kernel/drivers/media/usb/pvrusb2, branch 0x221E-v0.0.1-v6.19

media: pvrusb2: fix URB leak in pvr2_send_request_ex

2026-03-04T12:20:01Z

[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ] When pvr2_send_request_ex() submits a write URB successfully but fails to submit the read URB (e.g. returns -ENOMEM), it returns immediately without waiting for the write URB to complete. Since the driver reuses the same URB structure, a subsequent call to pvr2_send_request_ex() attempts to submit the still-active write URB, triggering a 'URB submitted while active' warning in usb_submit_urb(). Fix this by ensuring the write URB is unlinked and waited upon if the read URB submission fails. Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16 Signed-off-by: Szymon Wilczek Acked-by: Mike Isely Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin

media: pvrusb2: Fix incorrect variable used in trace message

2025-10-14T13:07:37Z

The pvr2_trace message is reporting an error about control read transfers, however it is using the incorrect variable write_len instead of read_lean. Fix this by using the correct variable read_len. Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Cc: stable@vger.kernel.org Signed-off-by: Colin Ian King Signed-off-by: Hans Verkuil

media: Reset file->private_data to NULL in v4l2_fh_del()

2025-08-13T06:33:44Z

Multiple drivers that use v4l2_fh and call v4l2_fh_del() manually reset the file->private_data pointer to NULL in their video device .release() file operation handler. Move the code to the v4l2_fh_del() function to avoid direct access to file->private_data in drivers. This requires adding a file pointer argument to the function. Changes to drivers have been generated with the following coccinelle semantic patch: @@ expression fh; identifier filp; identifier release; type ret; @@ ret release(..., struct file *filp, ...) { <... - filp->private_data = NULL; ... - v4l2_fh_del(fh); + v4l2_fh_del(fh, filp); ...> } @@ expression fh; identifier filp; identifier release; type ret; @@ ret release(..., struct file *filp, ...) { <... - v4l2_fh_del(fh); + v4l2_fh_del(fh, filp); ... - filp->private_data = NULL; ...> } @@ expression fh; identifier filp; identifier release; type ret; @@ ret release(..., struct file *filp, ...) { <... - v4l2_fh_del(fh); + v4l2_fh_del(fh, filp); ...> } Manual changes have been applied to Documentation/ to update the usage patterns, to drivers/media/v4l2-core/v4l2-fh.c to update the v4l2_fh_del() prototype and reset file->private_data, and to include/media/v4l2-fh.h to update the v4l2_fh_del() function prototype and its documentation. Additionally, white space issues have been fixed manually in drivers/usb/gadget/function/uvc_v4l2.c Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil

media: Set file->private_data in v4l2_fh_add()

2025-08-13T06:33:39Z

All the drivers that use v4l2_fh and call v4l2_fh_add() manually store a pointer to the v4l2_fh instance in file->private_data in their video device .open() file operation handler. Move the code to the v4l2_fh_add() function to avoid direct access to file->private_data in drivers. This requires adding a file pointer argument to the function. Changes to drivers have been generated with the following coccinelle semantic patch: @@ expression fh; identifier filp; identifier open; type ret; @@ ret open(..., struct file *filp, ...) { <... - filp->private_data = fh; ... - v4l2_fh_add(fh); + v4l2_fh_add(fh, filp); ...> } @@ expression fh; identifier filp; identifier open; type ret; @@ ret open(..., struct file *filp, ...) { <... - v4l2_fh_add(fh); + v4l2_fh_add(fh, filp); ... - filp->private_data = fh; ...> } Manual changes have been applied to Documentation/ to update the usage patterns, to drivers/media/v4l2-core/v4l2-fh.c to update the v4l2_fh_add() prototype set file->private_data, and to include/media/v4l2-fh.h to update the v4l2_fh_add() function prototype and its documentation. Additionally, white space issues have been fixed manually in drivers/media/platform/nvidia/tegra-vde/v4l2.c, drivers/media/platform/rockchip/rkvdec/rkvdec.c, drivers/media/v4l2-core/v4l2-fh.c and drivers/staging/most/video/video.c. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil

media: Replace file->private_data access with file_to_v4l2_fh()

2025-08-13T06:33:25Z

Accessing file->private_data manually to retrieve the v4l2_fh pointer is error-prone, as the field is a void * and will happily cast implicitly to any pointer type. Replace all remaining locations that read the v4l2_fh pointer directly from file->private_data with usage of the file_to_v4l2_fh() function. The change was generated manually. No functional change is intended, this only paves the way to remove direct accesses to file->private_data and make V4L2 drivers safer. Other accesses to the field will be addressed separately. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil

media: usb: pvrusb2: Store v4l2_fh pointer in file->private_data

2025-08-13T06:33:21Z

Most V4L2 drivers store the v4l2_fh pointer in file->private_data. The pvrusb2 driver instead stores the pointer to the driver-specific structure that embeds the v4l2_fh. Switch to storing the v4l2_fh pointer itself to standardize behaviour across drivers. This also prepares for future refactoring that depends on v4l2_fh being stored in private_data. While at it, drop unneeded structure forward declarations. Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37Z

Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

Merge tag 'media/v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2025-05-28T16:17:20Z

Pull media updates from Mauro Carvalho Chehab: - v4l2-core fix: V4L2_BUF_TYPE_VIDEO_OVERLAY is capture, not output - New driver: Amlogic C3 ISP - New sensor drivers: ST VD55G1 and VD56G3, OmniVision OV02C10 - amlogic: c3-mipi-csi2: Handle 64-bits division - a fix for 64-bits division at the amlogic c3-mipi-csi2 driver - Changes at atomisp to support mainline mt9m114 driver and remove deprecated GPIO APIs - various cleanups, fixes and enhancements * tag 'media/v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (314 commits) media: rkvdec: h264: Support High 10 and 4:2:2 profiles media: rkvdec: Add get_image_fmt ops media: rkvdec: Initialize the m2m context before the controls media: rkvdec: h264: Limit minimum profile to constrained baseline media: mediatek: jpeg: support 34bits media: verisilicon: Free post processor buffers on error media: platform: mtk-mdp3: Remove unused mdp_get_plat_device media: amlogic: c3-mipi-csi2: Handle 64-bits division media: uvcvideo: Use dev_err_probe for devm_gpiod_get_optional media: uvcvideo: Fix deferred probing error media: uvcvideo: Rollback non processed entities on error media: uvcvideo: Send control events for partial succeeds media: uvcvideo: Return the number of processed controls media: uvcvideo: Do not turn on the camera for some ioctls media: uvcvideo: Make power management granular media: uvcvideo: Increase/decrease the PM counter per IOCTL media: uvcvideo: Create uvc_pm_(get|put) functions media: uvcvideo: Keep streaming state in the file handle Documentation: media: Add documentation file c3-isp.rst Documentation: media: Add documentation file metafmt-c3-isp.rst ...

treewide, timers: Rename destroy_timer_on_stack() as timer_destroy_on_stack()

2025-05-08T17:49:33Z

Move this API to the canonical timer_*() namespace. Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250507175338.672442-10-mingo@kernel.org

media: pvrusb2: Remove unused pvr2_std_create_enum

2025-04-25T13:14:27Z

pvr2_std_create_enum() has been unused since 2012's commit c0bb609fdc0b ("[media] pvrusb2: Get rid of obsolete code for video standard enumeration") Remove it. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Hans Verkuil