5.4-stable patches

added patches:
	media-cx18-add-missing-check-after-dma-map.patch

diff --git a/queue-5.4/media-cx18-add-missing-check-after-dma-map.patch b/queue-5.4/media-cx18-add-missing-check-after-dma-map.patch
new file mode 100644 (file)
index 0000000..bd2b53c
--- /dev/null
+++ b/queue-5.4/media-cx18-add-missing-check-after-dma-map.patch
@@ -0,0 +1,53 @@
+From stable+bounces-186327-greg=kroah.com@vger.kernel.org Fri Oct 17 15:55:46 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 09:55:39 -0400
+Subject: media: cx18: Add missing check after DMA map
+To: stable@vger.kernel.org
+Cc: Thomas Fourier <fourier.thomas@gmail.com>, Hans Verkuil <hverkuil+cisco@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20251017135539.3964005-1-sashal@kernel.org>
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 23b53639a793477326fd57ed103823a8ab63084f ]
+
+The DMA map functions can fail and should be tested for errors.
+If the mapping fails, dealloc buffers, and return.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[ removed pci_map_single() replaced by dma_map_single() ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/cx18/cx18-queue.c |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/pci/cx18/cx18-queue.c
++++ b/drivers/media/pci/cx18/cx18-queue.c
+@@ -379,14 +379,22 @@ int cx18_stream_alloc(struct cx18_stream
+                       break;
+               }
+ 
++              buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev,
++                                               buf->buf, s->buf_size,
++                                               s->dma);
++              if (dma_mapping_error(&s->cx->pci_dev->dev, buf->dma_handle)) {
++                      kfree(buf->buf);
++                      kfree(mdl);
++                      kfree(buf);
++                      break;
++              }
++
+               INIT_LIST_HEAD(&mdl->list);
+               INIT_LIST_HEAD(&mdl->buf_list);
+               mdl->id = s->mdl_base_idx; /* a somewhat safe value */
+               cx18_enqueue(s, mdl, &s->q_idle);
+ 
+               INIT_LIST_HEAD(&buf->list);
+-              buf->dma_handle = pci_map_single(s->cx->pci_dev,
+-                              buf->buf, s->buf_size, s->dma);
+               cx18_buf_sync_for_cpu(s, buf);
+               list_add_tail(&buf->list, &s->buf_pool);
+       }

diff --git a/queue-5.4/series b/queue-5.4/series
index 8d8f60a9930d7987870a1b94ea05e3064f19413e..a3d7b3e186f82f994e208113cd53bc89b1141b45 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -147,3 +147,4 @@ pid-add-a-judgment-for-ns-null-in-pid_nr_ns.patch
 fs-add-initramfs_options-to-set-initramfs-mount-opti.patch
 cramfs-verify-inode-mode-when-loading-from-disk.patch
 xen-events-cleanup-find_virq-return-codes.patch
+media-cx18-add-missing-check-after-dma-map.patch