summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLaurent Pinchart <laurent.pinchart@ideasonboard.com>2012-04-24 11:29:42 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-04-24 13:55:37 -0700
commit6f6543f53f9ce136e01d7114bf6f0818ca54fb41 (patch)
treedb4e69dc1ce6f0bf7b21baecf85e4e14cf75d42b
parent66f75a5d028beaf67c931435fdc3e7823125730c (diff)
downloadop-kernel-dev-6f6543f53f9ce136e01d7114bf6f0818ca54fb41.zip
op-kernel-dev-6f6543f53f9ce136e01d7114bf6f0818ca54fb41.tar.gz
usb gadget: uvc: uvc_request_data::length field must be signed
The field is used to pass the UVC request data length, but can also be used to signal an error when setting it to a negative value. Switch from unsigned int to __s32. Reported-by: Fernandez Gonzalo <gfernandez@copreci.es> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/usb/gadget/uvc.h2
-rw-r--r--drivers/usb/gadget/uvc_v4l2.c2
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/usb/gadget/uvc.h b/drivers/usb/gadget/uvc.h
index bc78c60..ca4e03a 100644
--- a/drivers/usb/gadget/uvc.h
+++ b/drivers/usb/gadget/uvc.h
@@ -28,7 +28,7 @@
struct uvc_request_data
{
- unsigned int length;
+ __s32 length;
__u8 data[60];
};
diff --git a/drivers/usb/gadget/uvc_v4l2.c b/drivers/usb/gadget/uvc_v4l2.c
index f6e083b..54d7ca5 100644
--- a/drivers/usb/gadget/uvc_v4l2.c
+++ b/drivers/usb/gadget/uvc_v4l2.c
@@ -39,7 +39,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data)
if (data->length < 0)
return usb_ep_set_halt(cdev->gadget->ep0);
- req->length = min(uvc->event_length, data->length);
+ req->length = min_t(unsigned int, uvc->event_length, data->length);
req->zero = data->length < uvc->event_length;
req->dma = DMA_ADDR_INVALID;
OpenPOWER on IntegriCloud