1. 22 Jan, 2023 34 commits
  2. 15 Jan, 2023 6 commits
    • Kees Cook's avatar
      media: uvcvideo: Silence memcpy() run-time false positive warnings · b8392129
      Kees Cook authored
      The memcpy() in uvc_video_decode_meta() intentionally copies across the
      length and flags members and into the trailing buf flexible array.
      Split the copy so that the compiler can better reason about (the lack
      of) buffer overflows here. Avoid the run-time false positive warning:
      
        memcpy: detected field-spanning write (size 12) of single field "&meta->length" at drivers/media/usb/uvc/uvc_video.c:1355 (size 1)
      
      Additionally fix a typo in the documentation for struct uvc_meta_buf.
      
      Reported-by: ionut_n2001@yahoo.com
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=216810Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      b8392129
    • Ricardo Ribalda's avatar
      media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 · 136effa7
      Ricardo Ribalda authored
      Logitech B910 and C910 firmware are unable to recover from a USB
      autosuspend. When it resumes, the device is in a state where it only
      produces invalid frames. Eg:
      
      $ echo 0xFFFF > /sys/module/uvcvideo/parameters/trace # enable verbose log
      $ yavta -c1 -n1 --file='frame#.jpg' --format MJPEG --size=1920x1080 /dev/video1
      [350438.435219] uvcvideo: uvc_v4l2_open
      [350438.529794] uvcvideo: Resuming interface 2
      [350438.529801] uvcvideo: Resuming interface 3
      [350438.529991] uvcvideo: Trying format 0x47504a4d (MJPG): 1920x1080.
      [350438.529996] uvcvideo: Using default frame interval 33333.3 us (30.0 fps).
      [350438.551496] uvcvideo: uvc_v4l2_mmap
      [350438.555890] uvcvideo: Device requested 3060 B/frame bandwidth.
      [350438.555896] uvcvideo: Selecting alternate setting 11 (3060 B/frame bandwidth).
      [350438.556362] uvcvideo: Allocated 5 URB buffers of 32x3060 bytes each.
      [350439.316468] uvcvideo: Marking buffer as bad (error bit set).
      [350439.316475] uvcvideo: Frame complete (EOF found).
      [350439.316477] uvcvideo: EOF in empty payload.
      [350439.316484] uvcvideo: frame 1 stats: 149/261/417 packets, 1/149/417 pts (early initial), 416/417 scr, last pts/stc/sof 2976325734/2978107243/249
      [350439.384510] uvcvideo: Marking buffer as bad (error bit set).
      [350439.384516] uvcvideo: Frame complete (EOF found).
      [350439.384518] uvcvideo: EOF in empty payload.
      [350439.384525] uvcvideo: frame 2 stats: 265/379/533 packets, 1/265/533 pts (early initial), 532/533 scr, last pts/stc/sof 2979524454/2981305193/316
      [350439.448472] uvcvideo: Marking buffer as bad (error bit set).
      [350439.448478] uvcvideo: Frame complete (EOF found).
      [350439.448480] uvcvideo: EOF in empty payload.
      [350439.448487] uvcvideo: frame 3 stats: 265/377/533 packets, 1/265/533 pts (early initial), 532/533 scr, last pts/stc/sof 2982723174/2984503144/382
      ...(loop)...
      
      The devices can leave this invalid state if the alternate setting of
      the streaming interface is toggled.
      
      This patch adds a quirk for this device so it can be autosuspended
      properly.
      
      lsusb -v:
      Bus 001 Device 049: ID 046d:0821 Logitech, Inc. HD Webcam C910
      Device Descriptor:
        bLength                18
        bDescriptorType         1
        bcdUSB               2.00
        bDeviceClass          239 Miscellaneous Device
        bDeviceSubClass         2
        bDeviceProtocol         1 Interface Association
        bMaxPacketSize0        64
        idVendor           0x046d Logitech, Inc.
        idProduct          0x0821 HD Webcam C910
        bcdDevice            0.10
        iManufacturer           0
        iProduct                0
        iSerial                 1 390022B0
        bNumConfigurations      1
      Signed-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      136effa7
    • Ricardo Ribalda's avatar
      media: uvcvideo: Fix race condition with usb_kill_urb · 619d9b71
      Ricardo Ribalda authored
      usb_kill_urb warranties that all the handlers are finished when it
      returns, but does not protect against threads that might be handling
      asynchronously the urb.
      
      For UVC, the function uvc_ctrl_status_event_async() takes care of
      control changes asynchronously.
      
      If the code is executed in the following order:
      
      CPU 0					CPU 1
      ===== 					=====
      uvc_status_complete()
      					uvc_status_stop()
      uvc_ctrl_status_event_work()
      					uvc_status_start() -> FAIL
      
      Then uvc_status_start will keep failing and this error will be shown:
      
      <4>[    5.540139] URB 0000000000000000 submitted while active
      drivers/usb/core/urb.c:378 usb_submit_urb+0x4c3/0x528
      
      Let's improve the current situation, by not re-submiting the urb if
      we are stopping the status event. Also process the queued work
      (if any) during stop.
      
      CPU 0					CPU 1
      ===== 					=====
      uvc_status_complete()
      					uvc_status_stop()
      					uvc_status_start()
      uvc_ctrl_status_event_work() -> FAIL
      
      Hopefully, with the usb layer protection this should be enough to cover
      all the cases.
      
      Cc: stable@vger.kernel.org
      Fixes: e5225c82 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
      Reviewed-by: default avatarYunke Cao <yunkec@chromium.org>
      Signed-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      619d9b71
    • Ricardo Ribalda's avatar
      media: uvcvideo: Use standard names for menus · 716c3304
      Ricardo Ribalda authored
      Instead of duplicating the menu info, use the one from the core.
      Also, do not use extra memory for 1:1 mappings.
      Suggested-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      716c3304
    • Ricardo Ribalda's avatar
      media: uvcvideo: Fix power line control for Lenovo Integrated Camera · a7c28150
      Ricardo Ribalda authored
      The device does not implement the power line frequenyc control
      correctly. It is a UVC 1.5 device, but implements the control as a UVC
      1.1 device.
      
      Add the corresponding control mapping override.
      
      Bus 003 Device 002: ID 30c9:0093 Lenovo Integrated Camera
      Device Descriptor:
        bLength                18
        bDescriptorType         1
        bcdUSB               2.01
        bDeviceClass          239 Miscellaneous Device
        bDeviceSubClass         2
        bDeviceProtocol         1 Interface Association
        bMaxPacketSize0        64
        idVendor           0x30c9
        idProduct          0x0093
        bcdDevice            0.07
        iManufacturer           3 Lenovo
        iProduct                1 Integrated Camera
        iSerial                 2 8SSC21J75356V1SR2830069
        bNumConfigurations      1
      Signed-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      a7c28150
    • Ricardo Ribalda's avatar
      media: uvcvideo: Refactor power_line_frequency_controls_limited · 3aa8628e
      Ricardo Ribalda authored
      Move the control mapping to uvc_ctrl.c. This way we do not have
      references to UVC controls or V4L2 controls in uvc_driver.c.
      
      This also fixes a bug introduced in commit 38207560 ("media:
      uvcvideo: Limit power line control for Quanta UVC Webcam"). The
      offending commit caused the power line control menu entries to have
      incorrect indices compared to the V4L2_CID_POWER_LINE_FREQUENCY_*
      enumeration. Now that the limited mapping reuses the correct menu_info
      array, the indices correctly map to the V4L2 control specification.
      
      Fixes: 38207560 ("media: uvcvideo: Limit power line control for Quanta UVC Webcam")
      Signed-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
      Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      3aa8628e