kernel/drivers/media/cec/usb, branch linux-rolling-stable

media: update Hans Verkuil's email address

2025-09-09T13:59:02Z

Replace hverkuil@xs4all.nl by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: update Hans Verkuil's email address

2025-09-09T13:58:44Z

Replace hansverk@cisco.com by hverkuil@kernel.org. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: cec: extron-da-hd-4k-plus: drop external-module make commands

2025-08-29T09:04:02Z

Delete the external-module style Makefile commands. They are not needed for in-tree modules. This is the only Makefile in the kernel tree (aside from tools/ and samples/) that uses this Makefile style. The same files are built with or without this patch. Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver") Signed-off-by: Randy Dunlap Cc: stable@vger.kernel.org Signed-off-by: Hans Verkuil

media: v4l2: Rename second ioctl handlers argument to 'void *priv'

2025-08-13T06:34:01Z

The second argument to the ioctl handlers is not a file handle any more. The standard practice is to name it 'void *priv' in drivers. Many drivers still name it 'void *fh', and a few use more exotic names. Replace those more exotic names with 'void *priv' in all media drivers. Signed-off-by: Laurent Pinchart Acked-by: Jai Luthra Signed-off-by: Hans Verkuil

media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()

2025-06-17T08:35:16Z

In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team. Fixes: 0f314f6c2e77 ("[media] rainshadow-cec: new RainShadow Tech HDMI CEC driver") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Signed-off-by: Hans Verkuil

media: cec: extron-da-hd-4k-plus: Fix Wformat-truncation

2025-04-25T13:14:30Z

Fix gcc8 warning: drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c:1014:44: warning: 'DCEC' directive output may be truncated writing 4 bytes into a region of size between 0 and 53 [-Wformat-truncation=] Resizing the 'buf' and 'cmd' arrays fixed the warning. Signed-off-by: Ricardo Ribalda Signed-off-by: Hans Verkuil

media: pulse8-cec: fix data timestamp at pulse8_setup()

2024-10-18T08:43:03Z

As pointed by Coverity, there is a hidden overflow condition there. As date is signed and u8 is unsigned, doing: date = (data[0] << 24) With a value bigger than 07f will make all upper bits of date 0xffffffff. This can be demonstrated with this small code:


typedef int64_t time64_t;
typedef uint8_t u8;

int main(void)
{
	u8 data[] = { 0xde ,0xad , 0xbe, 0xef };
	time64_t date;

	date = (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];
	printf("Invalid data = 0x%08lx\n", date);

	date = ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];
	printf("Expected data = 0x%08lx\n", date);

	return 0;
}

Fix it by converting the upper bit calculation to unsigned. Fixes: cea28e7a55e7 ("media: pulse8-cec: reorganize function order") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab

media: cec: extron-da-hd-4k-plus: don't use -1 as an error code

2024-10-18T08:43:03Z

The logic at get_edid_tag_location() returns either an offset or an error condition. However, the error condition uses a non-standard "-1" value. This hits a Coverity bug, as Coverity assumes that positive values are underflow. While this is a false positive, returning error codes as -1 is an issue. So, instead, use -ENOENT to indicate that the tag was not found. Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver") Signed-off-by: Mauro Carvalho Chehab

media: cec: extron-da-hd-4k-plus: add the Extron DA HD 4K Plus CEC driver

2024-09-05T18:13:41Z

Add support for the Extron DA HD 4K Plus series of 4K HDMI Distrubution Amplifiers (aka HDMI Splitters). These devices support CEC and this driver adds support for the CEC protocol for both the input and all outputs (2, 4 or 6 outputs, depending on the model). It also exports the EDID from the outputs and allows reading and setting the EDID of the input. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: pulse8-cec: handle possible ping error

2023-07-14T07:14:09Z

Handle (and warn about) possible error waiting for MSGCODE_PING result. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab