user/sven/linux.git/include/media, branch v6.3.12

Revert "media: dvb-core: Fix use-after-free on race condition at dvb_frontend"

2023-06-21T14:02:17Z

[ Upstream commit ec21a38df77a5aefbd2f70c48127003b6f259cf3 ] As reported by Thomas Voegtle , sometimes a DVB card does not initialize properly booting Linux 6.4-rc4. This is not always, maybe in 3 out of 4 attempts. After double-checking, the root cause seems to be related to the UAF fix, which is causing a race issue: [ 26.332149] tda10071 7-0005: found a 'NXP TDA10071' in cold state, will try to load a firmware [ 26.340779] tda10071 7-0005: downloading firmware from file 'dvb-fe-tda10071.fw' [ 989.277402] INFO: task vdr:743 blocked for more than 491 seconds. [ 989.283504] Not tainted 6.4.0-rc5-i5 #249 [ 989.288036] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 989.295860] task:vdr state:D stack:0 pid:743 ppid:711 flags:0x00004002 [ 989.295865] Call Trace: [ 989.295867] [ 989.295869] __schedule+0x2ea/0x12d0 [ 989.295877] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 989.295881] schedule+0x57/0xc0 [ 989.295884] schedule_preempt_disabled+0xc/0x20 [ 989.295887] __mutex_lock.isra.16+0x237/0x480 [ 989.295891] ? dvb_get_property.isra.10+0x1bc/0xa50 [ 989.295898] ? dvb_frontend_stop+0x36/0x180 [ 989.338777] dvb_frontend_stop+0x36/0x180 [ 989.338781] dvb_frontend_open+0x2f1/0x470 [ 989.338784] dvb_device_open+0x81/0xf0 [ 989.338804] ? exact_lock+0x20/0x20 [ 989.338808] chrdev_open+0x7f/0x1c0 [ 989.338811] ? generic_permission+0x1a2/0x230 [ 989.338813] ? link_path_walk.part.63+0x340/0x380 [ 989.338815] ? exact_lock+0x20/0x20 [ 989.338817] do_dentry_open+0x18e/0x450 [ 989.374030] path_openat+0xca5/0xe00 [ 989.374031] ? terminate_walk+0xec/0x100 [ 989.374034] ? path_lookupat+0x93/0x140 [ 989.374036] do_filp_open+0xc0/0x140 [ 989.374038] ? __call_rcu_common.constprop.91+0x92/0x240 [ 989.374041] ? __check_object_size+0x147/0x260 [ 989.374043] ? __check_object_size+0x147/0x260 [ 989.374045] ? alloc_fd+0xbb/0x180 [ 989.374048] ? do_sys_openat2+0x243/0x310 [ 989.374050] do_sys_openat2+0x243/0x310 [ 989.374052] do_sys_open+0x52/0x80 [ 989.374055] do_syscall_64+0x5b/0x80 [ 989.421335] ? __task_pid_nr_ns+0x92/0xa0 [ 989.421337] ? syscall_exit_to_user_mode+0x20/0x40 [ 989.421339] ? do_syscall_64+0x67/0x80 [ 989.421341] ? syscall_exit_to_user_mode+0x20/0x40 [ 989.421343] ? do_syscall_64+0x67/0x80 [ 989.421345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 989.421348] RIP: 0033:0x7fe895d067e3 [ 989.421349] RSP: 002b:00007fff933c2ba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 989.421351] RAX: ffffffffffffffda RBX: 00007fff933c2c10 RCX: 00007fe895d067e3 [ 989.421352] RDX: 0000000000000802 RSI: 00005594acdce160 RDI: 00000000ffffff9c [ 989.421353] RBP: 0000000000000802 R08: 0000000000000000 R09: 0000000000000000 [ 989.421353] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 989.421354] R13: 00007fff933c2ca0 R14: 00000000ffffffff R15: 00007fff933c2c90 [ 989.421355] This reverts commit 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f. Fixes: 6769a0b7ee0c ("media: dvb-core: Fix use-after-free on race condition at dvb_frontend") Link: https://lore.kernel.org/all/da5382ad-09d6-20ac-0d53-611594b30861@lio96.de/ Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: dvb-core: Fix use-after-free due to race at dvb_register_device()

2023-06-09T08:48:05Z

[ Upstream commit 627bb528b086b4136315c25d6a447a98ea9448d3 ] dvb_register_device() dynamically allocates fops with kmemdup() to set the fops->owner. And these fops are registered in 'file->f_ops' using replace_fops() in the dvb_device_open() process, and kfree()d in dvb_free_device(). However, it is not common to use dynamically allocated fops instead of 'static const' fops as an argument of replace_fops(), and UAF may occur. These UAFs can occur on any dvb type using dvb_register_device(), such as dvb_dvr, dvb_demux, dvb_frontend, dvb_net, etc. So, instead of kfree() the fops dynamically allocated in dvb_register_device() in dvb_free_device() called during the .disconnect() process, kfree() it collectively in exit_dvbdev() called when the dvbdev.c module is removed. Link: https://lore.kernel.org/linux-media/20221117045925.14297-4-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: dvb-core: Fix use-after-free due on race condition at dvb_net

2023-06-09T08:48:05Z

[ Upstream commit 4172385b0c9ac366dcab78eda48c26814b87ed1a ] A race condition may occur between the .disconnect function, which is called when the device is disconnected, and the dvb_device_open() function, which is called when the device node is open()ed. This results in several types of UAFs. The root cause of this is that you use the dvb_device_open() function, which does not implement a conditional statement that checks 'dvbnet->exit'. So, add 'remove_mutex` to protect 'dvbnet->exit' and use locked_dvb_net_open() function to check 'dvbnet->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221117045925.14297-3-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: dvb-core: Fix use-after-free on race condition at dvb_frontend

2023-06-09T08:48:05Z

[ Upstream commit 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f ] If the device node of dvb_frontend is open() and the device is disconnected, many kinds of UAFs may occur when calling close() on the device node. The root cause of this is that wake_up() for dvbdev->wait_queue is implemented in the dvb_frontend_release() function, but wait_event() is not implemented in the dvb_frontend_stop() function. So, implement wait_event() function in dvb_frontend_stop() and add 'remove_mutex' which prevents race condition for 'fe->exit'. [mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic] Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

Merge tag 'media/v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2023-02-26T19:47:26Z

Pull media updates from Mauro Carvalho Chehab: - Removal of several VB1-only deprecated drivers: cpia2, fsl-viu, meye, stkwebcam, tm6000, vpfe_capture and zr364xx - saa7146 recovered from staging/deprecated. We opted to give ti a chance, and, instead of deprecating it, the intention is to write patches migrating it from VB1 to VB2. - av7110 returned from staging/deprecated/ to staging/ as we're not planning on dropping it any time soon - media controller API has gained experimental support for G_ROUTING and streams API. No drivers use it right now. We're planning to add one after -rc1, giving some time to experience the API and eventually have changes during the next development cycle - New sensor drivers: imx296, imx415, ov8858 - Atomisp had lots of changes, specially on its sensor's interface, making atomisp sensor drivers closer to normal sensor drivers - media controller kAPI has gained some helpers to traverse pipelines - uvcvideo now better support power line control - lots of bug fixes, cleanups and driver improvements * tag 'media/v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (296 commits) media: imx-mipi-csis: Check csis_fmt validity before use media: v4l2-subdev.c: clear stream field media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line media: Revert "media: saa7146: deprecate hexium_gemini/orion, mxb and ttpci" media: Revert "media: av7110: move to staging/media/deprecated/saa7146" media: imx-pxp: convert to regmap media: imx-pxp: Use non-threaded IRQ media: imx-pxp: Introduce pxp_read() and pxp_write() wrappers media: imx-pxp: Implement frame size enumeration media: imx-pxp: Pass pixel format value to find_format() media: imx-pxp: Add media controller support media: imx-pxp: Don't set bus_info manually in .querycap() media: imx-pxp: Sort headers alphabetically media: imx-pxp: add support for i.MX7D media: imx-pxp: make data_path_ctrl0 platform dependent media: imx-pxp: disable LUT block media: imx-pxp: explicitly disable unused blocks media: imx-pxp: extract helper function to setup data path media: imx-pxp: detect PXP version media: dt-bindings: media: fsl-pxp: convert to yaml ...

Merge tag 'usb-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2023-02-24T20:07:00Z

Pull USB / Thunderbolt driver updates from Greg KH: "Here is the big set of USB and Thunderbolt driver changes for 6.3-rc1. Nothing major in here, just lots of good development, including: - Thunderbolt additions for new device support and features - xhci driver updates and cleanups - USB gadget media driver updates (includes media core changes that were acked by the v4l2 maintainers) - lots of other USB gadget driver updates for new features - dwc3 driver updates and fixes - minor debugfs leak fixes - typec driver updates and additions - dt-bindings conversions to yaml - other small bugfixes and driver updates All have been in linux-next for a while with no reported issues" * tag 'usb-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (237 commits) usb: dwc3: xilinx: Remove unused of_gpio,h usb: typec: pd: Add higher capability sysfs for sink PDO usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO usb: dwc3: pci: add support for the Intel Meteor Lake-M usb: gadget: u_ether: Don't warn in gether_setup_name_default() usb: gadget: u_ether: Convert prints to device prints usb: gadget: u_serial: Add null pointer check in gserial_resume usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails xhci: host: potential NULL dereference in xhci_generic_plat_probe() dt-bindings: usb: amlogic,meson-g12a-usb-ctrl: make G12A usb3-phy0 optional usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev of: device: Do not ignore error code in of_device_uevent_modalias of: device: Ignore modalias of reused nodes usb: gadget: configfs: Fix set but not used variable warning usb: gadget: uvc: Use custom strings if available usb: gadget: uvc: Allow linking function to string descs usb: gadget: uvc: Pick up custom string descriptor IDs usb: gadget: uvc: Allow linking XUs to string descriptors usb: gadget: configfs: Attach arbitrary strings to cdev usb: gadget: configfs: Support arbitrary string descriptors ...

Merge tag 'platform-drivers-x86-v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

2023-02-22T01:32:50Z

Pull x86 platform driver updates from Hans de Goede: - AMD PMC: Improvements to aid s2idle debugging - Dell WMI-DDV: hwmon support - INT3472 camera sensor power-management: Improve privacy LED support - Intel VSEC: Base TPMI (Topology Aware Register and PM Capsule Interface) support - Mellanox: SN5600 and Nvidia L1 switch support - Microsoft Surface Support: Various cleanups + code improvements - tools/intel-speed-select: Various improvements - Miscellaneous other cleanups / fixes * tag 'platform-drivers-x86-v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (80 commits) platform/x86: nvidia-wmi-ec-backlight: Add force module parameter platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY platform/x86: dell-ddv: Prefer asynchronous probing platform/x86: dell-ddv: Add hwmon support Documentation/ABI: Add new attribute for mlxreg-io sysfs interfaces platform: mellanox: mlx-platform: Move bus shift assignment out of the loop platform: mellanox: mlx-platform: Add mux selection register to regmap platform_data/mlxreg: Add field with mapped resource address platform/mellanox: mlxreg-hotplug: Allow more flexible hotplug events configuration platform: mellanox: Extend all systems with I2C notification callback platform: mellanox: Split logic in init and exit flow platform: mellanox: Split initialization procedure platform: mellanox: Introduce support of new Nvidia L1 switch platform: mellanox: Introduce support for next-generation 800GB/s switch platform: mellanox: Cosmetic changes - rename to more common name platform: mellanox: Change "reset_pwr_converter_fail" attribute platform: mellanox: Introduce support for rack manager switch MAINTAINERS: dell-wmi-sysman: drop Divya Bharathi x86/platform/uv: Make kobj_type structure constant platform/x86: think-lmi: Make kobj_type structure constant ...

media: Revert "media: saa7146: deprecate hexium_gemini/orion, mxb and ttpci"

2023-02-09T08:22:36Z

This reverts commit e33fdb5a02490059e2f48ced2c038c8a46c6476d. The saa7146-based devices are still in use, esp. for DVB. So move these drivers back to mainline. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: core: add ov_16bit_addr_reg_helpers.h

2023-02-08T07:23:50Z

The following drivers under drivers/media/i2c: ov08x40.c, ov13858.c, ov13b10.c, ov2680.c, ov2685.c, ov2740.c, ov4689.c, ov5670.c, ov5675.c, ov5695.c, ov8856.c, ov9282.c and ov9734.c, as well as various "atomisp" sensor drivers in drivers/staging, *all* use register access helpers with the following function prototypes: int ovxxxx_read_reg(struct ovxxxx_dev *sensor, u16 reg, unsigned int len, u32 *val); int ovxxxx_write_reg(struct ovxxxx_dev *sensor, u16 reg, unsigned int len, u32 val); To read/write registers on Omnivision OVxxxx image sensors wich expect a 16 bit register address in big-endian format and which have 1-3 byte wide registers, in big-endian format (for the higher width registers). Add a new ov_16bit_addr_reg_helpers.h header file with static inline versions of these register access helpers, so that this code duplication can be removed. Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab

media: i2c: s5c73m3: remove support for platform data

2023-02-06T07:57:12Z

There are no existing users of s5c73m3_platform_data in the tree, and new users should either be using device tree, ACPI, or static device properties, so let's remove it from the driver. Reviewed-by: Linus Walleij Signed-off-by: Dmitry Torokhov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab