 delta: 33.234 ms fps: 30.53 seq: 55 ts: 204.582403 delta: 33.463 ms fps: 30.52 seq: 56 ts: 204.615563 delta: 33.160 ms fps: 30.51 seq: 57 ts: 204.649057 delta: 33.494 ms fps: 30.50 seq: 58 ts: 204.682301 delta: 33.244 ms fps: 30.49 seq: 59 ts: 204.715735 delta: 33.434 ms fps: 30.48 seq: 60 ts: 204.748890 delta: 33.155 ms fps: 30.48 ``` lsusb -v Bus 003 Device 005: ID 046d:085b Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 239 bDeviceSubClass 2 bDeviceProtocol 1 bMaxPacketSize0 64 idVendor 0x046d idProduct 0x085b bcdDevice 0.16 iManufacturer 0 iProduct 2 Logitech Webcam C925e iSerial 1 2F2036AF bNumConfigurations 1 Signed-off-by: Yunke Cao <yunkec@google.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260803065811.3490286-1-yunkec@google.com Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Add autosuspend quirk for AVerMedia Live Gamer HD 2Ricardo Ribalda
A user has reported that this device gets stuck in a loop where every few seconds it will turn off and turn back on, causing audio devices to disappear and reappear, its LED to flash, spamming dmesg, etc. This only happens when not in use; everything is fine when the video device is actually being used. They also reported that using the AUTOSUSPEND quirk via module parameters fixes the issue. Add the device to the quirk list. ID 07ca:1570 AVerMedia Technologies, Inc. AVerMedia USB Device Negotiated speed: High Speed (480Mbps) Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.10 bDeviceClass 239 Miscellaneous Device bDeviceSubClass 2 [unknown] bDeviceProtocol 1 Interface Association bMaxPacketSize0 64 idVendor 0x07ca AVerMedia Technologies, Inc. idProduct 0x1570 AVerMedia USB Device bcdDevice 1.00 iManufacturer 6 AVerMedia iProduct 7 AVerMedia USB Device iSerial 3 53106326013650 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x01d6 bNumInterfaces 4 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xa0 (Bus Powered) Remote Wakeup MaxPower 150mA Interface Association: bLength 8 bDescriptorType 11 bFirstInterface 0 bInterfaceCount 2 bFunctionClass 14 Video bFunctionSubClass 3 Video Interface Collection bFunctionProtocol 0 iFunction 8 AVerMedia Live Gamer HD 2 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 14 Video bInterfaceSubClass 1 Video Control bInterfaceProtocol 0 iInterface 8 AVerMedia Live Gamer HD 2 VideoControl Interface Descriptor: bLength 13 bDescriptorType 36 bDescriptorSubtype 1 (HEADER) bcdUVC 1.00 wTotalLength 0x004d dwClockFrequency 120.000000MHz bInCollection 1 baInterfaceNr( 0) 1 VideoControl Interface Descriptor: bLength 18 bDescriptorType 36 bDescriptorSubtype 2 (INPUT_TERMINAL) bTerminalID 1 wTerminalType 0x0201 Camera Sensor bAssocTerminal 0 iTerminal 0 wObjectiveFocalLengthMin 0 wObjectiveFocalLengthMax 0 wOcularFocalLength 0 bControlSize 3 bmControls 0x00000000 VideoControl Interface Descriptor: bLength 11 bDescriptorType 36 bDescriptorSubtype 5 (PROCESSING_UNIT) Warning: Descriptor too short bUnitID 3 bSourceID 1 wMaxMultiplier 0 bControlSize 2 bmControls 0x0000000f Brightness Contrast Hue Saturation iProcessing 0 bmVideoStandards 0x09 None SECAM - 625/50 VideoControl Interface Descriptor: bLength 9 bDescriptorType 36 bDescriptorSubtype 3 (OUTPUT_TERMINAL) bTerminalID 2 wTerminalType 0x0101 USB Streaming bAssocTerminal 0 bSourceID 4 iTerminal 0 VideoControl Interface Descriptor: bLength 28 bDescriptorType 36 bDescriptorSubtype 6 (EXTENSION_UNIT) bUnitID 4 guidExtensionCode {c66d125b-0480-0844-8c26-b8363a84de63} bNumControls 17 bNrInPins 1 baSourceID( 0) 3 bControlSize 3 bmControls( 0) 0x07 bmControls( 1) 0xfe bmControls( 2) 0x01 iExtension 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 14 Video bInterfaceSubClass 2 Video Streaming bInterfaceProtocol 0 iInterface 8 AVerMedia Live Gamer HD 2 VideoStreaming Interface Descriptor: bLength 14 bDescriptorType 36 bDescriptorSubtype 1 (INPUT_HEADER) bNumFormats 1 wTotalLength 0x00bd bEndpointAddress 0x89 EP 9 IN bmInfo 0 bTerminalLink 2 bStillCaptureMethod 0 bTriggerSupport 0 bTriggerUsage 0 bControlSize 1 bmaControls( 0) 0 VideoStreaming Interface Descriptor: bLength 11 bDescriptorType 36 bDescriptorSubtype 6 (FORMAT_MJPEG) bFormatIndex 1 bNumFrameDescriptors 5 bFlags 0 Fixed-size samples: No bDefaultFrameIndex 1 bAspectRatioX 0 bAspectRatioY 0 bmInterlaceFlags 0x00 Interlaced stream or variable: No Fields per frame: 1 fields Field 1 first: No Field pattern: Field 1 only bCopyProtect 0 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 7 (FRAME_MJPEG) bFrameIndex 1 bmCapabilities 0x00 Still image unsupported wWidth 640 wHeight 480 dwMinBitRate 294617088 dwMaxBitRate 294912000 dwMaxVideoFrameBufferSize 614400 dwDefaultFrameInterval 166833 bFrameIntervalType 2 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 VideoStreaming Interface Descriptor: bLength 34 bDescriptorType 36 bDescriptorSubtype 7 (FRAME_MJPEG) bFrameIndex 2 bmCapabilities 0x00 Still image unsupported wWidth 720 wHeight 480 dwMinBitRate 331444224 dwMaxBitRate 331776000 dwMaxVideoFrameBufferSize 691200 dwDefaultFrameInterval 166833 bFrameIntervalType 2 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 VideoStreaming Interface Descriptor: bLength 30 bDescriptorType 36 bDescriptorSubtype 7 (FRAME_MJPEG) bFrameIndex 3 bmCapabilities 0x00 Still image unsupported wWidth 720 wHeight 576 dwMinBitRate 331776000 dwMaxBitRate 331776000 dwMaxVideoFrameBufferSize 829440 dwDefaultFrameInterval 200000 bFrameIntervalType 1 dwFrameInterval( 0) 200000 VideoStreaming Interface Descriptor: bLength 38 bDescriptorType 36 bDescriptorSubtype 7 (FRAME_MJPEG) bFrameIndex 4 bmCapabilities 0x00 Still image unsupported wWidth 1280 wHeight 720 dwMinBitRate 737280000 dwMaxBitRate 884736000 dwMaxVideoFrameBufferSize 1843200 dwDefaultFrameInterval 166666 bFrameIntervalType 3 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 dwFrameInterval( 2) 200000 VideoStreaming Interface Descriptor: bLength 46 bDescriptorType 36 bDescriptorSubtype 7 (FRAME_MJPEG) bFrameIndex 5 bmCapabilities 0x00 Still image unsupported wWidth 1920 wHeight 1080 dwMinBitRate 994332672 dwMaxBitRate 1990656000 dwMaxVideoFrameBufferSize 4147200 dwDefaultFrameInterval 166666 bFrameIntervalType 5 dwFrameInterval( 0) 166666 dwFrameInterval( 1) 166833 dwFrameInterval( 2) 200000 dwFrameInterval( 3) 333333 dwFrameInterval( 4) 333667 VideoStreaming Interface Descriptor: bLength 6 bDescriptorType 36 bDescriptorSubtype 13 (COLORFORMAT) bColorPrimaries 1 (BT.709,sRGB) bTransferCharacteristics 1 (BT.709) bMatrixCoefficients 4 (SMPTE 170M (BT.601)) Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 1 bNumEndpoints 1 bInterfaceClass 14 Video bInterfaceSubClass 2 Video Streaming bInterfaceProtocol 0 iInterface 8 AVerMedia Live Gamer HD 2 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x89 EP 9 IN bmAttributes 5 Transfer Type Isochronous Synch Type Asynchronous Usage Type Data wMaxPacketSize 0x1400 3x 1024 bytes bInterval 1 Interface Association: bLength 8 bDescriptorType 11 bFirstInterface 2 bInterfaceCount 2 bFunctionClass 1 Audio bFunctionSubClass 2 Streaming bFunctionProtocol 0 iFunction 9 AVerMedia Live Gamer HD 2 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 2 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 1 Audio bInterfaceSubClass 1 Control Device bInterfaceProtocol 0 iInterface 9 AVerMedia Live Gamer HD 2 AudioControl Interface Descriptor: bLength 9 bDescriptorType 36 bDescriptorSubtype 1 (HEADER) bcdADC 1.00 wTotalLength 0x003a bInCollection 1 baInterfaceNr(0) 3 AudioControl Interface Descriptor: bLength 12 bDescriptorType 36 bDescriptorSubtype 2 (INPUT_TERMINAL) bTerminalID 1 wTerminalType 0x0602 Digital Audio Interface bAssocTerminal 0 bNrChannels 1 wChannelConfig 0x0000 iChannelNames 0 iTerminal 0 AudioControl Interface Descriptor: bLength 12 bDescriptorType 36 bDescriptorSubtype 2 (INPUT_TERMINAL) bTerminalID 5 wTerminalType 0x0603 Line Connector bAssocTerminal 0 bNrChannels 1 wChannelConfig 0x0000 iChannelNames 0 iTerminal 0 AudioControl Interface Descriptor: bLength 9 bDescriptorType 36 bDescriptorSubtype 3 (OUTPUT_TERMINAL) bTerminalID 2 wTerminalType 0x0101 USB Streaming bAssocTerminal 0 bSourceID 3 iTerminal 0 AudioControl Interface Descriptor: bLength 8 bDescriptorType 36 bDescriptorSubtype 6 (FEATURE_UNIT) bUnitID 3 bSourceID 4 bControlSize 1 bmaControls(0) 0x01 Mute Control iFeature 0 AudioControl Interface Descriptor: bLength 8 bDescriptorType 36 bDescriptorSubtype 5 (SELECTOR_UNIT) bUnitID 4 bNrInPins 2 baSourceID(0) 1 baSourceID(1) 5 iSelector 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 9 AVerMedia Live Gamer HD 2 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 1 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 9 AVerMedia Live Gamer HD 2 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 2 bDelay 1 frames wFormatTag 0x0001 PCM AudioStreaming Interface Descriptor: bLength 11 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 1 (FORMAT_TYPE_I) bNrChannels 2 bSubframeSize 2 bBitResolution 16 bSamFreqType 1 Discrete tSamFreq[ 0] 48000 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x8a EP 10 IN bmAttributes 5 Transfer Type Isochronous Synch Type Asynchronous Usage Type Data wMaxPacketSize 0x00c0 1x 192 bytes bInterval 4 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 0 Undefined wLockDelay 0x0000 Binary Object Store Descriptor: bLength 5 bDescriptorType 15 wTotalLength 0x0016 bNumDeviceCaps 2 USB 2.0 Extension Device Capability: bLength 7 bDescriptorType 16 bDevCapabilityType 2 bmAttributes 0x00000006 BESL Link Power Management (LPM) Supported SuperSpeed USB Device Capability: bLength 10 bDescriptorType 16 bDevCapabilityType 3 bmAttributes 0x00 wSpeedsSupported 0x000e Device can operate at Full Speed (12Mbps) Device can operate at High Speed (480Mbps) Device can operate at SuperSpeed (5Gbps) bFunctionalitySupport 1 Lowest fully-functional device speed is Full Speed (12Mbps) bU1DevExitLat 4 micro seconds bU2DevExitLat 4 micro seconds Device Status: 0x0000 (Bus Powered) Reported-by: Sean Baggaley <me@drinkybird.net> Closes: https://lore.kernel.org/linux-media/5ef59031-0853-41a7-8d11-c345fe535daf@drinkybird.net/ Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260730-uvc-avermedia-v1-1-7272dd394d83@chromium.org Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-02media: uvcvideo: Remove unused active fieldRicardo Ribalda
The active field in struct uvc_streaming is not used anymore, drop it. Reported-by: Hans de Goede <hansg@kernel.org> Closes: https://lore.kernel.org/linux-media/20260629-uvc-racemeta-v2-0-10e91d2afba0@chromium.org/T/#m3078f0d5fd71435b5cfacaa5c99f23a446db581f Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://patch.msgid.link/20260630-uvc-remove-active-v1-1-ed1421b99429@chromium.org Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: em28xx: hold the vb2 queue lock when releasing the queue on closeChristopher Snowhill
Commit de626073dfcb ("media: em28xx: drop 'users' field") replaced the vb2_fop_release() call in em28xx_v4l2_close() with _vb2_fop_release(filp, NULL) under dev->lock. vb2_fop_release() took the vb2 queue lock, but the new call takes no lock at all. The video and VBI queues have their own locks (vb_queue_lock and vb_vbi_queue_lock), and v4l2_ioctl_get_lock() serializes the queue ioctls with those rather than dev->lock. The queue can therefore be released on close while another file handle is in the middle of VIDIOC_REQBUFS. __vb2_queue_alloc() adds each buffer to the queue before allocating its planes, so the release can find an MMAP buffer whose mem_priv is still NULL and hand it to vb2_vmalloc_put(): BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:vb2_vmalloc_put+0xe/0x50 [videobuf2_vmalloc] Call Trace: __vb2_queue_free+0x14e/0x350 [videobuf2_common] vb2_core_queue_release+0x3b/0x80 [videobuf2_common] _vb2_fop_release+0x44/0x70 [videobuf2_v4l2] em28xx_v4l2_close+0x60/0x140 [em28xx_v4l] v4l2_release+0x9d/0xf0 [videodev] __fput+0xfd/0x280 This was hit with OBS on a MyGica iGrabber (card=105). Pass the queue lock to _vb2_fop_release(). Taking it while holding dev->lock matches the existing order in em28xx_v4l2_fini(), where vb2_video_unregister_device() takes the queue lock under dev->lock. Fixes: de626073dfcb ("media: em28xx: drop 'users' field") Assisted-by: LLM Signed-off-by: Christopher Snowhill <chris@kode54.net> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: em28xx: fix inverted tuner capability check for VBI deviceChristopher Snowhill
Commit 8e53399c63c3 ("media: em28xx: Add support for Empia em2828X bridge") changed the condition for setting V4L2_CAP_TUNER on the VBI device from "dev->tuner_type != TUNER_ABSENT" to a check of the video device's capabilities, but inverted it: the VBI node now advertises a tuner only when the video node does not have one. On boards without a tuner (e.g. the MyGica iGrabber, card=105) the VBI device's device_caps therefore contain V4L2_CAP_TUNER, while the shared vidioc_querycap() correctly omits it from cap->capabilities. This trips the sanity check in v4l_querycap() whenever the VBI node is queried, for example by udev's v4l_id on every hotplug: WARNING: drivers/media/v4l2-core/v4l2-ioctl.c:1119 at v4l_querycap+0xff/0x110 [videodev] (cap->capabilities & (vfd->device_caps | V4L2_CAP_DEVICE_CAPS)) != (vfd->device_caps | V4L2_CAP_DEVICE_CAPS) It also leaves the tuner ioctls enabled on the VBI node of tuner-less boards and disables them on boards that do have a tuner. Restore the intended logic so the VBI device has V4L2_CAP_TUNER exactly when the video device does. Fixes: 8e53399c63c3 ("media: em28xx: Add support for Empia em2828X bridge") Assisted-by: LLM Signed-off-by: Christopher Snowhill <chris@kode54.net> Cc: stable@vger.kernel.org Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: em28xx: fix double free in em28xx_alloc_urbsKaho Jiang
When allocation of usb_bufs->buf[i] fails, em28xx_alloc_urbs() explicitly frees all items within usb_bufs->buf before calling em28xx_uninit_usb_xfer(), which also frees these items, causing them to be freed twice. BUG: KASAN: double-free in usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96) Free of addr ffff88802fd37c00 by task kworker/1:2/1182 Workqueue: events request_module_async Call Trace: kasan_report_invalid_free (mm/kasan/report.c:557) check_slab_allocation (mm/kasan/common.c:235) kfree (./include/linux/kasan.h:199 (discriminator 1) mm/slub.c:2693 (discriminator 1) mm/slub.c:6508 (discriminator 1) mm/slub.c:6801 (discriminator 1)) usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96) usb_free_urb (drivers/usb/core/urb.c:95) em28xx_uninit_usb_xfer (drivers/media/usb/em28xx/em28xx-core.c:964) em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1076) em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698) em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248) request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685) process_one_work (kernel/workqueue.c:3396) worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Allocated by task 1182: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) __kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5414 mm/slub.c:5439) em28xx_alloc_urbs (./include/linux/slab.h:995 ./include/linux/slab.h:1312 drivers/media/usb/em28xx/em28xx-core.c:1081) em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698) em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248) request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685) process_one_work (kernel/workqueue.c:3396) worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Freed by task 1182: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2748 mm/slub.c:6508 mm/slub.c:6801) em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1084) em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698) em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248) request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685) process_one_work (kernel/workqueue.c:3396) worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Remove the explicit cleanup loop and let em28xx_uninit_usb_xfer() handle the cleanup. Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers") Cc: stable@vger.kernel.org Reported-by: co+6a04efcebe0fc0ce@bugs.sh Assisted-by: LLM Signed-off-by: Kaho Jiang <kj2864@nyu.edu> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: cx231xx: remove unused cx231xx_dump_SC_reg() debug helperZain Aboobacker
cx231xx_dump_SC_reg() is compiled out with #if 0 and has no callers. Remove the dead code. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Zain Aboobacker <zainaboobacker33@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: rtl28xxu: fix SDR platform device leakGuangshuo Li
rtl2832u_tuner_attach() registers an rtl2832_sdr platform device, but does not unregister it if no driver is bound. It also does not take a reference on the bound driver module. Unregister the platform device when no driver is bound or the module reference cannot be acquired. Drop the module reference in rtl28xxu_tuner_detach() before unregistering the device. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: a2f7f220df5e ("[media] rtl28xxu: switch SDR module to platform driver") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: em28xx: complete frames from non-interlaced sourcesDavid Wood
Non-interlaced 60 Hz sources, such as the 240p output of classic game consoles, produce 262 lines per field with no half-line offset, so every field has the same parity. The TVP5150 tracks such a signal without trouble (locked, 60 Hz, vertical line count 524 instead of 525) but reports the same field ID for every field, and the em2860 forwards that in its field-start header. On an EM2860/TVP5150 reference design (eb1a:5051) fed by a NES, 112 of 113 consecutive headers in a 6 s stream carry field ID 1 (bottom); the lone top-field header is the first one. finish_field_prepare_next() only completes a buffer and starts the next one when a top field arrives, so with such a source no frame is ever delivered: streaming starts, the first buffer never finishes, and the application sits in select() until it times out. Disturbing the cable briefly loses sync, yields a stray top-field header and lets a single frame through -- the "one frame, then it freezes" symptom. Track the previous field ID. When a header repeats the ID of the field before it, give the new field the opposite parity instead of taking the ID literally, so consecutive fields are woven into a frame the same way a genuine top/bottom pair is. Interlaced streams alternate IDs and are unaffected. A dropped field in one now lands two bottom fields in the same buffer, which the copy path already tolerates, and the following top field starts a new frame as before. With this the NES streams at 29.9 fps with a stable, correctly woven picture. Each frame holds two consecutive progressive source frames, so an application that wants the source's 60 fps back can bob-deinterlace. Signed-off-by: David Wood <d01.devel@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: em28xx: add StarTech.com SVID2USB23 with working audio captureDavid Wood
The StarTech.com SVID2USB23 is an EM2860 + TVP5150AM1 + EMP202 capture dongle that ships with the generic eb1a:5051 USB ID, so it is picked up as the EM2860/TVP5150 reference design. Video works, but analog audio capture is silent: the ALSA device yields a flat noise floor of about -85 dBFS whether or not anything is connected. Audio on this board is not on the em28xx vendor path. Chip config register 0x00 reads 0x50, so the board exposes a USB Audio Class interface, claimed by snd-usb-audio, that is fed by the EMP202 ADC. The ADC record source is selected by AC97_REC_SEL, which em28xx_audio_analog_set() only programs when EM28XX_AOUT_PCM_IN is set in the input's .aout. With .amux alone only the mixer volume registers are written, and the record source stays at its reset value (Mic, not wired on this board), so the ADC captures nothing. Add a board entry for the SVID2USB23 with .aout selecting the PCM record path from Line In, and identify the board by its EEPROM hash, leaving the reference design entry untouched. Boards with this USB ID that do not match a hash keep the reference design as before, without any extra log output. card=114 also selects the entry by hand. Verified on the SVID2USB23: the board is identified as card=114 and the driver programs AC97_REC_SEL to 0x0404 on its own at probe. Toggling that register alone with everything else held constant is what separates working (-22 dBFS, line level) from silent (-85 dBFS) capture. AC97_POWERDOWN reads 0x420d (ADC, analog and reference all ready) throughout, so this is not a power or GPIO problem. The V4L2 mute control still defaults to 1 and gates the bridge audio path, so clearing it remains necessary to hear anything; that is a separate issue. Signed-off-by: David Wood <d01.devel@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: pvrusb2: Fix USB parent device leak in class_dev_create()Wentao Liang
class_dev_create() stores a reference to the USB device obtained with get_device() in class_dev->parent, which class_dev_destroy() releases. When device_register() fails the function only drops class_dev, so the reference to the USB parent device is never released. Drop the parent reference on the failure path as well. Fixes: 28c4a5e6d324 ("V4L/DVB: pvrusb2: Fix USB parent device reference count") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: em28xx: reject audio endpoint with zero packet sizeXiang Mei
em28xx_audio_urb_init() divides by the audio endpoint's wMaxPacketSize without checking it, so a USB device that declares a zero-sized audio endpoint divides by zero at probe time. Reject a zero-sized audio endpoint like a missing one; the caller already unwinds on a negative return. Oops: divide error: 0000 [#1] SMP NOPTI Workqueue: usb_hub_wq hub_event RIP: 0010:em28xx_audio_init (drivers/media/usb/em28xx/em28xx-audio.c:718) Call Trace: em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248) em28xx_init_dev.isra.0 (drivers/media/usb/em28xx/em28xx-cards.c:3887) em28xx_usb_probe (drivers/media/usb/em28xx/em28xx-cards.c:4258) usb_probe_interface (drivers/usb/core/driver.c:396) ... usb_set_configuration (drivers/usb/core/message.c:2268) usb_generic_driver_probe (drivers/usb/core/generic.c:250) usb_probe_device (drivers/usb/core/driver.c:291) ... usb_new_device (drivers/usb/core/hub.c:2703) hub_event (drivers/usb/core/hub.c:5961) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Kernel panic - not syncing: Fatal exception Fixes: 1b3fd2d34266 ("[media] em28xx-audio: don't hardcode audio URB calculus") Cc: stable@vger.kernel.org Reported-by: co+9782320f78c23f40@bugs.sh Closes: https://lore.kernel.org/all/51lCz4R7QyTUKbh4mhXNaNzX0evpk0siOzbh%40bugs.sh/ Assisted-by: Claude:claude-opus-5 Signed-off-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: em28xx: setup queues before registering V4L2 deviceDmitry Antipov
Adjust em28xx_v4l2_init() to setup video and VBI capture queues before calling video_register_device(), thus making error cleanup work as expected. Reported-by: syzbot+dd0f06181ab66b93dc00@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=dd0f06181ab66b93dc00 Suggested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-10-01media: airspy: replace deprecated V4L2_TUNER_ADCSyed Ali
V4L2_TUNER_ADC is the deprecated alias of V4L2_TUNER_SDR. Use V4L2_TUNER_SDR directly throughout the driver. no change of function. Signed-off-by: Syed Ali <syedalia1000@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-23media: au0828: Fix media device leak in au0828_usb_probe()Wentao Liang
au0828_media_device_init() takes a reference to a media device with media_device_usb_allocate(). When au0828_v4l2_device_register() fails right after, the error path only unregisters the entities and frees au0828_dev, so that reference is never released. Release it with media_device_delete() on that path. Fixes: 812658d88d26 ("media: change au0828 to use Media Device Allocator API") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-23media: go7007: only set audio_enabled if go7007_snd_init() succeededXiang Mei
go7007_register_encoder() sets go->audio_enabled before calling go7007_snd_init() and discards its return value. go7007_snd_init() assigns go->snd_context only on success, so a failed ALSA setup leaves audio_enabled set with snd_context still NULL. The disconnect path tests audio_enabled and calls go7007_snd_remove(), which dereferences snd_context unconditionally. go7007_snd_init() returns -ENODEV once its never-decremented static card counter reaches SNDRV_CARDS, so SNDRV_CARDS attach/detach cycles arm the next attach; no memory pressure is needed. Set go->audio_enabled only once go7007_snd_init() has succeeded. Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: usb_hub_wq hub_event RIP: 0010:go7007_snd_remove (drivers/media/usb/go7007/snd-go7007.c:273) Call Trace: go7007_usb_disconnect (drivers/media/usb/go7007/go7007-usb.c:1336) usb_unbind_interface (drivers/usb/core/driver.c:461) device_remove (drivers/base/dd.c:618) device_release_driver_internal (drivers/base/dd.c:1349) bus_remove_device (drivers/base/bus.c:664) device_del (drivers/base/core.c:3965) usb_disable_device (drivers/usb/core/message.c:1478) usb_disconnect hub_event (drivers/usb/core/hub.c:5966) process_one_work (kernel/workqueue.c:3396) worker_thread (kernel/workqueue.c:3560) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Kernel panic - not syncing: Fatal exception Cc: stable@vger.kernel.org Fixes: 866b8695d67e ("Staging: add the go7007 video driver") Assisted-by: LLM Signed-off-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-23media: go7007: unregister the I2C adapter on USB probe failureMyeonghun Pak
USB probe failures after I2C adapter registration free the backing go7007 structure without unregistering the adapter. If i2c_adapter_online is set, unregister the adapter before releasing USB resources so that I2C client removal can still use its callbacks. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 59aea928d57f ("[media] go7007: don't continue if firmware can't be loaded") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Assisted-by: OpenAI:GPT-5.6 Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-23media: em28xx: use video_unregister_device for radio_devRohinthan P
Commit 7c8bf63b7937 ("media: em28xx: use vb2_video_unregister_device") converted device unregistrations in em28xx to use vb2_video_unregister_device() instead of video_unregister_device(). However, radio devices do not have an associated videobuf2 queue (v4l2->radio_dev.queue is NULL). Calling vb2_video_unregister_device() on a radio device triggers a WARNING in vb2_video_unregister_device(): !vdev->queue WARNING: drivers/media/common/videobuf2/videobuf2-v4l2.c:1264 at vb2_video_unregister_device+0x1f8/0x200 Call Trace: em28xx_v4l2_init+0x1c39/0x3150 drivers/media/usb/em28xx/em28xx-video.c:3085 As documented in vb2_video_unregister_device(), video_unregister_device() should be used instead when vdev->queue is NULL. Revert to calling video_unregister_device() for v4l2->radio_dev in both em28xx_v4l2_fini() and the em28xx_v4l2_init() error unwind path. Fixes: 7c8bf63b7937 ("media: em28xx: use vb2_video_unregister_device") Reported-by: syzbot+f26bc23e42eeb548dee1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f26bc23e42eeb548dee1 Signed-off-by: Rohinthan P <rokinthanp03@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-17media: v4l2-subdev: Add struct v4l2_subdev_client_info pointer to pad opsSakari Ailus
Add a pointer to const struct v4l2_subdev_client_info to the get_fmt, set_fmt, get_selection and set_selection sub-device pad ops. The client info struct will soon be used to differentiate UAPI based on client capabilities. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
2026-09-10media: cx231xx: preserve I2C transfer lengthJuan Perdomo
The I2C core stores message lengths in u16, but cx231xx truncates them to u8 when populating cx231xx_i2c_xfer_data. A 0x700-byte read therefore becomes a zero-length request. USB treats zero-length control transfers as OUT regardless of bRequestType, so the IN control pipe trips the usb_submit_urb() direction warning. Use u16 for buf_size, matching both i2c_msg.len and VENDOR_REQUEST_IN.wLength. Oversized transfers then reach the existing URB_MAX_CTRL_SIZE check and return -EINVAL. Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver") Cc: stable@kernel.org Reported-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ddccc0c0dbc0a38ffccb Tested-by: syzbot+ddccc0c0dbc0a38ffccb@syzkaller.appspotmail.com Signed-off-by: Juan Perdomo <jcperdomo100@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-10media: dvb-usb-v2/mxl111sf-i2c: fix typo "initilize" in commentsHemanth Selam
Correct "initilize" to "initialize", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-10media: fix repeated words in commentsHemanth Selam
Drop words accidentally written twice, reported by checkpatch.pl as a possible repeated word. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-10media: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-09media: require two-byte Cypress type 04 recordsPengpeng Hou
Both Cypress Intel HEX parsers read two address bytes from type 04 records. Generic record framing permits any record length, so a short record can make the parser consume the checksum or bytes beyond the firmware record. A longer record also violates the Intel HEX type 04 layout. Require the type 04 payload length to be exactly two bytes in both implementations. Fixes: 79a63c60a6a2 ("[media] media: move dvb-usb-v2/cypress_firmware.c to media/common") Fixes: 776338e121b9 ("[PATCH] dvb: Add generalized dvb-usb driver") Cc: stable@kernel.org Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: usb: em28xx: check if vbi is supported before calling vb2_queue_initHans Verkuil
If the device does not support vbi, then the vbi queue is still initialized with vb2_queue_init(), which fails with a WARNing because the q->lock pointer is never set. Only call vb2_queue_init for the vbi queue if vbi is actually supported. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Reported-by: Lars Ljung <lars@matholka.se> Closes: https://lore.kernel.org/linux-media/8ede91cc-b505-458a-94ef-fb02270f9701@matholka.se/T/#u Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-09-08media: go7007: bound EZ-USB I2C transfers to the usb_buf sizeShengzhuo Wei
go7007_usb_i2c_master_xfer() copies msgs[i].len bytes into go->usb_buf, a 16-byte buffer embedded in struct go7007, without any length check. The adapter declares no transfer limits, so an SMBus block transfer issued through /dev/i2c-N can write up to 34 bytes into it and corrupt the struct fields that follow the buffer. Bound the transfer size with i2c_adapter_quirks so the I2C core rejects oversized messages before they reach the driver. Fixes: 7955f03d18d1 ("[media] go7007: move out of staging into drivers/media/usb.") Cc: stable@vger.kernel.org Signed-off-by: Shengzhuo Wei <me@cherr.cc> Assisted-by: GLM:5.3 Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: em28xx: Fix PAL analog TV coloursBradford Love
Red/Blue chroma are swapped on PAL analog TV due to register 0x7A07 missing in the configuration block for PAL. Copying in the setting for composite fixes the issue and everything decodes properly. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: usbtv: fix null-pointer dereference on disconnectAleksandr Nogikh
A null-pointer dereference can occur in usb_make_path() when called from usbtv_querycap() (and other ioctl handlers) during device disconnection. Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:usb_make_path include/linux/usb.h:985 [inline] RIP: 0010:usbtv_querycap+0x9c/0x100 drivers/media/usb/usbtv/usbtv-video.c:612 ... Call Trace: <TASK> v4l_querycap+0x236/0x470 drivers/media/v4l2-core/v4l2-ioctl.c:1106 __video_do_ioctl+0x8af/0xc70 drivers/media/v4l2-core/v4l2-ioctl.c:3133 video_usercopy+0x860/0x1430 drivers/media/v4l2-core/v4l2-ioctl.c:3475 v4l2_ioctl+0x18d/0x1e0 drivers/media/v4l2-core/v4l2-dev.c:366 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 This happens due to a race condition between the USB device disconnect routine (usbtv_disconnect()) and V4L2 ioctls. When the device is disconnected, usbtv_disconnect() sets usbtv->udev = NULL without holding the usbtv->v4l2_lock mutex. Concurrently, an ioctl handler like usbtv_querycap() can be executing under the v4l2_lock and attempt to use usbtv->udev, leading to a crash. To fix this, move the usbtv->udev = NULL assignment into usbtv_video_free() and protect it with mutex_lock(&usbtv->v4l2_lock). This ensures that no non-queue ioctl handler can run concurrently with the pointer being nullified. If an ioctl is already running, the mutex will block the disconnect path until the ioctl finishes. If an ioctl is blocked waiting for the lock, it will acquire it after the disconnect routine releases it, but will then check video_is_registered() (which was cleared by vb2_video_unregister_device()) and safely return -ENODEV. Acquiring v4l2_lock after vb2_video_unregister_device() avoids reintroducing a historical deadlock issue, and usbtv_audio_free() remains safe as it is called before usbtv_video_free(). Fixes: 65e6a2773d65 ("media: usbtv: Remove useless locks in usbtv_video_free()") Cc: stable@vger.kernel.org Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+37a57a84893052ab6071@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=37a57a84893052ab6071 Link: https://syzkaller.appspot.com/ai_job?id=5abbe65a-5853-4bc2-9135-5c75f88d51ed Signed-off-by: Aleksandr Nogikh <nogikh@google.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: au0828: Free URBs when starting DVB streaming failsRuoyu Wang
start_urb_transfer() stores each allocated URB in dev->urbs[], but sets urb_streaming only after all URBs have been submitted. If a later URB or transfer buffer allocation fails, earlier entries are left allocated. A submission failure calls stop_urb_transfer(), but that function returns immediately while urb_streaming is false, leaving both submitted and unsubmitted URBs behind. Make stop_urb_transfer() release every populated slot regardless of the streaming flag and clear each slot after release. Route all start errors through this cleanup. usb_kill_urb() safely handles both submitted and unsubmitted URBs, while the existing preallocation check preserves the lifetime of shared transfer buffers. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 265a6510629a ("V4L/DVB (7621): Add support for Hauppauge HVR950Q/HVR850/FusioHDTV7-USB") Cc: stable@vger.kernel.org Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: gspca: use vb2_video_unregister_device() on disconnectShuangpeng Bai
gspca uses vb2_fop_release(), but gspca_disconnect() only unregisters the video device. If the queue owner closes the device after USB disconnect, vb2_fop_release() releases the queue and invokes gspca_stop_streaming() at that point. gspca_stream_off() calls subdriver stop callbacks and usb_set_interface() through gspca_dev->dev. By the time the late close runs, the USB core can have freed the usb_device, resulting in a use-after-free. This was observed as a KASAN use-after-free in sd_stopN(). Use vb2_video_unregister_device() so the queue is released and streaming is stopped synchronously during disconnect, while the usb_device is still valid. Since the helper takes the queue lock, which is usb_lock, call it after dropping that lock. Fixes: f729ef5796d8 ("media: videobuf2-v4l2.c: add vb2_video_unregister_device helper function") Cc: stable@vger.kernel.org # 5.10.x Suggested-by: Hans Verkuil <hverkuil@kernel.org> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: au0828: fix use-after-free in bulk_timeout timer on disconnectFan Wu
start_urb_transfer() arms dev->bulk_timeout, whose callback au0828_bulk_timeout() queues dev->restart_streaming; that work in turn calls start_urb_transfer() and re-arms the timer. au0828_dvb_unregister() cancels restart_streaming on disconnect but does not sync bulk_timeout. au0828_usb_release() then frees dev with kfree(), so a timer still armed or pending at that point can fire after the free and dereference dev through timer_container_of(). Sync the timer with timer_shutdown_sync() before cancel_work_sync(). The timer callback queues the work, so the timer must be stopped first; the shutdown variant is needed because the work re-arms the timer through start_urb_transfer(). The dvb->frontend == NULL early return guards the register-failure path where the timer was never set up. This bug was found by static analysis. Fixes: 53460c53b761 ("[media] au0828: Add timer to restart TS stream if no data arrives on bulk endpoint") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: hackrf: fix use-after-free in hackrf_alloc_urbs() error pathAnuj Bolewar
hackrf_alloc_urbs() frees the URBs it allocated so far when one allocation fails, but leaves the entries in dev->urb_list[] and dev->urbs_initialized untouched. The caller, hackrf_start_streaming(), then calls hackrf_free_urbs() on the error path, which walks dev->urbs_initialized entries and calls usb_free_urb() a second time on the already-freed URBs, causing a use-after-free (slab-use-after-free Write in usb_free_urb()). Drop the redundant cleanup loop inside hackrf_alloc_urbs() and let hackrf_free_urbs(), which the caller already invokes on error, own the cleanup of the successfully allocated URBs. Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d Fixes: 969ec1f6bd92 ("[media] hackrf: HackRF SDR driver") Cc: stable@vger.kernel.org Signed-off-by: Anuj Bolewar <bolewara@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: pvrusb2: fix URB pending flag leak on invalid endpointNguyen Quang Le Kien
In pvr2_send_request_ex(), when usb_urb_ep_type_check() fails for either the write or read control endpoint, the code returned -EINVAL directly without clearing the corresponding pending flags (ctl_write_pend_flag or ctl_read_pend_flag) or going through the done: cleanup path. This left the pending flags set while the URBs were never actually submitted. On the next call to pvr2_send_request_ex(), the URBs would be filled and submitted while the kernel still considered them active, triggering the WARNING "URB submitted while active" in usb_submit_urb(). Fix this by: - Clearing the pending flag before returning on invalid endpoint - Using goto done instead of direct return to go through proper cleanup - For the read endpoint case, unlinking the write URB if it was already submitted and waiting for its completion before returning Reported-by: syzbot+20fef510634faf733060@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=20fef510634faf733060 Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: cx231xx: Fix cleanup path on failureAndi Shyti
If cx231xx_init_v4l2() fails the probe currently jumps to err_init, which only unregisters the V4L2 device. The analog devices and I2C resources are left registered while the driver state can be released. A subsequent driver bind attempts to create the same I2C mux channel links and triggers a warning when the existing "channel-0" link is encountered. The remaining devices may also access released driver state. This produces the following warning can't create symlink to channel 0 WARNING: drivers/i2c/i2c-mux.c:403 at i2c_mux_add_adapter+0xcd8/0xeb0 Call Trace: i2c_mux_add_adapter+0xcdc/0xeb0 cx231xx_dev_init+0x2fb/0x1260 cx231xx_usb_probe+0xc48/0x2140 usb_probe_interface+0x657/0xc70 ... Jump to err_video_alt instead, which performs the full device cleanup before unregistering the V4L2 device. Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu> Closes: https://github.com/farhad-alemi/public_bug_reports/tree/main/185-warning-in-i2c-mux-add-adapter/ Fixes: 4d2a7d3509f5 ("[media] cx231xx: move analog init code to a separate function") Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Cc: <stable@vger.kernel.org> # v3.17+ Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-09-08media: cx231xx-audio: drain wq_trigger before audio finiFan Wu
audio_trigger() is deferred work (dev->wq_trigger) armed from snd_cx231xx_capture_trigger() on every PCM START/STOP; it dereferences dev->adev state and may free the URBs via cx231xx_isoc_audio_deinit(). cx231xx_audio_fini() tore down that state without draining wq_trigger, so work armed before or racing fini ran against freed state. Use disable_work_sync() in fini to drain the work and prevent further queueing. Initialize the work, lock and stream_started counter at the top of cx231xx_audio_init(), before any fallible allocation, and clear the partially-built audio state on its error path, so fini is safe even if a later step fails. This issue was found by an in-house static analysis tool. Fixes: 61b04cb24a12 ("[media] cx231xx-audio: fix some locking issues") Cc: stable@vger.kernel.org # v6.10+ Link: https://lore.kernel.org/r/8c7e1294-b906-4636-890c-b64d03b0e1d0@kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-08-25Merge tag 'usb-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1. Lots of driver work for new devices and systems, and many other minor fixes and updates. Included in here are: - Thunderbolt subsystem driver updates and additions - typec driver updates and additions - usb gadget fixes all over the place, seems like people are finally paying attention to these drivers for some reason - xhci driver updates and fixes based on lots of reports - usb-serial driver updates and additions - new device ids - other minor USB driver updates and fixes All of these have been in linux-next for a while with no reported issues" * tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits) usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() usb: typec: hd3ss3220: fix VBUS regulator error message usb: usbfs: fix use-after-free of usb_device in usbdev_release() usb: gadget: u_audio: Fix use-after-free on sound card disconnect usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition usb: gadget: f_tcm: keep port count until LUN teardown completes usb: usbtest: disable dynamic ID support usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() USB: c67x00: fix use-after-free in c67x00_add_iso_urb() usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion usb: gadget: snps_udc_plat: clean up PHY on probe deferral usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() usb: dwc2: gadget: Exit partial power down state when changing USB pull-up usb: gadget: f_fs: Fix Use-After-Free in AIO error path usb: gadget: f_fs: Prevent deadlock during ep0 read loop usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed usb: gadget: midi2: remove default configfs groups on teardown usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() usb: typec: thunderbolt: Disable work before freeing tbt on remove usb: xhci: Handle bogus TRB pointers in Missed Service Error events ...
2026-08-19Merge tag 'media/v7.3-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2-core: added ISP statistics support and per-block validation - v4l2-core: Allow unknown HDR10 white point and luminance - New camera sensors: Sony IMX678 and IMX471m, Himax HM1092 IR sensor - New codec: Milos: VPU v2.0 codec support - isp driver: gained support for Dreamchip RPPX1 ISP framework - vsp1 driver: gained support for RZ/T2H and RZ/N2H - Novalake driver: gained CVS support for new NVL hardware - dvb-core: fix feed leak on failed DMX_ADD_PID - several driver fixes, cleanups and minor improvements * tag 'media/v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (308 commits) media: ipu-bridge: check all DMI entries when overriding sensor rotation media: v4l2-async: avoid deleting unlinked ASC entry on link error media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement media: intel/ipu6: fix async notifier cleanup leak on parse error media: staging/ipu7: fix async notifier UAF on probe error path media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() media: rcar-isp: Fix VSPX reference leaks media: rcar-isp: Release ISPCORE resources media: i2c: imx415: Release runtime PM reference on VBLANK error media: i2c: imx415: Return test pattern write errors media: renesas: vsp1: Declare index variables in for loop statement media: renesas: vsp1: Make reset control optional to support platforms without a reset line media: dt-bindings: media: renesas,vsp1: Document RZ/T2H and RZ/N2H SoCs media: dt-bindings: media: renesas,fcp: Document RZ/T2H and RZ/N2H SoCs media: nxp: imx8-isi: Add additional 32-bit RGB format support media: nxp: imx8-isi: Add 16-bit raw Bayer format support media: nxp: imx8-isi: Implement per-stream reference counting for multiplexed streams media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks media: nxp: imx8-isi: Correct color map between V4L2 and ISI ...
2026-07-28media: em28xx: defer audio-only extension registrationDiego Fernando Mancera Gomez
The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before dev_next is created. The duplicate device inherits is_audio_only and is then independently inserted into em28xx_devlist. The list is intended to contain only primary devices: extension operations reach the secondary device through dev_next. The independently linked secondary can be freed during disconnect while its list node remains reachable, resulting in a use-after-free. Defer audio-only extension registration to the module-request work item. It runs only after probing has completed construction of the optional secondary device, so only the primary is registered and extension callbacks reach the secondary through dev_next. Fixes: 4a089668ef22 ("media: em28xx-cards: rework the em28xx probing code") Cc: stable@vger.kernel.org Reported-by: syzbot+a11c46f37ee083a73deb@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/66ec3c83.050a0220.29194.002f.GAE@google.com/T/ Suggested-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28media: remove conditional return with no effectSang-Heon Jeon
Both branches of the check return the same value, so the check has no effect. Remove it and return the value directly. This is the result of running the Coccinelle script from scripts/coccinelle/misc/cond_return_no_effect.cocci. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
generated by cgit v1.2.3 (git 2.0.4) at 2026-11-04 23:36:45 +0000