| a45a81a7 | 23-Jul-2026 |
Pan Chuang <panchuang@vivo.com> |
media: cec: tegra: Remove redundant dev_err()
Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error m
media: cec: tegra: Remove redundant dev_err()
Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err() calls.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
show more ...
|
| 78616695 | 23-Jul-2026 |
Pan Chuang <panchuang@vivo.com> |
media: cec: seco: Remove redundant dev_err()
Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error me
media: cec: seco: Remove redundant dev_err()
Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_threaded_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err() calls.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
show more ...
|
| bce7236c | 10-Jul-2026 |
Hans Verkuil <hverkuil+cisco@kernel.org> |
media: cec: tegra_cec: keep track of number of Rx Low Drives
Keep track of Rx Low Drive conditions. Useful for detecting
potential hardware/cable problems as it suggests unstable or
incorrect voltag
media: cec: tegra_cec: keep track of number of Rx Low Drives
Keep track of Rx Low Drive conditions. Useful for detecting
potential hardware/cable problems as it suggests unstable or
incorrect voltage levels.
Note that the Tx Low Drive conditions are already logged in
the CEC core.
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
show more ...
|
| 8dcf23ed | 04-Jul-2026 |
Pengpeng Hou <pengpeng@iscas.ac.cn> |
media: cec: tegra: add missing MODULE_DEVICE_TABLE()
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVI
media: cec: tegra: add missing MODULE_DEVICE_TABLE()
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
show more ...
|
| 3bc2e4a2 | 24-Jun-2026 |
Pengpeng Hou <pengpeng@iscas.ac.cn> |
media: cec: stm32: return an error when log-address wait times out
stm32_cec_adap_log_addr() waits for TXSOM to clear before disabling CEC
and updating the logical address registers. The wait result
media: cec: stm32: return an error when log-address wait times out
stm32_cec_adap_log_addr() waits for TXSOM to clear before disabling CEC
and updating the logical address registers. The wait result is ignored,
so a timeout can still be reported as a successful logical address
update.
Return the polling error before touching the address registers. Compute
the address mask only for valid logical addresses so the invalid-address
path does not evaluate a shift based on CEC_LOG_ADDR_INVALID.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
show more ...
|
| fb9dda38 | 11-Jun-2026 |
Weigang He <geoffreyhe2@gmail.com> |
media: cec: stm32: prevent out-of-bounds write on RX overflow
stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using
rx_msg.len as the write index, incrementing it on every RXBR
(recei
media: cec: stm32: prevent out-of-bounds write on RX overflow
stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using
rx_msg.len as the write index, incrementing it on every RXBR
(receive-byte-ready) interrupt without checking it against the buffer
size:
cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
rx_msg.msg[] is a fixed CEC_MAX_MSG_SIZE (16) byte array in struct
cec_msg, and rx_msg.len is only reset on RXACKE/RXOVR or after a
completed message (RXEND). The number of bytes received before RXEND is
decided by the remote CEC device (it sets EOM), not by the driver. A
peer that keeps sending bytes without ending the message drives RXBR
repeatedly, pushing rx_msg.len past 16 and writing peer-controlled bytes
out of bounds into the surrounding memory. This is reachable in normal
operation once the driver has probed and receiving is enabled, from the
IRQ thread, without any local privilege.
The length check in the CEC core runs on the consumer side, after the
byte has been stored, so it does not prevent the overflow. Bound the
index in the driver before the store, as the other platform CEC drivers
already do (e.g. tegra_cec), dropping the excess bytes of an overlong
frame.
Found by static analysis tool CodeQL.
Fixes: d69ae57453c8 ("[media] cec: add STM32 cec driver")
Cc: stable@vger.kernel.org
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
show more ...
|
| c3a78691 | 24-Apr-2026 |
Myeonghun Pak <mhun512@gmail.com> |
media: cec: seco: unregister adapter on IR probe failure
If secocec_ir_probe() fails after cec_register_adapter() succeeds,
probe returns an error and the driver remove callback is not called.
The c
media: cec: seco: unregister adapter on IR probe failure
If secocec_ir_probe() fails after cec_register_adapter() succeeds,
probe returns an error and the driver remove callback is not called.
The current unwind path unregisters the notifier and then falls through
to cec_delete_adapter(), which violates the CEC adapter lifetime rules
after a successful registration.
Add a registered-adapter unwind path that unregisters the notifier and
the adapter instead.
Fixes: daef95769b3a ("media: seco-cec: add Consumer-IR support")
Cc: stable@vger.kernel.org
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
show more ...
|
| 560d29f4 | 20-Apr-2026 |
Kells Ping <kells.ping@quanta.corp-partner.google.com> |
media: platform: cros-ec: Add Dirkson to the match table
The Google Dirkson device uses the same approach as the Google Brask
which enables the HDMI CEC via the cros-ec-cec driver.
Signed-off-by:
media: platform: cros-ec: Add Dirkson to the match table
The Google Dirkson device uses the same approach as the Google Brask
which enables the HDMI CEC via the cros-ec-cec driver.
Signed-off-by: Kells Ping <kells.ping@quanta.corp-partner.google.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
show more ...
|
| 5701c792 | 30-Jun-2025 |
Hans Verkuil <hverkuil@xs4all.nl> |
media: cec: cec-gpio: reading hpd/5v is allowed to sleep
Reading the hpd or 5v gpios is something that can sleep, so rework
the code to allow this.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
media: cec: cec-gpio: reading hpd/5v is allowed to sleep
Reading the hpd or 5v gpios is something that can sleep, so rework
the code to allow this.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
show more ...
|