summaryrefslogtreecommitdiff
path: root/drivers/media/video/gspca/spca505.c
diff options
context:
space:
mode:
authorJean-Francois Moine <moinejf@free.fr>2008-07-14 16:38:29 +0400
committerMauro Carvalho Chehab <mchehab@infradead.org>2008-07-20 14:26:14 +0400
commit739570bb218bb4607df1f197282561e97a98e54a (patch)
tree25555dfe5ac873bc96866c486d6f6c1dcabf24f4 /drivers/media/video/gspca/spca505.c
parent5b77ae7776183d733ec86727bcc34c52a336afd6 (diff)
downloadlinux-739570bb218bb4607df1f197282561e97a98e54a.tar.xz
V4L/DVB (8352): gspca: Buffers for USB exchanges cannot be in the stack.
gspca: Protect dq_callback() against simultaneous USB exchanges. Temporary buffer for USB exchanges added in the device struct. (all) Use a temporary buffer for all USB exchanges. Signed-off-by: Jean-Francois Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'drivers/media/video/gspca/spca505.c')
-rw-r--r--drivers/media/video/gspca/spca505.c24
1 files changed, 11 insertions, 13 deletions
diff --git a/drivers/media/video/gspca/spca505.c b/drivers/media/video/gspca/spca505.c
index 5d28d23b8375..ddea6e140aa8 100644
--- a/drivers/media/video/gspca/spca505.c
+++ b/drivers/media/video/gspca/spca505.c
@@ -23,8 +23,8 @@
#include "gspca.h"
-#define DRIVER_VERSION_NUMBER KERNEL_VERSION(2, 1, 5)
-static const char version[] = "2.1.5";
+#define DRIVER_VERSION_NUMBER KERNEL_VERSION(2, 1, 7)
+static const char version[] = "2.1.7";
MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
MODULE_DESCRIPTION("GSPCA/SPCA505 USB Camera Driver");
@@ -593,29 +593,27 @@ static int reg_write(struct usb_device *dev,
}
/* returns: negative is error, pos or zero is data */
-static int reg_read(struct usb_device *dev,
+static int reg_read(struct gspca_dev *gspca_dev,
__u16 reg, /* bRequest */
__u16 index, /* wIndex */
__u16 length) /* wLength (1 or 2 only) */
{
int ret;
- __u8 buf[4];
- buf[1] = 0;
- ret = usb_control_msg(dev,
- usb_rcvctrlpipe(dev, 0),
+ gspca_dev->usb_buf[1] = 0;
+ ret = usb_control_msg(gspca_dev->dev,
+ usb_rcvctrlpipe(gspca_dev->dev, 0),
reg,
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
(__u16) 0, /* value */
(__u16) index,
- buf,
- length,
+ gspca_dev->usb_buf, length,
500); /* timeout */
if (ret < 0) {
PDEBUG(D_ERR, "reg_read err %d", ret);
return -1;
}
- return (buf[1] << 8) + buf[0];
+ return (gspca_dev->usb_buf[1] << 8) + gspca_dev->usb_buf[0];
}
static int write_vector(struct gspca_dev *gspca_dev,
@@ -697,7 +695,7 @@ static int sd_open(struct gspca_dev *gspca_dev)
write_vector(gspca_dev, spca505b_open_data_ccd);
else
write_vector(gspca_dev, spca505_open_data_ccd);
- ret = reg_read(gspca_dev->dev, 6, 0x16, 2);
+ ret = reg_read(gspca_dev, 6, 0x16, 2);
if (ret < 0) {
PDEBUG(D_ERR|D_STREAM,
@@ -874,8 +872,8 @@ static void getbrightness(struct gspca_dev *gspca_dev)
struct sd *sd = (struct sd *) gspca_dev;
sd->brightness = 255
- - ((reg_read(gspca_dev->dev, 5, 0x01, 1) >> 2)
- + (reg_read(gspca_dev->dev, 5, 0x0, 1) << 6));
+ - ((reg_read(gspca_dev, 5, 0x01, 1) >> 2)
+ + (reg_read(gspca_dev, 5, 0x0, 1) << 6));
}
static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)