From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Stephan Lachowsky <stephan.lachowsky@maxim-ic.com>,
Mauro Carvalho Chehab <mchehab@redhat.com>
Subject: [14/23] [media] uvcvideo: Fix uvc_fixup_video_ctrl() format search
Date: Fri, 25 Mar 2011 16:55:51 -0700 [thread overview]
Message-ID: <20110325235637.914844766@clark.kroah.org> (raw)
In-Reply-To: <20110325235654.GA24416@kroah.com>
[-- Attachment #1: uvcvideo-fix-uvc_fixup_video_ctrl-format-search.patch --]
[-- Type: text/plain, Size: 1513 bytes --]
From: Stephan Lachowsky <stephan.lachowsky@maxim-ic.com>
commit 38a66824d96de8aeeb915e6f46f0d3fe55828eb1 upstream.
The scheme used to index format in uvc_fixup_video_ctrl() is not robust:
format index is based on descriptor ordering, which does not necessarily
match bFormatIndex ordering. Searching for first matching format will
prevent uvc_fixup_video_ctrl() from using the wrong format/frame to make
adjustments.
Signed-off-by: Stephan Lachowsky <stephan.lachowsky@maxim-ic.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/uvc/uvc_video.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -64,15 +64,19 @@ int uvc_query_ctrl(struct uvc_device *de
static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
struct uvc_streaming_control *ctrl)
{
- struct uvc_format *format;
+ struct uvc_format *format = NULL;
struct uvc_frame *frame = NULL;
unsigned int i;
- if (ctrl->bFormatIndex <= 0 ||
- ctrl->bFormatIndex > stream->nformats)
- return;
+ for (i = 0; i < stream->nformats; ++i) {
+ if (stream->format[i].index == ctrl->bFormatIndex) {
+ format = &stream->format[i];
+ break;
+ }
+ }
- format = &stream->format[ctrl->bFormatIndex - 1];
+ if (format == NULL)
+ return;
for (i = 0; i < format->nframes; ++i) {
if (format->frame[i].bFrameIndex == ctrl->bFrameIndex) {
next prev parent reply other threads:[~2011-03-26 0:00 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20110325235537.660072281@clark.kroah.org>
2011-03-25 23:56 ` [00/23] 2.6.32.36-longterm review Greg KH
2011-03-25 23:55 ` [01/23] aio: wake all waiters when destroying ctx Greg KH
2011-03-25 23:55 ` [02/23] shmem: let shared anonymous be nonlinear again Greg KH
2011-03-25 23:55 ` [03/23] PCI hotplug: acpiphp: set current_state to D0 in register_slot Greg KH
2011-03-25 23:55 ` [04/23] xen: set max_pfn_mapped to the last pfn mapped Greg KH
2011-03-25 23:55 ` [05/23] x86: Cleanup highmap after brk is concluded Greg KH
2011-03-25 23:55 ` [06/23] PCI: return correct value when writing to the "reset" attribute Greg KH
2011-03-25 23:55 ` [07/23] Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code Greg KH
2011-03-25 23:55 ` [08/23] ext3: skip orphan cleanup on rocompat fs Greg KH
2011-03-25 23:55 ` [09/23] procfs: fix /proc/<pid>/maps heap check Greg KH
2011-03-25 23:55 ` [10/23] proc: protect mm start_code/end_code in /proc/pid/stat Greg KH
2011-03-25 23:55 ` [11/23] fbcon: Bugfix soft cursor detection in Tile Blitting Greg KH
2011-03-25 23:55 ` [12/23] nfsd41: modify the members value of nfsd4_op_flags Greg KH
2011-03-25 23:55 ` [13/23] nfsd: wrong index used in inner loop Greg KH
2011-03-25 23:55 ` Greg KH [this message]
2011-03-25 23:55 ` [15/23] ehci-hcd: Bug fix: dont set a QHs Halt bit Greg KH
2011-03-25 23:55 ` [16/23] USB: uss720 fixup refcount position Greg KH
2011-03-25 23:55 ` [17/23] USB: cdc-acm: fix memory corruption / panic Greg KH
2011-03-25 23:55 ` [18/23] USB: cdc-acm: fix potential null-pointer dereference Greg KH
2011-03-25 23:55 ` [19/23] USB: cdc-acm: fix potential null-pointer dereference on disconnect Greg KH
2011-03-25 23:55 ` [20/23] Input: xen-kbdfront - advertise either absolute or relative coordinates Greg KH
2011-03-25 23:55 ` [21/23] SUNRPC: Never reuse the socket port after an xs_close() Greg KH
2011-03-25 23:55 ` [22/23] fs: call security_d_instantiate in d_obtain_alias V2 Greg KH
2011-03-25 23:56 ` [23/23] dcdbas: force SMI to happen when expected Greg KH
2011-03-26 0:50 ` [00/23] 2.6.32.36-longterm review Teck Choon Giam
2011-03-26 4:51 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110325235637.914844766@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@redhat.com \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=stephan.lachowsky@maxim-ic.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®