Commit 9bc6218d authored by Michael Hennerich's avatar Michael Hennerich Committed by Mauro Carvalho Chehab

V4L/DVB (9660): uvcvideo: Fix unaligned memory access.

Use the unaligned memory access macros when accessing unaligned memory.
Signed-off-by: default avatarMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: default avatarBryan Wu <cooloney@kernel.org>
Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 4d3939f6
...@@ -32,6 +32,7 @@ ...@@ -32,6 +32,7 @@
#include <linux/vmalloc.h> #include <linux/vmalloc.h>
#include <linux/wait.h> #include <linux/wait.h>
#include <asm/atomic.h> #include <asm/atomic.h>
#include <asm/unaligned.h>
#include <media/v4l2-common.h> #include <media/v4l2-common.h>
...@@ -452,20 +453,20 @@ static int uvc_parse_format(struct uvc_device *dev, ...@@ -452,20 +453,20 @@ static int uvc_parse_format(struct uvc_device *dev,
frame->bFrameIndex = buffer[3]; frame->bFrameIndex = buffer[3];
frame->bmCapabilities = buffer[4]; frame->bmCapabilities = buffer[4];
frame->wWidth = le16_to_cpup((__le16 *)&buffer[5]); frame->wWidth = get_unaligned_le16(&buffer[5]);
frame->wHeight = le16_to_cpup((__le16 *)&buffer[7]); frame->wHeight = get_unaligned_le16(&buffer[7]);
frame->dwMinBitRate = le32_to_cpup((__le32 *)&buffer[9]); frame->dwMinBitRate = get_unaligned_le32(&buffer[9]);
frame->dwMaxBitRate = le32_to_cpup((__le32 *)&buffer[13]); frame->dwMaxBitRate = get_unaligned_le32(&buffer[13]);
if (ftype != VS_FRAME_FRAME_BASED) { if (ftype != VS_FRAME_FRAME_BASED) {
frame->dwMaxVideoFrameBufferSize = frame->dwMaxVideoFrameBufferSize =
le32_to_cpup((__le32 *)&buffer[17]); get_unaligned_le32(&buffer[17]);
frame->dwDefaultFrameInterval = frame->dwDefaultFrameInterval =
le32_to_cpup((__le32 *)&buffer[21]); get_unaligned_le32(&buffer[21]);
frame->bFrameIntervalType = buffer[25]; frame->bFrameIntervalType = buffer[25];
} else { } else {
frame->dwMaxVideoFrameBufferSize = 0; frame->dwMaxVideoFrameBufferSize = 0;
frame->dwDefaultFrameInterval = frame->dwDefaultFrameInterval =
le32_to_cpup((__le32 *)&buffer[17]); get_unaligned_le32(&buffer[17]);
frame->bFrameIntervalType = buffer[21]; frame->bFrameIntervalType = buffer[21];
} }
frame->dwFrameInterval = *intervals; frame->dwFrameInterval = *intervals;
...@@ -488,7 +489,7 @@ static int uvc_parse_format(struct uvc_device *dev, ...@@ -488,7 +489,7 @@ static int uvc_parse_format(struct uvc_device *dev,
* some other divisions by zero which could happen. * some other divisions by zero which could happen.
*/ */
for (i = 0; i < n; ++i) { for (i = 0; i < n; ++i) {
interval = le32_to_cpup((__le32 *)&buffer[26+4*i]); interval = get_unaligned_le32(&buffer[26+4*i]);
*(*intervals)++ = interval ? interval : 1; *(*intervals)++ = interval ? interval : 1;
} }
...@@ -832,8 +833,7 @@ static int uvc_parse_vendor_control(struct uvc_device *dev, ...@@ -832,8 +833,7 @@ static int uvc_parse_vendor_control(struct uvc_device *dev,
unit->type = VC_EXTENSION_UNIT; unit->type = VC_EXTENSION_UNIT;
memcpy(unit->extension.guidExtensionCode, &buffer[4], 16); memcpy(unit->extension.guidExtensionCode, &buffer[4], 16);
unit->extension.bNumControls = buffer[20]; unit->extension.bNumControls = buffer[20];
unit->extension.bNrInPins = unit->extension.bNrInPins = get_unaligned_le16(&buffer[21]);
le16_to_cpup((__le16 *)&buffer[21]);
unit->extension.baSourceID = (__u8 *)unit + sizeof *unit; unit->extension.baSourceID = (__u8 *)unit + sizeof *unit;
memcpy(unit->extension.baSourceID, &buffer[22], p); memcpy(unit->extension.baSourceID, &buffer[22], p);
unit->extension.bControlSize = buffer[22+p]; unit->extension.bControlSize = buffer[22+p];
...@@ -877,8 +877,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev, ...@@ -877,8 +877,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
return -EINVAL; return -EINVAL;
} }
dev->uvc_version = le16_to_cpup((__le16 *)&buffer[3]); dev->uvc_version = get_unaligned_le16(&buffer[3]);
dev->clock_frequency = le32_to_cpup((__le32 *)&buffer[7]); dev->clock_frequency = get_unaligned_le32(&buffer[7]);
/* Parse all USB Video Streaming interfaces. */ /* Parse all USB Video Streaming interfaces. */
for (i = 0; i < n; ++i) { for (i = 0; i < n; ++i) {
...@@ -905,7 +905,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev, ...@@ -905,7 +905,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
/* Make sure the terminal type MSB is not null, otherwise it /* Make sure the terminal type MSB is not null, otherwise it
* could be confused with a unit. * could be confused with a unit.
*/ */
type = le16_to_cpup((__le16 *)&buffer[4]); type = get_unaligned_le16(&buffer[4]);
if ((type & 0xff00) == 0) { if ((type & 0xff00) == 0) {
uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol "
"interface %d INPUT_TERMINAL %d has invalid " "interface %d INPUT_TERMINAL %d has invalid "
...@@ -947,11 +947,11 @@ static int uvc_parse_standard_control(struct uvc_device *dev, ...@@ -947,11 +947,11 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
term->camera.bControlSize = n; term->camera.bControlSize = n;
term->camera.bmControls = (__u8 *)term + sizeof *term; term->camera.bmControls = (__u8 *)term + sizeof *term;
term->camera.wObjectiveFocalLengthMin = term->camera.wObjectiveFocalLengthMin =
le16_to_cpup((__le16 *)&buffer[8]); get_unaligned_le16(&buffer[8]);
term->camera.wObjectiveFocalLengthMax = term->camera.wObjectiveFocalLengthMax =
le16_to_cpup((__le16 *)&buffer[10]); get_unaligned_le16(&buffer[10]);
term->camera.wOcularFocalLength = term->camera.wOcularFocalLength =
le16_to_cpup((__le16 *)&buffer[12]); get_unaligned_le16(&buffer[12]);
memcpy(term->camera.bmControls, &buffer[15], n); memcpy(term->camera.bmControls, &buffer[15], n);
} else if (UVC_ENTITY_TYPE(term) == ITT_MEDIA_TRANSPORT_INPUT) { } else if (UVC_ENTITY_TYPE(term) == ITT_MEDIA_TRANSPORT_INPUT) {
term->media.bControlSize = n; term->media.bControlSize = n;
...@@ -987,7 +987,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev, ...@@ -987,7 +987,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
/* Make sure the terminal type MSB is not null, otherwise it /* Make sure the terminal type MSB is not null, otherwise it
* could be confused with a unit. * could be confused with a unit.
*/ */
type = le16_to_cpup((__le16 *)&buffer[4]); type = get_unaligned_le16(&buffer[4]);
if ((type & 0xff00) == 0) { if ((type & 0xff00) == 0) {
uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol "
"interface %d OUTPUT_TERMINAL %d has invalid " "interface %d OUTPUT_TERMINAL %d has invalid "
...@@ -1061,7 +1061,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev, ...@@ -1061,7 +1061,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
unit->type = buffer[2]; unit->type = buffer[2];
unit->processing.bSourceID = buffer[4]; unit->processing.bSourceID = buffer[4];
unit->processing.wMaxMultiplier = unit->processing.wMaxMultiplier =
le16_to_cpup((__le16 *)&buffer[5]); get_unaligned_le16(&buffer[5]);
unit->processing.bControlSize = buffer[7]; unit->processing.bControlSize = buffer[7];
unit->processing.bmControls = (__u8 *)unit + sizeof *unit; unit->processing.bmControls = (__u8 *)unit + sizeof *unit;
memcpy(unit->processing.bmControls, &buffer[8], n); memcpy(unit->processing.bmControls, &buffer[8], n);
...@@ -1096,8 +1096,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev, ...@@ -1096,8 +1096,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
unit->type = buffer[2]; unit->type = buffer[2];
memcpy(unit->extension.guidExtensionCode, &buffer[4], 16); memcpy(unit->extension.guidExtensionCode, &buffer[4], 16);
unit->extension.bNumControls = buffer[20]; unit->extension.bNumControls = buffer[20];
unit->extension.bNrInPins = unit->extension.bNrInPins = get_unaligned_le16(&buffer[21]);
le16_to_cpup((__le16 *)&buffer[21]);
unit->extension.baSourceID = (__u8 *)unit + sizeof *unit; unit->extension.baSourceID = (__u8 *)unit + sizeof *unit;
memcpy(unit->extension.baSourceID, &buffer[22], p); memcpy(unit->extension.baSourceID, &buffer[22], p);
unit->extension.bControlSize = buffer[22+p]; unit->extension.bControlSize = buffer[22+p];
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment