diff options
| -rw-r--r-- | 0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch | 65 | ||||
| -rw-r--r-- | 0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch | 95 | ||||
| -rw-r--r-- | kernel.spec | 11 |
3 files changed, 170 insertions, 1 deletions
diff --git a/0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch b/0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch new file mode 100644 index 000000000..76f2ce025 --- /dev/null +++ b/0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch @@ -0,0 +1,65 @@ +From 0dc68cabdb626e33d02561529e6a4c681b72a784 Mon Sep 17 00:00:00 2001 +From: Kieran Bingham <kieran.bingham@ideasonboard.com> +Date: Wed, 21 Mar 2018 11:43:08 -0400 +Subject: [PATCH] media: uvcvideo: Prevent setting unavailable flags + +The addition of an extra operation to use the GET_INFO command +overwrites all existing flags from the uvc_ctrls table. This includes +setting all controls as supporting GET_MIN, GET_MAX, GET_RES, and +GET_DEF regardless of whether they do or not. + +Move the initialisation of these control capabilities directly to the +uvc_ctrl_fill_xu_info() call where they were originally located in that +use case, and ensure that the new functionality in uvc_ctrl_get_flags() +will only set flags based on their reported capability from the GET_INFO +call. + +Fixes: 859086ae3636 ("media: uvcvideo: Apply flags from device to actual properties") + +Cc: stable@vger.kernel.org +Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com> +Tested-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com> +Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> +--- + drivers/media/usb/uvc/uvc_ctrl.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 102594ec3e97..a36b4fb949fa 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1607,14 +1607,12 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, + ret = uvc_query_ctrl(dev, UVC_GET_INFO, ctrl->entity->id, dev->intfnum, + info->selector, data, 1); + if (!ret) +- info->flags = UVC_CTRL_FLAG_GET_MIN | UVC_CTRL_FLAG_GET_MAX +- | UVC_CTRL_FLAG_GET_RES | UVC_CTRL_FLAG_GET_DEF +- | (data[0] & UVC_CONTROL_CAP_GET ? +- UVC_CTRL_FLAG_GET_CUR : 0) +- | (data[0] & UVC_CONTROL_CAP_SET ? +- UVC_CTRL_FLAG_SET_CUR : 0) +- | (data[0] & UVC_CONTROL_CAP_AUTOUPDATE ? +- UVC_CTRL_FLAG_AUTO_UPDATE : 0); ++ info->flags |= (data[0] & UVC_CONTROL_CAP_GET ? ++ UVC_CTRL_FLAG_GET_CUR : 0) ++ | (data[0] & UVC_CONTROL_CAP_SET ? ++ UVC_CTRL_FLAG_SET_CUR : 0) ++ | (data[0] & UVC_CONTROL_CAP_AUTOUPDATE ? ++ UVC_CTRL_FLAG_AUTO_UPDATE : 0); + + kfree(data); + return ret; +@@ -1689,6 +1687,9 @@ static int uvc_ctrl_fill_xu_info(struct uvc_device *dev, + + info->size = le16_to_cpup((__le16 *)data); + ++ info->flags = UVC_CTRL_FLAG_GET_MIN | UVC_CTRL_FLAG_GET_MAX ++ | UVC_CTRL_FLAG_GET_RES | UVC_CTRL_FLAG_GET_DEF; ++ + ret = uvc_ctrl_get_flags(dev, ctrl, info); + if (ret < 0) { + uvc_trace(UVC_TRACE_CONTROL, +-- +2.17.1 + diff --git a/0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch b/0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch new file mode 100644 index 000000000..126593918 --- /dev/null +++ b/0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch @@ -0,0 +1,95 @@ +From f620d1d7afc7db57ab59f35000752840c91f67e7 Mon Sep 17 00:00:00 2001 +From: ming_qian <ming_qian@realsil.com.cn> +Date: Tue, 8 May 2018 22:13:08 -0400 +Subject: [PATCH] media: uvcvideo: Support realtek's UVC 1.5 device + +media: uvcvideo: Support UVC 1.5 video probe & commit controls + +The length of UVC 1.5 video control is 48, and it is 34 for UVC 1.1. +Change it to 48 for UVC 1.5 device, and the UVC 1.5 device can be +recognized. + +More changes to the driver are needed for full UVC 1.5 compatibility. +However, at least the UVC 1.5 Realtek RTS5847/RTS5852 cameras have been +reported to work well. + +[laurent.pinchart@ideasonboard.com: Factor out code to helper function, update size checks] + +Cc: stable@vger.kernel.org +Signed-off-by: ming_qian <ming_qian@realsil.com.cn> +Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> +Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com> +Tested-by: Ana Guerrero Lopez <ana.guerrero@collabora.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> +--- + drivers/media/usb/uvc/uvc_video.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c +index aa0082fe5833..b28c997a7ab0 100644 +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -163,14 +163,27 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream, + } + } + ++static size_t uvc_video_ctrl_size(struct uvc_streaming *stream) ++{ ++ /* ++ * Return the size of the video probe and commit controls, which depends ++ * on the protocol version. ++ */ ++ if (stream->dev->uvc_version < 0x0110) ++ return 26; ++ else if (stream->dev->uvc_version < 0x0150) ++ return 34; ++ else ++ return 48; ++} ++ + static int uvc_get_video_ctrl(struct uvc_streaming *stream, + struct uvc_streaming_control *ctrl, int probe, u8 query) + { ++ u16 size = uvc_video_ctrl_size(stream); + u8 *data; +- u16 size; + int ret; + +- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26; + if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) && + query == UVC_GET_DEF) + return -EIO; +@@ -225,7 +238,7 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream, + ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]); + ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]); + +- if (size == 34) { ++ if (size >= 34) { + ctrl->dwClockFrequency = get_unaligned_le32(&data[26]); + ctrl->bmFramingInfo = data[30]; + ctrl->bPreferedVersion = data[31]; +@@ -254,11 +267,10 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream, + static int uvc_set_video_ctrl(struct uvc_streaming *stream, + struct uvc_streaming_control *ctrl, int probe) + { ++ u16 size = uvc_video_ctrl_size(stream); + u8 *data; +- u16 size; + int ret; + +- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26; + data = kzalloc(size, GFP_KERNEL); + if (data == NULL) + return -ENOMEM; +@@ -275,7 +287,7 @@ static int uvc_set_video_ctrl(struct uvc_streaming *stream, + put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]); + put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]); + +- if (size == 34) { ++ if (size >= 34) { + put_unaligned_le32(ctrl->dwClockFrequency, &data[26]); + data[30] = ctrl->bmFramingInfo; + data[31] = ctrl->bPreferedVersion; +-- +2.17.1 + diff --git a/kernel.spec b/kernel.spec index 40aaf0dd9..b28a18af9 100644 --- a/kernel.spec +++ b/kernel.spec @@ -654,6 +654,12 @@ Patch511: 2-2-xen-netfront-Update-features-after-registering-netdev.patch # CVE-2018-12633 rhbz 1594170 1594172 Patch512: 0001-virt-vbox-Only-copy_from_user-the-request-header-onc.patch +# rhbz 1590304 +Patch513: 0001-media-uvcvideo-Prevent-setting-unavailable-flags.patch + +# rhbz 1592454 +Patch514: 0001-media-uvcvideo-Support-realtek-s-UVC-1.5-device.patch + # END OF PATCH DEFINITIONS %endif @@ -1903,7 +1909,10 @@ fi # # %changelog -* Fri Jun 22 2018 Justin M. Forbes <jforbes@fedoraproject.org> +* Mon Jun 25 2018 Laura Abbott <labbott@fedoraproject.org> +- Some webcam fixes (rhbz 1592454 1590304) + +* Fri Jun 22 2018 Justin M. Forbes <jforbes@fedoraproject.org> - Fix CVE-2018-12633 (rhbz 1594170 1594172) * Thu Jun 21 2018 Laura Abbott <labbott@fedoraproject.org> |