Commit 1a10d7fd authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab
Browse files

media: uvc: don't do DMA on stack 



As warned by smatch:
	drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i)
	drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)

those two functions call uvc_query_ctrl passing a pointer to
a data at the DMA stack. those are used to send URBs via
usb_control_msg(). Using DMA stack is not supported and should
not work anymore on modern Linux versions.

So, use a kmalloc'ed buffer.

Cc: stable@vger.kernel.org	# Kernel 4.9 and upper
Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 54e80d98

drivers/media/usb/uvc/uvc_v4l2.c

+23 −11
Original line number Diff line number Diff line
@@ -899,8 +899,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) 
{

	struct uvc_fh *handle = fh;

	struct uvc_video_chain *chain = handle->chain;

	u8 *buf;

	int ret;

	u8 i;



	if (chain->selector == NULL ||

	    (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
@@ -908,22 +908,27 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) 
		return 0;

	}



	buf = kmalloc(1, GFP_KERNEL);

	if (!buf)

		return -ENOMEM;



	ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id,

			     chain->dev->intfnum,  UVC_SU_INPUT_SELECT_CONTROL,

			     &i, 1);

	if (ret < 0)

		return ret;

			     buf, 1);

	if (!ret)

		*input = *buf - 1;



	*input = i - 1;

	return 0;

	kfree(buf);



	return ret;

}



static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)

{

	struct uvc_fh *handle = fh;

	struct uvc_video_chain *chain = handle->chain;

	u8 *buf;

	int ret;

	u32 i;



	ret = uvc_acquire_privileges(handle);

	if (ret < 0)
@@ -939,10 +944,17 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) 
	if (input >= chain->selector->bNrInPins)

		return -EINVAL;



	i = input + 1;

	return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,

	buf = kmalloc(1, GFP_KERNEL);

	if (!buf)

		return -ENOMEM;



	*buf = input + 1;

	ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,

			     chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,

			      &i, 1);

			     buf, 1);

	kfree(buf);



	return ret;

}



static int uvc_ioctl_queryctrl(struct file *file, void *fh,