From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
To: unlisted-recipients:; (no To-header on input)
Cc: linuxarm@huawei.com, mauro.chehab@huawei.com,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
linux-kernel@vger.kernel.org, linux-media@vger.kernel.org
Subject: [PATCH 2/5] media: uvc: don't do DMA on stack
Date: Mon, 21 Jun 2021 13:56:46 +0200 [thread overview]
Message-ID: <d9d3b95daf726f3d4dc09477b1f61669763e301a.1624276138.git.mchehab+huawei@kernel.org> (raw)
In-Reply-To: <cover.1624276137.git.mchehab+huawei@kernel.org>
As warned by smatch:
drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i)
drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)
those two functions call uvc_query_ctrl passing a pointer to
a data at the DMA stack. those are used to send URBs via
usb_control_msg(). Using DMA stack is not supported and should
not work anymore on modern Linux versions.
So, use a temporary buffer, allocated together with
struct uvc_video_chain.
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
---
drivers/media/usb/uvc/uvc_v4l2.c | 10 ++++------
drivers/media/usb/uvc/uvcvideo.h | 3 +++
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 252136cc885c..e60d4675881a 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -900,7 +900,6 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
struct uvc_fh *handle = fh;
struct uvc_video_chain *chain = handle->chain;
int ret;
- u8 i;
if (chain->selector == NULL ||
(chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
@@ -910,11 +909,11 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id,
chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
- &i, 1);
+ &chain->input, 1);
if (ret < 0)
return ret;
- *input = i - 1;
+ *input = chain->input - 1;
return 0;
}
@@ -923,7 +922,6 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
struct uvc_fh *handle = fh;
struct uvc_video_chain *chain = handle->chain;
int ret;
- u32 i;
ret = uvc_acquire_privileges(handle);
if (ret < 0)
@@ -939,10 +937,10 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
if (input >= chain->selector->bNrInPins)
return -EINVAL;
- i = input + 1;
+ chain->input = input + 1;
return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
- &i, 1);
+ &chain->input, 1);
}
static int uvc_ioctl_queryctrl(struct file *file, void *fh,
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index cce5e38133cd..3c0ed90d6912 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -475,6 +475,9 @@ struct uvc_video_chain {
struct mutex ctrl_mutex; /* Protects ctrl.info */
struct v4l2_prio_state prio; /* V4L2 priority state */
+
+ u8 input; /* buffer for set/get input */
+
u32 caps; /* V4L2 chain-wide caps */
};
--
2.31.1
next prev parent reply other threads:[~2021-06-21 11:57 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-21 11:56 [PATCH 0/5] some smatch fixes Mauro Carvalho Chehab
2021-06-21 11:56 ` [PATCH 1/5] media: dib8000: rewrite the init prbs logic Mauro Carvalho Chehab
2021-06-21 11:56 ` Mauro Carvalho Chehab [this message]
2021-06-21 12:09 ` [PATCH 2/5] media: uvc: don't do DMA on stack Laurent Pinchart
2021-06-21 11:56 ` [PATCH 3/5] media: v4l2-flash-led-class: drop an useless check Mauro Carvalho Chehab
2021-06-24 9:31 ` Sakari Ailus
2021-06-24 9:59 ` Mauro Carvalho Chehab
2021-06-24 10:14 ` Sakari Ailus
2021-06-24 11:12 ` Sakari Ailus
2021-06-24 11:32 ` Mauro Carvalho Chehab
2021-06-24 11:37 ` Sakari Ailus
2021-06-21 11:56 ` [PATCH 4/5] media: ivtv: prevent going past the hw arrays Mauro Carvalho Chehab
2021-06-21 15:24 ` Hans Verkuil
2021-06-21 11:56 ` [PATCH 5/5] media: sti: don't copy past the size Mauro Carvalho Chehab
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d9d3b95daf726f3d4dc09477b1f61669763e301a.1624276138.git.mchehab+huawei@kernel.org \
--to=mchehab+huawei@kernel.org \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linuxarm@huawei.com \
--cc=mauro.chehab@huawei.com \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).