[GIT PULL for v6.4-rc3] media fixes

[Mauro Carvalho Chehab <mchehab@kernel.org>]

Hi Linus,

Please pull from:
  git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media tags/media/v6.4-3

For several fixes at the dvb core and drivers:

  - Address some UAF and null pointer de-reference conditions at DVB core;
  - Fix kernel runtime warning for blocking operation in wait_event*() at dvb core;
  - Fix a size write bug at DVB conditional access core;
  - Address a bug at the dvb demux continuity counter debug check logic;
  - a couple randconfig build fixes at pvrusb2 and mn88443x drivers;
  - fix a memory leak at ttusb-dec driver;
  - a fix at netup_unidvb probe-time error check logic;
  - dw2102 will better handle an error check if it can't retrieve DVB MAC address.

Regards,
Mauro

---

The following changes since commit ae3c253f595b31ff30d55b4c50b4470e56bc4e0d:

  media: platform: mtk-mdp3: work around unused-variable warning (2023-05-08 12:11:25 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media tags/media/v6.4-3

for you to fetch changes up to 280a8ab81733da8bc442253c700a52c4c0886ffd:

  media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (2023-05-14 16:04:48 +0100)

----------------------------------------------------------------
media fixes for v6.4-rc3

----------------------------------------------------------------
Arnd Bergmann (1):
      media: pvrusb2: fix DVB_CORE dependency

Duoming Zhou (1):
      media: netup_unidvb: fix use-after-free at del_timer()

Hyunwoo Kim (5):
      media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
      media: dvb-core: Fix use-after-free on race condition at dvb_frontend
      media: dvb-core: Fix use-after-free due on race condition at dvb_net
      media: dvb-core: Fix use-after-free due to race at dvb_register_device()
      media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221

Krzysztof Kozlowski (1):
      media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table

Takashi Iwai (1):
      media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()

Wei Chen (6):
      media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
      media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
      media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
      media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
      media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
      media: netup_unidvb: fix irq init by register it at the end of probe

YongSu Yoo (2):
      media: dvb_demux: fix a bug for the continuity counter
      media: dvb_ca_en50221: fix a size write bug

Zhang Shurong (1):
      media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer

 drivers/media/dvb-core/dvb_ca_en50221.c            | 49 +++++++++++--
 drivers/media/dvb-core/dvb_demux.c                 |  4 +-
 drivers/media/dvb-core/dvb_frontend.c              | 69 ++++++++++++++----
 drivers/media/dvb-core/dvb_net.c                   | 38 +++++++++-
 drivers/media/dvb-core/dvbdev.c                    | 84 ++++++++++++++++------
 drivers/media/dvb-frontends/mn88443x.c             |  2 +-
 drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 19 ++---
 drivers/media/usb/dvb-usb-v2/ce6230.c              |  8 +++
 drivers/media/usb/dvb-usb-v2/ec168.c               | 12 ++++
 drivers/media/usb/dvb-usb-v2/rtl28xxu.c            | 20 ++++++
 drivers/media/usb/dvb-usb/az6027.c                 | 12 ++++
 drivers/media/usb/dvb-usb/digitv.c                 |  4 ++
 drivers/media/usb/dvb-usb/dw2102.c                 |  2 +-
 drivers/media/usb/pvrusb2/Kconfig                  |  1 +
 drivers/media/usb/ttusb-dec/ttusb_dec.c            |  3 +-
 include/media/dvb_frontend.h                       |  6 +-
 include/media/dvb_net.h                            |  4 ++
 include/media/dvbdev.h                             | 15 ++++
 18 files changed, 293 insertions(+), 59 deletions(-)