| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20210318202928.166955-14-ribalda@chromium.org>
Date: Thu, 18 Mar 2021 21:29:24 +0100
From: Ricardo Ribalda <ribalda@...omium.org>
To: Laurent Pinchart <laurent.pinchart@...asonboard.com>,
Mauro Carvalho Chehab <mchehab@...nel.org>,
Hans Verkuil <hverkuil-cisco@...all.nl>,
Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
tfiga@...omium.org
Cc: Ricardo Ribalda <ribalda@...omium.org>
Subject: [PATCH v7 13/17] media: uvcvideo: Return -EACCES to inactive controls
If a control is inactive return -EACCES to let the userspace know that
the value will not be applied automatically when the control is active
again.
Reviewed-by: Hans Verkuil <hverkuil-cisco@...all.nl>
Suggested-by: Hans Verkuil <hverkuil-cisco@...all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@...omium.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 68 ++++++++++++++++++++++----------
drivers/media/usb/uvc/uvc_v4l2.c | 11 +++++-
drivers/media/usb/uvc/uvcvideo.h | 2 +-
3 files changed, 58 insertions(+), 23 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 24fd5afc4e4f..1ec8333811bc 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1046,8 +1046,33 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id,
return 0;
}
+static bool uvc_ctrl_is_inactive(struct uvc_video_chain *chain,
+ struct uvc_control *ctrl,
+ struct uvc_control_mapping *mapping)
+{
+ struct uvc_control_mapping *master_map = NULL;
+ struct uvc_control *master_ctrl = NULL;
+ s32 val;
+ int ret;
+
+ if (!mapping->master_id)
+ return false;
+
+ __uvc_find_control(ctrl->entity, mapping->master_id, &master_map,
+ &master_ctrl, 0);
+
+ if (!master_ctrl || !(master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR))
+ return false;
+
+ ret = __uvc_ctrl_get(chain, master_ctrl, master_map, &val);
+ if (ret < 0 || val == mapping->master_manual)
+ return false;
+
+ return true;
+}
+
int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
- bool read)
+ unsigned long ioctl)
{
struct uvc_control_mapping *mapping;
struct uvc_control *ctrl;
@@ -1059,11 +1084,26 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
if (!ctrl)
return -EINVAL;
- if (!(ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR) && read)
- return -EACCES;
-
- if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR) && !read)
- return -EACCES;
+ switch (ioctl) {
+ case VIDIOC_G_CTRL:
+ case VIDIOC_G_EXT_CTRLS:
+ if (!(ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR))
+ return -EACCES;
+ break;
+ case VIDIOC_S_EXT_CTRLS:
+ case VIDIOC_S_CTRL:
+ if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR))
+ return -EACCES;
+ if (uvc_ctrl_is_inactive(chain, ctrl, mapping))
+ return -EACCES;
+ break;
+ case VIDIOC_TRY_EXT_CTRLS:
+ if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR))
+ return -EACCES;
+ break;
+ default:
+ return -EINVAL;
+ }
return 0;
}
@@ -1087,8 +1127,6 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
struct uvc_control_mapping *mapping,
struct v4l2_queryctrl *v4l2_ctrl)
{
- struct uvc_control_mapping *master_map = NULL;
- struct uvc_control *master_ctrl = NULL;
const struct uvc_menu_info *menu;
unsigned int i;
@@ -1104,18 +1142,8 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR))
v4l2_ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
- if (mapping->master_id)
- __uvc_find_control(ctrl->entity, mapping->master_id,
- &master_map, &master_ctrl, 0);
- if (master_ctrl && (master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR)) {
- s32 val;
- int ret = __uvc_ctrl_get(chain, master_ctrl, master_map, &val);
- if (ret < 0)
- return ret;
-
- if (val != mapping->master_manual)
- v4l2_ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
- }
+ if (uvc_ctrl_is_inactive(chain, ctrl, mapping))
+ v4l2_ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
if (!ctrl->cached) {
int ret = uvc_ctrl_populate_cache(chain, ctrl);
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index fbb99f3c2fb4..ddebdeb5a81b 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -999,6 +999,10 @@ static int uvc_ioctl_g_ctrl(struct file *file, void *fh,
struct v4l2_ext_control xctrl;
int ret;
+ ret = uvc_ctrl_is_accessible(chain, ctrl->id, VIDIOC_G_CTRL);
+ if (ret)
+ return ret;
+
memset(&xctrl, 0, sizeof(xctrl));
xctrl.id = ctrl->id;
@@ -1023,6 +1027,10 @@ static int uvc_ioctl_s_ctrl(struct file *file, void *fh,
struct v4l2_ext_control xctrl;
int ret;
+ ret = uvc_ctrl_is_accessible(chain, ctrl->id, VIDIOC_S_CTRL);
+ if (ret)
+ return ret;
+
memset(&xctrl, 0, sizeof(xctrl));
xctrl.id = ctrl->id;
xctrl.value = ctrl->value;
@@ -1054,8 +1062,7 @@ static int uvc_ctrl_check_access(struct uvc_video_chain *chain,
int ret = 0;
for (i = 0; i < ctrls->count; ++ctrl, ++i) {
- ret = uvc_ctrl_is_accessible(chain, ctrl->id,
- ioctl == VIDIOC_G_EXT_CTRLS);
+ ret = uvc_ctrl_is_accessible(chain, ctrl->id, ioctl);
if (ret)
break;
}
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 9471c342a310..a93aeedb5499 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -903,7 +903,7 @@ static inline int uvc_ctrl_rollback(struct uvc_fh *handle)
int uvc_ctrl_get(struct uvc_video_chain *chain, struct v4l2_ext_control *xctrl);
int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl);
int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
- bool read);
+ unsigned long ioctl);
int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
struct uvc_xu_control_query *xqry);
--
2.31.0.rc2.261.g7f71774620-goog
Powered by blists - more mailing lists