kernel.git/drivers/media/dvb-frontends, branch linux-6.10.y

drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error

2024-10-04T14:33:05Z

[ Upstream commit 46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14 ] Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue. Fixes: df70ddad81b4 ("[media] rtl2830: implement PID filter") Signed-off-by: Junlin Li Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin

drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error

2024-10-04T14:33:05Z

[ Upstream commit 8ae06f360cfaca2b88b98ca89144548b3186aab1 ] Ensure index in rtl2832_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue. Signed-off-by: Junlin Li Signed-off-by: Hans Verkuil Fixes: 4b01e01a81b6 ("[media] rtl2832: implement PID filter") [hverkuil: added fixes tag, rtl2830_pid_filter -> rtl2832_pid_filter in logmsg] Signed-off-by: Sasha Levin

Merge tag 'i2c-for-6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

2024-05-20T15:55:18Z

Pull i2c updates from Wolfram Sang: "i2c core removes an argument from the i2c_mux_add_adapter() call to further deprecate class based I2C device instantiation. All users are converted, too. Other that that, Andi collected a number if I2C host driver patches. Those merges have their own description" * tag 'i2c-for-6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (72 commits) power: supply: sbs-manager: Remove class argument from i2c_mux_add_adapter() i2c: mux: Remove class argument from i2c_mux_add_adapter() i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() i2c: acpi: Unbind mux adapters before delete i2c: designware: Replace MODULE_ALIAS() with MODULE_DEVICE_TABLE() i2c: pxa: use 'time_left' variable with wait_event_timeout() i2c: s3c2410: use 'time_left' variable with wait_event_timeout() i2c: rk3x: use 'time_left' variable with wait_event_timeout() i2c: qcom-geni: use 'time_left' variable with wait_for_completion_timeout() i2c: jz4780: use 'time_left' variable with wait_for_completion_timeout() i2c: synquacer: use 'time_left' variable with wait_for_completion_timeout() i2c: stm32f7: use 'time_left' variable with wait_for_completion_timeout() i2c: stm32f4: use 'time_left' variable with wait_for_completion_timeout() i2c: st: use 'time_left' variable with wait_for_completion_timeout() i2c: omap: use 'time_left' variable with wait_for_completion_timeout() i2c: imx-lpi2c: use 'time_left' variable with wait_for_completion_timeout() i2c: hix5hd2: use 'time_left' variable with wait_for_completion_timeout() i2c: exynos5: use 'time_left' variable with wait_for_completion_timeout() i2c: digicolor: use 'time_left' variable with wait_for_completion_timeout() i2c: amd-mp2-plat: use 'time_left' variable with wait_for_completion_timeout() ...

i2c: mux: Remove class argument from i2c_mux_add_adapter()

2024-05-13T14:13:19Z

99a741aa7a2d ("i2c: mux: gpio: remove support for class-based device instantiation") removed the last call to i2c_mux_add_adapter() with a non-null class argument. Therefore the class argument can be removed. Note: Class-based device instantiation is a legacy mechanism which shouldn't be used in new code, so we can rule out that this argument may be needed again in the future. Signed-off-by: Heiner Kallweit Reviewed-by: Thomas Zimmermann Acked-by: Peter Rosin Reviewed-by: Laurent Pinchart Acked-by: Jonathan Cameron Acked-by: Rob Herring (Arm) Signed-off-by: Wolfram Sang

media: dvb-frontends: tda10048: Fix integer overflow

2024-05-03T10:18:26Z

state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 64 bit variable to hold the calculations. Link: https://lore.kernel.org/linux-media/20240429-fix-cocci-v3-25-3c4865f5a4b0@chromium.org Reported-by: Dan Carpenter Signed-off-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab

media: dvb-frontends: drx39xyj: Use min macro

2024-05-03T10:12:24Z

Replace ternary assignments with min() to simplify and make the code more readable. Found by cocci: drivers/media/dvb-frontends/drx39xyj/drxj.c:1447:23-24: WARNING opportunity for min() drivers/media/dvb-frontends/drx39xyj/drxj.c:1662:21-22: WARNING opportunity for min() drivers/media/dvb-frontends/drx39xyj/drxj.c:1685:24-25: WARNING opportunity for min() Link: https://lore.kernel.org/linux-media/20240429-fix-cocci-v3-14-3c4865f5a4b0@chromium.org Reviewed-by: Bryan O'Donoghue Signed-off-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab

media: dvb-frontends: tda18271c2dd: Remove casting during div

2024-05-03T10:08:08Z

do_div() divides 64 bits by 32. We were adding a casting to the divider to 64 bits, for a number that fits perfectly in 32 bits. Remove it. Found by cocci: drivers/media/dvb-frontends/tda18271c2dd.c:355:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead. drivers/media/dvb-frontends/tda18271c2dd.c:331:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead. Link: https://lore.kernel.org/linux-media/20240429-fix-cocci-v3-8-3c4865f5a4b0@chromium.org Signed-off-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab

media: stb0899: Simplify check

2024-05-03T10:03:01Z

chip_id is an unsigned number, it can never be < 0 Fixes cocci check: drivers/media/dvb-frontends/stb0899_drv.c:1280:8-15: WARNING: Unsigned expression compared with zero: chip_id > 0 Link: https://lore.kernel.org/linux-media/20240429-fix-cocci-v3-2-3c4865f5a4b0@chromium.org Reviewed-by: Bryan O'Donoghue Signed-off-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab

media: mxl5xx: Move xpt structures off stack

2024-05-03T06:00:14Z

When building for LoongArch with clang 18.0.0, the stack usage of probe() is larger than the allowed 2048 bytes: drivers/media/dvb-frontends/mxl5xx.c:1698:12: warning: stack frame size (2368) exceeds limit (2048) in 'probe' [-Wframe-larger-than] 1698 | static int probe(struct mxl *state, struct mxl5xx_cfg *cfg) | ^ 1 warning generated. This is the result of the linked LLVM commit, which changes how the arrays of structures in config_ts() get handled with CONFIG_INIT_STACK_ZERO and CONFIG_INIT_STACK_PATTERN, which causes the above warning in combination with inlining, as config_ts() gets inlined into probe(). This warning can be easily fixed by moving the array of structures off of the stackvia 'static const', which is a better location for these variables anyways because they are static data that is only ever read from, never modified, so allocating the stack space is wasteful. This drops the stack usage from 2368 bytes to 256 bytes with the same compiler and configuration. Link: https://lore.kernel.org/linux-media/20240111-dvb-mxl5xx-move-structs-off-stack-v1-1-ca4230e67c11@kernel.org Cc: stable@vger.kernel.org Closes: https://github.com/ClangBuiltLinux/linux/issues/1977 Link: https://github.com/llvm/llvm-project/commit/afe8b93ffdfef5d8879e1894b9d7dda40dee2b8d Signed-off-by: Nathan Chancellor Reviewed-by: Miguel Ojeda Tested-by: Miguel Ojeda Signed-off-by: Mauro Carvalho Chehab

media: si2165: Remove redundant NULL check before release_firmware() call

2024-04-29T11:26:56Z

release_firmware() checks for NULL pointers internally so checking before calling it is redundant. Link: https://lore.kernel.org/linux-media/20220606014433.290667-1-chi.minghao@zte.com.cn Reported-by: Zeal Robot Signed-off-by: Minghao Chi Acked-by: Matthias Schwarzott Signed-off-by: Mauro Carvalho Chehab