| Message ID | 25c6bfeb-a601-45cf-91dd-234349dc2d5e@rwthex-w3-b.rwth-ad.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Hi Joel, Thank you for the patch, and sorry for the late reply. On Tuesday, 29 May 2018 22:02:12 EEST Joel Pepper wrote: > While checks are in place to avoid attributes and children of a format > being manipulated after the format is linked into the streaming header, > the linked flag was never actually set, invalidating the protections. > > Signed-off-by: Joel Pepper <joel.pepper@rwth-aachen.de> This looks good to me, but you might want to shorten the subject line though, it's supposed to fit in 72 characters. How about usb: gadget: uvc: configfs: Prevent format changes after linking header Apart from that, Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> > --- > drivers/usb/gadget/function/uvc_configfs.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/usb/gadget/function/uvc_configfs.c > b/drivers/usb/gadget/function/uvc_configfs.c index c9b8cc4a..7a98f9f 100644 > --- a/drivers/usb/gadget/function/uvc_configfs.c > +++ b/drivers/usb/gadget/function/uvc_configfs.c > @@ -760,6 +760,7 @@ static int uvcg_streaming_header_allow_link(struct > config_item *src, format_ptr->fmt = target_fmt; > list_add_tail(&format_ptr->entry, &src_hdr->formats); > ++src_hdr->num_fmt; > + ++target_fmt->linked; > > out: > mutex_unlock(&opts->lock); > @@ -797,6 +798,8 @@ static void uvcg_streaming_header_drop_link(struct > config_item *src, break; > } > > + --target_fmt->linked; > + > out: > mutex_unlock(&opts->lock); > mutex_unlock(su_mutex);
diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c index c9b8cc4a..7a98f9f 100644 --- a/drivers/usb/gadget/function/uvc_configfs.c +++ b/drivers/usb/gadget/function/uvc_configfs.c @@ -760,6 +760,7 @@ static int uvcg_streaming_header_allow_link(struct config_item *src, format_ptr->fmt = target_fmt; list_add_tail(&format_ptr->entry, &src_hdr->formats); ++src_hdr->num_fmt; + ++target_fmt->linked; out: mutex_unlock(&opts->lock); @@ -797,6 +798,8 @@ static void uvcg_streaming_header_drop_link(struct config_item *src, break; } + --target_fmt->linked; + out: mutex_unlock(&opts->lock); mutex_unlock(su_mutex);
While checks are in place to avoid attributes and children of a format being manipulated after the format is linked into the streaming header, the linked flag was never actually set, invalidating the protections. Signed-off-by: Joel Pepper <joel.pepper@rwth-aachen.de> --- drivers/usb/gadget/function/uvc_configfs.c | 3 +++ 1 file changed, 3 insertions(+)