V4L/DVB (8352): gspca: Buffers for USB exchanges cannot be in the stack.

gspca:    Protect dq_callback() against simultaneous USB exchanges.
          Temporary buffer for USB exchanges added in the device struct.
(all)     Use a temporary buffer for all USB exchanges.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 61 insertions, 54 deletions

diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index f0770ee595d8..b659bd0f788d 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -24,8 +24,8 @@
 
 #include "gspca.h"
 
-#define DRIVER_VERSION_NUMBER   KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER   KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA/SPCA561 USB Camera Driver");
@@ -177,27 +177,28 @@ static void write_vector(struct gspca_dev *gspca_dev,
         }
 }
 
-static void reg_r(struct usb_device *dev,
-                  __u16 index, __u8 *buffer, __u16 length)
+/* read 'len' bytes to gspca_dev->usb_buf */
+static void reg_r(struct gspca_dev *gspca_dev,
+                  __u16 index, __u16 length)
 {
-        usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+        usb_control_msg(gspca_dev->dev,
+                        usb_rcvctrlpipe(gspca_dev->dev, 0),
                         0,                      /* request */
                         USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                         0,                      /* value */
-                        index, buffer, length, 500);
+                        index, gspca_dev->usb_buf, length, 500);
 }
 
-static void reg_w_buf(struct usb_device *dev,
+static void reg_w_buf(struct gspca_dev *gspca_dev,
                       __u16 index, const __u8 *buffer, __u16 len)
 {
-        __u8 tmpbuf[8];
-
-        memcpy(tmpbuf, buffer, len);
-        usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+        memcpy(gspca_dev->usb_buf, buffer, len);
+        usb_control_msg(gspca_dev->dev,
+                        usb_sndctrlpipe(gspca_dev->dev, 0),
                         0,                      /* request */
                         USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                         0,                      /* value */
-                        index, tmpbuf, len, 500);
+                        index, gspca_dev->usb_buf, len, 500);
 }
 
 static void i2c_init(struct gspca_dev *gspca_dev, __u8 mode)
@@ -211,7 +212,6 @@ static void i2c_write(struct gspca_dev *gspca_dev, __u16 valeur, __u16 reg)
         int retry = 60;
         __u8 DataLow;
         __u8 DataHight;
-        __u8 Data;
 
         DataLow = valeur;
         DataHight = valeur >> 8;
@@ -219,8 +219,8 @@ static void i2c_write(struct gspca_dev *gspca_dev, __u16 valeur, __u16 reg)
         reg_w_val(gspca_dev->dev, DataLow, 0x8805);
         reg_w_val(gspca_dev->dev, DataHight, 0x8800);
         while (retry--) {
-                reg_r(gspca_dev->dev, 0x8803, &Data, 1);
-                if (!Data)
+                reg_r(gspca_dev, 0x8803, 1);
+                if (!gspca_dev->usb_buf[0])
                         break;
         }
 }
@@ -230,20 +230,21 @@ static int i2c_read(struct gspca_dev *gspca_dev, __u16 reg, __u8 mode)
         int retry = 60;
         __u8 value;
         __u8 vallsb;
-        __u8 Data;
 
         reg_w_val(gspca_dev->dev, 0x92, 0x8804);
         reg_w_val(gspca_dev->dev, reg, 0x8801);
         reg_w_val(gspca_dev->dev, (mode | 0x01), 0x8802);
         while (retry--) {
-                reg_r(gspca_dev->dev, 0x8803, &Data, 1);
-                if (!Data)
+                reg_r(gspca_dev, 0x8803, 1);
+                if (!gspca_dev->usb_buf)
                         break;
         }
         if (retry == 0)
                 return -1;
-        reg_r(gspca_dev->dev, 0x8800, &value, 1);
-        reg_r(gspca_dev->dev, 0x8805, &vallsb, 1);
+        reg_r(gspca_dev, 0x8800, 1);
+        value = gspca_dev->usb_buf[0];
+        reg_r(gspca_dev, 0x8805, 1);
+        vallsb = gspca_dev->usb_buf[0];
         return ((int) value << 8) | vallsb;
 }
 
@@ -541,7 +542,7 @@ static void sensor_mapwrite(struct gspca_dev *gspca_dev,
         while (sensormap[i][0]) {
                 usbval[0] = sensormap[i][1];
                 usbval[1] = sensormap[i][1] >> 8;
-                reg_w_buf(gspca_dev->dev, sensormap[i][0], usbval, 2);
+                reg_w_buf(gspca_dev, sensormap[i][0], usbval, 2);
                 i++;
         }
 }
@@ -559,7 +560,6 @@ static int sd_config(struct gspca_dev *gspca_dev,
                      const struct usb_device_id *id)
 {
         struct sd *sd = (struct sd *) gspca_dev;
-        struct usb_device *dev = gspca_dev->dev;
         struct cam *cam;
         __u16 vendor, product;
         __u8 data1, data2;
@@ -568,11 +568,15 @@ static int sd_config(struct gspca_dev *gspca_dev,
          * prove that we can communicate with the device.  This works, which
          * confirms at we are communicating properly and that the device
          * is a 561. */
-        reg_r(dev, 0x8104, &data1, 1);
-        reg_r(dev, 0x8105, &data2, 1);
+        reg_r(gspca_dev, 0x8104, 1);
+        data1 = gspca_dev->usb_buf[0];
+        reg_r(gspca_dev, 0x8105, 1);
+        data2 = gspca_dev->usb_buf[0];
         vendor = (data2 << 8) | data1;
-        reg_r(dev, 0x8106, &data1, 1);
-        reg_r(dev, 0x8107, &data2, 1);
+        reg_r(gspca_dev, 0x8106, 1);
+        data1 = gspca_dev->usb_buf[0];
+        reg_r(gspca_dev, 0x8107, 1);
+        data2 = gspca_dev->usb_buf[0];
         product = (data2 << 8) | data1;
         if (vendor != id->idVendor || product != id->idProduct) {
                 PDEBUG(D_PROBE, "Bad vendor / product from device");
@@ -656,8 +660,8 @@ static void setcontrast(struct gspca_dev *gspca_dev)
                 Reg8391[0] = expotimes & 0xff;  /* exposure */
                 Reg8391[1] = 0x18 | (expotimes >> 8);
                 Reg8391[2] = sd->brightness;    /* gain */
-                reg_w_buf(dev, 0x8391, Reg8391, 8);
-                reg_w_buf(dev, 0x8390, Reg8391, 8);
+                reg_w_buf(gspca_dev, 0x8391, Reg8391, 8);
+                reg_w_buf(gspca_dev, 0x8390, Reg8391, 8);
                 break;
             }
         }
@@ -714,10 +718,11 @@ static void sd_start(struct gspca_dev *gspca_dev)
                          * is sufficient to push raw frames at ~20fps */
                         reg_w_val(dev, 0x8500, mode);
                 }               /* -- qq@kuku.eu.org */
-                reg_w_buf(dev, 0x8307, Reg8307, 2);
-                reg_w_val(dev, 0x8700, Clck);   /* 0x8f 0x85 0x27 clock */
-                reg_w_val(dev, 0x8112, 0x1e | 0x20);
-                reg_w_val(dev, 0x850b, 0x03);
+                reg_w_buf(gspca_dev, 0x8307, Reg8307, 2);
+                reg_w_val(gspca_dev->dev, 0x8700, Clck);
+                                                /* 0x8f 0x85 0x27 clock */
+                reg_w_val(gspca_dev->dev, 0x8112, 0x1e | 0x20);
+                reg_w_val(gspca_dev->dev, 0x850b, 0x03);
                 setcontrast(gspca_dev);
                 break;
         }
@@ -752,10 +757,14 @@ static void setautogain(struct gspca_dev *gspca_dev)
 
         switch (sd->chip_revision) {
         case Rev072A:
-                reg_r(gspca_dev->dev, 0x8621, &Gr, 1);
-                reg_r(gspca_dev->dev, 0x8622, &R, 1);
-                reg_r(gspca_dev->dev, 0x8623, &B, 1);
-                reg_r(gspca_dev->dev, 0x8624, &Gb, 1);
+                reg_r(gspca_dev, 0x8621, 1);
+                Gr = gspca_dev->usb_buf[0];
+                reg_r(gspca_dev, 0x8622, 1);
+                R = gspca_dev->usb_buf[0];
+                reg_r(gspca_dev, 0x8623, 1);
+                B = gspca_dev->usb_buf[0];
+                reg_r(gspca_dev, 0x8624, 1);
+                Gb = gspca_dev->usb_buf[0];
                 y = (77 * R + 75 * (Gr + Gb) + 29 * B) >> 8;
                 /* u= (128*B-(43*(Gr+Gb+R))) >> 8; */
                 /* v= (128*R-(53*(Gr+Gb))-21*B) >> 8; */
@@ -867,20 +876,19 @@ static void setbrightness(struct gspca_dev *gspca_dev)
 static void getbrightness(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
-        __u8 value;
         __u16 tot;
 
         switch (sd->chip_revision) {
         case Rev072A:
                 tot = 0;
-                reg_r(gspca_dev->dev, 0x8611, &value, 1);
-                tot += value;
-                reg_r(gspca_dev->dev, 0x8612, &value, 1);
-                tot += value;
-                reg_r(gspca_dev->dev, 0x8613, &value, 1);
-                tot += value;
-                reg_r(gspca_dev->dev, 0x8614, &value, 1);
-                tot += value;
+                reg_r(gspca_dev, 0x8611, 1);
+                tot += gspca_dev->usb_buf[0];
+                reg_r(gspca_dev, 0x8612, 1);
+                tot += gspca_dev->usb_buf[0];
+                reg_r(gspca_dev, 0x8613, 1);
+                tot += gspca_dev->usb_buf[0];
+                reg_r(gspca_dev, 0x8614, 1);
+                tot += gspca_dev->usb_buf[0];
                 sd->brightness = tot >> 2;
                 break;
         default:
@@ -893,20 +901,19 @@ static void getbrightness(struct gspca_dev *gspca_dev)
 static void getcontrast(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
-        __u8 value;
         __u16 tot;
 
         switch (sd->chip_revision) {
         case Rev072A:
                 tot = 0;
-                reg_r(gspca_dev->dev, 0x8651, &value, 1);
-                tot += value;
-                reg_r(gspca_dev->dev, 0x8652, &value, 1);
-                tot += value;
-                reg_r(gspca_dev->dev, 0x8653, &value, 1);
-                tot += value;
-                reg_r(gspca_dev->dev, 0x8654, &value, 1);
-                tot += value;
+                reg_r(gspca_dev, 0x8651, 1);
+                tot += gspca_dev->usb_buf[0];
+                reg_r(gspca_dev, 0x8652, 1);
+                tot += gspca_dev->usb_buf[0];
+                reg_r(gspca_dev, 0x8653, 1);
+                tot += gspca_dev->usb_buf[0];
+                reg_r(gspca_dev, 0x8654, 1);
+                tot += gspca_dev->usb_buf[0];
                 sd->contrast = tot << 6;
                 break;
         default: