V4L/DVB (8195): gspca: Input buffer overwritten in spca561 + cleanup code.

spca561:  Input buffer may be changed on reg write.
(all sd): Cleanup code, 'const' added.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 103 insertions, 95 deletions

diff --git a/drivers/media/video/gspca/t613.c b/drivers/media/video/gspca/t613.c
index de43118dec7a..4e69a8e16357 100644
--- a/drivers/media/video/gspca/t613.c
+++ b/drivers/media/video/gspca/t613.c
@@ -26,13 +26,8 @@
 
 #define MODULE_NAME "t613"
 #include "gspca.h"
-#define DRIVER_VERSION_NUMBER   KERNEL_VERSION(2, 1, 3)
-static const char version[] = "2.1.3";
-
-struct control_menu_info {
-        int value;
-        char name[32];
-};
+#define DRIVER_VERSION_NUMBER   KERNEL_VERSION(2, 1, 4)
+static const char version[] = "2.1.4";
 
 #define MAX_GAMMA 0x10          /* 0 to 15 */
 
@@ -227,19 +222,16 @@ static struct ctrl sd_ctrls[] = {
         },
 };
 
-static struct control_menu_info effects_control[] = {
-        {0, "Normal"},
-        {1, "Emboss"},          /* disabled */
-        {2, "Monochrome"},
-        {3, "Sepia"},
-        {4, "Sketch"},
-        {5, "Sun Effect"},      /* disabled */
-        {6, "Negative"},
+static char *effects_control[] = {
+        "Normal",
+        "Emboss",               /* disabled */
+        "Monochrome",
+        "Sepia",
+        "Sketch",
+        "Sun Effect",           /* disabled */
+        "Negative",
 };
 
-#define NUM_EFFECTS_CONTROL \
-                        (sizeof(effects_control)/sizeof(effects_control[0]))
-
 static struct cam_mode vga_mode_t16[] = {
         {V4L2_PIX_FMT_JPEG, 160, 120, 4},
         {V4L2_PIX_FMT_JPEG, 176, 144, 3},
@@ -252,7 +244,7 @@ static struct cam_mode vga_mode_t16[] = {
 #define MAX_EFFECTS 7
 /* easily done by soft, this table could be removed,
  * i keep it here just in case */
-unsigned char effects_table[MAX_EFFECTS][6] = {
+static const __u8 effects_table[MAX_EFFECTS][6] = {
         {0xa8, 0xe8, 0xc6, 0xd2, 0xc0, 0x00},   /* Normal */
         {0xa8, 0xc8, 0xc6, 0x52, 0xc0, 0x04},   /* Repujar */
         {0xa8, 0xe8, 0xc6, 0xd2, 0xc0, 0x20},   /* Monochrome */
@@ -262,7 +254,7 @@ unsigned char effects_table[MAX_EFFECTS][6] = {
         {0xa8, 0xc8, 0xc6, 0xd2, 0xc0, 0x40},   /* Negative */
 };
 
-unsigned char gamma_table[MAX_GAMMA][34] = {
+static const __u8 gamma_table[MAX_GAMMA][34] = {
         {0x90, 0x00, 0x91, 0x3e, 0x92, 0x69, 0x93, 0x85,
          0x94, 0x95, 0x95, 0xa1, 0x96, 0xae, 0x97, 0xb9,
          0x98, 0xc2, 0x99, 0xcb, 0x9a, 0xd4, 0x9b, 0xdb,
@@ -345,7 +337,7 @@ unsigned char gamma_table[MAX_GAMMA][34] = {
          0xA0, 0xFF}
 };
 
-static __u8 tas5130a_sensor_init[][8] = {
+static const __u8 tas5130a_sensor_init[][8] = {
         {0x62, 0x08, 0x63, 0x70, 0x64, 0x1d, 0x60, 0x09},
         {0x62, 0x20, 0x63, 0x01, 0x64, 0x02, 0x60, 0x09},
         {0x62, 0x07, 0x63, 0x03, 0x64, 0x00, 0x60, 0x09},
@@ -366,22 +358,41 @@ static void t16RegRead(struct usb_device *dev,
 
 static void t16RegWrite(struct usb_device *dev,
                         __u16 value,
-                        __u16 index, __u8 *buffer, __u16 len)
+                        __u16 index,
+                        const __u8 *buffer, __u16 len)
 {
-        __u8 tmpbuf[70];
-
-#ifdef CONFIG_VIDEO_ADV_DEBUG
-        if (len > sizeof tmpbuf) {
-                PDEBUG(D_ERR|D_PACK, "reg_w: buffer overflow");
+        if (buffer == NULL) {
+                usb_control_msg(dev,
+                                usb_sndctrlpipe(dev, 0),
+                                0,
+                           USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+                                value, index,
+                                NULL, 0, 500);
                 return;
         }
-#endif
-        memcpy(tmpbuf, buffer, len);
-        usb_control_msg(dev,
-                        usb_sndctrlpipe(dev, 0),
-                        0,              /* request */
-                        USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                        value, index, tmpbuf, len, 500);
+        if (len < 16) {
+                __u8 tmpbuf[16];
+
+                memcpy(tmpbuf, buffer, len);
+                usb_control_msg(dev,
+                                usb_sndctrlpipe(dev, 0),
+                                0,
+                           USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+                                value, index,
+                                tmpbuf, len, 500);
+        } else {
+                __u8 *tmpbuf;
+
+                tmpbuf = kmalloc(len, GFP_KERNEL);
+                memcpy(tmpbuf, buffer, len);
+                usb_control_msg(dev,
+                                usb_sndctrlpipe(dev, 0),
+                                0,
+                           USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+                                value, index,
+                                tmpbuf, len, 500);
+                kfree(tmpbuf);
+        }
 }
 
 /* this function is called at probe time */
@@ -421,18 +432,18 @@ static int init_default_parameters(struct gspca_dev *gspca_dev)
         int i = 0;
         __u8 test_byte;
 
-        static unsigned char read_indexs[] =
+        static const __u8 read_indexs[] =
                 { 0x06, 0x07, 0x0a, 0x0b, 0x66, 0x80, 0x81, 0x8e, 0x8f, 0xa5,
                   0xa6, 0xa8, 0xbb, 0xbc, 0xc6, 0x00, 0x00 };
-        static unsigned char n1[6] =
+        static const __u8 n1[6] =
                         {0x08, 0x03, 0x09, 0x03, 0x12, 0x04};
-        static unsigned char n2[2] =
+        static const __u8 n2[2] =
                         {0x08, 0x00};
-        static unsigned char nset[6] =
+        static const __u8 nset[6] =
                 { 0x61, 0x68, 0x62, 0xff, 0x60, 0x07 };
-        static unsigned char n3[6] =
+        static const __u8 n3[6] =
                         {0x61, 0x68, 0x65, 0x0a, 0x60, 0x04};
-        static unsigned char n4[0x46] =
+        static const __u8 n4[0x46] =
                 {0x09, 0x01, 0x12, 0x04, 0x66, 0x8a, 0x80, 0x3c,
                  0x81, 0x22, 0x84, 0x50, 0x8a, 0x78, 0x8b, 0x68,
                  0x8c, 0x88, 0x8e, 0x33, 0x8f, 0x24, 0xaa, 0xb1,
@@ -442,40 +453,40 @@ static int init_default_parameters(struct gspca_dev *gspca_dev)
                  0x65, 0x0a, 0xbb, 0x86, 0xaf, 0x58, 0xb0, 0x68,
                  0x87, 0x40, 0x89, 0x2b, 0x8d, 0xff, 0x83, 0x40,
                  0xac, 0x84, 0xad, 0x86, 0xaf, 0x46};
-        static unsigned char nset4[18] = {
+        static const __u8 nset4[18] = {
                 0xe0, 0x60, 0xe1, 0xa8, 0xe2, 0xe0, 0xe3, 0x60, 0xe4, 0xa8,
                 0xe5, 0xe0, 0xe6, 0x60, 0xe7, 0xa8,
                 0xe8, 0xe0
         };
         /* ojo puede ser 0xe6 en vez de 0xe9 */
-        static unsigned char nset2[20] = {
+        static const __u8 nset2[20] = {
                 0xd0, 0xbb, 0xd1, 0x28, 0xd2, 0x10, 0xd3, 0x10, 0xd4, 0xbb,
                 0xd5, 0x28, 0xd6, 0x1e, 0xd7, 0x27,
                 0xd8, 0xc8, 0xd9, 0xfc
         };
-        static unsigned char missing[8] =
+        static const __u8 missing[8] =
                 { 0x87, 0x20, 0x88, 0x20, 0x89, 0x20, 0x80, 0x38 };
-        static unsigned char nset3[18] = {
+        static const __u8 nset3[18] = {
                 0xc7, 0x60, 0xc8, 0xa8, 0xc9, 0xe0, 0xca, 0x60, 0xcb, 0xa8,
                 0xcc, 0xe0, 0xcd, 0x60, 0xce, 0xa8,
                 0xcf, 0xe0
         };
-        static unsigned char nset5[4] =
+        static const __u8 nset5[4] =
                 { 0x8f, 0x24, 0xc3, 0x00 };     /* bright */
-        static unsigned char nset6[34] = {
+        static const __u8 nset6[34] = {
                 0x90, 0x00, 0x91, 0x1c, 0x92, 0x30, 0x93, 0x43, 0x94, 0x54,
                 0x95, 0x65, 0x96, 0x75, 0x97, 0x84,
                 0x98, 0x93, 0x99, 0xa1, 0x9a, 0xb0, 0x9b, 0xbd, 0x9c, 0xca,
                 0x9d, 0xd8, 0x9e, 0xe5, 0x9f, 0xf2,
                 0xa0, 0xff
         };                      /* Gamma */
-        static unsigned char nset7[4] =
+        static const __u8 nset7[4] =
                         { 0x66, 0xca, 0xa8, 0xf8 };     /* 50/60 Hz */
-        static unsigned char nset9[4] =
+        static const __u8 nset9[4] =
                         { 0x0b, 0x04, 0x0a, 0x78 };
-        static unsigned char nset8[6] =
+        static const __u8 nset8[6] =
                         { 0xa8, 0xf0, 0xc6, 0x88, 0xc0, 0x00 };
-        static unsigned char nset10[6] =
+        static const __u8 nset10[6] =
                         { 0x0c, 0x03, 0xab, 0x10, 0x81, 0x20 };
 
         t16RegWrite(dev, 0x01, 0x0000, n1, 0x06);
@@ -493,31 +504,31 @@ static int init_default_parameters(struct gspca_dev *gspca_dev)
         t16RegWrite(dev, 0x01, 0x0000, n3, 0x06);
         t16RegWrite(dev, 0x01, 0x0000, n4, 0x46);
         t16RegRead(dev, 0x0080, &test_byte, 1);
-        t16RegWrite(dev, 0x00, 0x2c80, 0x00, 0x0);
+        t16RegWrite(dev, 0x00, 0x2c80, NULL, 0x0);
         t16RegWrite(dev, 0x01, 0x0000, nset2, 0x14);
         t16RegWrite(dev, 0x01, 0x0000, nset3, 0x12);
         t16RegWrite(dev, 0x01, 0x0000, nset4, 0x12);
-        t16RegWrite(dev, 0x00, 0x3880, 0x00, 0x0);
-        t16RegWrite(dev, 0x00, 0x3880, 0x00, 0x0);
-        t16RegWrite(dev, 0x00, 0x338e, 0x00, 0x0);
+        t16RegWrite(dev, 0x00, 0x3880, NULL, 0x0);
+        t16RegWrite(dev, 0x00, 0x3880, NULL, 0x0);
+        t16RegWrite(dev, 0x00, 0x338e, NULL, 0x0);
         t16RegWrite(dev, 0x01, 0x0000, nset5, 0x04);
-        t16RegWrite(dev, 0x00, 0x00a9, 0x00, 0x0);
+        t16RegWrite(dev, 0x00, 0x00a9, NULL, 0x0);
         t16RegWrite(dev, 0x01, 0x0000, nset6, 0x22);
-        t16RegWrite(dev, 0x00, 0x86bb, 0x00, 0x0);
-        t16RegWrite(dev, 0x00, 0x4aa6, 0x00, 0x0);
+        t16RegWrite(dev, 0x00, 0x86bb, NULL, 0x0);
+        t16RegWrite(dev, 0x00, 0x4aa6, NULL, 0x0);
 
         t16RegWrite(dev, 0x01, 0x0000, missing, 0x08);
 
-        t16RegWrite(dev, 0x00, 0x2087, 0x00, 0x0);
-        t16RegWrite(dev, 0x00, 0x2088, 0x00, 0x0);
-        t16RegWrite(dev, 0x00, 0x2089, 0x00, 0x0);
+        t16RegWrite(dev, 0x00, 0x2087, NULL, 0x0);
+        t16RegWrite(dev, 0x00, 0x2088, NULL, 0x0);
+        t16RegWrite(dev, 0x00, 0x2089, NULL, 0x0);
 
         t16RegWrite(dev, 0x01, 0x0000, nset7, 0x04);
         t16RegWrite(dev, 0x01, 0x0000, nset10, 0x06);
         t16RegWrite(dev, 0x01, 0x0000, nset8, 0x06);
         t16RegWrite(dev, 0x01, 0x0000, nset9, 0x04);
 
-        t16RegWrite(dev, 0x00, 0x2880, 0x00, 0x00);
+        t16RegWrite(dev, 0x00, 0x2880, NULL, 0x00);
         t16RegWrite(dev, 0x01, 0x0000, nset2, 0x14);
         t16RegWrite(dev, 0x01, 0x0000, nset3, 0x12);
         t16RegWrite(dev, 0x01, 0x0000, nset4, 0x12);
@@ -530,7 +541,7 @@ static void setbrightness(struct gspca_dev *gspca_dev)
         struct sd *sd = (struct sd *) gspca_dev;
         struct usb_device *dev = gspca_dev->dev;
         unsigned int brightness;
-        unsigned char set6[4] = { 0x8f, 0x26, 0xc3, 0x80 };
+        __u8 set6[4] = { 0x8f, 0x26, 0xc3, 0x80 };
         brightness = sd->brightness;
 
         if (brightness < 7) {
@@ -548,7 +559,7 @@ static void setflip(struct gspca_dev *gspca_dev)
         struct sd *sd = (struct sd *) gspca_dev;
         struct usb_device *dev = gspca_dev->dev;
 
-        unsigned char flipcmd[8] =
+        __u8 flipcmd[8] =
             { 0x62, 0x07, 0x63, 0x03, 0x64, 0x00, 0x60, 0x09 };
 
         if (sd->mirror == 1)
@@ -570,9 +581,9 @@ static void seteffect(struct gspca_dev *gspca_dev)
         }
 
         if (sd->effect == 1 || sd->effect == 4)
-                t16RegWrite(dev, 0x00, 0x4aa6, 0x00, 0x00);
+                t16RegWrite(dev, 0x00, 0x4aa6, NULL, 0x00);
         else
-                t16RegWrite(dev, 0x00, 0xfaa6, 0x00, 0x00);
+                t16RegWrite(dev, 0x00, 0xfaa6, NULL, 0x00);
 }
 
 static void setwhitebalance(struct gspca_dev *gspca_dev)
@@ -580,7 +591,7 @@ static void setwhitebalance(struct gspca_dev *gspca_dev)
         struct sd *sd = (struct sd *) gspca_dev;
         struct usb_device *dev = gspca_dev->dev;
 
-        unsigned char white_balance[8] =
+        __u8 white_balance[8] =
             { 0x87, 0x20, 0x88, 0x20, 0x89, 0x20, 0x80, 0x38 };
 
         if (sd->whitebalance == 1)
@@ -613,18 +624,17 @@ static void setcontrast(struct gspca_dev *gspca_dev)
         else
                 reg_to_write = (0x00a9 + ((contrast - 7) * 0x200));
 
-        t16RegWrite(dev, 0x00, reg_to_write, 0x00, 0);
-
+        t16RegWrite(dev, 0x00, reg_to_write, NULL, 0);
 }
 
 static void setcolors(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
         struct usb_device *dev = gspca_dev->dev;
-        __u16 reg_to_write = 0x00;
+        __u16 reg_to_write;
 
         reg_to_write = 0xc0bb + sd->colors * 0x100;
-        t16RegWrite(dev, 0x00, reg_to_write, 0x00, 0);
+        t16RegWrite(dev, 0x00, reg_to_write, NULL, 0);
 }
 
 static void setgamma(struct gspca_dev *gspca_dev)
@@ -635,11 +645,11 @@ static void setsharpness(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
         struct usb_device *dev = gspca_dev->dev;
-        __u16 reg_to_write = 0x00;
+        __u16 reg_to_write;
 
         reg_to_write = 0x0aa6 + 0x1000 * sd->sharpness;
 
-        t16RegWrite(dev, 0x00, reg_to_write, 0x00, 0x00);
+        t16RegWrite(dev, 0x00, reg_to_write, NULL, 0x00);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
@@ -655,6 +665,7 @@ static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
 static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val)
 {
         struct sd *sd = (struct sd *) gspca_dev;
+
         *val = sd->brightness;
         return *val;
 }
@@ -677,7 +688,6 @@ static int sd_getwhitebalance(struct gspca_dev *gspca_dev, __s32 *val)
         return *val;
 }
 
-
 static int sd_setflip(struct gspca_dev *gspca_dev, __s32 val)
 {
         struct sd *sd = (struct sd *) gspca_dev;
@@ -811,9 +821,9 @@ static int sd_setlowlight(struct gspca_dev *gspca_dev, __s32 val)
 
         sd->autogain = val;
         if (val != 0)
-                t16RegWrite(dev, 0x00, 0xf48e, 0x00, 0);
+                t16RegWrite(dev, 0x00, 0xf48e, NULL, 0);
         else
-                t16RegWrite(dev, 0x00, 0xb48e, 0x00, 0);
+                t16RegWrite(dev, 0x00, 0xb48e, NULL, 0);
         return 0;
 }
 
@@ -831,12 +841,12 @@ static void sd_start(struct gspca_dev *gspca_dev)
         int mode;
         __u8 test_byte;
 
-        static __u8 t1[] = { 0x66, 0x00, 0xa8, 0xe8 };
+        static const __u8 t1[] = { 0x66, 0x00, 0xa8, 0xe8 };
         __u8 t2[] = { 0x07, 0x00, 0x0d, 0x60, 0x0e, 0x80 };
-        static __u8 t3[] =
+        static const __u8 t3[] =
                 { 0xb3, 0x07, 0xb4, 0x00, 0xb5, 0x88, 0xb6, 0x02, 0xb7, 0x06,
                   0xb8, 0x00, 0xb9, 0xe7, 0xba, 0x01 };
-        static __u8 t4[] = { 0x0b, 0x04, 0x0a, 0x40 };
+        static const __u8 t4[] = { 0x0b, 0x04, 0x0a, 0x40 };
 
         mode = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode]. mode;
         switch (mode) {
@@ -860,16 +870,16 @@ static void sd_start(struct gspca_dev *gspca_dev)
         t16RegWrite(dev, 0x01, 0x0000, tas5130a_sensor_init[1], 0x8);
         t16RegWrite(dev, 0x01, 0x0000, tas5130a_sensor_init[2], 0x8);
         t16RegWrite(dev, 0x01, 0x0000, tas5130a_sensor_init[3], 0x8);
-        t16RegWrite(dev, 0x00, 0x3c80, 0x00, 0x00);
+        t16RegWrite(dev, 0x00, 0x3c80, NULL, 0x00);
                 /* just in case and to keep sync with logs  (for mine) */
         t16RegWrite(dev, 0x01, 0x0000, tas5130a_sensor_init[3], 0x8);
-        t16RegWrite(dev, 0x00, 0x3c80, 0x00, 0x00);
+        t16RegWrite(dev, 0x00, 0x3c80, NULL, 0x00);
                 /* just in case and to keep sync with logs  (for mine) */
         t16RegWrite(dev, 0x01, 0x0000, t1, 4);
         t16RegWrite(dev, 0x01, 0x0000, t2, 6);
         t16RegRead(dev, 0x0012, &test_byte, 0x1);
         t16RegWrite(dev, 0x01, 0x0000, t3, 0x10);
-        t16RegWrite(dev, 0x00, 0x0013, 0x00, 0x00);
+        t16RegWrite(dev, 0x00, 0x0013, NULL, 0x00);
         t16RegWrite(dev, 0x01, 0x0000, t4, 0x4);
         /* restart on each start, just in case, sometimes regs goes wrong
          * when using controls from app */
@@ -892,11 +902,11 @@ static void sd_close(struct gspca_dev *gspca_dev)
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                         struct gspca_frame *frame,      /* target */
-                        unsigned char *data,            /* isoc packet */
+                        __u8 *data,                     /* isoc packet */
                         int len)                        /* iso packet length */
 {
         int sof = 0;
-        static unsigned char ffd9[] = { 0xff, 0xd9 };
+        static __u8 ffd9[] = { 0xff, 0xd9 };
 
         if (data[0] == 0x5a) {
                 /* Control Packet, after this came the header again,
@@ -935,27 +945,26 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 static int sd_querymenu(struct gspca_dev *gspca_dev,
                         struct v4l2_querymenu *menu)
 {
-        memset(menu->name, 0, sizeof menu->name);
-
         switch (menu->id) {
         case V4L2_CID_POWER_LINE_FREQUENCY:
                 switch (menu->index) {
                 case 1:         /* V4L2_CID_POWER_LINE_FREQUENCY_50HZ */
-                        strcpy(menu->name, "50 Hz");
+                        strcpy((char *) menu->name, "50 Hz");
                         return 0;
                 case 2:         /* V4L2_CID_POWER_LINE_FREQUENCY_60HZ */
-                        strcpy(menu->name, "60 Hz");
+                        strcpy((char *) menu->name, "60 Hz");
                         return 0;
                 }
                 break;
         case V4L2_CID_EFFECTS:
-                if (menu->index < 0 || menu->index >= NUM_EFFECTS_CONTROL)
-                        return -EINVAL;
-                strncpy((char *) menu->name,
-                        effects_control[menu->index].name, 32);
+                if ((unsigned) menu->index < ARRAY_SIZE(effects_control)) {
+                        strncpy((char *) menu->name,
+                                effects_control[menu->index], 32);
+                        return 0;
+                }
                 break;
         }
-        return 0;
+        return -EINVAL;
 }
 
 /* this function is called at open time */
@@ -966,7 +975,7 @@ static int sd_open(struct gspca_dev *gspca_dev)
 }
 
 /* sub-driver description */
-static struct sd_desc sd_desc = {
+static const struct sd_desc sd_desc = {
         .name = MODULE_NAME,
         .ctrls = sd_ctrls,
         .nctrls = ARRAY_SIZE(sd_ctrls),
@@ -982,11 +991,10 @@ static struct sd_desc sd_desc = {
 
 /* -- module initialisation -- */
 #define DVNM(name) .driver_info = (kernel_ulong_t) name
-static __devinitdata struct usb_device_id device_table[] = {
+static const __devinitdata struct usb_device_id device_table[] = {
         {USB_DEVICE(0x17a1, 0x0128), DVNM("XPX Webcam")},
         {}
 };
-
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */