All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Johan Hovold <johan@kernel.org>,
	Lubomir Rintel <lkundrak@v3.sk>,
	Hans Verkuil <hverkuil-cisco@xs4all.nl>,
	Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Subject: [PATCH 5.6 09/23] media: usbtv: fix control-message timeouts
Date: Tue, 31 Mar 2020 10:59:21 +0200	[thread overview]
Message-ID: <20200331085312.064800702@linuxfoundation.org> (raw)
In-Reply-To: <20200331085308.098696461@linuxfoundation.org>

From: Johan Hovold <johan@kernel.org>

commit 536f561d871c5781bc33d26d415685211b94032e upstream.

The driver was issuing synchronous uninterruptible control requests
without using a timeout. This could lead to the driver hanging on
various user requests due to a malfunctioning (or malicious) device
until the device is physically disconnected.

The USB upper limit of five seconds per request should be more than
enough.

Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber")
Fixes: c53a846c48f2 ("[media] usbtv: add video controls")
Cc: stable <stable@vger.kernel.org>     # 3.11
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Lubomir Rintel <lkundrak@v3.sk>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/usbtv/usbtv-core.c  |    2 +-
 drivers/media/usb/usbtv/usbtv-video.c |    5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/media/usb/usbtv/usbtv-core.c
+++ b/drivers/media/usb/usbtv/usbtv-core.c
@@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv,
 
 		ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG,
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			value, index, NULL, 0, 0);
+			value, index, NULL, 0, USB_CTRL_GET_TIMEOUT);
 		if (ret < 0)
 			return ret;
 	}
--- a/drivers/media/usb/usbtv/usbtv-video.c
+++ b/drivers/media/usb/usbtv/usbtv-video.c
@@ -800,7 +800,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
 		ret = usb_control_msg(usbtv->udev,
 			usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			0, USBTV_BASE + 0x0244, (void *)data, 3, 0);
+			0, USBTV_BASE + 0x0244, (void *)data, 3,
+			USB_CTRL_GET_TIMEOUT);
 		if (ret < 0)
 			goto error;
 	}
@@ -851,7 +852,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
 	ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0),
 			USBTV_CONTROL_REG,
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			0, index, (void *)data, size, 0);
+			0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT);
 
 error:
 	if (ret < 0)



  parent reply	other threads:[~2020-03-31  9:00 UTC|newest]

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-31  8:59 [PATCH 5.6 00/23] 5.6.1-rc1 review Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 01/23] bpf: Undo incorrect __reg_bound_offset32 handling Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 02/23] USB: serial: option: add support for ASKEY WWHC050 Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 03/23] USB: serial: option: add BroadMobi BM806U Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 04/23] USB: serial: option: add Wistron Neweb D19Q1 Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 05/23] USB: cdc-acm: restore capability check order Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 06/23] USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 07/23] usb: musb: fix crash with highmen PIO and usbmon Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 08/23] media: flexcop-usb: fix endpoint sanity check Greg Kroah-Hartman
2020-03-31  8:59 ` Greg Kroah-Hartman [this message]
2020-03-31  8:59 ` [PATCH 5.6 10/23] staging: kpc2000: prevent underflow in cpld_reconfigure() Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 11/23] staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 12/23] staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 13/23] staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 14/23] staging: wfx: add proper "compatible" string Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 15/23] staging: wfx: fix init/remove vs IRQ race Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 16/23] staging: wfx: annotate nested gc_list vs tx queue locking Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 17/23] ahci: Add Intel Comet Lake H RAID PCI ID Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 18/23] libfs: fix infoleak in simple_attr_read() Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 19/23] media: ov519: add missing endpoint sanity checks Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 20/23] media: dib0700: fix rc endpoint lookup Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 21/23] media: stv06xx: add missing descriptor sanity checks Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 22/23] media: xirlink_cit: " Greg Kroah-Hartman
2020-03-31  8:59 ` [PATCH 5.6 23/23] media: v4l2-core: fix a use-after-free bug of sd->devnode Greg Kroah-Hartman
2020-03-31 18:07 ` [PATCH 5.6 00/23] 5.6.1-rc1 review Naresh Kamboju
2020-03-31 18:20   ` Linus Torvalds
2020-03-31 19:29     ` Arnaldo Carvalho de Melo
2020-03-31 23:18       ` Daniel Díaz
2020-04-01 12:40         ` Arnaldo Carvalho de Melo
2020-04-01 13:45           ` Daniel Díaz
2020-04-01 14:34             ` Arnaldo Carvalho de Melo
2020-04-01 15:07               ` Daniel Díaz
2020-04-04  8:41           ` [tip: perf/urgent] perf python: Fix clang detection to strip out options passed in $CC tip-bot2 for Arnaldo Carvalho de Melo
2020-03-31 19:32 ` [PATCH 5.6 00/23] 5.6.1-rc1 review shuah
2020-04-01  8:19   ` Greg Kroah-Hartman
2020-03-31 20:02 ` Vitor Massaru Iha
2020-03-31 20:02   ` [Linux-kernel-mentees] " Vitor Massaru Iha
2020-04-01  2:25 ` Guenter Roeck
2020-04-01  8:20   ` Greg Kroah-Hartman
2020-04-01  3:06 ` Woody Suwalski
2020-04-01  5:51   ` Greg Kroah-Hartman
2020-04-01  5:53     ` Greg Kroah-Hartman
2020-04-01 11:06       ` Woody Suwalski
2020-04-01 11:18         ` Greg Kroah-Hartman
2020-04-01 15:40   ` shuah
2020-04-01 16:10     ` Greg Kroah-Hartman
2020-04-01  8:57 ` Jon Hunter
2020-04-01  8:57   ` Jon Hunter
     [not found]   ` <d0744ad0-40b4-3bea-4d4f-1faf562126ec-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org>
2020-04-01  9:33     ` Greg Kroah-Hartman
2020-04-01  9:33       ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200331085312.064800702@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=hverkuil-cisco@xs4all.nl \
    --cc=johan@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lkundrak@v3.sk \
    --cc=mchehab+huawei@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.