lkml.org 
[lkml]   [2020]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 086/116] media: usbtv: fix control-message timeouts
    Date
    From: Johan Hovold <johan@kernel.org>

    commit 536f561d871c5781bc33d26d415685211b94032e upstream.

    The driver was issuing synchronous uninterruptible control requests
    without using a timeout. This could lead to the driver hanging on
    various user requests due to a malfunctioning (or malicious) device
    until the device is physically disconnected.

    The USB upper limit of five seconds per request should be more than
    enough.

    Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber")
    Fixes: c53a846c48f2 ("[media] usbtv: add video controls")
    Cc: stable <stable@vger.kernel.org> # 3.11
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Acked-by: Lubomir Rintel <lkundrak@v3.sk>
    Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/usb/usbtv/usbtv-core.c | 2 +-
    drivers/media/usb/usbtv/usbtv-video.c | 5 +++--
    2 files changed, 4 insertions(+), 3 deletions(-)

    --- a/drivers/media/usb/usbtv/usbtv-core.c
    +++ b/drivers/media/usb/usbtv/usbtv-core.c
    @@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv,

    ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG,
    USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    - value, index, NULL, 0, 0);
    + value, index, NULL, 0, USB_CTRL_GET_TIMEOUT);
    if (ret < 0)
    return ret;
    }
    --- a/drivers/media/usb/usbtv/usbtv-video.c
    +++ b/drivers/media/usb/usbtv/usbtv-video.c
    @@ -805,7 +805,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
    ret = usb_control_msg(usbtv->udev,
    usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
    USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    - 0, USBTV_BASE + 0x0244, (void *)data, 3, 0);
    + 0, USBTV_BASE + 0x0244, (void *)data, 3,
    + USB_CTRL_GET_TIMEOUT);
    if (ret < 0)
    goto error;
    }
    @@ -856,7 +857,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
    ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0),
    USBTV_CONTROL_REG,
    USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    - 0, index, (void *)data, size, 0);
    + 0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT);

    error:
    if (ret < 0)

    \
     
     \ /
      Last update: 2020-04-01 18:55    [W:4.449 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site