V4L/DVB (8352): gspca: Buffers for USB exchanges cannot be in the stack.

gspca:    Protect dq_callback() against simultaneous USB exchanges.
          Temporary buffer for USB exchanges added in the device struct.
(all)     Use a temporary buffer for all USB exchanges.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 85 insertions, 73 deletions

diff --git a/drivers/media/video/gspca/mars.c b/drivers/media/video/gspca/mars.c
index 23f3dba..88c2b02 100644
--- a/drivers/media/video/gspca/mars.c
+++ b/drivers/media/video/gspca/mars.c
@@ -24,8 +24,8 @@
 #include "gspca.h"
 #include "jpeg.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA/Mars USB Camera Driver");
@@ -83,39 +83,53 @@ enum {
 	REG_HW_MI_63,
 	REG_HW_MI_64,
 	REG_HW_MI_F1 = 0xf1,
-	ATTR_TOTAL_MI_REG = 242
+	ATTR_TOTAL_MI_REG = 0xf2
 };
 
-static int pcam_reg_write(struct usb_device *dev,
-			  __u16 index, __u8 *value, int len)
+/* the bytes to write are in gspca_dev->usb_buf */
+static int reg_w(struct gspca_dev *gspca_dev,
+		 __u16 index, int len)
 {
 	int rc;
 
-	rc = usb_control_msg(dev,
-			 usb_sndbulkpipe(dev, 4),
+	rc = usb_control_msg(gspca_dev->dev,
+			 usb_sndbulkpipe(gspca_dev->dev, 4),
 			 0x12,
-/*		?? 0xc8 = USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_??? !? */
-			 0xc8,
+			 0xc8,		/* ?? */
 			 0,		/* value */
-			 index, value, len, 500);
+			 index, gspca_dev->usb_buf, len, 500);
 	if (rc < 0)
 		PDEBUG(D_ERR, "reg write [%02x] error %d", index, rc);
 	return rc;
 }
 
-static void MISensor_BulkWrite(struct usb_device *dev,
-				unsigned short *pch,
-				char Address)
+static int reg_w_buf(struct gspca_dev *gspca_dev,
+			__u16 index, __u8 *buf, int len)
 {
-	__u8 data[6];
+	int rc;
+
+	rc = usb_control_msg(gspca_dev->dev,
+			 usb_sndbulkpipe(gspca_dev->dev, 4),
+			 0x12,
+			 0xc8,		/* ?? */
+			 0,		/* value */
+			 index, buf, len, 500);
+	if (rc < 0)
+		PDEBUG(D_ERR, "reg write [%02x] error %d", index, rc);
+	return rc;
+}
 
-	data[0] = 0x1f;
-	data[1] = 0;			/* control byte */
-	data[2] = Address;
-	data[3] = *pch >> 8;		/* high byte */
-	data[4] = *pch;			/* low byte */
+static void bulk_w(struct gspca_dev *gspca_dev,
+		   __u16 *pch,
+		   __u16 Address)
+{
+	gspca_dev->usb_buf[0] = 0x1f;
+	gspca_dev->usb_buf[1] = 0;			/* control byte */
+	gspca_dev->usb_buf[2] = Address;
+	gspca_dev->usb_buf[3] = *pch >> 8;		/* high byte */
+	gspca_dev->usb_buf[4] = *pch;			/* low byte */
 
-	pcam_reg_write(dev, Address, data, 5);
+	reg_w(gspca_dev, Address, 5);
 }
 
 /* this function is called at probe time */
@@ -142,33 +156,30 @@ static int sd_open(struct gspca_dev *gspca_dev)
 
 static void sd_start(struct gspca_dev *gspca_dev)
 {
-	struct usb_device *dev = gspca_dev->dev;
 	int err_code;
-	__u8 data[12];
-	__u16 MI_buf[242];
+	__u8 *data;
+	__u16 *MI_buf;
 	int h_size, v_size;
 	int intpipe;
-/*	struct usb_device *dev = pcam->dev; */
-
-	memset(data, 0, sizeof data);
-	memset(MI_buf, 0, sizeof MI_buf);
 
 	PDEBUG(D_STREAM, "camera start, iface %d, alt 8", gspca_dev->iface);
-	if (usb_set_interface(dev, gspca_dev->iface, 8) < 0) {
+	if (usb_set_interface(gspca_dev->dev, gspca_dev->iface, 8) < 0) {
 		PDEBUG(D_ERR|D_STREAM, "Set packet size: set interface error");
 		return;
 	}
 
+	data = gspca_dev->usb_buf;
 	data[0] = 0x01;		/* address */
 	data[1] = 0x01;
 
-	err_code = pcam_reg_write(dev, data[0], data, 2);
+	err_code = reg_w(gspca_dev, data[0], 2);
 	if (err_code < 0)
 		return;
 
 	/*
 	   Initialize the MR97113 chip register
 	 */
+	data = kmalloc(16, GFP_KERNEL);
 	data[0] = 0x00;		/* address */
 	data[1] = 0x0c | 0x01;	/* reg 0 */
 	data[2] = 0x01;		/* reg 1 */
@@ -181,34 +192,34 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	data[6] = 4;		/* reg 5, H start */
 	data[7] = 0xc0;		/* reg 6, gamma 1.5 */
 	data[8] = 3;		/* reg 7, V start */
-/*	if(h_size == 320 ) */
+/*	if (h_size == 320 ) */
 /*		data[9]= 0x56;	 * reg 8, 24MHz, 2:1 scale down */
 /*	else */
 	data[9] = 0x52;		/* reg 8, 24MHz, no scale down */
 	data[10] = 0x5d;	/* reg 9, I2C device address
 				 *	[for PAS5101 (0x40)] [for MI (0x5d)] */
 
-	err_code = pcam_reg_write(dev, data[0], data, 11);
+	err_code = reg_w_buf(gspca_dev, data[0], data, 11);
+	kfree(data);
 	if (err_code < 0)
 		return;
 
+	data = gspca_dev->usb_buf;
 	data[0] = 0x23;		/* address */
 	data[1] = 0x09;		/* reg 35, append frame header */
 
-	err_code = pcam_reg_write(dev, data[0], data, 2);
-	if (err_code < 0) {
-		PDEBUG(D_ERR, "Register write failed");
+	err_code = reg_w(gspca_dev, data[0], 2);
+	if (err_code < 0)
 		return;
-	}
 
-	data[0] = 0x3C;		/* address */
-/*	if (pcam->width == 1280) */
+	data[0] = 0x3c;		/* address */
+/*	if (gspca_dev->width == 1280) */
 /*		data[1] = 200;	 * reg 60, pc-cam frame size
 				 *	(unit: 4KB) 800KB */
 /*	else */
 	data[1] = 50;		/* 50 reg 60, pc-cam frame size
 				 *	(unit: 4KB) 200KB */
-	err_code = pcam_reg_write(dev, data[0], data, 2);
+	err_code = reg_w(gspca_dev, data[0], 2);
 	if (err_code < 0)
 		return;
 
@@ -250,19 +261,20 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	/* auto dark-gain */
 	data[0] = 0x5e;		/* address */
 
-	err_code = pcam_reg_write(dev, data[0], data, 6);
+	err_code = reg_w(gspca_dev, data[0], 6);
 	if (err_code < 0)
 		return;
 
 	data[0] = 0x67;
 	data[1] = 0x13;		/* reg 103, first pixel B, disable sharpness */
-	err_code = pcam_reg_write(dev, data[0], data, 2);
+	err_code = reg_w(gspca_dev, data[0], 2);
 	if (err_code < 0)
 		return;
 
 	/*
 	 * initialize the value of MI sensor...
 	 */
+	MI_buf = kzalloc(ATTR_TOTAL_MI_REG * sizeof *MI_buf, GFP_KERNEL);
 	MI_buf[REG_HW_MI_1] = 0x000a;
 	MI_buf[REG_HW_MI_2] = 0x000c;
 	MI_buf[REG_HW_MI_3] = 0x0405;
@@ -304,48 +316,48 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	}
 	MI_buf[0x20] = 0x1104;
 
-	MISensor_BulkWrite(dev, MI_buf + 1, 1);
-	MISensor_BulkWrite(dev, MI_buf + 2, 2);
-	MISensor_BulkWrite(dev, MI_buf + 3, 3);
-	MISensor_BulkWrite(dev, MI_buf + 4, 4);
-	MISensor_BulkWrite(dev, MI_buf + 5, 5);
-	MISensor_BulkWrite(dev, MI_buf + 6, 6);
-	MISensor_BulkWrite(dev, MI_buf + 7, 7);
-	MISensor_BulkWrite(dev, MI_buf + 9, 9);
-	MISensor_BulkWrite(dev, MI_buf + 0x0b, 0x0b);
-	MISensor_BulkWrite(dev, MI_buf + 0x0c, 0x0c);
-	MISensor_BulkWrite(dev, MI_buf + 0x0d, 0x0d);
-	MISensor_BulkWrite(dev, MI_buf + 0x1e, 0x1e);
-	MISensor_BulkWrite(dev, MI_buf + 0x20, 0x20);
-	MISensor_BulkWrite(dev, MI_buf + 0x2b, 0x2b);
-	MISensor_BulkWrite(dev, MI_buf + 0x2c, 0x2c);
-	MISensor_BulkWrite(dev, MI_buf + 0x2d, 0x2d);
-	MISensor_BulkWrite(dev, MI_buf + 0x2e, 0x2e);
-	MISensor_BulkWrite(dev, MI_buf + 0x35, 0x35);
-	MISensor_BulkWrite(dev, MI_buf + 0x5f, 0x5f);
-	MISensor_BulkWrite(dev, MI_buf + 0x60, 0x60);
-	MISensor_BulkWrite(dev, MI_buf + 0x61, 0x61);
-	MISensor_BulkWrite(dev, MI_buf + 0x62, 0x62);
-	MISensor_BulkWrite(dev, MI_buf + 0x63, 0x63);
-	MISensor_BulkWrite(dev, MI_buf + 0x64, 0x64);
-	MISensor_BulkWrite(dev, MI_buf + 0xf1, 0xf1);
-
-	intpipe = usb_sndintpipe(dev, 0);
-	err_code = usb_clear_halt(dev, intpipe);
+	bulk_w(gspca_dev, MI_buf + 1, 1);
+	bulk_w(gspca_dev, MI_buf + 2, 2);
+	bulk_w(gspca_dev, MI_buf + 3, 3);
+	bulk_w(gspca_dev, MI_buf + 4, 4);
+	bulk_w(gspca_dev, MI_buf + 5, 5);
+	bulk_w(gspca_dev, MI_buf + 6, 6);
+	bulk_w(gspca_dev, MI_buf + 7, 7);
+	bulk_w(gspca_dev, MI_buf + 9, 9);
+	bulk_w(gspca_dev, MI_buf + 0x0b, 0x0b);
+	bulk_w(gspca_dev, MI_buf + 0x0c, 0x0c);
+	bulk_w(gspca_dev, MI_buf + 0x0d, 0x0d);
+	bulk_w(gspca_dev, MI_buf + 0x1e, 0x1e);
+	bulk_w(gspca_dev, MI_buf + 0x20, 0x20);
+	bulk_w(gspca_dev, MI_buf + 0x2b, 0x2b);
+	bulk_w(gspca_dev, MI_buf + 0x2c, 0x2c);
+	bulk_w(gspca_dev, MI_buf + 0x2d, 0x2d);
+	bulk_w(gspca_dev, MI_buf + 0x2e, 0x2e);
+	bulk_w(gspca_dev, MI_buf + 0x35, 0x35);
+	bulk_w(gspca_dev, MI_buf + 0x5f, 0x5f);
+	bulk_w(gspca_dev, MI_buf + 0x60, 0x60);
+	bulk_w(gspca_dev, MI_buf + 0x61, 0x61);
+	bulk_w(gspca_dev, MI_buf + 0x62, 0x62);
+	bulk_w(gspca_dev, MI_buf + 0x63, 0x63);
+	bulk_w(gspca_dev, MI_buf + 0x64, 0x64);
+	bulk_w(gspca_dev, MI_buf + 0xf1, 0xf1);
+	kfree(MI_buf);
+
+	intpipe = usb_sndintpipe(gspca_dev->dev, 0);
+	err_code = usb_clear_halt(gspca_dev->dev, intpipe);
 
 	data[0] = 0x00;
 	data[1] = 0x4d;		/* ISOC transfering enable... */
-	pcam_reg_write(dev, data[0], data, 2);
+	reg_w(gspca_dev, data[0], 2);
 }
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
 	int result;
-	__u8 data[2];
 
-	data[0] = 1;
-	data[1] = 0;
-	result = pcam_reg_write(gspca_dev->dev, data[0], data, 2);
+	gspca_dev->usb_buf[0] = 1;
+	gspca_dev->usb_buf[1] = 0;
+	result = reg_w(gspca_dev, gspca_dev->usb_buf[0], 2);
 	if (result < 0)
 		PDEBUG(D_ERR, "Camera Stop failed");
 }