summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLaura Abbott <labbott@redhat.com>2018-06-25 11:05:52 -0700
committerLaura Abbott <labbott@redhat.com>2018-06-25 11:05:52 -0700
commit1af46037fb080511467c5752152aaf9a583d09ae (patch)
tree20ad1ba91fbfebee33a2c24c4c1e8077a86facc5
parent052e62cec7e275257815bbf6008913cbf3e0b7e9 (diff)
downloadkernel-1af46037fb080511467c5752152aaf9a583d09ae.tar.gz
kernel-1af46037fb080511467c5752152aaf9a583d09ae.tar.xz
kernel-1af46037fb080511467c5752152aaf9a583d09ae.zip
Some webcam fixes (rhbz 1592454 1590304)
-rw-r--r--0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch65
-rw-r--r--0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch95
-rw-r--r--kernel.spec11
3 files changed, 170 insertions, 1 deletions
diff --git a/0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch b/0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch
new file mode 100644
index 000000000..76f2ce025
--- /dev/null
+++ b/0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch
@@ -0,0 +1,65 @@
+From 0dc68cabdb626e33d02561529e6a4c681b72a784 Mon Sep 17 00:00:00 2001
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Wed, 21 Mar 2018 11:43:08 -0400
+Subject: [PATCH] media: uvcvideo: Prevent setting unavailable flags
+
+The addition of an extra operation to use the GET_INFO command
+overwrites all existing flags from the uvc_ctrls table. This includes
+setting all controls as supporting GET_MIN, GET_MAX, GET_RES, and
+GET_DEF regardless of whether they do or not.
+
+Move the initialisation of these control capabilities directly to the
+uvc_ctrl_fill_xu_info() call where they were originally located in that
+use case, and ensure that the new functionality in uvc_ctrl_get_flags()
+will only set flags based on their reported capability from the GET_INFO
+call.
+
+Fixes: 859086ae3636 ("media: uvcvideo: Apply flags from device to actual properties")
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Tested-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index 102594ec3e97..a36b4fb949fa 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -1607,14 +1607,12 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev,
+ ret = uvc_query_ctrl(dev, UVC_GET_INFO, ctrl->entity->id, dev->intfnum,
+ info->selector, data, 1);
+ if (!ret)
+- info->flags = UVC_CTRL_FLAG_GET_MIN | UVC_CTRL_FLAG_GET_MAX
+- | UVC_CTRL_FLAG_GET_RES | UVC_CTRL_FLAG_GET_DEF
+- | (data[0] & UVC_CONTROL_CAP_GET ?
+- UVC_CTRL_FLAG_GET_CUR : 0)
+- | (data[0] & UVC_CONTROL_CAP_SET ?
+- UVC_CTRL_FLAG_SET_CUR : 0)
+- | (data[0] & UVC_CONTROL_CAP_AUTOUPDATE ?
+- UVC_CTRL_FLAG_AUTO_UPDATE : 0);
++ info->flags |= (data[0] & UVC_CONTROL_CAP_GET ?
++ UVC_CTRL_FLAG_GET_CUR : 0)
++ | (data[0] & UVC_CONTROL_CAP_SET ?
++ UVC_CTRL_FLAG_SET_CUR : 0)
++ | (data[0] & UVC_CONTROL_CAP_AUTOUPDATE ?
++ UVC_CTRL_FLAG_AUTO_UPDATE : 0);
+
+ kfree(data);
+ return ret;
+@@ -1689,6 +1687,9 @@ static int uvc_ctrl_fill_xu_info(struct uvc_device *dev,
+
+ info->size = le16_to_cpup((__le16 *)data);
+
++ info->flags = UVC_CTRL_FLAG_GET_MIN | UVC_CTRL_FLAG_GET_MAX
++ | UVC_CTRL_FLAG_GET_RES | UVC_CTRL_FLAG_GET_DEF;
++
+ ret = uvc_ctrl_get_flags(dev, ctrl, info);
+ if (ret < 0) {
+ uvc_trace(UVC_TRACE_CONTROL,
+--
+2.17.1
+
diff --git a/0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch b/0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch
new file mode 100644
index 000000000..126593918
--- /dev/null
+++ b/0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch
@@ -0,0 +1,95 @@
+From f620d1d7afc7db57ab59f35000752840c91f67e7 Mon Sep 17 00:00:00 2001
+From: ming_qian <ming_qian@realsil.com.cn>
+Date: Tue, 8 May 2018 22:13:08 -0400
+Subject: [PATCH] media: uvcvideo: Support realtek's UVC 1.5 device
+
+media: uvcvideo: Support UVC 1.5 video probe & commit controls
+
+The length of UVC 1.5 video control is 48, and it is 34 for UVC 1.1.
+Change it to 48 for UVC 1.5 device, and the UVC 1.5 device can be
+recognized.
+
+More changes to the driver are needed for full UVC 1.5 compatibility.
+However, at least the UVC 1.5 Realtek RTS5847/RTS5852 cameras have been
+reported to work well.
+
+[laurent.pinchart@ideasonboard.com: Factor out code to helper function, update size checks]
+
+Cc: stable@vger.kernel.org
+Signed-off-by: ming_qian <ming_qian@realsil.com.cn>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Tested-by: Ana Guerrero Lopez <ana.guerrero@collabora.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_video.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
+index aa0082fe5833..b28c997a7ab0 100644
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -163,14 +163,27 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
+ }
+ }
+
++static size_t uvc_video_ctrl_size(struct uvc_streaming *stream)
++{
++ /*
++ * Return the size of the video probe and commit controls, which depends
++ * on the protocol version.
++ */
++ if (stream->dev->uvc_version < 0x0110)
++ return 26;
++ else if (stream->dev->uvc_version < 0x0150)
++ return 34;
++ else
++ return 48;
++}
++
+ static int uvc_get_video_ctrl(struct uvc_streaming *stream,
+ struct uvc_streaming_control *ctrl, int probe, u8 query)
+ {
++ u16 size = uvc_video_ctrl_size(stream);
+ u8 *data;
+- u16 size;
+ int ret;
+
+- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
+ if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) &&
+ query == UVC_GET_DEF)
+ return -EIO;
+@@ -225,7 +238,7 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream,
+ ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]);
+ ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]);
+
+- if (size == 34) {
++ if (size >= 34) {
+ ctrl->dwClockFrequency = get_unaligned_le32(&data[26]);
+ ctrl->bmFramingInfo = data[30];
+ ctrl->bPreferedVersion = data[31];
+@@ -254,11 +267,10 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream,
+ static int uvc_set_video_ctrl(struct uvc_streaming *stream,
+ struct uvc_streaming_control *ctrl, int probe)
+ {
++ u16 size = uvc_video_ctrl_size(stream);
+ u8 *data;
+- u16 size;
+ int ret;
+
+- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
+ data = kzalloc(size, GFP_KERNEL);
+ if (data == NULL)
+ return -ENOMEM;
+@@ -275,7 +287,7 @@ static int uvc_set_video_ctrl(struct uvc_streaming *stream,
+ put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]);
+ put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]);
+
+- if (size == 34) {
++ if (size >= 34) {
+ put_unaligned_le32(ctrl->dwClockFrequency, &data[26]);
+ data[30] = ctrl->bmFramingInfo;
+ data[31] = ctrl->bPreferedVersion;
+--
+2.17.1
+
diff --git a/kernel.spec b/kernel.spec
index 40aaf0dd9..b28a18af9 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -654,6 +654,12 @@ Patch511: 2-2-xen-netfront-Update-features-after-registering-netdev.patch
# CVE-2018-12633 rhbz 1594170 1594172
Patch512: 0001-virt-vbox-Only-copy_from_user-the-request-header-onc.patch
+# rhbz 1590304
+Patch513: 0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch
+
+# rhbz 1592454
+Patch514: 0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch
+
# END OF PATCH DEFINITIONS
%endif
@@ -1903,7 +1909,10 @@ fi
#
#
%changelog
-* Fri Jun 22 2018 Justin M. Forbes <jforbes@fedoraproject.org>
+* Mon Jun 25 2018 Laura Abbott <labbott@fedoraproject.org>
+- Some webcam fixes (rhbz 1592454 1590304)
+
+* Fri Jun 22 2018 Justin M. Forbes <jforbes@fedoraproject.org>
- Fix CVE-2018-12633 (rhbz 1594170 1594172)
* Thu Jun 21 2018 Laura Abbott <labbott@fedoraproject.org>