kernel/linux.git/drivers/media/dvb-core, branch v6.19.11

media: dvb-net: fix OOB access in ULE extension header tables

2026-03-19T15:15:17+00:00

commit 24d87712727a5017ad142d63940589a36cd25647 upstream. The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer. Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Ariel Silver Signed-off-by: Ariel Silver Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

media: dvb-core: fix wrong reinitialization of ringbuffer on reopen

2026-03-12T11:09:28+00:00

commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 upstream. dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty. Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}. The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions. Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock. Cc: stable@vger.kernel.org Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer") Reported-by: syzbot+ab12f0c08dd7ab8d057c@syzkaller.appspotmail.com Tested-by: syzbot+ab12f0c08dd7ab8d057c@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/ Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

media: dvb-core: dmxdevfilter must always flush bufs

2026-03-04T12:19:54+00:00

[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ] Currently the buffers are being filled until full, which works fine for the transport stream, but not when reading sections, those have to be returned to userspace immediately, otherwise dvbv5-scan will just wait forever. Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether the buffer must be flushed or wait until it is full. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: dvb_ca_en50221: fix "writen"->"written"

2025-11-03T14:58:41+00:00

Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Signed-off-by: Hans Verkuil

media: dvbdev: Use %pe format specifier

2025-10-17T09:31:15+00:00

The %pe format specifier is designed to print error pointers. It prints a symbolic error name (eg. -EINVAL) and it makes the code simpler by omitting PTR_ERR() This patch fixes this cocci report: ./dvb-core/dvbdev.c:575:48-55: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: Ricardo Ribalda Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil

media: dvb-core: use vmalloc_array to simplify code

2025-10-14T13:07:36+00:00

Remove array_size() calls and replace vmalloc() with vmalloc_array() to simplify the code. Signed-off-by: Qianfeng Rong Signed-off-by: Hans Verkuil

media: dvb-core: dvb_demux: Fix assignments in if conditions

2025-10-14T13:07:36+00:00

The code in dvb_demux.c has multiple instances where a variable is assigned a value inside the conditional part of an 'if' statement. This practice is prohibited by the Linux kernel coding style to avoid potential bugs arising from accidental assignments (e.g., '=' instead of '=='). This patch refactors these instances by moving the assignment out of the 'if' statement and onto the preceding line. This makes the code clearer, safer, and compliant with checkpatch.pl. Additionally, a minor whitespace issue in a function signature is also corrected. This is a purely stylistic change with no functional impact. Signed-off-by: Darshan Rathod Signed-off-by: Hans Verkuil

media: dvb-core: dvb_ringbuffer: Fix various coding style issues

2025-10-14T13:07:36+00:00

The file dvb_ringbuffer.c has several minor coding style violations. This patch resolves these issues to improve code readability and align the code with the Linux kernel coding style. The cleanups include: - Adding spaces around assignment and comparison operators. - Adding spaces after commas in function arguments. - Placing statements on a new line for single-line 'if' blocks. - Correcting minor indentation. This is a purely stylistic change with no functional impact. Signed-off-by: Darshan Rathod Signed-off-by: Hans Verkuil [hverkuil: split rbuf->pread = rbuf->pwrite = 0 in two lines]

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37+00:00

Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05T08:30:12+00:00

timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree over and remove the historical wrapper inlines. Conversion was done with coccinelle plus manual fixups where necessary. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar