Hi Mauro,

Thank you for the patch.

On Mon, Jun 21, 2021 at 03:23:35PM +0200, Mauro Carvalho Chehab wrote:

As warned by smatch: drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i) drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)

those two functions call uvc_query_ctrl passing a pointer to a data at the DMA stack. those are used to send URBs via usb_control_msg(). Using DMA stack is not supported and should not work anymore on modern Linux versions.

So, use a temporary buffer, allocated together with struct uvc_video_chain.

The second part of the sentence isn't correct anymore.

Cc: stable@vger.kernel.org # Kernel 4.9 and upper Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org

---

drivers/media/usb/uvc/uvc_v4l2.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 252136cc885c..d680ae8a5f87 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -899,8 +899,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) { struct uvc_fh *handle = fh; struct uvc_video_chain *chain = handle->chain;

• char *buf;

I'd make this

u8 *buf;

as the selector value is unsigned.

int ret;

• u8 i;

if (chain->selector == NULL || (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) { @@ -908,13 +908,18 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) return 0; }

• buf = kmalloc(1, GFP_KERNEL);

MIssing error check.

• ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id, chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,

• 	     &i, 1);
  

• 	     buf, 1);
  

  if (ret < 0) return ret;

• *input = i - 1;

• *input = *buf;
• kfree(buf);
• return 0;

} @@ -922,8 +927,8 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) { struct uvc_fh *handle = fh; struct uvc_video_chain *chain = handle->chain;

• char *buf;

u8 * here too.

int ret;

• u32 i;

ret = uvc_acquire_privileges(handle); if (ret < 0) @@ -939,10 +944,15 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) if (input >= chain->selector->bNrInPins) return -EINVAL;

• i = input + 1;
• return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,

• 	      chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
  

• 	      &i, 1);
  

• buf = kmalloc(1, GFP_KERNEL);

And missing error check.

• *buf = input + 1;
• ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,

• 	     chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
  

• 	     buf, 1);
  

• kfree(buf);
• return ret;

} static int uvc_ioctl_queryctrl(struct file *file, void *fh,