kernel.git/drivers/media/rc, branch linux-6.16.y

media: rc: fix races with imon_disconnect()

2025-10-06T09:18:48Z

commit fa0f61cc1d828178aa921475a9b786e7fbb65ccb upstream. Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device. Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer. Thread 1 vfd_write Thread 2 imon_disconnect ... if usb_put_dev(ictx->usbdev_intf0) else usb_put_dev(ictx->usbdev_intf1) ... while send_packet if pipe = usb_sndintpipe( ictx->usbdev_intf0) UAF else pipe = usb_sndctrlpipe( ictx->usbdev_intf0, 0) UAF Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present. Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations. Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Reported-by: syzbot+f1a69784f6efe748c3bf@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f1a69784f6efe748c3bf Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver") Cc: stable@vger.kernel.org Signed-off-by: Larshin Sergey Signed-off-by: Sean Young Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37Z

Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

media: rc: add keymap for Hauppauge Credit Card RC

2025-04-30T07:35:24Z

Add keymap for the black Hauppauge Credit Card Remote Control. Signed-off-by: Petja Patjas Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05T08:30:12Z

timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree over and remove the historical wrapper inlines. Conversion was done with coccinelle plus manual fixups where necessary. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar

Merge tag 'media/v6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2025-03-26T04:00:31Z

Pull media updates from Mauro Carvalho Chehab: - platform: synopsys: hdmirx: Fix 64-bit division for 32-bit targets - vim2m: print device name after registering device - Synopsys DesignWare HDMI RX Driver and various fixes - cec/printk fixes and the removal of the vidioc_g/s_ctrl and vidioc_queryctrl callbacks - AVerMedia H789-C PCIe support and rc-core structs padding - Several camera sensor patches - uvcvideo improvements - visl: Fix ERANGE error when setting enum controls - codec fixes - V4L2 camera sensor patches mostly - chips-media: wave5: Fixes - Add SDM670 camera subsystem - Qualcomm iris video decoder driver - dt-bindings: update clocks for sc7280-camss - various fixes and enhancements * tag 'media/v6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (264 commits) media: pci: mgb4: include linux/errno.h media: synopsys: hdmirx: Fix signedness bug in hdmirx_parse_dt() media: platform: synopsys: hdmirx: Fix 64-bit division for 32-bit targets media: vim2m: print device name after registering device media: vivid: Introduce VIDEO_VIVID_OSD media: vivid: Move all fb_info references into vivid-osd media: platform: synopsys: hdmirx: Optimize struct snps_hdmirx_dev media: platform: synopsys: hdmirx: Remove unused HDMI audio CODEC relics media: platform: synopsys: hdmirx: Remove duplicated header inclusion media: qcom: Clean up Kconfig dependencies media: dvb-frontends: tda10048: Make the range of z explicit. media: platform: stm32: Add check for clk_enable() media: xilinx-tpg: fix double put in xtpg_parse_of() media: siano: Fix error handling in smsdvb_module_init() media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() media: i2c: tda1997x: Call of_node_put(ep) only once in tda1997x_parse_dt() dt-bindings: media: mediatek,vcodec: Revise description dt-bindings: media: mediatek,jpeg: Relax IOMMU max item count media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() media: rockchip: rga: fix rga offset lookup ...

media: rc: reduce useless padding in struct rc_dev etc

2025-03-04T14:56:11Z

Reorder the fields in these structs so that we waste less space due to padding. pahole shows that lirc_fh is 8 bytes smaller, and rc_dev is 32 bytes smaller. Signed-off-by: Sean Young Signed-off-by: Hans Verkuil

media: Switch to use hrtimer_setup()

2025-02-18T10:19:04Z

hrtimer_setup() takes the callback function pointer as argument and initializes the timer completely. Replace hrtimer_init() and the open coded initialization of hrtimer::function with the new setup mechanism. Patch was created by using Coccinelle. Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Acked-by: Hans Verkuil Acked-by: Zack Rusin Link: https://lore.kernel.org/all/c725ad8d0ecac3cf6bbc532af567e56d47a6b75c.1738746904.git.namcao@linutronix.de

media: rc: add keymap for Siemens Gigaset RC20 remote

2025-02-13T11:12:31Z

Add keymap for the Siemens Gigaset RC20 remote (RC-5). Signed-off-by: Michael Klein Signed-off-by: Sean Young Signed-off-by: Hans Verkuil

media: streamzap: prevent processing IR data on URB failure

2025-02-13T11:12:30Z

If streamzap_callback() receives an urb with any non-critical error status, i.e. any error code other than -ECONNRESET, -ENOENT or -ESHUTDOWN, it will try to process IR data, ignoring a possible transfer failure. Make streamzap_callback() process IR data only when urb->status is 0. Move processing logic to a separate function to make code cleaner and more similar to the URB completion handlers in other RC drivers. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 19770693c354 ("V4L/DVB: staging/lirc: add lirc_streamzap driver") Cc: stable@vger.kernel.org Signed-off-by: Murad Masimov Signed-off-by: Sean Young Signed-off-by: Hans Verkuil

media: streamzap: fix race between device disconnection and urb callback

2025-02-13T11:12:30Z

Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzap_disconnect() function: rc_unregister_device() is called before usb_kill_urb(). The dev->raw pointer is freed and set to NULL in rc_unregister_device(), and only after that usb_kill_urb() waits for in-progress requests to finish. If rc_unregister_device() is called while streamzap_callback() handler is not finished, this can lead to accessing freed resources. Thus rc_unregister_device() should be called after usb_kill_urb(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 8e9e60640067 ("V4L/DVB: staging/lirc: port lirc_streamzap to ir-core") Cc: stable@vger.kernel.org Reported-by: syzbot+34008406ee9a31b13c73@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=34008406ee9a31b13c73 Signed-off-by: Murad Masimov Signed-off-by: Sean Young Signed-off-by: Hans Verkuil