V4L/DVB (8352): gspca: Buffers for USB exchanges cannot be in the stack.

gspca:    Protect dq_callback() against simultaneous USB exchanges.
          Temporary buffer for USB exchanges added in the device struct.
(all)     Use a temporary buffer for all USB exchanges.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 40 insertions, 41 deletions

diff --git a/drivers/media/video/gspca/vc032x.c b/drivers/media/video/gspca/vc032x.c
index 668e024aaa8f..dd7c1389f38d 100644
--- a/drivers/media/video/gspca/vc032x.c
+++ b/drivers/media/video/gspca/vc032x.c
@@ -1227,17 +1227,18 @@ static const struct sensor_info sensor_info_data[] = {
 	{SENSOR_MI1310_SOC, 0x80 | 0x5d, 0x00, 0x143a, 0x24, 0x25, 0x01},
 };
 
-static void reg_r(struct usb_device *dev,
-			   __u16 req,
-			   __u16 index,
-			   __u8 *buffer, __u16 length)
+/* read 'len' bytes in gspca_dev->usb_buf */
+static void reg_r(struct gspca_dev *gspca_dev,
+		  __u16 req,
+		  __u16 index,
+		  __u16 len)
 {
-	usb_control_msg(dev,
-			usb_rcvctrlpipe(dev, 0),
+	usb_control_msg(gspca_dev->dev,
+			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			req,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			1,			/* value */
-			index, buffer, length,
+			index, gspca_dev->usb_buf, len,
 			500);
 }
 
@@ -1254,55 +1255,55 @@ static void reg_w(struct usb_device *dev,
 			500);
 }
 
-static void vc032x_read_sensor_register(struct usb_device *dev,
+static void read_sensor_register(struct gspca_dev *gspca_dev,
 				__u16 address, __u16 *value)
 {
+	struct usb_device *dev = gspca_dev->dev;
 	__u8 ldata, mdata, hdata;
-	__u8 tmpvalue = 0;
 	int retry = 50;
-	ldata = 0;
-	mdata = 0;
-	hdata = 0;
+
 	*value = 0;
 
-	reg_r(dev, 0xa1, 0xb33f, &tmpvalue, 1);
+	reg_r(gspca_dev, 0xa1, 0xb33f, 1);
 	/*PDEBUG(D_PROBE, " I2c Bus Busy Wait  0x%02X ", tmpvalue); */
-	if (!(tmpvalue & 0x02)) {
-		PDEBUG(D_ERR, "I2c Bus Busy Wait %d", tmpvalue & 0x02);
+	if (!(gspca_dev->usb_buf[0] & 0x02)) {
+		PDEBUG(D_ERR, "I2c Bus Busy Wait %d",
+			gspca_dev->usb_buf[0] & 0x02);
 		return;
 	}
 	reg_w(dev, 0xa0, address, 0xb33a);
 	reg_w(dev, 0xa0, 0x02, 0xb339);
 
-	tmpvalue = 0;
-	reg_r(dev, 0xa1, 0xb33b, &tmpvalue, 1);
-	while (retry-- && tmpvalue) {
-		reg_r(dev, 0xa1, 0xb33b, &tmpvalue, 1);
+	reg_r(gspca_dev, 0xa1, 0xb33b, 1);
+	while (retry-- && gspca_dev->usb_buf[0]) {
+		reg_r(gspca_dev, 0xa1, 0xb33b, 1);
 /*		PDEBUG(D_PROBE, "Read again 0xb33b %d", tmpvalue); */
 		msleep(1);
 	}
-	reg_r(dev, 0xa1, 0xb33e, &hdata, 1);
-	reg_r(dev, 0xa1, 0xb33d, &mdata, 1);
-	reg_r(dev, 0xa1, 0xb33c, &ldata, 1);
+	reg_r(gspca_dev, 0xa1, 0xb33e, 1);
+	hdata = gspca_dev->usb_buf[0];
+	reg_r(gspca_dev, 0xa1, 0xb33d, 1);
+	mdata = gspca_dev->usb_buf[0];
+	reg_r(gspca_dev, 0xa1, 0xb33c, 1);
+	ldata = gspca_dev->usb_buf[0];
 	PDEBUG(D_PROBE, "Read Sensor h (0x%02X) m (0x%02X) l (0x%02X)",
 		hdata, mdata, ldata);
-	tmpvalue = 0;
-	reg_r(dev, 0xa1, 0xb334, &tmpvalue, 1);
-	if (tmpvalue == 0x02)
+	reg_r(gspca_dev, 0xa1, 0xb334, 1);
+	if (gspca_dev->usb_buf[0] == 0x02)
 		*value = (ldata << 8) + mdata;
 	else
 		*value = ldata;
 }
+
 static int vc032x_probe_sensor(struct gspca_dev *gspca_dev)
 {
 	struct usb_device *dev = gspca_dev->dev;
 	int i;
-	__u8 data;
 	__u16 value;
 	const struct sensor_info *ptsensor_info;
 
-	reg_r(dev, 0xa1, 0xbfcf, &data, 1);
-	PDEBUG(D_PROBE, "check sensor header %d", data);
+	reg_r(gspca_dev, 0xa1, 0xbfcf, 1);
+	PDEBUG(D_PROBE, "check sensor header %d", gspca_dev->usb_buf[0]);
 	for (i = 0; i < ARRAY_SIZE(sensor_info_data); i++) {
 		ptsensor_info = &sensor_info_data[i];
 		reg_w(dev, 0xa0, 0x02, 0xb334);
@@ -1315,7 +1316,7 @@ static int vc032x_probe_sensor(struct gspca_dev *gspca_dev)
 			"check sensor VC032X -> %d Add -> ox%02X!",
 			i, ptsensor_info->I2cAdd); */
 		reg_w(dev, 0xa0, ptsensor_info->op, 0xb301);
-		vc032x_read_sensor_register(dev, ptsensor_info->IdAdd, &value);
+		read_sensor_register(gspca_dev, ptsensor_info->IdAdd, &value);
 		if (value == ptsensor_info->VpId) {
 /*			PDEBUG(D_PROBE, "find sensor VC032X -> ox%04X!",
 				ptsensor_info->VpId); */
@@ -1325,14 +1326,14 @@ static int vc032x_probe_sensor(struct gspca_dev *gspca_dev)
 	return -1;
 }
 
-static __u8 i2c_write(struct usb_device *dev,
+static __u8 i2c_write(struct gspca_dev *gspca_dev,
 			__u8 reg, const __u8 *val, __u8 size)
 {
-	__u8 retbyte;
+	struct usb_device *dev = gspca_dev->dev;
 
 	if (size > 3 || size < 1)
 		return -EINVAL;
-	reg_r(dev, 0xa1, 0xb33f, &retbyte, 1);
+	reg_r(gspca_dev, 0xa1, 0xb33f, 1);
 	reg_w(dev, 0xa0, size, 0xb334);
 	reg_w(dev, 0xa0, reg, 0xb33a);
 	switch (size) {
@@ -1353,8 +1354,8 @@ static __u8 i2c_write(struct usb_device *dev,
 		return -EINVAL;
 	}
 	reg_w(dev, 0xa0, 0x01, 0xb339);
-	reg_r(dev, 0xa1, 0xb33b, &retbyte, 1);
-	return retbyte == 0;
+	reg_r(gspca_dev, 0xa1, 0xb33b, 1);
+	return gspca_dev->usb_buf[0] == 0;
 }
 
 static void put_tab_to_reg(struct gspca_dev *gspca_dev,
@@ -1382,10 +1383,10 @@ static void usb_exchange(struct gspca_dev *gspca_dev,
 					((data[i][0])<<8) | data[i][1]);
 			break;
 		case 0xaa:			/* i2c op */
-			i2c_write(dev, data[i][1], &data[i][2], 1);
+			i2c_write(gspca_dev, data[i][1], &data[i][2], 1);
 			break;
 		case 0xbb:			/* i2c op */
-			i2c_write(dev, data[i][0], &data[i][1], 2);
+			i2c_write(gspca_dev, data[i][0], &data[i][1], 2);
 			break;
 		case 0xdd:
 			msleep(data[i][2] + 10);
@@ -1417,7 +1418,6 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct usb_device *dev = gspca_dev->dev;
 	struct cam *cam;
-	__u8 tmp2[4];
 	int sensor;
 	__u16 product;
 
@@ -1488,10 +1488,10 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	sd->lightfreq = FREQ_DEF;
 
 	if (sd->bridge == BRIDGE_VC0321) {
-		reg_r(dev, 0x8a, 0, tmp2, 3);
+		reg_r(gspca_dev, 0x8a, 0, 3);
 		reg_w(dev, 0x87, 0x00, 0x0f0f);
 
-		reg_r(dev, 0x8b, 0, tmp2, 3);
+		reg_r(gspca_dev, 0x8b, 0, 3);
 		reg_w(dev, 0x88, 0x00, 0x0202);
 	}
 	return 0;
@@ -1525,7 +1525,6 @@ static void setlightfreq(struct gspca_dev *gspca_dev)
 static void sd_start(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-/*	__u8 tmp2; */
 	const __u8 *GammaT = NULL;
 	const __u8 *MatrixT = NULL;
 	int mode;
@@ -1627,7 +1626,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
 		reg_w(gspca_dev->dev, 0xa0, 0x40, 0xb824);
 		*/
 		/* Only works for HV7131R ??
-		reg_r (gspca_dev->dev, 0xa1, 0xb881, &tmp2, 1);
+		reg_r (gspca_dev, 0xa1, 0xb881, 1);
 		reg_w(gspca_dev->dev, 0xa0, 0xfe01, 0xb881);
 		reg_w(gspca_dev->dev, 0xa0, 0x79, 0xb801);
 		*/