| From 2d84dbbc9b7b0ae905299c19cd197f4a07058dda Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 24 May 2021 13:09:18 +0200 |
| Subject: media: gspca/gl860: fix zero-length control requests |
| |
| From: Johan Hovold <johan@kernel.org> |
| |
| [ Upstream commit 8ed339f23d41e21660a389adf2e7b2966d457ff6 ] |
| |
| The direction of the pipe argument must match the request-type direction |
| bit or control requests may fail depending on the host-controller-driver |
| implementation. |
| |
| Control transfers without a data stage are treated as OUT requests by |
| the USB stack and should be using usb_sndctrlpipe(). Failing to do so |
| will now trigger a warning. |
| |
| Fix the gl860_RTx() helper so that zero-length control reads fail with |
| an error message instead. Note that there are no current callers that |
| would trigger this. |
| |
| Fixes: 4f7cb8837cec ("V4L/DVB (12954): gspca - gl860: Addition of GL860 based webcams") |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/usb/gspca/gl860/gl860.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| diff --git a/drivers/media/usb/gspca/gl860/gl860.c b/drivers/media/usb/gspca/gl860/gl860.c |
| index 2c05ea2598e7..ce4ee8bc75c8 100644 |
| --- a/drivers/media/usb/gspca/gl860/gl860.c |
| +++ b/drivers/media/usb/gspca/gl860/gl860.c |
| @@ -561,8 +561,8 @@ int gl860_RTx(struct gspca_dev *gspca_dev, |
| len, 400 + 200 * (len > 1)); |
| memcpy(pdata, gspca_dev->usb_buf, len); |
| } else { |
| - r = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), |
| - req, pref, val, index, NULL, len, 400); |
| + gspca_err(gspca_dev, "zero-length read request\n"); |
| + r = -EINVAL; |
| } |
| } |
| |
| -- |
| 2.30.2 |
| |