lkml.org 
[lkml]   [2020]   [Jan]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] media: usbtv: fix control-message timeouts
    Date
    The driver was issuing synchronous uninterruptible control requests
    without using a timeout. This could lead to the driver hanging on
    various user requests due to a malfunctioning (or malicious) device
    until the device is physically disconnected.

    The USB upper limit of five seconds per request should be more than
    enough.

    Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber")
    Fixes: c53a846c48f2 ("[media] usbtv: add video controls")
    Cc: stable <stable@vger.kernel.org> # 3.11
    Cc: Lubomir Rintel <lkundrak@v3.sk>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    ---
    drivers/media/usb/usbtv/usbtv-core.c | 2 +-
    drivers/media/usb/usbtv/usbtv-video.c | 5 +++--
    2 files changed, 4 insertions(+), 3 deletions(-)

    diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
    index 5095c380b2c1..ee9c656d121f 100644
    --- a/drivers/media/usb/usbtv/usbtv-core.c
    +++ b/drivers/media/usb/usbtv/usbtv-core.c
    @@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv, const u16 regs[][2], int size)

    ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG,
    USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    - value, index, NULL, 0, 0);
    + value, index, NULL, 0, USB_CTRL_GET_TIMEOUT);
    if (ret < 0)
    return ret;
    }
    diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
    index 3d9284a09ee5..b249f037900c 100644
    --- a/drivers/media/usb/usbtv/usbtv-video.c
    +++ b/drivers/media/usb/usbtv/usbtv-video.c
    @@ -800,7 +800,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl *ctrl)
    ret = usb_control_msg(usbtv->udev,
    usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
    USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    - 0, USBTV_BASE + 0x0244, (void *)data, 3, 0);
    + 0, USBTV_BASE + 0x0244, (void *)data, 3,
    + USB_CTRL_GET_TIMEOUT);
    if (ret < 0)
    goto error;
    }
    @@ -851,7 +852,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl *ctrl)
    ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0),
    USBTV_CONTROL_REG,
    USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    - 0, index, (void *)data, size, 0);
    + 0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT);

    error:
    if (ret < 0)
    --
    2.24.1
    \
     
     \ /
      Last update: 2020-01-13 18:19    [W:4.257 / U:1.520 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site