media: uvc: don't do DMA on stack

commit 1a10d7fdb6d0e235e9d230916244cc2769d3f170 upstream.

As warned by smatch:
	drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i)
	drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)

those two functions call uvc_query_ctrl passing a pointer to
a data at the DMA stack. those are used to send URBs via
usb_control_msg(). Using DMA stack is not supported and should
not work anymore on modern Linux versions.

So, use a kmalloc'ed buffer.

Cc: stable@vger.kernel.org	# Kernel 4.9 and upper
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 6a19cf94705b12ad2da6d2116661fb5f6a50375f..4a270f88aa18c5c98db4d1238f591e4f5bb0f743 100644 (file)
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -881,8 +881,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
 {
        struct uvc_fh *handle = fh;
        struct uvc_video_chain *chain = handle->chain;
+       u8 *buf;
        int ret;
-       u8 i;
 
        if (chain->selector == NULL ||
            (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
@@ -890,22 +890,27 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
                return 0;
        }
 
+       buf = kmalloc(1, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+
        ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id,
                             chain->dev->intfnum,  UVC_SU_INPUT_SELECT_CONTROL,
-                            &i, 1);
-       if (ret < 0)
-               return ret;
+                            buf, 1);
+       if (!ret)
+               *input = *buf - 1;
 
-       *input = i - 1;
-       return 0;
+       kfree(buf);
+
+       return ret;
 }
 
 static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
 {
        struct uvc_fh *handle = fh;
        struct uvc_video_chain *chain = handle->chain;
+       u8 *buf;
        int ret;
-       u32 i;
 
        ret = uvc_acquire_privileges(handle);
        if (ret < 0)
@@ -921,10 +926,17 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
        if (input >= chain->selector->bNrInPins)
                return -EINVAL;
 
-       i = input + 1;
-       return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
-                             chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
-                             &i, 1);
+       buf = kmalloc(1, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+
+       *buf = input + 1;
+       ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
+                            chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
+                            buf, 1);
+       kfree(buf);
+
+       return ret;
 }
 
 static int uvc_ioctl_queryctrl(struct file *file, void *fh,