kernel.git/drivers/media/platform/qcom, branch linux-6.15.y

media: venus: Fix OOB read due to missing payload bound check

2025-08-20T16:36:33Z

commit 06d6770ff0d8cc8dfd392329a8cc03e2a83e7289 upstream. Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior. Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)") Cc: stable@vger.kernel.org Signed-off-by: Vedang Nagar Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Co-developed-by: Dikshita Agarwal Signed-off-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

media: iris: Add handling for corrupt and drop frames

2025-08-20T16:36:19Z

[ Upstream commit b791dcfcba3a0c46fb3e2decab31d2340c5dc313 ] Firmware attach DATACORRUPT/DROP buffer flags for the frames which needs to be dropped, handle it by setting VB2_BUF_STATE_ERROR for these buffers before calling buf_done. Reviewed-by: Bryan O'Donoghue Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin

media: qcom: venus: Fix uninitialized variable warning

2025-06-27T10:13:19Z

[ Upstream commit 8e172e38a623ce284baf2514f963b29e4d47c62e ] Avoid uninitialized variable when both V4L2_TYPE_IS_OUTPUT() and V4L2_TYPE_IS_CAPTURE() return false. Signed-off-by: Nas Chung Signed-off-by: Sebastian Fricke Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin

media: venus: Fix probe error handling

2025-06-27T10:13:00Z

commit 523cea3a19f0b3b020a4745344c136a636e6ffd7 upstream. Video device registering has been moved earlier in the probe function, but the new order has not been propagated to error handling. This means we can end with unreleased resources on error (e.g dangling video device on missing firmware probe aborting). Fixes: 08b1cf474b7f7 ("media: venus: core, venc, vdec: Fix probe dependency error") Cc: stable@vger.kernel.org Signed-off-by: Loic Poulain Reviewed-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

media: qcom: camss: vfe: suppress VFE version log spam

2025-06-27T10:13:00Z

commit b6fafb3941fa0f065def304d44d6c3c6d6ac0f64 upstream. A recent commit refactored the printing of the VFE hardware version, but (without it being mentioned) also changed the log level from debug to info. This results in several hundred lines of repeated log spam during boot and use, for example, on the Lenovo ThinkPad X13s: qcom-camss ac5a000.camss: VFE:1 HW Version = 1.2.2 qcom-camss ac5a000.camss: VFE:0 HW Version = 1.2.2 qcom-camss ac5a000.camss: VFE:2 HW Version = 1.2.2 qcom-camss ac5a000.camss: VFE:2 HW Version = 1.2.2 qcom-camss ac5a000.camss: VFE:3 HW Version = 1.2.2 qcom-camss ac5a000.camss: VFE:5 HW Version = 1.3.0 qcom-camss ac5a000.camss: VFE:6 HW Version = 1.3.0 qcom-camss ac5a000.camss: VFE:4 HW Version = 1.3.0 qcom-camss ac5a000.camss: VFE:5 HW Version = 1.3.0 qcom-camss ac5a000.camss: VFE:6 HW Version = 1.3.0 qcom-camss ac5a000.camss: VFE:7 HW Version = 1.3.0 qcom-camss ac5a000.camss: VFE:7 HW Version = 1.3.0 qcom-camss ac5a000.camss: VFE:7 HW Version = 1.3.0 ... Suppress the version logging by demoting to debug level again. Fixes: 10693fed125d ("media: qcom: camss: vfe: Move common code into vfe core") Cc: stable@vger.kernel.org Cc: Depeng Shao Reviewed-by: Bryan O'Donoghue Signed-off-by: Johan Hovold Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

media: qcom: camss: csid: suppress CSID log spam

2025-06-27T10:13:00Z

commit aef1d545989bc9e7f555af6b9f1be4963772192b upstream. A recent commit refactored the printing of the CSID hardware version, but (without it being mentioned) also changed the log level from debug to info. This results in repeated log spam during use, for example, on the Lenovo ThinkPad X13s: qcom-camss ac5a000.camss: CSID:0 HW Version = 1.0.0 qcom-camss ac5a000.camss: CSID:0 HW Version = 1.0.0 qcom-camss ac5a000.camss: CSID:0 HW Version = 1.0.0 qcom-camss ac5a000.camss: CSID:0 HW Version = 1.0.0 qcom-camss ac5a000.camss: CSID:0 HW Version = 1.0.0 Suppress the version logging by demoting to debug level again. Fixes: f759b8fd3086 ("media: qcom: camss: csid: Move common code into csid core") Cc: stable@vger.kernel.org Cc: Depeng Shao Signed-off-by: Johan Hovold Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

media: iris: fix error code in iris_load_fw_to_memory()

2025-06-27T10:13:00Z

commit e68c3c50a736490d9c07888fe525718d16ff9e9c upstream. Return -ENOMEM if memremap() fails. Don't return success. Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

media: qcom: Clean up Kconfig dependencies

2025-03-06T16:28:30Z

Depending on IOMMU_DMA is suspicious, since the low-level DMA ops internals and MSI helpers is provides are not of interest to general drivers. In practice it mostly seems to be serving as a dependency on ARM64 here, so do that properly. The venus driver looks like it won't actually be useful at runtime without the IOMMU API, so add that too. Signed-off-by: Robin Murphy Reviewed-by: Robert Foss Signed-off-by: Hans Verkuil

media: v4l2-ctrls: add support for V4L2_CTRL_WHICH_MIN/MAX_VAL

2025-03-03T17:23:35Z

Add the capability of retrieving the min and max values of a compound control. [Ricardo: Added static to v4l2_ctrl_type_op_(maximum|minimum) proto] [Ricardo: Fix documentation] Signed-off-by: Yunke Cao Tested-by: Yunke Cao Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250203-uvc-roi-v17-2-5900a9fed613@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil [hverkuil: fix small alignment checkpatch warning]

media: venus: hfi: add a check to handle OOB in sfr region

2025-03-03T17:21:55Z

sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases. Cc: stable@vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue Signed-off-by: Vikash Garodia Signed-off-by: Hans Verkuil