* [PATCH v2] media: uvc: don't do DMA on stack
@ 2021-06-21 13:23 Mauro Carvalho Chehab
2021-06-21 13:28 ` Laurent Pinchart
0 siblings, 1 reply; 2+ messages in thread
From: Mauro Carvalho Chehab @ 2021-06-21 13:23 UTC (permalink / raw)
Cc: linuxarm, mauro.chehab, Mauro Carvalho Chehab, Laurent Pinchart,
Mauro Carvalho Chehab, linux-kernel, linux-media, stable
As warned by smatch:
drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i)
drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)
those two functions call uvc_query_ctrl passing a pointer to
a data at the DMA stack. those are used to send URBs via
usb_control_msg(). Using DMA stack is not supported and should
not work anymore on modern Linux versions.
So, use a temporary buffer, allocated together with
struct uvc_video_chain.
Cc: stable@vger.kernel.org # Kernel 4.9 and upper
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
---
drivers/media/usb/uvc/uvc_v4l2.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 252136cc885c..d680ae8a5f87 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -899,8 +899,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
{
struct uvc_fh *handle = fh;
struct uvc_video_chain *chain = handle->chain;
+ char *buf;
int ret;
- u8 i;
if (chain->selector == NULL ||
(chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
@@ -908,13 +908,18 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
return 0;
}
+ buf = kmalloc(1, GFP_KERNEL);
+
ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id,
chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
- &i, 1);
+ buf, 1);
if (ret < 0)
return ret;
- *input = i - 1;
+ *input = *buf;
+
+ kfree(buf);
+
return 0;
}
@@ -922,8 +927,8 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
{
struct uvc_fh *handle = fh;
struct uvc_video_chain *chain = handle->chain;
+ char *buf;
int ret;
- u32 i;
ret = uvc_acquire_privileges(handle);
if (ret < 0)
@@ -939,10 +944,15 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
if (input >= chain->selector->bNrInPins)
return -EINVAL;
- i = input + 1;
- return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
- chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
- &i, 1);
+ buf = kmalloc(1, GFP_KERNEL);
+
+ *buf = input + 1;
+ ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
+ chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
+ buf, 1);
+ kfree(buf);
+
+ return ret;
}
static int uvc_ioctl_queryctrl(struct file *file, void *fh,
--
2.31.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] media: uvc: don't do DMA on stack
2021-06-21 13:23 [PATCH v2] media: uvc: don't do DMA on stack Mauro Carvalho Chehab
@ 2021-06-21 13:28 ` Laurent Pinchart
0 siblings, 0 replies; 2+ messages in thread
From: Laurent Pinchart @ 2021-06-21 13:28 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: linuxarm, mauro.chehab, Mauro Carvalho Chehab, linux-kernel,
linux-media, stable
Hi Mauro,
Thank you for the patch.
On Mon, Jun 21, 2021 at 03:23:35PM +0200, Mauro Carvalho Chehab wrote:
> As warned by smatch:
> drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i)
> drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)
>
> those two functions call uvc_query_ctrl passing a pointer to
> a data at the DMA stack. those are used to send URBs via
> usb_control_msg(). Using DMA stack is not supported and should
> not work anymore on modern Linux versions.
>
> So, use a temporary buffer, allocated together with
> struct uvc_video_chain.
The second part of the sentence isn't correct anymore.
> Cc: stable@vger.kernel.org # Kernel 4.9 and upper
> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> ---
> drivers/media/usb/uvc/uvc_v4l2.c | 26 ++++++++++++++++++--------
> 1 file changed, 18 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
> index 252136cc885c..d680ae8a5f87 100644
> --- a/drivers/media/usb/uvc/uvc_v4l2.c
> +++ b/drivers/media/usb/uvc/uvc_v4l2.c
> @@ -899,8 +899,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
> {
> struct uvc_fh *handle = fh;
> struct uvc_video_chain *chain = handle->chain;
> + char *buf;
I'd make this
u8 *buf;
as the selector value is unsigned.
> int ret;
> - u8 i;
>
> if (chain->selector == NULL ||
> (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
> @@ -908,13 +908,18 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
> return 0;
> }
>
> + buf = kmalloc(1, GFP_KERNEL);
MIssing error check.
> +
> ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id,
> chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
> - &i, 1);
> + buf, 1);
> if (ret < 0)
> return ret;
>
> - *input = i - 1;
> + *input = *buf;
> +
> + kfree(buf);
> +
> return 0;
> }
>
> @@ -922,8 +927,8 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
> {
> struct uvc_fh *handle = fh;
> struct uvc_video_chain *chain = handle->chain;
> + char *buf;
u8 * here too.
> int ret;
> - u32 i;
>
> ret = uvc_acquire_privileges(handle);
> if (ret < 0)
> @@ -939,10 +944,15 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
> if (input >= chain->selector->bNrInPins)
> return -EINVAL;
>
> - i = input + 1;
> - return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
> - chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
> - &i, 1);
> + buf = kmalloc(1, GFP_KERNEL);
And missing error check.
> +
> + *buf = input + 1;
> + ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
> + chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
> + buf, 1);
> + kfree(buf);
> +
> + return ret;
> }
>
> static int uvc_ioctl_queryctrl(struct file *file, void *fh,
--
Regards,
Laurent Pinchart
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-06-21 13:28 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-21 13:23 [PATCH v2] media: uvc: don't do DMA on stack Mauro Carvalho Chehab
2021-06-21 13:28 ` Laurent Pinchart
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).