Merge tag 'media/v6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:

 - New driver for Mediatek MDP V3

 - New driver for NXP i.MX DW100 dewarper

 - Zoran driver got promoted from staging

 - Hantro and related drivers got promoted from staging

 - Several VB1 drivers got moved to staging/deprecated (cpia2, fsl-viu,
   meye, saa7146, av7110, stkwebcam, tm6000, vpfe_capture, davinci,
   zr364xx)

 - Usual set of driver fixes, improvements and cleanups

* tag 'media/v6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (107 commits)
  media: destage Hantro VPU driver
  media: platform: mtk-mdp3: add MediaTek MDP3 driver
  media: dt-binding: mediatek: add bindings for MediaTek CCORR and WDMA
  media: dt-binding: mediatek: add bindings for MediaTek MDP3 components
  media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
  media: xilinx: video: Add 1X12 greyscale format
  media: xilinx: csi2rxss: Add 1X12 greyscale format
  media: staging: media: imx: imx7-media-csi: Increase video mem limit
  media: uvcvideo: Limit power line control for Sonix Technology
  media: uvcvideo: Use entity get_cur in uvc_ctrl_set
  media: uvcvideo: Fix typo 'the the' in comment
  media: uvcvideo: Use indexed loops in uvc_ctrl_init_ctrl()
  media: uvcvideo: Fix memory leak in uvc_gpio_parse
  media: renesas: vsp1: Add support for RZ/G2L VSPD
  media: renesas: vsp1: Add VSP1_HAS_NON_ZERO_LBA feature bit
  media: renesas: vsp1: Add support for VSP software version
  media: renesas: vsp1: Add support to deassert/assert reset line
  media: dt-bindings: media: renesas,vsp1: Document RZ/G2L VSPD bindings
  media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
  media: amphion: fix a bug that vpu core may not resume after suspend
  ...

5 files changed, 9 insertions, 7 deletions

diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
index 49aca579576a..0d5ce69f12e7 100644
--- a/drivers/media/i2c/adv7511-v4l2.c
+++ b/drivers/media/i2c/adv7511-v4l2.c
@@ -943,8 +943,8 @@ static int adv7511_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
 		v4l2_dbg(1, debug, sd, "%s: cec msg len %d\n", __func__,
 			 msg.len);
 
-		if (msg.len > 16)
-			msg.len = 16;
+		if (msg.len > CEC_MAX_MSG_SIZE)
+			msg.len = CEC_MAX_MSG_SIZE;
 
 		if (msg.len) {
 			u8 i;
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index 5988a4fa0c46..bda0c547ce44 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -2047,8 +2047,8 @@ static void adv76xx_cec_isr(struct v4l2_subdev *sd, bool *handled)
 		struct cec_msg msg;
 
 		msg.len = cec_read(sd, 0x25) & 0x1f;
-		if (msg.len > 16)
-			msg.len = 16;
+		if (msg.len > CEC_MAX_MSG_SIZE)
+			msg.len = CEC_MAX_MSG_SIZE;
 
 		if (msg.len) {
 			u8 i;
diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index a8dd92948df0..7731cc1887e6 100644
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -2215,8 +2215,8 @@ static void adv7842_cec_isr(struct v4l2_subdev *sd, bool *handled)
 		struct cec_msg msg;
 
 		msg.len = cec_read(sd, 0x25) & 0x1f;
-		if (msg.len > 16)
-			msg.len = 16;
+		if (msg.len > CEC_MAX_MSG_SIZE)
+			msg.len = CEC_MAX_MSG_SIZE;
 
 		if (msg.len) {
 			u8 i;
diff --git a/drivers/media/i2c/cx25840/cx25840-ir.c b/drivers/media/i2c/cx25840/cx25840-ir.c
index 9d7d1d149f1a..8cef9656c612 100644
--- a/drivers/media/i2c/cx25840/cx25840-ir.c
+++ b/drivers/media/i2c/cx25840/cx25840-ir.c
@@ -196,7 +196,7 @@ static u32 clock_divider_to_resolution(u16 divider)
 {
 	/*
 	 * Resolution is the duration of 1 tick of the readable portion of
-	 * of the pulse width counter as read from the FIFO.  The two lsb's are
+	 * the pulse width counter as read from the FIFO.  The two lsb's are
 	 * not readable, hence the << 2.  This function returns ns.
 	 */
 	return DIV_ROUND_CLOSEST((1 << 2)  * ((u32) divider + 1) * 1000,
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index d99eedbdf011..200841c1f5cf 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -964,6 +964,8 @@ static void tc358743_cec_handler(struct v4l2_subdev *sd, u16 intstatus,
 
 		v = i2c_rd32(sd, CECRCTR);
 		msg.len = v & 0x1f;
+		if (msg.len > CEC_MAX_MSG_SIZE)
+			msg.len = CEC_MAX_MSG_SIZE;
 		for (i = 0; i < msg.len; i++) {
 			v = i2c_rd32(sd, CECRBUF1 + i * 4);
 			msg.msg[i] = v & 0xff;