kernel/drivers/media/rc/streamzap.c, branch linux-rolling-stable

media: streamzap: prevent processing IR data on URB failure

2025-04-20T08:18:01Z

commit 549f6d348167fb2f7800ed7c8d4bce9630c74498 upstream. If streamzap_callback() receives an urb with any non-critical error status, i.e. any error code other than -ECONNRESET, -ENOENT or -ESHUTDOWN, it will try to process IR data, ignoring a possible transfer failure. Make streamzap_callback() process IR data only when urb->status is 0. Move processing logic to a separate function to make code cleaner and more similar to the URB completion handlers in other RC drivers. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 19770693c354 ("V4L/DVB: staging/lirc: add lirc_streamzap driver") Cc: stable@vger.kernel.org Signed-off-by: Murad Masimov Signed-off-by: Sean Young Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

media: streamzap: fix race between device disconnection and urb callback

2025-04-10T12:42:06Z

commit f656cfbc7a293a039d6a0c7100e1c846845148c1 upstream. Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzap_disconnect() function: rc_unregister_device() is called before usb_kill_urb(). The dev->raw pointer is freed and set to NULL in rc_unregister_device(), and only after that usb_kill_urb() waits for in-progress requests to finish. If rc_unregister_device() is called while streamzap_callback() handler is not finished, this can lead to accessing freed resources. Thus rc_unregister_device() should be called after usb_kill_urb(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 8e9e60640067 ("V4L/DVB: staging/lirc: port lirc_streamzap to ir-core") Cc: stable@vger.kernel.org Reported-by: syzbot+34008406ee9a31b13c73@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=34008406ee9a31b13c73 Signed-off-by: Murad Masimov Signed-off-by: Sean Young Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman

media: streamzap: avoid unnecessary GFP_ATOMIC

2022-06-20T09:30:33Z

During resume() GFP_NOIO is enough. Signed-off-by: Oliver Neukum Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: remove third argument of usb_maxpacket()

2022-04-23T08:33:53Z

The third argument of usb_maxpacket(): in_out has been deprecated because it could be derived from the second argument (e.g. using usb_pipeout(pipe)). N.B. function usb_maxpacket() was made variadic to accommodate the transition from the old prototype with three arguments to the new one with only two arguments (so that no renaming is needed). The variadic argument is to be removed once all users of usb_maxpacket() get migrated. CC: Sean Young CC: Mauro Carvalho Chehab CC: Benjamin Valentin Signed-off-by: Vincent Mailhol Link: https://lore.kernel.org/r/20220317035514.6378-5-mailhol.vincent@wanadoo.fr Signed-off-by: Greg Kroah-Hartman

media: streamzap: remove redundant gap calculations

2021-12-14T14:09:13Z

The lirc core already introduces gaps, so there is no need for this in the driver. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: streamzap: remove unused struct members

2021-12-14T14:09:13Z

These struct members do not serve any purpose. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: streamzap: less chatter

2021-12-14T14:09:13Z

Remove superfluous messages which add no information. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: streamzap: no need for usb pid/vid in device name

2021-12-14T14:09:13Z

The usb pid/vid can be found elsewhere, the idVendor/idProduct usb sysfs files for example. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: streamzap: remove unnecessary ir_raw_event_reset and handle

2021-12-14T14:09:13Z

There is no reason to have a reset after an IR timeout. Calling ir_raw_event_handle() twice for the same interrupt has no affect. Fixes: 56b0ec30c4bc ("[media] rc/streamzap: fix reporting response times") Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: streamzap: ensure rx resolution can be retrieved

2021-09-30T08:07:40Z

The receiver resolution is not populated. The resolution can be used to for various purposes like calculating the margins the decoder should use. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab