kernel/linux.git/drivers/usb/gadget/function/uvc_queue.c, branch v5.10.257

usb: gadget: uvc: Fix crash when encoding data for usb request

2022-05-09T07:04:58+00:00

commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream. During the uvcg_video_pump() process, if an error occurs and uvcg_queue_cancel() is called, the buffer queue will be cleared out, but the current marker (queue->buf_used) of the active buffer (no longer active) is not reset. On the next iteration of uvcg_video_pump() the stale buf_used count will be used and the logic of min((unsigned int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a nbytes size, causing an invalid memory access. [80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. [80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. ... uvcg_queue_cancel() is called and the queue is cleared out, but the marker queue->buf_used is not reset. ... [80802.262328][ T8682] Unable to handle kernel paging request at virtual address ffffffc03af9f000 ... ... [80802.263138][ T8682] Call trace: [80802.263146][ T8682] __memcpy+0x12c/0x180 [80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0 [80802.263165][ T8682] process_one_work+0x2cc/0x568 [80802.263173][ T8682] worker_thread+0x28c/0x518 [80802.263181][ T8682] kthread+0x160/0x170 [80802.263188][ T8682] ret_from_fork+0x10/0x18 [80802.263198][ T8682] Code: a8c12829 a88130cb a8c130 Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework") Cc: Signed-off-by: Dan Vacura Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: uvc: constify vb2_ops structure

2018-11-26T07:06:32+00:00

The vb2_ops structure can be const as it is only stored in the ops field of a vb2_queue structure and this field is const. Done with the help of Coccinelle. Reviewed-by: Laurent Pinchart Signed-off-by: Julia Lawall Signed-off-by: Felipe Balbi

media: videobuf2-v4l2: integrate with media requests

2018-08-31T15:19:30+00:00

This implements the V4L2 part of the request support. The main change is that vb2_qbuf and vb2_prepare_buf now have a new media_device pointer. This required changes to several drivers that did not use the vb2_ioctl_qbuf/prepare_buf helper functions. Signed-off-by: Hans Verkuil Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Mauro Carvalho Chehab

media: annotate ->poll() instances

2017-11-27T21:20:06+00:00

Signed-off-by: Al Viro

USB: gadget: function: Remove redundant license text

2017-11-07T14:45:02+00:00

Now that the SPDX tag is in all USB files, that identifies the license in a specific and legally-defined manner. So the extra GPL text wording can be removed as it is no longer needed at all. This is done on a quest to remove the 700+ different ways that files in the kernel describe the GPL license text. And there's unneeded stuff like the address (sometimes incorrect) for the FSF which is never needed. No copyright headers or other non-license-description text was removed. Cc: Oliver Neukum Cc: Johan Hovold Cc: Jerry Zhang Cc: John Keeping Cc: Krzysztof Opasiak Cc: Abdulhadi Mohamed Cc: Matthew Wilcox Cc: Janusz Dziedzic Acked-by: Felipe Balbi Acked-by: Michal Nazarewicz Acked-by: Laurent Pinchart Acked-by: Vincent Pelletier Signed-off-by: Greg Kroah-Hartman

USB: add SPDX identifiers to all remaining files in drivers/usb/

2017-11-04T10:48:02+00:00

It's good to have SPDX identifiers in all files to make it easier to audit the kernel tree for correct licenses. Update the drivers/usb/ and include/linux/usb* files with the correct SPDX license identifier based on the license text in the file itself. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This work is based on a script and data from Thomas Gleixner, Philippe Ombredanne, and Kate Stewart. Cc: Thomas Gleixner Cc: Kate Stewart Cc: Philippe Ombredanne Signed-off-by: Greg Kroah-Hartman Acked-by: Felipe Balbi Acked-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

[media] vb2: replace void alloc_ctxs by struct device alloc_devs

2016-07-08T17:45:07+00:00

Make this a proper typed array. Drop the old allocate context code since that is no longer used. Note that the memops functions now get a struct device pointer instead of the struct device ** that was there initially (actually a void pointer to a struct containing only a struct device pointer). This code is now a lot cleaner. Signed-off-by: Hans Verkuil Reviewed-by: Laurent Pinchart Cc: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab

[media] media: videobuf2: Move timestamp to vb2_buffer

2015-12-18T15:53:31+00:00

Move timestamp from struct vb2_v4l2_buffer to struct vb2_buffer for common use, and change its type to u64 in order to handling y2038 problem. This patch also includes all device drivers' changes related to this restructuring. Signed-off-by: Junghak Sung Signed-off-by: Geunyoung Kim Acked-by: Seung-Woo Kim Acked-by: Inki Dae Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] vb2: drop v4l2_format argument from queue_setup

2015-12-18T15:48:19+00:00

The queue_setup callback has a void pointer that is just for V4L2 and is the pointer to the v4l2_format struct that was passed to VIDIOC_CREATE_BUFS. The idea was that drivers would use the information from that struct to buffers suitable for the requested format. After the vb2 split series this pointer is now a void pointer, which is ugly, and the reality is that all existing drivers will effectively just look at the sizeimage field of v4l2_format. To make this more generic the queue_setup callback is changed: the void pointer is dropped, instead if the *num_planes argument is 0, then use the current format size, if it is non-zero, then it contains the number of requested planes and the sizes array contains the requested sizes. If either is unsupported, then return -EINVAL, otherwise use the requested size(s). Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] media: videobuf2: Change queue_setup argument

2015-10-20T16:48:39+00:00

Replace struct v4l2_format * with void * to make queue_setup() for common use. And then, modify all device drivers related with this change. Signed-off-by: Junghak Sung Signed-off-by: Geunyoung Kim Acked-by: Seung-Woo Kim Acked-by: Inki Dae Signed-off-by: Hans Verkuil [hans.verkuil@cisco.com: fix missing const in fimc-lite.c] Signed-off-by: Mauro Carvalho Chehab