usb gadget: uvc: uvc_request_data::length field must be signed
authorLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Tue, 24 Apr 2012 09:29:42 +0000 (11:29 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 24 Apr 2012 20:55:37 +0000 (13:55 -0700)
The field is used to pass the UVC request data length, but can also be
used to signal an error when setting it to a negative value. Switch from
unsigned int to __s32.

Reported-by: Fernandez Gonzalo <gfernandez@copreci.es>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/uvc.h
drivers/usb/gadget/uvc_v4l2.c

index bc78c606c12bbe5726f077832c3dff1897918134..ca4e03a1c73a6d9ec030d133a15558d50362de4a 100644 (file)
@@ -28,7 +28,7 @@
 
 struct uvc_request_data
 {
-       unsigned int length;
+       __s32 length;
        __u8 data[60];
 };
 
index f6e083b5019137db248fc67731f24eb6e683b1ac..54d7ca559cb215f5fc963d10cdd0b99d6367c777 100644 (file)
@@ -39,7 +39,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data)
        if (data->length < 0)
                return usb_ep_set_halt(cdev->gadget->ep0);
 
-       req->length = min(uvc->event_length, data->length);
+       req->length = min_t(unsigned int, uvc->event_length, data->length);
        req->zero = data->length < uvc->event_length;
        req->dma = DMA_ADDR_INVALID;