Commit 1da97219 authored by Michael Grzeschik's avatar Michael Grzeschik Committed by Heyuan Wang
Browse files

usb: gadget: uvc: fix try format returns on uncompressed formats 

mainline inclusion
from mainline-v6.10-rc1
commit 7a700d8f2431b681f2dae1118d62177719912f5d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRHZ
CVE: CVE-2024-50056

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7a700d8f2431b681f2dae1118d62177719912f5d



--------------------------------

When setting uncompressed formats, the values of bytesperline and
sizeimage can already be determined by using the v4l2_fill_pixfmt helper
function. We change the try_fmt function to use the helper instead.

Signed-off-by: default avatarMichael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20240221-uvc-gadget-uncompressed-v1-1-f55e97287cae@pengutronix.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarHeyuan Wang <wangheyuan2@h-partners.com>
parent b2eaf472

drivers/usb/gadget/function/uvc_v4l2.c

+19 −5
Original line number Diff line number Diff line
@@ -260,12 +260,26 @@ uvc_v4l2_try_format(struct file *file, void *fh, struct v4l2_format *fmt) 
	if (!uframe)

		return -EINVAL;



	if (uformat->type == UVCG_UNCOMPRESSED) {

		struct uvcg_uncompressed *u =

			to_uvcg_uncompressed(&uformat->group.cg_item);

		if (!u)

			return 0;



		v4l2_fill_pixfmt(&fmt->fmt.pix, fmt->fmt.pix.pixelformat,

				 uframe->frame.w_width, uframe->frame.w_height);



		if (fmt->fmt.pix.sizeimage != (uvc_v4l2_get_bytesperline(uformat, uframe) *

						uframe->frame.w_height))

			return -EINVAL;

	} else {

		fmt->fmt.pix.width = uframe->frame.w_width;

		fmt->fmt.pix.height = uframe->frame.w_height;

	fmt->fmt.pix.field = V4L2_FIELD_NONE;

		fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(uformat, uframe);

		fmt->fmt.pix.sizeimage = uvc_get_frame_size(uformat, uframe);

		fmt->fmt.pix.pixelformat = to_uvc_format(uformat)->fcc;

	}

	fmt->fmt.pix.field = V4L2_FIELD_NONE;

	fmt->fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;

	fmt->fmt.pix.priv = 0;