diff options
| author | Jean-Francois Moine <moinejf@free.fr> | 2008-07-14 11:38:29 +0200 |
|---|---|---|
| committer | Jean-Francois Moine <moinejf@free.fr> | 2008-07-14 11:38:29 +0200 |
| commit | 3e6fb557cb5a96fa415ec4ea6b141d22fb948b12 (patch) | |
| tree | ccf89defd2dffa588a46348ccfbf56da9fd42d06 /linux/drivers/media/video/gspca/spca505.c | |
| parent | 5d9abf072da54a382d318a6a23bc4d65d1c9f6a7 (diff) | |
| download | mediapointer-dvb-s2-3e6fb557cb5a96fa415ec4ea6b141d22fb948b12.tar.gz mediapointer-dvb-s2-3e6fb557cb5a96fa415ec4ea6b141d22fb948b12.tar.bz2 | |
gspca: Buffers for USB exchanges cannot be in the stack.
From: Jean-Francois Moine <moinejf@free.fr>
gspca: Protect dq_callback() against simultaneous USB exchanges.
Temporary buffer for USB exchanges added in the device struct.
(all) Use a temporary buffer for all USB exchanges.
Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Diffstat (limited to 'linux/drivers/media/video/gspca/spca505.c')
| -rw-r--r-- | linux/drivers/media/video/gspca/spca505.c | 24 |
1 files changed, 11 insertions, 13 deletions
diff --git a/linux/drivers/media/video/gspca/spca505.c b/linux/drivers/media/video/gspca/spca505.c index cecbc4362..f8c46e571 100644 --- a/linux/drivers/media/video/gspca/spca505.c +++ b/linux/drivers/media/video/gspca/spca505.c @@ -23,8 +23,8 @@ #include "gspca.h" -#define DRIVER_VERSION_NUMBER KERNEL_VERSION(2, 1, 5) -static const char version[] = "2.1.5"; +#define DRIVER_VERSION_NUMBER KERNEL_VERSION(2, 1, 7) +static const char version[] = "2.1.7"; MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>"); MODULE_DESCRIPTION("GSPCA/SPCA505 USB Camera Driver"); @@ -662,29 +662,27 @@ static int reg_write(struct usb_device *dev, } /* returns: negative is error, pos or zero is data */ -static int reg_read(struct usb_device *dev, +static int reg_read(struct gspca_dev *gspca_dev, __u16 reg, /* bRequest */ __u16 index, /* wIndex */ __u16 length) /* wLength (1 or 2 only) */ { int ret; - __u8 buf[4]; - buf[1] = 0; - ret = usb_control_msg(dev, - usb_rcvctrlpipe(dev, 0), + gspca_dev->usb_buf[1] = 0; + ret = usb_control_msg(gspca_dev->dev, + usb_rcvctrlpipe(gspca_dev->dev, 0), reg, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, (__u16) 0, /* value */ (__u16) index, - buf, - length, + gspca_dev->usb_buf, length, 500); /* timeout */ if (ret < 0) { PDEBUG(D_ERR, "reg_read err %d", ret); return -1; } - return (buf[1] << 8) + buf[0]; + return (gspca_dev->usb_buf[1] << 8) + gspca_dev->usb_buf[0]; } static int write_vector(struct gspca_dev *gspca_dev, @@ -766,7 +764,7 @@ static int sd_open(struct gspca_dev *gspca_dev) write_vector(gspca_dev, spca505b_open_data_ccd); else write_vector(gspca_dev, spca505_open_data_ccd); - ret = reg_read(gspca_dev->dev, 6, 0x16, 2); + ret = reg_read(gspca_dev, 6, 0x16, 2); if (ret < 0) { PDEBUG(D_ERR|D_STREAM, @@ -943,8 +941,8 @@ static void getbrightness(struct gspca_dev *gspca_dev) struct sd *sd = (struct sd *) gspca_dev; sd->brightness = 255 - - ((reg_read(gspca_dev->dev, 5, 0x01, 1) >> 2) - + (reg_read(gspca_dev->dev, 5, 0x0, 1) << 6)); + - ((reg_read(gspca_dev, 5, 0x01, 1) >> 2) + + (reg_read(gspca_dev, 5, 0x0, 1) << 6)); } static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val) |