summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJean-Francois Moine <moinejf@free.fr>2008-05-04 06:46:21 -0300
committerMauro Carvalho Chehab <mchehab@infradead.org>2008-07-20 07:14:40 -0300
commit4aa0d037a6c8e6b37ecfd986a444f83190c32a21 (patch)
tree37ec7366de97498236b82048e7c10e0d6ebe22e2
parente2997a72ddfafc25bd0c8f1f52bcf41979d5a559 (diff)
V4L/DVB (8154): Fix protection problems in the main driver.
- Protect format change when streaming active. - Protect USB exchanges on close. - Set a timeout in frame wait. - Have only one capture file and free the resources when closing this file. - Simplify the URB buffer. - Don't reset the control values at open time in pac207. - Fix compilation warnings of stk014. Signed-off-by: Jean-Francois Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
-rw-r--r--drivers/media/video/gspca/gspca.c163
-rw-r--r--drivers/media/video/gspca/gspca.h16
-rw-r--r--drivers/media/video/gspca/pac207.c11
-rw-r--r--drivers/media/video/gspca/stk014.c7
4 files changed, 113 insertions, 84 deletions
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index c4735e13361..04dbaba4b78 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -39,8 +39,8 @@ MODULE_AUTHOR("Jean-Francois Moine <http://moinejf.free.fr>");
MODULE_DESCRIPTION("GSPCA USB Camera Driver");
MODULE_LICENSE("GPL");
-#define DRIVER_VERSION_NUMBER KERNEL_VERSION(0, 0, 30)
-static const char version[] = "0.0.30";
+#define DRIVER_VERSION_NUMBER KERNEL_VERSION(0, 1, 1)
+static const char version[] = "0.1.1";
static int video_nr = -1;
@@ -346,22 +346,17 @@ static int gspca_kill_transfer(struct gspca_dev *gspca_dev)
PDEBUG(D_STREAM, "kill transfer");
for (i = 0; i < NURBS; ++i) {
- urb = gspca_dev->pktbuf[i].urb;
+ urb = gspca_dev->urb[i];
if (urb == NULL)
continue;
- gspca_dev->pktbuf[i].urb = NULL;
+ gspca_dev->urb[i] = NULL;
usb_kill_urb(urb);
-
- /* urb->transfer_buffer_length is not touched by USB core,
- * so we can use it here as the buffer length */
- if (gspca_dev->pktbuf[i].data) {
+ if (urb->transfer_buffer != 0)
usb_buffer_free(gspca_dev->dev,
urb->transfer_buffer_length,
- gspca_dev->pktbuf[i].data,
+ urb->transfer_buffer,
urb->transfer_dma);
- gspca_dev->pktbuf[i].data = NULL;
- }
usb_free_urb(urb);
}
return 0;
@@ -460,25 +455,25 @@ static int create_urbs(struct gspca_dev *gspca_dev,
err("usb_alloc_urb failed");
return -ENOMEM;
}
- gspca_dev->pktbuf[n].data = usb_buffer_alloc(gspca_dev->dev,
+ urb->transfer_buffer = usb_buffer_alloc(gspca_dev->dev,
bsize,
GFP_KERNEL,
&urb->transfer_dma);
- if (gspca_dev->pktbuf[n].data == NULL) {
+ if (urb->transfer_buffer == NULL) {
usb_free_urb(urb);
gspca_kill_transfer(gspca_dev);
err("usb_buffer_urb failed");
return -ENOMEM;
}
- gspca_dev->pktbuf[n].urb = urb;
+ gspca_dev->urb[n] = urb;
urb->dev = gspca_dev->dev;
urb->context = gspca_dev;
urb->pipe = usb_rcvisocpipe(gspca_dev->dev,
ep->desc.bEndpointAddress);
- urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
+ urb->transfer_flags = URB_ISO_ASAP
+ | URB_NO_TRANSFER_DMA_MAP;
urb->interval = ep->desc.bInterval;
- urb->transfer_buffer = gspca_dev->pktbuf[n].data;
urb->complete = isoc_irq;
urb->number_of_packets = npkt;
urb->transfer_buffer_length = bsize;
@@ -523,8 +518,7 @@ static int gspca_init_transfer(struct gspca_dev *gspca_dev)
/* submit the URBs */
for (n = 0; n < NURBS; n++) {
- ret = usb_submit_urb(gspca_dev->pktbuf[n].urb,
- GFP_KERNEL);
+ ret = usb_submit_urb(gspca_dev->urb[n], GFP_KERNEL);
if (ret < 0) {
PDEBUG(D_ERR|D_STREAM,
"usb_submit_urb [%d] err %d", n, ret);
@@ -732,15 +726,13 @@ static int vidioc_g_fmt_cap(struct file *file, void *priv,
return 0;
}
-static int try_fmt_cap(struct file *file,
- void *priv,
+static int try_fmt_cap(struct gspca_dev *gspca_dev,
struct v4l2_format *fmt)
{
- struct gspca_dev *gspca_dev = priv;
int w, h, mode, mode2, frsz;
- w = (int) fmt->fmt.pix.width;
- h = (int) fmt->fmt.pix.height;
+ w = fmt->fmt.pix.width;
+ h = fmt->fmt.pix.height;
#ifdef GSPCA_DEBUG
if (gspca_debug & D_CONF)
PDEBUG_MODE("try fmt cap", fmt->fmt.pix.pixelformat, w, h);
@@ -786,9 +778,10 @@ static int vidioc_try_fmt_cap(struct file *file,
void *priv,
struct v4l2_format *fmt)
{
+ struct gspca_dev *gspca_dev = priv;
int ret;
- ret = try_fmt_cap(file, priv, fmt);
+ ret = try_fmt_cap(gspca_dev, fmt);
if (ret < 0)
return ret;
return 0;
@@ -809,14 +802,19 @@ static int vidioc_s_fmt_cap(struct file *file, void *priv,
#endif
if (mutex_lock_interruptible(&gspca_dev->queue_lock))
return -ERESTARTSYS;
- ret = try_fmt_cap(file, priv, fmt);
+ ret = try_fmt_cap(gspca_dev, fmt);
if (ret < 0)
goto out;
if (ret == gspca_dev->curr_mode)
goto out; /* same mode */
was_streaming = gspca_dev->streaming;
- if (was_streaming != 0) {
+ if (was_streaming) {
+ if (gspca_dev->capt_file != 0
+ && gspca_dev->capt_file != file) {
+ ret = -EBUSY;
+ goto out;
+ }
if (mutex_lock_interruptible(&gspca_dev->usb_lock)) {
ret = -ERESTARTSYS;
goto out;
@@ -824,8 +822,8 @@ static int vidioc_s_fmt_cap(struct file *file, void *priv,
gspca_stream_off(gspca_dev);
mutex_unlock(&gspca_dev->usb_lock);
}
- gspca_dev->width = (int) fmt->fmt.pix.width;
- gspca_dev->height = (int) fmt->fmt.pix.height;
+ gspca_dev->width = fmt->fmt.pix.width;
+ gspca_dev->height = fmt->fmt.pix.height;
gspca_dev->pixfmt = fmt->fmt.pix.pixelformat;
gspca_dev->curr_mode = ret;
if (was_streaming)
@@ -891,17 +889,18 @@ static int dev_close(struct inode *inode, struct file *file)
if (mutex_lock_interruptible(&gspca_dev->queue_lock))
return -ERESTARTSYS;
gspca_dev->users--;
- if (gspca_dev->users > 0) {
- mutex_unlock(&gspca_dev->queue_lock);
- return 0;
- }
- if (gspca_dev->streaming)
- gspca_stream_off(gspca_dev);
- gspca_dev->sd_desc->close(gspca_dev);
-
- frame_free(gspca_dev);
- file->private_data = NULL;
+ /* if the file did capture, free the streaming resources */
+ if (gspca_dev->capt_file == file) {
+ mutex_lock(&gspca_dev->usb_lock);
+ if (gspca_dev->streaming)
+ gspca_stream_off(gspca_dev);
+ gspca_dev->sd_desc->close(gspca_dev);
+ mutex_unlock(&gspca_dev->usb_lock);
+ frame_free(gspca_dev);
+ file->private_data = NULL;
+ gspca_dev->capt_file = 0;
+ }
mutex_unlock(&gspca_dev->queue_lock);
PDEBUG(D_STREAM, "closed");
return 0;
@@ -1052,12 +1051,19 @@ static int vidioc_reqbufs(struct file *file, void *priv,
return frsz;
if (mutex_lock_interruptible(&gspca_dev->queue_lock))
return -ERESTARTSYS;
+ if (gspca_dev->capt_file != 0) { /* only one file may do capture */
+ ret = -EBUSY;
+ goto out;
+ }
ret = frame_alloc(gspca_dev,
rb->count,
(unsigned int) frsz,
rb->memory);
- if (ret == 0)
+ if (ret == 0) {
rb->count = gspca_dev->nframes;
+ gspca_dev->capt_file = file;
+ }
+out:
mutex_unlock(&gspca_dev->queue_lock);
PDEBUG(D_STREAM, "reqbufs st:%d c:%d", ret, rb->count);
return ret;
@@ -1099,6 +1105,10 @@ static int vidioc_streamon(struct file *file, void *priv,
ret = -EINVAL;
goto out;
}
+ if (gspca_dev->capt_file != file) {
+ ret = -EINVAL;
+ goto out;
+ }
if (!gspca_dev->streaming) {
ret = gspca_init_transfer(gspca_dev);
if (ret < 0)
@@ -1122,22 +1132,30 @@ static int vidioc_streamoff(struct file *file, void *priv,
enum v4l2_buf_type buf_type)
{
struct gspca_dev *gspca_dev = priv;
+ int ret;
PDEBUG(D_STREAM, "stream off");
if (buf_type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
return -EINVAL;
- if (gspca_dev->streaming) {
- if (mutex_lock_interruptible(&gspca_dev->queue_lock))
- return -ERESTARTSYS;
- if (mutex_lock_interruptible(&gspca_dev->usb_lock)) {
- mutex_unlock(&gspca_dev->queue_lock);
- return -ERESTARTSYS;
- }
- gspca_stream_off(gspca_dev);
- mutex_unlock(&gspca_dev->usb_lock);
- mutex_unlock(&gspca_dev->queue_lock);
+ if (!gspca_dev->streaming)
+ return 0;
+ if (mutex_lock_interruptible(&gspca_dev->queue_lock))
+ return -ERESTARTSYS;
+ if (mutex_lock_interruptible(&gspca_dev->usb_lock)) {
+ ret = -ERESTARTSYS;
+ goto out;
}
- return 0;
+ if (gspca_dev->capt_file != file) {
+ ret = -EINVAL;
+ goto out2;
+ }
+ gspca_stream_off(gspca_dev);
+ ret = 0;
+out2:
+ mutex_unlock(&gspca_dev->usb_lock);
+out:
+ mutex_unlock(&gspca_dev->queue_lock);
+ return ret;
}
static int vidioc_g_jpegcomp(struct file *file, void *priv,
@@ -1187,14 +1205,11 @@ static int vidioc_s_parm(struct file *filp, void *priv,
struct gspca_dev *gspca_dev = priv;
int n;
- if (mutex_lock_interruptible(&gspca_dev->usb_lock))
- return -ERESTARTSYS;
n = parm->parm.capture.readbuffers;
if (n == 0 || n > GSPCA_MAX_FRAMES)
parm->parm.capture.readbuffers = gspca_dev->nbufread;
else
gspca_dev->nbufread = n;
- mutex_unlock(&gspca_dev->usb_lock);
return 0;
}
@@ -1245,7 +1260,11 @@ static int dev_mmap(struct file *file, struct vm_area_struct *vma)
return -ERESTARTSYS;
if (!gspca_dev->present) {
ret = -ENODEV;
- goto done;
+ goto out;
+ }
+ if (gspca_dev->capt_file != file) {
+ ret = -EINVAL;
+ goto out;
}
for (i = 0; i < gspca_dev->nframes; ++i) {
@@ -1262,7 +1281,7 @@ static int dev_mmap(struct file *file, struct vm_area_struct *vma)
if (frame == 0) {
PDEBUG(D_STREAM, "mmap no frame buffer found");
ret = -EINVAL;
- goto done;
+ goto out;
}
#ifdef CONFIG_VIDEO_V4L1_COMPAT
if (i == 0 && size == frame->v4l2_buf.length * gspca_dev->nframes)
@@ -1272,7 +1291,7 @@ static int dev_mmap(struct file *file, struct vm_area_struct *vma)
if (size != frame->v4l2_buf.length) {
PDEBUG(D_STREAM, "mmap bad size");
ret = -EINVAL;
- goto done;
+ goto out;
}
/*
@@ -1286,7 +1305,7 @@ static int dev_mmap(struct file *file, struct vm_area_struct *vma)
page = vmalloc_to_page((void *) addr);
ret = vm_insert_page(vma, start, page);
if (ret < 0)
- goto done;
+ goto out;
start += PAGE_SIZE;
addr += PAGE_SIZE;
size -= PAGE_SIZE;
@@ -1304,7 +1323,7 @@ static int dev_mmap(struct file *file, struct vm_area_struct *vma)
}
#endif
ret = 0;
-done:
+out:
mutex_unlock(&gspca_dev->queue_lock);
return ret;
}
@@ -1356,10 +1375,14 @@ static int gspca_frame_wait(struct gspca_dev *gspca_dev,
/* wait till a frame is ready */
for (;;) {
- ret = wait_event_interruptible(gspca_dev->wq,
- atomic_read(&gspca_dev->nevent) > 0);
- if (ret != 0)
- return ret;
+ ret = wait_event_interruptible_timeout(gspca_dev->wq,
+ atomic_read(&gspca_dev->nevent) > 0,
+ msecs_to_jiffies(3000));
+ if (ret <= 0) {
+ if (ret < 0)
+ return ret;
+ return -EIO;
+ }
if (!gspca_dev->streaming || !gspca_dev->present)
return -EIO;
i = gspca_dev->fr_o;
@@ -1402,6 +1425,10 @@ static int vidioc_dqbuf(struct file *file, void *priv,
return -EINVAL;
if (!gspca_dev->streaming)
return -EINVAL;
+ if (gspca_dev->capt_file != file) {
+ ret = -EINVAL;
+ goto out;
+ }
/* only one read */
if (mutex_lock_interruptible(&gspca_dev->read_lock))
@@ -1409,14 +1436,14 @@ static int vidioc_dqbuf(struct file *file, void *priv,
ret = gspca_frame_wait(gspca_dev, file->f_flags & O_NONBLOCK);
if (ret < 0)
- goto done;
+ goto out;
i = ret; /* frame index */
frame = &gspca_dev->frame[i];
frame->v4l2_buf.flags &= ~V4L2_BUF_FLAG_DONE;
memcpy(v4l2_buf, &frame->v4l2_buf, sizeof *v4l2_buf);
PDEBUG(D_FRAM, "dqbuf %d", i);
ret = 0;
-done:
+out:
mutex_unlock(&gspca_dev->read_lock);
return ret;
}
@@ -1450,6 +1477,8 @@ static int vidioc_qbuf(struct file *file, void *priv,
PDEBUG(D_STREAM, "qbuf bad memory type");
return -EINVAL;
}
+ if (gspca_dev->capt_file != file)
+ return -EINVAL;
if (mutex_lock_interruptible(&gspca_dev->queue_lock))
return -ERESTARTSYS;
@@ -1524,7 +1553,9 @@ static ssize_t dev_read(struct file *file, char __user *data,
return ret;
}
}
- }
+ } else if (gspca_dev->capt_file != file)
+ return -EINVAL;
+
if (!gspca_dev->streaming) {
ret = vidioc_streamon(file, gspca_dev,
V4L2_BUF_TYPE_VIDEO_CAPTURE);
@@ -1719,7 +1750,7 @@ EXPORT_SYMBOL(gspca_dev_probe);
*/
void gspca_disconnect(struct usb_interface *intf)
{
- struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
+ struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
if (!gspca_dev)
return;
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index 3bfb3641cf3..c2618c0e661 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -108,11 +108,6 @@ struct sd_desc {
cam_qmnu_op querymenu;
};
-struct gspca_pktbuf {
- char *data;
- struct urb *urb;
-};
-
/* packet types when moving from iso buf to frame buf */
#define DISCARD_PACKET 0
#define FIRST_PACKET 1
@@ -121,19 +116,20 @@ struct gspca_pktbuf {
struct gspca_frame {
unsigned char *data; /* frame buffer */
- unsigned char *data_end; /* current end of frame while filling */
+ unsigned char *data_end; /* end of frame while filling */
int vma_use_count;
struct v4l2_buffer v4l2_buf;
};
struct gspca_dev {
- struct video_device vdev; /* !! must be the first item */
+ struct video_device vdev; /* !! must be the first item */
struct usb_device *dev;
+ struct file *capt_file; /* file doing video capture */
struct cam cam; /* device information */
const struct sd_desc *sd_desc; /* subdriver description */
- struct gspca_pktbuf pktbuf[NURBS];
+ struct urb *urb[NURBS];
__u8 *frbuf; /* buffer for nframes */
struct gspca_frame frame[GSPCA_MAX_FRAMES];
@@ -147,7 +143,7 @@ struct gspca_dev {
__u8 iface; /* USB interface number */
__u8 alt; /* USB alternate setting */
- char curr_mode; /* current camera mode */
+ unsigned char curr_mode; /* current camera mode */
__u32 pixfmt; /* current mode parameters */
short width;
short height;
@@ -158,7 +154,7 @@ struct gspca_dev {
struct mutex read_lock; /* read protection */
struct mutex queue_lock; /* ISOC queue protection */
__u32 sequence; /* frame sequence number */
- signed char streaming;
+ char streaming;
char users; /* # open */
char present; /* device connected */
char nbufread; /* number of buffers for read() */
diff --git a/drivers/media/video/gspca/pac207.c b/drivers/media/video/gspca/pac207.c
index ac16c735289..57d48f51e3a 100644
--- a/drivers/media/video/gspca/pac207.c
+++ b/drivers/media/video/gspca/pac207.c
@@ -27,8 +27,8 @@
#include "gspca.h"
-#define DRIVER_VERSION_NUMBER KERNEL_VERSION(0, 0, 30)
-static const char version[] = "0.0.30";
+#define DRIVER_VERSION_NUMBER KERNEL_VERSION(0, 1, 1)
+static const char version[] = "0.1.1";
MODULE_AUTHOR("Hans de Goede <j.w.r.degoede@hhs.nl>");
MODULE_DESCRIPTION("Pixart PAC207");
@@ -251,6 +251,7 @@ int pac207_read_reg(struct gspca_dev *gspca_dev, u16 index)
static int sd_config(struct gspca_dev *gspca_dev,
const struct usb_device_id *id)
{
+ struct sd *sd = (struct sd *) gspca_dev;
struct cam *cam;
u8 idreg[2];
@@ -282,6 +283,9 @@ static int sd_config(struct gspca_dev *gspca_dev,
cam->epaddr = 0x05;
cam->cam_mode = sif_mode;
cam->nmodes = ARRAY_SIZE(sif_mode);
+ sd->brightness = PAC207_BRIGHTNESS_DEFAULT;
+ sd->exposure = PAC207_EXPOSURE_DEFAULT;
+ sd->gain = PAC207_GAIN_DEFAULT;
return 0;
}
@@ -291,9 +295,6 @@ static int sd_open(struct gspca_dev *gspca_dev)
{
struct sd *sd = (struct sd *) gspca_dev;
- sd->brightness = PAC207_BRIGHTNESS_DEFAULT;
- sd->exposure = PAC207_EXPOSURE_DEFAULT;
- sd->gain = PAC207_GAIN_DEFAULT;
sd->autogain = 1;
return 0;
diff --git a/drivers/media/video/gspca/stk014.c b/drivers/media/video/gspca/stk014.c
index 8fd4ff01362..2e4cf64442a 100644
--- a/drivers/media/video/gspca/stk014.c
+++ b/drivers/media/video/gspca/stk014.c
@@ -24,8 +24,8 @@
#include "gspca.h"
#include "jpeg.h"
-#define DRIVER_VERSION_NUMBER KERNEL_VERSION(0, 0, 22)
-static const char version[] = "0.0.22";
+#define DRIVER_VERSION_NUMBER KERNEL_VERSION(0, 1, 0)
+static const char version[] = "0.1.0";
MODULE_AUTHOR("Jean-Francois Moine <http://moinejf.free.fr>");
MODULE_DESCRIPTION("Syntek DV4000 (STK014) USB Camera Driver");
@@ -390,6 +390,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
int len) /* iso packet length */
{
int l;
+ static unsigned char ffd9[] = {0xff, 0xd9};
/* a frame starts with:
* - 0xff 0xfe
@@ -445,7 +446,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
if (len > frame->v4l2_buf.bytesused - 2 - l)
len = frame->v4l2_buf.bytesused - 2 - l;
gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
- gspca_frame_add(gspca_dev, LAST_PACKET, frame, "\xff\xd9", 2);
+ gspca_frame_add(gspca_dev, LAST_PACKET, frame, ffd9, 2);
}
static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)