Commit ceb06133 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'media/v6.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 

Pull media fixes from Mauro Carvalho Chehab:

 - dvb-core fixes for vb2 check and device registration

 - v4l2-core: fix an issue with error handling for VIDIOC_G_CTRL

 - vb2 core: fix an issue with vb plane copy logic

 - videobuf2-core: copy vb planes unconditionally

 - vivid: fix buffer overwrite when using > 32 buffers

 - vivid: fix a potential division by zero due to an issue at v4l2-tpg

 - some spectre vulnerability fixes

 - several OOM access fixes

 - some buffer overflow fixes

* tag 'media/v6.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: videobuf2-core: copy vb planes unconditionally
  media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
  media: vivid: fix buffer overwrite when using > 32 buffers
  media: pulse8-cec: fix data timestamp at pulse8_setup()
  media: cec: extron-da-hd-4k-plus: don't use -1 as an error code
  media: stb0899_algo: initialize cfr before using it
  media: adv7604: prevent underflow condition when reporting colorspace
  media: cx24116: prevent overflows on SNR calculus
  media: ar0521: don't overflow when checking PLL values
  media: s5p-jpeg: prevent buffer overflows
  media: av7110: fix a spectre vulnerability
  media: mgb4: protect driver against spectre
  media: dvb_frontend: don't play tricks with underflow values
  media: dvbdev: prevent the risk of out of memory access
  media: v4l2-tpg: prevent the risk of a division by zero
  media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl()
  media: dvb-core: add missing buffer index check
parents f1dce1f0 702a47ce

drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c

+3 −3
Original line number Diff line number Diff line
@@ -348,12 +348,12 @@ static int get_edid_tag_location(const u8 *edid, unsigned int size, 


	/* Return if not a CTA-861 extension block */

	if (size < 256 || edid[0] != 0x02 || edid[1] != 0x03)

		return -1;

		return -ENOENT;



	/* search tag */

	d = edid[0x02] & 0x7f;

	if (d <= 4)

		return -1;

		return -ENOENT;



	i = 0x04;

	end = 0x00 + d;
@@ -371,7 +371,7 @@ static int get_edid_tag_location(const u8 *edid, unsigned int size, 
			return offset + i;

		i += len + 1;

	} while (i < end);

	return -1;

	return -ENOENT;

}



static void extron_edid_crc(u8 *edid)

drivers/media/cec/usb/pulse8/pulse8-cec.c

+1 −1
Original line number Diff line number Diff line
@@ -685,7 +685,7 @@ static int pulse8_setup(struct pulse8 *pulse8, struct serio *serio, 
	err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 4);

	if (err)

		return err;

	date = (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];

	date = ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];

	dev_info(pulse8->dev, "Firmware build date %ptT\n", &date);



	dev_dbg(pulse8->dev, "Persistent config:\n");

drivers/media/common/v4l2-tpg/v4l2-tpg-core.c

+3 −0
Original line number Diff line number Diff line
@@ -1795,6 +1795,9 @@ static void tpg_precalculate_line(struct tpg_data *tpg) 
	unsigned p;

	unsigned x;



	if (WARN_ON_ONCE(!tpg->src_width || !tpg->scaled_width))

		return;



	switch (tpg->pattern) {

	case TPG_PAT_GREEN:

		contrast = TPG_COLOR_100_RED;

drivers/media/common/videobuf2/videobuf2-core.c

+15 −13
Original line number Diff line number Diff line
@@ -1482,6 +1482,10 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) 
			}

			vb->planes[plane].dbuf_mapped = 1;

		}

	} else {

		for (plane = 0; plane < vb->num_planes; ++plane)

			dma_buf_put(planes[plane].dbuf);

	}



	/*

	 * Now that everything is in order, copy relevant information
@@ -1494,6 +1498,7 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) 
		vb->planes[plane].data_offset = planes[plane].data_offset;

	}



	if (reacquired) {

		/*

		 * Call driver-specific initialization on the newly acquired buffer,

		 * if provided.
@@ -1503,9 +1508,6 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) 
			dprintk(q, 1, "buffer initialization failed\n");

			goto err_put_vb2_buf;

		}

	} else {

		for (plane = 0; plane < vb->num_planes; ++plane)

			dma_buf_put(planes[plane].dbuf);

	}



	ret = call_vb_qop(vb, buf_prepare, vb);

drivers/media/dvb-core/dvb_frontend.c

+2 −2
Original line number Diff line number Diff line
@@ -443,8 +443,8 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wra 


		default:

			fepriv->auto_step++;

			fepriv->auto_sub_step = -1; /* it'll be incremented to 0 in a moment */

			break;

			fepriv->auto_sub_step = 0;

			continue;

		}



		if (!ready) fepriv->auto_sub_step++;