mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 08:19:28 +00:00
b839212988
The memcpy() in uvc_video_decode_meta() intentionally copies across the length and flags members and into the trailing buf flexible array. Split the copy so that the compiler can better reason about (the lack of) buffer overflows here. Avoid the run-time false positive warning: memcpy: detected field-spanning write (size 12) of single field "&meta->length" at drivers/media/usb/uvc/uvc_video.c:1355 (size 1) Additionally fix a typo in the documentation for struct uvc_meta_buf. Reported-by: ionut_n2001@yahoo.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216810 Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
101 lines
2.6 KiB
C
101 lines
2.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
|
#ifndef __LINUX_UVCVIDEO_H_
|
|
#define __LINUX_UVCVIDEO_H_
|
|
|
|
#include <linux/ioctl.h>
|
|
#include <linux/types.h>
|
|
|
|
/*
|
|
* Dynamic controls
|
|
*/
|
|
|
|
/* Data types for UVC control data */
|
|
#define UVC_CTRL_DATA_TYPE_RAW 0
|
|
#define UVC_CTRL_DATA_TYPE_SIGNED 1
|
|
#define UVC_CTRL_DATA_TYPE_UNSIGNED 2
|
|
#define UVC_CTRL_DATA_TYPE_BOOLEAN 3
|
|
#define UVC_CTRL_DATA_TYPE_ENUM 4
|
|
#define UVC_CTRL_DATA_TYPE_BITMASK 5
|
|
|
|
/* Control flags */
|
|
#define UVC_CTRL_FLAG_SET_CUR (1 << 0)
|
|
#define UVC_CTRL_FLAG_GET_CUR (1 << 1)
|
|
#define UVC_CTRL_FLAG_GET_MIN (1 << 2)
|
|
#define UVC_CTRL_FLAG_GET_MAX (1 << 3)
|
|
#define UVC_CTRL_FLAG_GET_RES (1 << 4)
|
|
#define UVC_CTRL_FLAG_GET_DEF (1 << 5)
|
|
/* Control should be saved at suspend and restored at resume. */
|
|
#define UVC_CTRL_FLAG_RESTORE (1 << 6)
|
|
/* Control can be updated by the camera. */
|
|
#define UVC_CTRL_FLAG_AUTO_UPDATE (1 << 7)
|
|
/* Control supports asynchronous reporting */
|
|
#define UVC_CTRL_FLAG_ASYNCHRONOUS (1 << 8)
|
|
|
|
#define UVC_CTRL_FLAG_GET_RANGE \
|
|
(UVC_CTRL_FLAG_GET_CUR | UVC_CTRL_FLAG_GET_MIN | \
|
|
UVC_CTRL_FLAG_GET_MAX | UVC_CTRL_FLAG_GET_RES | \
|
|
UVC_CTRL_FLAG_GET_DEF)
|
|
|
|
#define UVC_MENU_NAME_LEN 32
|
|
|
|
struct uvc_menu_info {
|
|
__u32 value;
|
|
__u8 name[UVC_MENU_NAME_LEN];
|
|
};
|
|
|
|
struct uvc_xu_control_mapping {
|
|
__u32 id;
|
|
__u8 name[32];
|
|
__u8 entity[16];
|
|
__u8 selector;
|
|
|
|
__u8 size;
|
|
__u8 offset;
|
|
__u32 v4l2_type;
|
|
__u32 data_type;
|
|
|
|
struct uvc_menu_info __user *menu_info;
|
|
__u32 menu_count;
|
|
|
|
__u32 reserved[4];
|
|
};
|
|
|
|
struct uvc_xu_control_query {
|
|
__u8 unit;
|
|
__u8 selector;
|
|
__u8 query; /* Video Class-Specific Request Code, */
|
|
/* defined in linux/usb/video.h A.8. */
|
|
__u16 size;
|
|
__u8 __user *data;
|
|
};
|
|
|
|
#define UVCIOC_CTRL_MAP _IOWR('u', 0x20, struct uvc_xu_control_mapping)
|
|
#define UVCIOC_CTRL_QUERY _IOWR('u', 0x21, struct uvc_xu_control_query)
|
|
|
|
/*
|
|
* Metadata node
|
|
*/
|
|
|
|
/**
|
|
* struct uvc_meta_buf - metadata buffer building block
|
|
* @ns: system timestamp of the payload in nanoseconds
|
|
* @sof: USB Frame Number
|
|
* @length: length of the payload header
|
|
* @flags: payload header flags
|
|
* @buf: optional device-specific header data
|
|
*
|
|
* UVC metadata nodes fill buffers with possibly multiple instances of this
|
|
* struct. The first two fields are added by the driver, they can be used for
|
|
* clock synchronisation. The rest is an exact copy of a UVC payload header.
|
|
* Only complete objects with complete buffers are included. Therefore it's
|
|
* always sizeof(meta->ns) + sizeof(meta->sof) + meta->length bytes large.
|
|
*/
|
|
struct uvc_meta_buf {
|
|
__u64 ns;
|
|
__u16 sof;
|
|
__u8 length;
|
|
__u8 flags;
|
|
__u8 buf[];
|
|
} __packed;
|
|
|
|
#endif
|