lkml.org 
[lkml]   [2021]   [Jul]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.13 251/266] media: gspca/sunplus: fix zero-length control requests
    Date
    From: Johan Hovold <johan@kernel.org>

    commit b4bb4d425b7b02424afea2dfdcd77b3b4794175e upstream.

    The direction of the pipe argument must match the request-type direction
    bit or control requests may fail depending on the host-controller-driver
    implementation.

    Control transfers without a data stage are treated as OUT requests by
    the USB stack and should be using usb_sndctrlpipe(). Failing to do so
    will now trigger a warning.

    Fix the single zero-length control request which was using the
    read-register helper, and update the helper so that zero-length reads
    fail with an error message instead.

    Fixes: 6a7eba24e4f0 ("V4L/DVB (8157): gspca: all subdrivers")
    Cc: stable@vger.kernel.org # 2.6.27
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/media/usb/gspca/sunplus.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)

    --- a/drivers/media/usb/gspca/sunplus.c
    +++ b/drivers/media/usb/gspca/sunplus.c
    @@ -242,6 +242,10 @@ static void reg_r(struct gspca_dev *gspc
    gspca_err(gspca_dev, "reg_r: buffer overflow\n");
    return;
    }
    + if (len == 0) {
    + gspca_err(gspca_dev, "reg_r: zero-length read\n");
    + return;
    + }
    if (gspca_dev->usb_err < 0)
    return;
    ret = usb_control_msg(gspca_dev->dev,
    @@ -250,7 +254,7 @@ static void reg_r(struct gspca_dev *gspc
    USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    0, /* value */
    index,
    - len ? gspca_dev->usb_buf : NULL, len,
    + gspca_dev->usb_buf, len,
    500);
    if (ret < 0) {
    pr_err("reg_r err %d\n", ret);
    @@ -727,7 +731,7 @@ static int sd_start(struct gspca_dev *gs
    case MegaImageVI:
    reg_w_riv(gspca_dev, 0xf0, 0, 0);
    spca504B_WaitCmdStatus(gspca_dev);
    - reg_r(gspca_dev, 0xf0, 4, 0);
    + reg_w_riv(gspca_dev, 0xf0, 4, 0);
    spca504B_WaitCmdStatus(gspca_dev);
    break;
    default:

    \
     
     \ /
      Last update: 2021-07-15 21:50    [W:2.323 / U:0.388 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site