diff options
| author | Jean-Francois Moine <moinejf@free.fr> | 2008-07-14 09:38:29 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@infradead.org> | 2008-07-20 07:26:14 -0300 |
| commit | 739570bb218bb4607df1f197282561e97a98e54a (patch) | |
| tree | 25555dfe5ac873bc96866c486d6f6c1dcabf24f4 /drivers/media/video/gspca/ov519.c | |
| parent | 5b77ae7776183d733ec86727bcc34c52a336afd6 (diff) | |
V4L/DVB (8352): gspca: Buffers for USB exchanges cannot be in the stack.
gspca: Protect dq_callback() against simultaneous USB exchanges.
Temporary buffer for USB exchanges added in the device struct.
(all) Use a temporary buffer for all USB exchanges.
Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'drivers/media/video/gspca/ov519.c')
| -rw-r--r-- | drivers/media/video/gspca/ov519.c | 19 |
1 files changed, 8 insertions, 11 deletions
diff --git a/drivers/media/video/gspca/ov519.c b/drivers/media/video/gspca/ov519.c index ba245bafcd6..08d99c3b78e 100644 --- a/drivers/media/video/gspca/ov519.c +++ b/drivers/media/video/gspca/ov519.c @@ -24,8 +24,8 @@ #include "gspca.h" -#define DRIVER_VERSION_NUMBER KERNEL_VERSION(2, 1, 5) -static const char version[] = "2.1.5"; +#define DRIVER_VERSION_NUMBER KERNEL_VERSION(2, 1, 7) +static const char version[] = "2.1.7"; MODULE_AUTHOR("Jean-Francois Moine <http://moinejf.free.fr>"); MODULE_DESCRIPTION("OV519 USB Camera Driver"); @@ -282,15 +282,14 @@ static unsigned char ov7670_abs_to_sm(unsigned char v) static int reg_w(struct sd *sd, __u16 index, __u8 value) { int ret; - __u8 data; - data = value; + sd->gspca_dev.usb_buf[0] = value; ret = usb_control_msg(sd->gspca_dev.dev, usb_sndctrlpipe(sd->gspca_dev.dev, 0), 1, /* REQ_IO (ov518/519) */ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 0, index, - &data, 1, 500); + sd->gspca_dev.usb_buf, 1, 500); if (ret < 0) PDEBUG(D_ERR, "Write reg [%02x] %02x failed", index, value); return ret; @@ -301,16 +300,15 @@ static int reg_w(struct sd *sd, __u16 index, __u8 value) static int reg_r(struct sd *sd, __u16 index) { int ret; - __u8 data; ret = usb_control_msg(sd->gspca_dev.dev, usb_rcvctrlpipe(sd->gspca_dev.dev, 0), 1, /* REQ_IO */ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0, index, &data, 1, 500); + 0, index, sd->gspca_dev.usb_buf, 1, 500); if (ret >= 0) - ret = data; + ret = sd->gspca_dev.usb_buf[0]; else PDEBUG(D_ERR, "Read reg [0x%02x] failed", index); return ret; @@ -321,16 +319,15 @@ static int reg_r8(struct sd *sd, __u16 index) { int ret; - __u8 buf[8]; ret = usb_control_msg(sd->gspca_dev.dev, usb_rcvctrlpipe(sd->gspca_dev.dev, 0), 1, /* REQ_IO */ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0, index, &buf[0], 8, 500); + 0, index, sd->gspca_dev.usb_buf, 8, 500); if (ret >= 0) - ret = buf[0]; + ret = sd->gspca_dev.usb_buf[0]; else PDEBUG(D_ERR, "Read reg 8 [0x%02x] failed", index); return ret; |