| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 5 Jan 2023 12:17:44 +0100
From: Ricardo Ribalda <ribalda@...omium.org>
To: Mauro Carvalho Chehab <mchehab@...nel.org>,
Laurent Pinchart <laurent.pinchart@...asonboard.com>
Cc: Hans Verkuil <hverkuil@...all.nl>, linux-media@...r.kernel.org,
linux-kernel@...r.kernel.org,
Hans Verkuil <hans.verkuil@...co.com>,
Hans Verkuil <hverkuil-cisco@...all.nl>
Subject: Re: [PATCH v3 6/8] media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU
HI Laurent
There is a bug here as well.
When you drop "Fix power line control for Lenovo Integrated Camera"
Can you drop this as well?
Thanks!
On Tue, 3 Jan 2023 at 15:36, Ricardo Ribalda <ribalda@...omium.org> wrote:
>
> Replace the count with a mask field that lets us choose not only the max
> value, but also the minimum value and what values are valid in between.
>
> Reviewed-by: Laurent Pinchart <laurent.pinchart@...asonboard.com>
> Signed-off-by: Ricardo Ribalda <ribalda@...omium.org>
> Suggested-by: Laurent Pinchart <laurent.pinchart@...asonboard.com>
> ---
> drivers/media/usb/uvc/uvc_ctrl.c | 30 ++++++++++++++++++++----------
> drivers/media/usb/uvc/uvc_driver.c | 3 ++-
> drivers/media/usb/uvc/uvc_v4l2.c | 3 ++-
> drivers/media/usb/uvc/uvcvideo.h | 2 +-
> 4 files changed, 25 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
> index 7622c5b54b35..aa7a668f60a7 100644
> --- a/drivers/media/usb/uvc/uvc_ctrl.c
> +++ b/drivers/media/usb/uvc/uvc_ctrl.c
> @@ -6,6 +6,7 @@
> * Laurent Pinchart (laurent.pinchart@...asonboard.com)
> */
>
> +#include <linux/bitops.h>
> #include <linux/kernel.h>
> #include <linux/list.h>
> #include <linux/module.h>
> @@ -525,7 +526,7 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
> .v4l2_type = V4L2_CTRL_TYPE_MENU,
> .data_type = UVC_CTRL_DATA_TYPE_BITMASK,
> .menu_info = exposure_auto_controls,
> - .menu_count = ARRAY_SIZE(exposure_auto_controls),
> + .menu_mask = BIT_MASK(ARRAY_SIZE(exposure_auto_controls)),
This should say
.menu_mask =
GENMASK(ARRAY_SIZE(exposure_auto_controls) - 1, 0
> .slave_ids = { V4L2_CID_EXPOSURE_ABSOLUTE, },
> },
> {
> @@ -731,7 +732,7 @@ static const struct uvc_control_mapping uvc_ctrl_mappings_uvc11[] = {
> .v4l2_type = V4L2_CTRL_TYPE_MENU,
> .data_type = UVC_CTRL_DATA_TYPE_ENUM,
> .menu_info = power_line_frequency_controls,
> - .menu_count = ARRAY_SIZE(power_line_frequency_controls) - 1,
> + .menu_mask = BIT_MASK(ARRAY_SIZE(power_line_frequency_controls) - 1),
.menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ,
V4L2_CID_POWER_LINE_FREQUENCY_50HZ),
> },
> };
>
> @@ -745,7 +746,7 @@ static const struct uvc_control_mapping uvc_ctrl_mappings_uvc15[] = {
> .v4l2_type = V4L2_CTRL_TYPE_MENU,
> .data_type = UVC_CTRL_DATA_TYPE_ENUM,
> .menu_info = power_line_frequency_controls,
> - .menu_count = ARRAY_SIZE(power_line_frequency_controls),
> + .menu_mask = BIT_MASK(ARRAY_SIZE(power_line_frequency_controls)),
> },
> };
>
> @@ -975,7 +976,9 @@ static s32 __uvc_ctrl_get_value(struct uvc_control_mapping *mapping,
> const struct uvc_menu_info *menu = mapping->menu_info;
> unsigned int i;
>
> - for (i = 0; i < mapping->menu_count; ++i, ++menu) {
> + for (i = 0; BIT(i) <= mapping->menu_mask; ++i, ++menu) {
> + if (!test_bit(i, &mapping->menu_mask))
> + continue;
> if (menu->value == value) {
> value = i;
> break;
> @@ -1228,12 +1231,14 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
>
> switch (mapping->v4l2_type) {
> case V4L2_CTRL_TYPE_MENU:
> - v4l2_ctrl->minimum = 0;
> - v4l2_ctrl->maximum = mapping->menu_count - 1;
> + v4l2_ctrl->minimum = ffs(mapping->menu_mask) - 1;
> + v4l2_ctrl->maximum = fls(mapping->menu_mask) - 1;
> v4l2_ctrl->step = 1;
>
> menu = mapping->menu_info;
> - for (i = 0; i < mapping->menu_count; ++i, ++menu) {
> + for (i = 0; BIT(i) <= mapping->menu_mask; ++i, ++menu) {
> + if (!test_bit(i, &mapping->menu_mask))
> + continue;
> if (menu->value == v4l2_ctrl->default_value) {
> v4l2_ctrl->default_value = i;
> break;
> @@ -1354,7 +1359,7 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain,
> goto done;
> }
>
> - if (query_menu->index >= mapping->menu_count) {
> + if (!test_bit(query_menu->index, &mapping->menu_mask)) {
> ret = -EINVAL;
> goto done;
> }
> @@ -1868,8 +1873,13 @@ int uvc_ctrl_set(struct uvc_fh *handle,
> break;
>
> case V4L2_CTRL_TYPE_MENU:
> - if (xctrl->value < 0 || xctrl->value >= mapping->menu_count)
> + if (xctrl->value < (ffs(mapping->menu_mask) - 1) ||
> + xctrl->value > (fls(mapping->menu_mask) - 1))
> return -ERANGE;
> +
> + if (!test_bit(xctrl->value, &mapping->menu_mask))
> + return -EINVAL;
> +
> value = mapping->menu_info[xctrl->value].value;
>
> /*
> @@ -2305,7 +2315,7 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
>
> INIT_LIST_HEAD(&map->ev_subs);
>
> - size = sizeof(*mapping->menu_info) * mapping->menu_count;
> + size = sizeof(*mapping->menu_info) * fls(mapping->menu_mask);
> map->menu_info = kmemdup(mapping->menu_info, size, GFP_KERNEL);
> if (map->menu_info == NULL) {
> kfree(map->name);
> diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
> index e4bcb5011360..f9e6208c4636 100644
> --- a/drivers/media/usb/uvc/uvc_driver.c
> +++ b/drivers/media/usb/uvc/uvc_driver.c
> @@ -7,6 +7,7 @@
> */
>
> #include <linux/atomic.h>
> +#include <linux/bits.h>
> #include <linux/gpio/consumer.h>
> #include <linux/kernel.h>
> #include <linux/list.h>
> @@ -2384,7 +2385,7 @@ static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = {
> .v4l2_type = V4L2_CTRL_TYPE_MENU,
> .data_type = UVC_CTRL_DATA_TYPE_ENUM,
> .menu_info = power_line_frequency_controls_limited,
> - .menu_count = ARRAY_SIZE(power_line_frequency_controls_limited),
> + .menu_mask = BIT_MASK(ARRAY_SIZE(power_line_frequency_controls_limited)),
> };
>
> static const struct uvc_device_info uvc_ctrl_power_line_limited = {
> diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
> index 3edb54c086b2..ed2525e7e2a5 100644
> --- a/drivers/media/usb/uvc/uvc_v4l2.c
> +++ b/drivers/media/usb/uvc/uvc_v4l2.c
> @@ -6,6 +6,7 @@
> * Laurent Pinchart (laurent.pinchart@...asonboard.com)
> */
>
> +#include <linux/bits.h>
> #include <linux/compat.h>
> #include <linux/kernel.h>
> #include <linux/list.h>
> @@ -80,7 +81,7 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
> goto free_map;
> }
>
> - map->menu_count = xmap->menu_count;
> + map->menu_mask = BIT_MASK(xmap->menu_count);
> break;
>
> default:
> diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
> index a151f583cd15..f75e5864bbf7 100644
> --- a/drivers/media/usb/uvc/uvcvideo.h
> +++ b/drivers/media/usb/uvc/uvcvideo.h
> @@ -117,7 +117,7 @@ struct uvc_control_mapping {
> u32 data_type;
>
> const struct uvc_menu_info *menu_info;
> - u32 menu_count;
> + unsigned long menu_mask;
>
> u32 master_id;
> s32 master_manual;
>
> --
> 2.39.0.314.g84b9a713c41-goog-b4-0.11.0-dev-696ae
--
Ricardo Ribalda
Powered by blists - more mailing lists