xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: uvc: don't do DMA on stack

Browse Source 
commit 1a10d7fdb6d0e235e9d230916244cc2769d3f170 upstream.

As warned by smatch:
	drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i)
	drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)

those two functions call uvc_query_ctrl passing a pointer to
a data at the DMA stack. those are used to send URBs via
usb_control_msg(). Using DMA stack is not supported and should
not work anymore on modern Linux versions.

So, use a kmalloc'ed buffer.

Cc: stable@vger.kernel.org	# Kernel 4.9 and upper
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Mauro Carvalho Chehab
2021-06-17 14:33:29 +02:00
committed by Greg Kroah-Hartman
parent 516dbe27f4
commit c0eaaa6868
1 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
drivers/media/usb/uvc/uvc_v4l2.c
View File

@@ -898,8 +898,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
{ {
struct uvc_fh *handle = fh; struct uvc_fh *handle = fh;
struct uvc_video_chain *chain = handle->chain; struct uvc_video_chain *chain = handle->chain;
u8 *buf;
int ret; int ret;
u8 i;
if (chain->selector == NULL || if (chain->selector == NULL ||
(chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) { (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
@@ -907,22 +907,27 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
return 0; return 0;
} }
buf = kmalloc(1, GFP_KERNEL);
if (!buf)
return -ENOMEM;
ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id, ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id,
chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
&i, 1); buf, 1);
if (ret < 0) if (!ret)
return ret; *input = *buf - 1;
*input = i - 1; kfree(buf);
return 0;
return ret;
} }
static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
{ {
struct uvc_fh *handle = fh; struct uvc_fh *handle = fh;
struct uvc_video_chain *chain = handle->chain; struct uvc_video_chain *chain = handle->chain;
u8 *buf;
int ret; int ret;
u32 i;
ret = uvc_acquire_privileges(handle); ret = uvc_acquire_privileges(handle);
if (ret < 0) if (ret < 0)
@@ -938,10 +943,17 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
if (input >= chain->selector->bNrInPins) if (input >= chain->selector->bNrInPins)
return -EINVAL; return -EINVAL;
i = input + 1; buf = kmalloc(1, GFP_KERNEL);
return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id, if (!buf)
return -ENOMEM;
*buf = input + 1;
ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
&i, 1); buf, 1);
kfree(buf);
return ret;
} }
static int uvc_ioctl_queryctrl(struct file *file, void *fh, static int uvc_ioctl_queryctrl(struct file *file, void *fh,