kernel/linux.git/drivers/media/test-drivers, branch v6.19.11

Merge tag 'media/v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2025-12-04T16:15:19+00:00

Pull media updates from Mauro Carvalho Chehab: - New drivers: - Mali-C55 ISP - Rockchip VICAP (RKCIF) - RKVDEC HEVC Decoder - Renesas RZV2H IVC - Sony IMX111 CMOS sensor driver - Removed STi C8SECTPFE Driver - Added a V4L2 ISP generic framework - Usual set of cleanup, fixes and driver improvements * tag 'media/v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (249 commits) media: rockchip: rkcif: add support for rk3568 vicap mipi capture media: rockchip: rkcif: add support for rk3568 vicap dvp capture media: rockchip: rkcif: add support for px30 vip dvp capture media: rockchip: rkcif: add abstraction for dma blocks media: rockchip: rkcif: add abstraction for interface and crop blocks media: rockchip: add driver for the rockchip camera interface media: dt-bindings: add rockchip rk3568 vicap media: dt-bindings: add rockchip px30 vip media: dt-bindings: video-interfaces: add defines for sampling modes Documentation: admin-guide: media: add rockchip camera interface media: mali-c55: Mark pm handlers as __maybe_unused media: mali-c55: Assert ISP blocks size correctness media: v4l2-isp: Rename block_info to block_type_info MAINTAINERS: Add entry for rzv2h-ivc driver media: platform: Add Renesas Input Video Control block driver dt-bindings: media: Add bindings for the RZ/V2H(P) IVC block Documentation: media: mali-c55: Document the mali-c55 parameter setting media: platform: Add mali-c55 parameters video node media: uapi: Add parameters structs to mali-c55-config.h media: mali-c55: Add image formats for Mali-C55 parameters buffer ...

media: vivid: use prandom

2025-10-30T17:35:26+00:00

This is part of a prandom cleanup, which removes next_pseudo_random32 and replaces it with the standard PRNG. Signed-off-by: Markus Theil Reviewed-by: Krzysztof Karas Signed-off-by: Jason A. Donenfeld

media: v4l2-mem2mem: Don't copy frame flags in v4l2_m2m_buf_copy_metadata()

2025-10-17T09:31:16+00:00

The v4l2_m2m_buf_copy_metadata() function takes a boolean copy_frame_flags argument. When true, it causes the function to copy the V4L2_BUF_FLAG_KEYFRAME, V4L2_BUF_FLAG_BFRAME and V4L2_BUF_FLAG_PFRAME flags from the output buffer to the capture buffer. There is no use cases in any upstream driver for copying the flags. KEY/P/B frames are properties of the bitstream buffer in some formats. Once decoded, this is no longer a property of the video frame and should be discarded. It was considered useful to know if an uncompressed frame was decoded from a KEY/P/B compressed frame, and to preserve that information if that same uncompressed frame was passed through another M2M device (e.g. a scaler). However, the V4L2 documentation makes it clear that the flags are meant for compressed frames only. Drop the copy_frame_flags argument from v4l2_m2m_buf_copy_metadata(). The change to drivers was performed with the following Coccinelle semantic patch: @@ expression src; expression dst; expression flag; @@ - v4l2_m2m_buf_copy_metadata(src, dst, flag); + v4l2_m2m_buf_copy_metadata(src, dst); include/media/v4l2-mem2mem.h and drivers/media/v4l2-core/v4l2-mem2mem.c have been updated manually. Signed-off-by: Laurent Pinchart Reviewed-by: Philipp Zabel Reviewed-by: Benjamin Gaignard Signed-off-by: Hans Verkuil

media: vim2m: Drop unneeded v4l2_m2m_get_vq() NULL check

2025-10-17T09:31:15+00:00

The v4l2_m2m_get_vq() function never returns NULL. In the set format handler, the check may have been intended to catch invalid format types, but that's not needed as the V4L2 core picks the appropriate VIDIOC_S_FMT ioctl handler based on the format type, so the type can't be incorrect. In the get format handler, the return value is not used for any purpose other than the NULL check, which was therefore probably intended to catch invalid format types. That's not needed for the same reason as in the set format handler. Drop the unneeded return value checks and, as the function has no side effect, the unneeded function call as well. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil

media: vicodec: Drop unneeded v4l2_m2m_get_vq() NULL check

2025-10-17T09:31:15+00:00

media: vidtv: initialize local pointers upon transfer of memory ownership

2025-10-14T13:07:37+00:00

vidtv_channel_si_init() creates a temporary list (program, service, event) and ownership of the memory itself is transferred to the PAT/SDT/EIT tables through vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), vidtv_psi_eit_event_assign(). The problem here is that the local pointer where the memory ownership transfer was completed is not initialized to NULL. This causes the vidtv_psi_pmt_create_sec_for_each_pat_entry() function to fail, and in the flow that jumps to free_eit, the memory that was freed by vidtv_psi_*_table_destroy() can be accessed again by vidtv_psi_*_event_destroy() due to the uninitialized local pointer, so it is freed once again. Therefore, to prevent use-after-free and double-free vulnerability, local pointers must be initialized to NULL when transferring memory ownership. Cc: Reported-by: syzbot+1d9c0edea5907af239e0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1d9c0edea5907af239e0 Fixes: 3be8037960bc ("media: vidtv: add error checks") Signed-off-by: Jeongjun Park Reviewed-by: Daniel Almeida Signed-off-by: Hans Verkuil

media: vivid: use vmalloc_array and vcalloc to simplify code

2025-10-14T13:07:36+00:00

Remove array_size() calls and replace vmalloc(array_size()) with vmalloc_array() and vzalloc(array_size()) with vcalloc() to simplify the code. Signed-off-by: Qianfeng Rong Signed-off-by: Hans Verkuil

media: vivid: fix disappearing messages

2025-09-09T14:12:56+00:00

The vivid driver supports the message, but if the Vendor ID of the received message didn't match the Vendor ID of the CEC Adapter, then it ignores it (good) and returns 0 (bad). It should return -ENOMSG to indicate that other followers should be asked to handle it. Return code 0 means that the driver handled it, which is wrong in this case. As a result, userspace followers never get the chance to process such a message. Refactor the code a bit to have the function return -ENOMSG at the end, drop the default case, and ensure that the message handlers return 0. That way 0 is only returned if the message is actually handled in the vivid_received() function. Fixes: 812765cd6954 ("media: vivid: add support") Cc: stable@vger.kernel.org Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: update Hans Verkuil's email address

2025-09-09T13:58:44+00:00

Replace hansverk@cisco.com by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: vim2m: remove unused CLIP macro

2025-08-29T09:04:01+00:00

The CLIP macro, which was used to clamp color component values to the [0, 255] range, is no longer used anywhere in the vim2m driver. Remove it to clean up the code and avoid confusion. The following issues were reported by checkpatch: ERROR: Macros with complex values should be enclosed in parentheses Signed-off-by: Yunseong Kim Signed-off-by: Hans Verkuil