kernel/linux.git/drivers/media/tuners, branch v7.1

media: si2157: Include support for si2177 chip

2026-03-25T17:27:25+00:00

The si2177 is very closely related to si2157, with slight differences when doing analog operations. Digital is left as is, but analog needs to be configured specially because the signal is internally demodulated and CVBS video is output directly from the tuner. Verified locked and working with all supported standards. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil

media: xc5000: Add rf strength function

2026-03-17T09:50:19+00:00

Without a rf strength function implemented, analog lock cannot be detected by standardized command line tools. Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil

media: si2157: Analog format fixes

2026-03-17T09:50:19+00:00

Updates to support PAL-N and PAL-Nc Verifies PAL-I and PAL-DK standards are working Fixes and verifies SECAM-L now works Signed-off-by: Bradford Love Signed-off-by: Hans Verkuil

media: mxl5005s: reduce stack usage in MXL5005_ControlInit

2026-03-16T10:51:54+00:00

This function initializes two large structures with arrays. On at least parisc, the specific code sequence here leads to a badly misoptimized output from the compiler along with a warning about the resulting excessive stack usage from many spilled variables: drivers/media/tuners/mxl5005s.c: In function 'MXL5005_ControlInit.isra': drivers/media/tuners/mxl5005s.c:1660:1: warning: the frame size of 1400 bytes is larger than 1024 bytes [-Wframe-larger-than=] Splitting this one function into two functions avoids this because there are few temporaries that can be spilled to the stack in each of the smaller structures, so this avoids the warning and also improves readability. Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

kmalloc_obj: Clean up after treewide replacements

2026-02-21T09:02:52+00:00

Coccinelle doesn't handle re-indenting line escapes. Fix the 2 places where these got misaligned. Remove 2 now-redundant type casts, found with: $ git grep -P 'struct (\S+).*\)\s*k\S+alloc_(objs?|flex)\(struct \1' Signed-off-by: Kees Cook

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

Revert "media: xc2028: avoid use-after-free in load_firmware_cb()"

2025-10-14T13:07:36+00:00

Revert commit 68594cec291f ("media: xc2028: avoid use-after-free in load_firmware_cb()") since it doesn't make sense to check dangling 'struct dvb_frontend *' passed to 'load_firmware_cb()'. Signed-off-by: Dmitry Antipov Signed-off-by: Hans Verkuil

media: tuner: xc5000: Fix use-after-free in xc5000_release

2025-09-17T10:15:35+00:00

The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv. A typical race condition is illustrated below: CPU 0 (release thread) | CPU 1 (delayed work callback) xc5000_release() | xc5000_do_timer_sleep() cancel_delayed_work() | hybrid_tuner_release_state(priv) | kfree(priv) | | priv = container_of() // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated. A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here. This bug was initially identified through static analysis. Fixes: f7a27ff1fb77 ("[media] xc5000: delay tuner sleep to 5 seconds") Cc: stable@vger.kernel.org Signed-off-by: Duoming Zhou Signed-off-by: Hans Verkuil [hverkuil: fix typo in Subject: tunner -> tuner]

media: fix uninitialized symbol warnings

2025-08-29T09:04:02+00:00

Initialize variables to fix these smatch warnings drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'protocol'. drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'scancode'. drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'toggle'. drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized symbol 'adc_envelope'. drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized symbol 'lock_status'. drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized symbol 'frame_lines'. drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized symbol 'quality'. drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized symbol 'adc_envelope'. drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized symbol 'lock_status'. drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized symbol 'frame_lines'. drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized symbol 'quality'. drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized symbol 'snr'. drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized symbol 'totalgain'. Signed-off-by: Chelsy Ratnawat Signed-off-by: Hans Verkuil [hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]