Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f6543f5 authored by Laurent Pinchart's avatar Laurent Pinchart Committed by Greg Kroah-Hartman
Browse files

usb gadget: uvc: uvc_request_data::length field must be signed 



The field is used to pass the UVC request data length, but can also be
used to signal an error when setting it to a negative value. Switch from
unsigned int to __s32.

Reported-by: default avatarFernandez Gonzalo <gfernandez@copreci.es>
Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 66f75a5d

drivers/usb/gadget/uvc.h

+1 −1
Original line number Diff line number Diff line
@@ -28,7 +28,7 @@ 


struct uvc_request_data

{

	unsigned int length;

	__s32 length;

	__u8 data[60];

};

drivers/usb/gadget/uvc_v4l2.c

+1 −1
Original line number Diff line number Diff line
@@ -39,7 +39,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data) 
	if (data->length < 0)

		return usb_ep_set_halt(cdev->gadget->ep0);



	req->length = min(uvc->event_length, data->length);

	req->length = min_t(unsigned int, uvc->event_length, data->length);

	req->zero = data->length < uvc->event_length;

	req->dma = DMA_ADDR_INVALID;