Commit graph

4,521 commits

Author SHA1 Message Date
Kees Cook
3a2c4d55e3 treewide: refresh kmalloc_obj() conversions
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
2026-09-04 21:37:00 -07:00
Cong Nguyen
d7f48aa7d6 media: staging/ipu7: fix async notifier UAF on probe error path
isys_register_devices() registers the V4L2 async notifier via
isys_notifier_init(). If a subsequent probe step such as
isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label
which only calls isys_unregister_devices(). That helper tears down the
video devices, subdevices, V4L2 device and media device, but never
unregisters or cleans up the async notifier.

As a result the notifier stays chained in the global notifier_list while
the enclosing struct ipu7_isys is freed by devres, leading to list
corruption and a use-after-free the next time the list is walked.

The remove path already does the right thing by calling
isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on
the probe error path so the notifier is unregistered and cleaned up
before the device is torn down.

Fixes: a516d36bdc ("media: staging/ipu7: add IPU7 input system device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-08-10 11:51:33 +03:00
Cong Nguyen
11ccf31a65 media: staging/ipu7: fix async notifier leak on init error
isys_notifier_init() initialises a v4l2 async notifier and then, for
each CSI-2 port, adds a remote sensor subdev to the notifier's
waiting_list via v4l2_async_nf_add_fwnode_remote(), which allocates a
sensor_async_sd descriptor and takes a fwnode reference.

If parsing or adding a later port fails, the code jumps to the
"err_parse" label, which only drops the current endpoint fwnode
reference and returns, without calling v4l2_async_nf_cleanup(). Any
descriptors already added to the notifier for earlier ports are
therefore leaked, and the caller's error path does not clean up the
notifier either.

Call v4l2_async_nf_cleanup() on the error path, matching the cleanup
already performed when v4l2_async_nf_register() fails. This is safe as
the notifier is always initialised before the loop is entered.

Fixes: a516d36bdc ("media: staging/ipu7: add IPU7 input system device driver")
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-29 15:55:47 +03:00
Faisal Mukhtar
4dac3652c6 media: tegra-video: Fix length warnings in tegra20.c
Wrap long function arguments under the starting
parentheses because of line length style warning
reported by checkpatch.pl

Signed-off-by: Faisal Mukhtar <mukhtarfaisal03@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-28 15:17:55 +02:00
Dawei Feng
9df2fbe563 media: cedrus: fix memory leak in cedrus_init_ctrls()
In cedrus_init_ctrls(), the V4L2 control handler is initialized before
allocating memory for ctx->ctrls. If this allocation fails, the function
returns -ENOMEM without freeing the previously allocated handler
resources, leading to a memory leak.

Fix this by calling v4l2_ctrl_handler_free() on the ctx->ctrls allocation
failure path.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.

An x86_64 allyesconfig build showed no new warnings. As we do not have an
Allwinner SoC or board with a Cedrus VPU available to test with, no
runtime testing was able to be performed.

Fixes: 50e761516f ("media: platform: Add Cedrus VPU decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-17 12:36:48 +02:00
Christian Hewitt
20aa934ace media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
When VIDIOC_TRY_FMT is called with an unsupported pixel format on the
OUTPUT queue, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2.
However, if a distro has locally patched MPEG2 support out (as it has
been broken for some time) the platform format table does not contain
MPEG2 so find_format() returns NULL and the subsequent dereference of
fmt_out->max_width triggers a NULL pointer dereference.

Fix this by falling back to the first format in the platform's format
array instead of hardcoding V4L2_PIX_FMT_MPEG2. This is always valid
since every platform defines at least one format.

Fixes: 3e7f51bd96 ("media: meson: add v4l2 m2m video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-17 12:36:48 +02:00
Ricardo Ribalda
bb03a00d68 media: atomisp: Demote all broken kernel-doc comments
The atomisp code has been very heavily annotated in doxygen format.

Unfortunately, both doxygen and kernel-doc use the same mark for signify
the beginning of a comment (/**).

As a result of this, kernel-doc gets confused when it parses atomisp and
throws tons of warnings, which made us completely disable atomisp
kernel-doc checks in Media-CI.

Demote all the broken comments so we can have 100% coverage.

Future patches can convert the doxygen annotations to kernel-doc if this
is deemed useful.

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Hao-Qun Huang
ae15adeed9 staging: media: tegra-video: vi: fix probe failure on skipped last port
tegra_vi_channels_alloc() iterates over port nodes and skips those
whose reg property cannot be read or whose remote endpoint fails
v4l2_fwnode_endpoint_parse(), leaving the negative result of the
failed call in ret. If that happens on the last port node, the loop
ends with ret still negative and tegra_vi_init() fails the whole VI
probe.

The same defective port earlier in the ports node is skipped silently,
so probing succeeds or fails depending on the order of the port nodes.
The CSI equivalent, tegra_csi_channels_alloc(), returns 0
unconditionally after its loop and does not have this problem.

Use a separate variable for the per-port checks so that only fatal
errors end up in ret.

Fixes: 1ebaeb0983 ("media: tegra-video: Add support for external sensor capture")
Fixes: 2ac4035a78 ("media: tegra-video: Add support for x8 captures with gang ports")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Hao-Qun Huang
7393372f79 staging: media: tegra-video: fix of_node_put() on VIP parse errors
tegra_vip_channel_of_parse() initializes np from dev->of_node without
taking a reference, but its error paths drop one through the
err_node_put label. This underflows the refcount of the VIP device's
OF node when endpoint parsing fails on a malformed device tree.

The only reference the function takes on np is the success-path
of_node_get() stored in vip->chan.of_node, and that one is already
released by the tegra_vip_init() error path and by tegra_vip_exit().

Return errors directly instead of jumping to the bogus cleanup label.

Fixes: e740d199cf ("staging: media: tegra-video: add support for Tegra20 parallel input")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Svyatoslav Ryhel
dd5f981d02 staging: media: tegra-video: vi: Improve media graph building logic
The existing tegra_vi_graph_build function relies heavily on a one-to-one
match between Device Tree nodes and media pad links. While this works for
simpler configurations, it causes issues when Device Tree nodes do not
match media pad link logic (e.g., mt9m114). Switch to the
media_entity_get_fwnode_pad helper to verify and retrieve the correct pad
linked to an endpoint, rather than assuming the endpoint ID matches the
pad ID.

Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # tegra20, parallel camera
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:54 +02:00
André Moreira
635590417a staging: media: av7110: refactor av7110_start_feed to reduce indentation
The av7110_start_feed function contains heavily nested if-statements,
causing excessive indentation and violating code style guidelines.

Refactor the logic inside the DMX_MEMORY_FE case by inverting the
conditional check to break early. Additionally, remove the inner
'if (feed->ts_type & TS_DECODER)' check, as it is redundant since
the outer block already validates this condition.

This reduces the indentation level and cleans up redundant checks
without altering the underlying driver behavior.

Signed-off-by: André Moreira <andrem.33333@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:54 +02:00
Vidhu Sarwal
b298b80814 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()
ipu7_resume() calls pm_runtime_get_sync() before resuming the device.
If the runtime PM resume fails, the usage count remains incremented, but
the error path returns without dropping the reference.

Use pm_runtime_resume_and_get() instead, which balances the usage count
on failure and avoids the leak. Keep returning 0 on error, as resume
callbacks should not propagate failures to the PM core, matching the
behaviour of the ipu6 driver.

Fixes: b7fe4c0019 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Vidhu Sarwal <vidhu.linux@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-08 13:58:38 +03:00
Vidhu Sarwal
843644e1c3 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_init_fw_code_region_by_sys()
ipu7_init_fw_code_region_by_sys() calls pm_runtime_get_sync() before
accessing the firmware code region. If resuming the device fails,
pm_runtime_get_sync() leaves the runtime PM usage count incremented,
but the error path returns without dropping the reference.

Use pm_runtime_resume_and_get() instead, which balances the usage count
automatically on failure and avoids the leak.

The ipu6 driver uses pm_runtime_resume_and_get() in the equivalent
location.

Fixes: b7fe4c0019 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Vidhu Sarwal <vidhu.linux@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-08 13:58:38 +03:00
Linus Torvalds
8c13415c8a [GIT PULL for v7.2] media updates
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmo0VwMACgkQCF8+vY7k
 4RXLxxAAhXl0y+3e9g4gx/FQAGGV6d3zohNomiw7u8DEPtgo3oE0n4FA2Xrd2bsK
 0cWskUMqz06fMYjwi0kloLi0MNW1ufERBL2Ehr73hS+8Iza/NCPcr34B6V6wiAOV
 i1vnB0qw7Juh1vr0lcplPKvcFzLBj0XWIphGkB0kRdhypfhEl36lRCf5OdmWPe63
 h7Co05/zceDaBPBzATEh9pKqH8jPJvmvEDkDLCLBIiQgBAClqCcX7xZuV/MiAJWE
 B8yuRoyakH/dpKfvUVaMCwtFLag3fmvkQwfSOVaF4NHmr7tW+nTRI4D7QLVDI6if
 cTIEEWdQsckVh2PKVuhaRod6o02pZdk+PWoSejdq8iTqPukR9vAp4iCjVW2Hc5dG
 fCirdVXla1zqbn/IZTo4T7oLHcYiFaqbrU8Xom4qZFqgeJp64H7AdifVWyqB92ru
 7DMgeVAhFQJIIvLrmqhpC1wvJ6nVhnkYHeHeL8UX0NRi7korb1jY5Shj5IfekuCW
 2xOtSEG+p7ni6BMFKc5qso/ZObnToymriWrjXykcowZrMjKoxYzXfsngMmsRZBN3
 QPRAM23FZvaNfF/poxnHNlRazi86+HgsrU2Q2koYR4FqUJ1iLYD6OvXX2WiirI3K
 j09P1BybvX7/NxyOldL60a7pICGJr7j9J6jx2DQZmVaqPMsTxew=
 =Br7k
 -----END PGP SIGNATURE-----

Merge tag 'media/v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:

 - v4l2:
     - core: fix subdev sensor ownership
     - subdev: Allow accessing routes with STREAMS client capability
     - ctrls: Add validation for HEVC active reference counts and
       background detection control
     - common: Add YUV24 format info and has_alpha helper

 - vb2: Change vb2_read() and vb2_write() return types to ssize_t

 - i2c: cvs: Add driver of Intel Computer Vision Sensing Controller(CVS)

 - atmel-isc: remove deprecated driver

 - cec: Add CEC Latency Indication Protocol (LIP) support

 - imon: Add iMON VFD HID OEM v1.2 key mappings

 - AVMatrix: new HWS capture driver

 - isp4: new AMD capture driver

 - qcom:
     - iris: Add hierarchical coding, B-frame, and Long-Term Reference
       support for encoder
     - camss: Add SM6350 platform support
     - venus: Add SM6115 platform support

 - chips-media: wave5: Add support for Packed YUV422, CBP profile, and
   background detection

 - csi2rx: Add multistream support and 32 dma chans

 - Several cleanups and fixes

* tag 'media/v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (394 commits)
  media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
  media: qcom: iris: vdec: allow GEN2 decoding into 10bit format
  media: qcom: iris: vdec: update find_format to handle 8bit and 10bit formats
  media: qcom: iris: vdec: update size and stride calculations for 10bit formats
  media: qcom: iris: gen2: add support for 10bit decoding
  media: qcom: iris: add QC10C & P010 buffer size calculations
  media: qcom: iris: add helpers for 8bit and 10bit formats
  media: qcom: iris: Fix FPS calculation and VPP FW overhead
  media: qcom: camss: vfe-340: Support for PIX client
  media: qcom: camss: vfe-340: Proper client handling
  media: qcom: camss: csid-340: Enable PIX interface routing
  media: qcom: camss: csid-340: Add port-to-interface mapping
  media: qcom: camss: csid-340: Switch to generic CSID_CFG/CTRL registers
  media: iris: Initialize HFI ops after firmware load in core init
  media: iris: drop struct iris_fmt
  media: iris: Add platform data for X1P42100
  media: iris: Add hardware power on/off ops for X1P42100
  media: iris: optimize COMV buffer allocation for VPU3x and VPU4x
  media: iris: add FPS calculation and VPP FW overhead in frequency formula
  media: qcom: iris: Simplify COMV size calculation
  ...
2026-06-18 17:21:54 -07:00
Bartosz Golaszewski
b8840c4f64 staging: media: max96712: drop unneeded dependency on OF_GPIO
OF_GPIO is selected automatically on all OF systems. Any symbols it
controls also provide stubs and are private to GPIOLIB anyway so there's
really no reason to select it explicitly.

Link: https://patch.msgid.link/20260506082211.5624-1-bartosz.golaszewski@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-08 10:37:09 +02:00
Shyam Sunder Reddy Padira
a96fcde9fa media: staging: imx: remove unnecessary out-of-memory error message
Remove dev_err() call after dma_alloc_coherent() failure.

checkpatch.pl reports this as an unnecessary out-of-memory message because
failure is already conveyed by returning -ENOMEM, and the current message
does not provide additional useful debugging information.

Signed-off-by: Shyam Sunder Reddy Padira <shyamsunderreddypadira@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-27 10:58:27 +02:00
Michael Tretter
e33062c19b media: staging: imx-csi: use media_pad_is_streaming helper
The media_pad_is_streaming() helper is explicitly intended to check whether
a pad has been started with media_pipeline_start(). Use it instead of
relying on the implicit assumption that a pad with a pipeline is streaming.

Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-27 10:58:27 +02:00
Michael Tretter
262d2e7cfc media: staging: imx-csi: explicitly start media pipeline on pad 0
entity->pads is an array that contains all the pads of an entity.

Calling __media_pipeline_start() or __media_pipeline_stop() on the pads,
implicitly starts the pipeline with the first pad in this array as origin.

Explicitly use the first pad to start the pipeline to make this more
obvious to the reader.

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-27 10:58:27 +02:00
Michael Tretter
e52b90b827 media: staging: imx-csi: move media_pipeline to video device
The imx-media driver has a single imx_media_device. Attaching the
media_pipeline to the imx_media_device prevents the execution of multiple
media pipelines on the device. This should be possible as long as the
media_pipelines don't use the same pads or pads that be configured while
the other media pipeline is streaming.

Move the media_pipeline to the imx_media_video_dev to be able to construct
media pipelines per imx capture device.

If different media pipelines in the media device conflict, the validation
will fail. Thus, the pipeline will fail to start and signal an error to
user space.

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-27 10:58:27 +02:00
Anand Moon
940f161f73 media: meson: vdec: Fix memory leak in error path of vdec_open
The vdec_open() function previously jumped directly to
err_m2m_release when vdec_init_ctrls() failed, skipping
release of the m2m context. This caused a resource leak.

Fix it by introducing a proper err_m2m_ctx_release label
that calls v4l2_m2m_ctx_release(sess->m2m_ctx) before
releasing the m2m device.

This was identified via kmemleak:
unreferenced object 0xffff0000205d6878 (size 8):
  comm "v4l_id", pid 5289, jiffies 4294938580
  hex dump (first 8 bytes):
    40 d2 49 18 00 00 ff ff                          @.I.....
  backtrace (crc d3204599):
    kmemleak_alloc+0xc8/0xf0
    __kvmalloc_node_noprof+0x60c/0x850
    v4l2_ctrl_handler_init_class+0x1b4/0x2e8 [videodev]
    vdec_open+0x1f4/0x788 [meson_vdec]
    v4l2_open+0x144/0x460 [videodev]
    chrdev_open+0x1ac/0x500
    do_dentry_open+0x3f0/0xfe8
    vfs_open+0x68/0x320
    do_open+0x2d8/0x9a8
    path_openat+0x1d0/0x4f0
    do_filp_open+0x190/0x380
    do_sys_openat2+0xf8/0x1b0
    __arm64_sys_openat+0x13c/0x1e8
    invoke_syscall+0xdc/0x268
    el0_svc_common.constprop.0+0x178/0x258
    do_el0_svc+0x4c/0x70

Fixes: 3e7f51bd96 ("media: meson: add v4l2 m2m video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-21 12:32:22 +02:00
Maha Maryam Javaid
2a1a564ada staging: media: meson: fix typo in codec files
Fix spelling mistake: substracted -> subtracted

Signed-off-by: Maha Maryam Javaid <mahamaryamjavaid@gmail.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-21 12:32:21 +02:00
Myeonghun Pak
2c869b6969 media: cedrus: clean up media device on probe failure
cedrus_probe() initializes the media device before registering the video
device, the media controller, and the media device. If any of those later
steps fails, probe returns without calling media_device_cleanup(), so the
media device internals initialized by media_device_init() are left behind.

Add a media-device cleanup label to the probe unwind path and route video
registration failures through it as well.

Fixes: 50e761516f ("media: platform: Add Cedrus VPU decoder driver")
Cc: stable@vger.kernel.org
Reviewed-by: Paul Kocialkowski <paulk@sys-base.io>
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-21 12:32:21 +02:00
Pedro Pontes
11f94f5b1d media: atomisp: use kmalloc_objs for array allocations
Convert manual kmalloc() multiplications to the modern kmalloc_objs()
interface to improve type safety and prevent potential integer
overflows.

Signed-off-by: Pedro Pontes <pontescpedro@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:42 +03:00
Taekyung Oh
f4705de3a9 staging: media: atomisp: remove dead code in ov2722.h
Remove unused code blocks enclosed in #if 0 to clean up the code.

Signed-off-by: Taekyung Oh <ohxorud@ohxorud.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:42 +03:00
Taekyung Oh
85354d9842 staging: media: atomisp: Fix block comment style in ov2722.h
Fix coding style warnings reported by checkpatch.pl.
Move the comments above the corresponding code lines to align with guideline.

Signed-off-by: Taekyung Oh <ohxorud@ohxorud.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:42 +03:00
Oskar Ray-Frayssinet
f6f729763c staging: media: atomisp: replace msleep() with fsleep() in atomisp-gc2235.c
Replace msleep(5) with fsleep(5000) to avoid sleeping longer than
necessary. msleep() with values less than 20ms may sleep for up to
20ms due to timer granularity. fsleep() selects the appropriate sleep
function automatically.

Signed-off-by: Oskar Ray-Frayssinet <rayfraytech@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:42 +03:00
Huihui Huang
12ea582820 staging: media: atomisp: fix map and vmap leaks in stat buffer allocation
There are memory leaks in
drivers/staging/media/atomisp/pci/atomisp_compat_css20.c.

In atomisp_css_allocate_stat_buffers(), s3a_map is allocated by
ia_css_isp_3a_statistics_map_allocate() and its backing memory is
mapped via hmm_vmap(). When dis_buf allocation fails, the error path
frees s3a_data but does not unmap or free s3a_map. Similarly, when
md_buf allocation fails, neither s3a_map nor dvs_map (and their hmm
vmaps) are freed.

Add the missing hmm_vunmap() and map free calls on both error paths,
matching the cleanup order used in atomisp_css_free_3a_buffer() and
atomisp_css_free_dis_buffer().

Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:42 +03:00
Timo Röhling
63c9b7def8 media: atomisp: style fix for trailing statements
Fix checkpatch errors "ERROR: trailing statements should be on next line"
in drivers/staging/media/atomisp/pci/sh_css_params.c.

Signed-off-by: Timo Röhling <roehling@debian.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:41 +03:00
LiangCheng Wang
9862d3f9de staging: media: atomisp: fix indentation in bh host files
Fix inconsistent tab/space usage and bring function definitions
into a single-line format, matching kernel coding style.

Signed-off-by: LiangCheng Wang <zaq14760@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:41 +03:00
LiangCheng Wang
b643225f61 staging: media: atomisp: use designated initializer in anr config
Improve readability by using designated initializer for
default_anr_config.

Signed-off-by: LiangCheng Wang <zaq14760@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:41 +03:00
LiangCheng Wang
15b4210a06 staging: media: atomisp: fix indentation in anr files
Fix inconsistent tab/space usage and bring function definitions
into a single-line format, matching kernel coding style.

Signed-off-by: LiangCheng Wang <zaq14760@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:41 +03:00
LiangCheng Wang
d13b75670e staging: media: atomisp: improve kernel-doc for ia_css_aa_config
Move kernel-doc comment for strength field in
ia_css_aa_config from inline to structure-level comment
for better readability and tooling compatibility.

Signed-off-by: LiangCheng Wang <zaq14760@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:41 +03:00
Adrian Barnaś
2bc7dd2b1f staging: media: atomisp: Remove return from end of void function in gdc.c
Fix checkpatch.pl warning on useless return on the end of the void
function.

Signed-off-by: Adrian Barnaś <abarnas@google.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:41 +03:00
Adrian Barnaś
3322fc4dca staging: media: atomisp: Whitespaces style cleanup in gdc.c
Clean up coding style whitespace issues
in drivers/staging/media/atomisp/pci/hive_isp_css_common/host/gdc.c.

Fixes include:
 - removal of unnecessary line breaks
 - correcting spacing around operators
 - correcting spaces between types and names

Signed-off-by: Adrian Barnaś <abarnas@google.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:40 +03:00
Chelsy Ratnawat
07e4753014 media: atomisp: Use string choices helpers
Use string_choices.h helpers instead of hard-coded strings.

Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:40 +03:00
Feng Ning
d178c7ca8f staging: media: atomisp: use array3_size() for overflow-safe allocation
Replace open-coded width * height * sizeof() multiplications with
array3_size() to prevent integer overflow in buffer allocations.

The atomisp driver computes DVS, morphing table, shading table and
statistics buffer sizes using unchecked arithmetic.  When dimensions
are attacker-controlled or simply large, the product can silently wrap,
causing kvmalloc() to allocate an undersized buffer.

array3_size() saturates to SIZE_MAX on overflow, so kvmalloc() returns
NULL instead of succeeding with too few bytes.

Signed-off-by: Feng Ning <feng@innora.ai>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:40 +03:00
Oskar Ray-Frayssinet
7222dc8751 staging: media: atomisp: use __func__ in debug message in atomisp_cmd.c
Replace hardcoded function name string with __func__ macro in
dev_dbg call as recommended by kernel coding style.

Signed-off-by: Oskar Ray-Frayssinet <rayfraytech@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:40 +03:00
Oskar Ray-Frayssinet
cede4f26b4 staging: media: atomisp: remove unnecessary else after return in atomisp_cmd.c
Remove unnecessary else clause after return statement as the else
branch is not needed when the if branch always returns.

Signed-off-by: Oskar Ray-Frayssinet <rayfraytech@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:40 +03:00
Lin YuChen
4d542f256c staging: media: atomisp: use kmalloc_array() for sh_css_blob_info
Replace the open-coded multiplication in kmalloc() with kmalloc_array()
to provide overflow protection and improve code readability.

Signed-off-by: Lin YuChen <starpt.official@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:40 +03:00
Zile Xiong
de1844c0da staging: media: atomisp: hmm: remove unnecessary casts
Drop unnecessary casts when accessing vma->vm_private_data.

No functional change.

Signed-off-by: Zile Xiong <xiongzile99@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:40 +03:00
Andy Shevchenko
016a8735b8 media: atomisp: Drop unused include
This driver includes the legacy header <linux/gpio.h> but does
not use any symbols from it. Drop the inclusion.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:21:39 +03:00
Arnd Bergmann
f4d51e55dd staging: media: atomisp: reduce load_primary_binaries() stack usage
The load_primary_binaries() function is overly complex and has som large
variables on the stack, which can cause warnings depending on CONFIG_FRAME_WARN
setting:

drivers/staging/media/atomisp/pci/sh_css.c: In function 'load_primary_binaries':
drivers/staging/media/atomisp/pci/sh_css.c:5260:1: error: the frame size of 1560 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]

Half of the stack usage is for the prim_descr[] array, but only one
member of the array is used at any given time.

Reduce the stack usage by turning the array into a single structure.

Fixes: a49d25364d ("staging/atomisp: Add support for the Intel IPU v2")
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 13:15:08 +03:00
Jose A. Perez de Azpillaga
f14d52b67e staging: media: atomisp: improve cleanup robustness in ia_css_stream_destroy_isp2401()
Remove the 'assert(entry)' call. In the atomisp driver, assert() is a
wrapper around BUG(), which intentionally crashes the entire kernel.
This is dangerous and inappropriate for a simple null pointer check
during stream teardown. Replace it with a safe 'if (!entry) continue;'
check.

Change the early 'return' to a 'continue'. In a destruction
path, it is better to proceed with cleaning up as many resources as
possible rather than aborting early, which would result in memory leaks
for the remaining pipes.

Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:32 +03:00
Jose A. Perez de Azpillaga
d133bd6ac9 staging: media: atomisp: extract ISP2401 cleanup into helper function
To reduce indentation and improve the readability of
ia_css_stream_destroy(), extract the ISP2401-specific cleanup block into
a new static helper function, ia_css_stream_destroy_isp2401().

Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:31 +03:00
Jose A. Perez de Azpillaga
9087395a38 staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy()
The nested loop inside the IS_ISP2401 block incorrectly uses the same
variable 'i' as the outer loop. This shadows the outer loop variable
and causes premature termination or skipped array elements.

Change the inner loop to use a new variable 'j' to prevent this.

Fixes: 113401c673 ("media: atomisp: sh_css: Removed #ifdef ISP2401 to make code generic")
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:31 +03:00
Michael Ugrin
79b29f7f26 staging: media: atomisp: use umin() for strscpy size arguments
Replace open-coded ternary min expressions with umin() in
strscpy() calls, as suggested by Dan Carpenter.

Signed-off-by: Michael Ugrin <mugrinphoto@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:31 +03:00
Mohamad El Harake
7488f3e073 media: atomisp: avoid ACPI package count underflow in gmin_cfg_get_dsm
gmin_cfg_get_dsm() iterates over ACPI _DSM package elements as
key/value pairs using obj->package.count - 1 as the loop bound.

If package.count is 0, the subtraction underflows and may lead
to out-of-bounds access.

Use i + 1 < obj->package.count instead.

Signed-off-by: Mohamad El Harake <mohamedharake2006@gmail.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:31 +03:00
Jose A. Perez de Azpillaga
7d0e5f2ee1 media: atomisp: remove redundant call to ia_css_output0_configure()
The function configure_isp_from_args() contained a duplicate call to
ia_css_output0_configure() using the same output frame index. Remove the
redundant call to simplify the configuration path.

The ia_css_output0_configure() function acts as a configuration setter.
It populates a struct ia_css_output0_configuration from the frame info
and caches it in the binary parameters. Calling it twice with the same
out_frame[0] pointer merely overwrites the exact same state with
identical values. It has no cumulative state, neither does its order
matter relative to ia_css_copy_output_configure().

ia_css_configure_output0() writes into binary->mem_params.params[], a
software-side DMEM parameter buffer in kernel memory. The ISP firmware
receives these parameters later as a batch, not at the time of the call.
Calling a pure memory write twice with the same pointer and same value
simply overwrites the same location with identical data, there is no
hardware interaction that could require repetition.

Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:31 +03:00
Jose A. Perez de Azpillaga
e4e6bc933a media: atomisp: gate ref and tnr frame config behind ISP enable flags
The FIXME comment noted that delay_frames can be NULL for certain
pipeline configurations, without knowing why. The reason is that when a
binary does not enable ref_frame, delay frame allocation is
intentionally skipped to save memory, leaving the pointers NULL by
design.

The ISP feature flags in binary->info->sp.enable accurately reflect
which features are active for a given binary. Using enable.ref_frame and
enable.tnr as the predicate for their respective configuration steps
ensures the configuration path stays in sync with what was actually
built into the pipeline

Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:31 +03:00
Anushka Badhe
c06b73f1e1 staging: media: atomisp: pci: fix split GP_TIMER_BASE declaration
Merge declaration of const GP_TIMER_BASE split across 2 lines to improve
readability.

Signed-off-by: Anushka Badhe <anushkabadhe@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:30 +03:00