diff options
| author | Laurent Pinchart <laurent.pinchart@ideasonboard.com> | 2012-04-24 11:29:42 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-04-24 13:55:37 -0700 |
| commit | 6f6543f53f9ce136e01d7114bf6f0818ca54fb41 (patch) | |
| tree | db4e69dc1ce6f0bf7b21baecf85e4e14cf75d42b | |
| parent | 66f75a5d028beaf67c931435fdc3e7823125730c (diff) | |
| download | overlayfs-6f6543f53f9ce136e01d7114bf6f0818ca54fb41.tar.gz | |
usb gadget: uvc: uvc_request_data::length field must be signed
The field is used to pass the UVC request data length, but can also be
used to signal an error when setting it to a negative value. Switch from
unsigned int to __s32.
Reported-by: Fernandez Gonzalo <gfernandez@copreci.es>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/gadget/uvc.h | 2 | ||||
| -rw-r--r-- | drivers/usb/gadget/uvc_v4l2.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/usb/gadget/uvc.h b/drivers/usb/gadget/uvc.h index bc78c606c12bbe..ca4e03a1c73a6d 100644 --- a/drivers/usb/gadget/uvc.h +++ b/drivers/usb/gadget/uvc.h @@ -28,7 +28,7 @@ struct uvc_request_data { - unsigned int length; + __s32 length; __u8 data[60]; }; diff --git a/drivers/usb/gadget/uvc_v4l2.c b/drivers/usb/gadget/uvc_v4l2.c index f6e083b5019137..54d7ca559cb215 100644 --- a/drivers/usb/gadget/uvc_v4l2.c +++ b/drivers/usb/gadget/uvc_v4l2.c @@ -39,7 +39,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data) if (data->length < 0) return usb_ep_set_halt(cdev->gadget->ep0); - req->length = min(uvc->event_length, data->length); + req->length = min_t(unsigned int, uvc->event_length, data->length); req->zero = data->length < uvc->event_length; req->dma = DMA_ADDR_INVALID; |