V4L/DVB (8195): gspca: Input buffer overwritten in spca561 + cleanup code.

spca561:  Input buffer may be changed on reg write.
(all sd): Cleanup code, 'const' added.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 88 insertions, 77 deletions

diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index 4f23b16c89a8..eb5e1bfd7911 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -24,8 +24,8 @@
 #include "gspca.h"
 #include "jpeg.h"
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 3)
-static const char version[] = "2.1.3";
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 4)
+static const char version[] = "2.1.4";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA/SONIX JPEG USB Camera Driver");
@@ -74,7 +74,6 @@ static int sd_setautogain(struct gspca_dev *gspca_dev, __s32 val);
 static int sd_getautogain(struct gspca_dev *gspca_dev, __s32 *val);
 
 static struct ctrl sd_ctrls[] = {
-#define SD_BRIGHTNESS 0
 	{
 	    {
 		.id      = V4L2_CID_BRIGHTNESS,
@@ -83,12 +82,12 @@ static struct ctrl sd_ctrls[] = {
 		.minimum = 0,
 		.maximum = 0xffff,
 		.step    = 1,
-		.default_value = 0x7fff,
+#define BRIGHTNESS_DEF 0x7fff
+		.default_value = BRIGHTNESS_DEF,
 	    },
 	    .set = sd_setbrightness,
 	    .get = sd_getbrightness,
 	},
-#define SD_CONTRAST 1
 	{
 	    {
 		.id      = V4L2_CID_CONTRAST,
@@ -97,12 +96,12 @@ static struct ctrl sd_ctrls[] = {
 		.minimum = 0,
 		.maximum = 127,
 		.step    = 1,
-		.default_value = 63,
+#define CONTRAST_DEF 63
+		.default_value = CONTRAST_DEF,
 	    },
 	    .set = sd_setcontrast,
 	    .get = sd_getcontrast,
 	},
-#define SD_COLOR 2
 	{
 	    {
 		.id      = V4L2_CID_SATURATION,
@@ -111,12 +110,12 @@ static struct ctrl sd_ctrls[] = {
 		.minimum = 0,
 		.maximum = 255,
 		.step    = 1,
-		.default_value = 127,
+#define COLOR_DEF 127
+		.default_value = COLOR_DEF,
 	    },
 	    .set = sd_setcolors,
 	    .get = sd_getcolors,
 	},
-#define SD_AUTOGAIN 3
 	{
 	    {
 		.id      = V4L2_CID_AUTOGAIN,
@@ -125,7 +124,8 @@ static struct ctrl sd_ctrls[] = {
 		.minimum = 0,
 		.maximum = 1,
 		.step    = 1,
-		.default_value = 1,
+#define AUTOGAIN_DEF 1
+		.default_value = AUTOGAIN_DEF,
 	    },
 	    .set = sd_setautogain,
 	    .get = sd_getautogain,
@@ -139,7 +139,7 @@ static struct cam_mode vga_mode[] = {
 };
 
 /*Data from sn9c102p+hv71331r */
-static __u8 sn_hv7131[] = {
+static const __u8 sn_hv7131[] = {
 	0x00, 0x03, 0x64, 0x00, 0x1A, 0x20, 0x20, 0x20, 0xA1, 0x11,
 /*	reg0  reg1  reg2  reg3  reg4  reg5  reg6  reg7  reg8  reg9 */
 	0x02, 0x09, 0x00, 0x00, 0x00, 0x10, 0x03, 0x00,		/* 00 */
@@ -150,7 +150,7 @@ static __u8 sn_hv7131[] = {
 /*	reg1c reg1d reg1e reg1f reg20 reg21 reg22 reg23 */
 };
 
-static __u8 sn_mi0360[] = {
+static const __u8 sn_mi0360[] = {
 	0x00, 0x61, 0x44, 0x00, 0x1a, 0x20, 0x20, 0x20, 0xb1, 0x5d,
 /*	reg0  reg1  reg2  reg3  reg4  reg5  reg6  reg7  reg8  reg9 */
 	0x07, 0x00, 0x00, 0x00, 0x00, 0x10, 0x03, 0x00,
@@ -161,7 +161,7 @@ static __u8 sn_mi0360[] = {
 /*	reg1c reg1d reg1e reg1f reg20 reg21 reg22 reg23 */
 };
 
-static __u8 sn_mo4000[] = {
+static const __u8 sn_mo4000[] = {
 	0x12,	0x23,	0x60,	0x00,	0x1A,	0x00,	0x20,	0x18,	0x81,
 /*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7	reg8 */
 	0x21,	0x00,	0x00,	0x00,	0x00,	0x00,	0x00,	0x03,	0x00,
@@ -174,13 +174,13 @@ static __u8 sn_mo4000[] = {
 	0xd3,	0xdf,	0xea,	0xf5
 };
 
-static __u8 sn_ov7648[] = {
+static const __u8 sn_ov7648[] = {
 	0x00, 0x21, 0x62, 0x00, 0x1a, 0x20, 0x20, 0x20, 0xA1, 0x6E, 0x18, 0x65,
 	0x00, 0x00, 0x00, 0x10, 0x03, 0x00, 0x00, 0x06, 0x06, 0x28, 0x1E, 0x82,
 	0x07, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
-static __u8 sn_ov7660[]	= {
+static const __u8 sn_ov7660[]	= {
 /*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7	reg8 */
 	0x00,	0x61,	0x40,	0x00,	0x1a,	0x00,	0x00,	0x00,	0x81,
 /* 	reg9	rega	regb	regc	regd	rege	regf	reg10	reg11*/
@@ -192,7 +192,7 @@ static __u8 sn_ov7660[]	= {
 };
 
 /* sequence specific to the sensors - !! index = SENSOR_xxx */
-static __u8 *sn_tb[] = {
+static const __u8 *sn_tb[] = {
 	sn_hv7131,
 	sn_mi0360,
 	sn_mo4000,
@@ -200,28 +200,28 @@ static __u8 *sn_tb[] = {
 	sn_ov7660
 };
 
-static __u8 regsn20[] = {
+static const __u8 regsn20[] = {
 	0x00, 0x2d, 0x46, 0x5a, 0x6c, 0x7c, 0x8b, 0x99,
 	0xa6, 0xb2, 0xbf, 0xca, 0xd5, 0xe0, 0xeb, 0xf5, 0xff
 };
-static __u8 regsn20_sn9c325[] = {
+static const __u8 regsn20_sn9c325[] = {
 	0x0a, 0x3a, 0x56, 0x6c, 0x7e, 0x8d, 0x9a, 0xa4,
 	0xaf, 0xbb, 0xc5, 0xcd, 0xd5, 0xde, 0xe8, 0xed, 0xf5
 };
 
-static __u8 reg84[] = {
+static const __u8 reg84[] = {
 	0x14, 0x00, 0x27, 0x00, 0x07, 0x00, 0xe5, 0x0f,
 	0xe4, 0x0f, 0x38, 0x00, 0x3e, 0x00, 0xc3, 0x0f,
 /*	0x00, 0x00, 0x00, 0x00, 0x00 */
 	0xf7, 0x0f, 0x0a, 0x00, 0x00
 };
-static __u8 reg84_sn9c325[] = {
+static const __u8 reg84_sn9c325[] = {
 	0x14, 0x00, 0x27, 0x00, 0x07, 0x00, 0xe4, 0x0f,
 	0xd3, 0x0f, 0x4b, 0x00, 0x48, 0x00, 0xc0, 0x0f,
 	0xf8, 0x0f, 0x00, 0x00, 0x00
 };
 
-static __u8 hv7131r_sensor_init[][8] = {
+static const __u8 hv7131r_sensor_init[][8] = {
 	{0xC1, 0x11, 0x01, 0x08, 0x01, 0x00, 0x00, 0x10},
 	{0xB1, 0x11, 0x34, 0x17, 0x7F, 0x00, 0x00, 0x10},
 	{0xD1, 0x11, 0x40, 0xFF, 0x7F, 0x7F, 0x7F, 0x10},
@@ -250,9 +250,9 @@ static __u8 hv7131r_sensor_init[][8] = {
 	{0xA1, 0x11, 0x21, 0xD0, 0x00, 0x00, 0x00, 0x10},
 	{0xA1, 0x11, 0x22, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xA1, 0x11, 0x23, 0x10, 0x00, 0x00, 0x00, 0x10},
-	{0, 0, 0, 0, 0, 0, 0, 0}
+	{}
 };
-static __u8 mi0360_sensor_init[][8] = {
+static const __u8 mi0360_sensor_init[][8] = {
 	{0xB1, 0x5D, 0x07, 0x00, 0x02, 0x00, 0x00, 0x10},
 	{0xB1, 0x5D, 0x0D, 0x00, 0x01, 0x00, 0x00, 0x10},
 	{0xB1, 0x5D, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x10},
@@ -304,9 +304,9 @@ static __u8 mi0360_sensor_init[][8] = {
 /*	{0xB1, 0x5D, 0x35, 0x00, 0x20, 0x00, 0x00, 0x10}, * gain */
 	{0xB1, 0x5D, 0x07, 0x00, 0x03, 0x00, 0x00, 0x10}, /* update */
 	{0xB1, 0x5D, 0x07, 0x00, 0x02, 0x00, 0x00, 0x10}, /* sensor on */
-	{0, 0, 0, 0, 0, 0, 0, 0}
+	{}
 };
-static __u8 mo4000_sensor_init[][8] = {
+static const __u8 mo4000_sensor_init[][8] = {
 	{0xa1, 0x21, 0x01, 0x02, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x02, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x03, 0x00, 0x00, 0x00, 0x00, 0x10},
@@ -327,9 +327,9 @@ static __u8 mo4000_sensor_init[][8] = {
 	{0xa1, 0x21, 0x10, 0x20, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x11, 0x38, 0x00, 0x00, 0x00, 0x10},
-	{0, 0, 0, 0, 0, 0, 0, 0}
+	{}
 };
-static __u8 ov7660_sensor_init[][8] = {
+static const __u8 ov7660_sensor_init[][8] = {
 	{0xa1, 0x21, 0x12, 0x80, 0x00, 0x00, 0x00, 0x10}, /* reset SCCB */
 	{0xa1, 0x21, 0x12, 0x05, 0x00, 0x00, 0x00, 0x10},
 						/* Outformat ?? rawRGB */
@@ -420,12 +420,12 @@ static __u8 ov7660_sensor_init[][8] = {
 	{0xa1, 0x21, 0x2a, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x2b, 0xc3, 0x00, 0x00, 0x00, 0x10},
 /* here may start the isoc exchanges */
-	{0, 0, 0, 0, 0, 0, 0, 0}
+	{}
 };
 /* reg0x04		reg0x07		reg 0x10 */
 /* expo  = (COM1 & 0x02) | (AECHH & 0x2f <<10) [ (AECh << 2) */
 
-static __u8 ov7648_sensor_init[][8] = {
+static const __u8 ov7648_sensor_init[][8] = {
 	{0xC1, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00},
 	{0xC1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00},
 	{0xC1, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00},
@@ -478,10 +478,10 @@ static __u8 ov7648_sensor_init[][8] = {
 	{0xA1, 0x6E, 0x07, 0x66, 0x00, 0x00, 0x00, 0x10}, /* B.. */
 	{0xC1, 0x6E, 0x1A, 0x03, 0x65, 0x90, 0x00, 0x10}, /* Bright/Witen....*/
 /*	{0xC1, 0x6E, 0x16, 0x45, 0x40, 0x60, 0x00, 0x10},  * Bright/Witene */
-	{0, 0, 0, 0, 0, 0, 0, 0}
+	{}
 };
 
-static __u8 qtable4[] = {
+static const __u8 qtable4[] = {
 	0x06, 0x04, 0x04, 0x06, 0x04, 0x04, 0x06, 0x06, 0x06, 0x06, 0x08, 0x06,
 	0x06, 0x08, 0x0A, 0x11,
 	0x0A, 0x0A, 0x08, 0x08, 0x0A, 0x15, 0x0F, 0x0F, 0x0C, 0x11, 0x19, 0x15,
@@ -518,27 +518,36 @@ static void reg_w(struct usb_device *dev,
 			  const __u8 *buffer,
 			  int len)
 {
-	__u8 tmpbuf[64];
-
-#ifdef CONFIG_VIDEO_ADV_DEBUG
-	if (len > sizeof tmpbuf) {
-		PDEBUG(D_ERR|D_PACK, "reg_w: buffer overflow");
-		return;
+	if (len < 16) {
+		__u8 tmpbuf[16];
+
+		memcpy(tmpbuf, buffer, len);
+		usb_control_msg(dev,
+				usb_sndctrlpipe(dev, 0),
+				0x08,
+			   USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+				value, 0,
+				tmpbuf, len,
+				500);
+	} else {
+		__u8 *tmpbuf;
+
+		tmpbuf = kmalloc(len, GFP_KERNEL);
+		memcpy(tmpbuf, buffer, len);
+		usb_control_msg(dev,
+				usb_sndctrlpipe(dev, 0),
+				0x08,
+			   USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+				value, 0,
+				tmpbuf, len,
+				500);
+		kfree(tmpbuf);
 	}
-#endif
-	memcpy(tmpbuf, buffer, len);
-	usb_control_msg(dev,
-			usb_sndctrlpipe(dev, 0),
-			0x08,
-			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-			value, 0,
-			tmpbuf, len,
-			500);
 }
 
 /* write 2 bytes */
 static void i2c_w2(struct gspca_dev *gspca_dev,
-		   __u8 *buffer)
+		   const __u8 *buffer)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct usb_device *dev = gspca_dev->dev;
@@ -557,7 +566,7 @@ static void i2c_w2(struct gspca_dev *gspca_dev,
 }
 
 /* write 8 bytes */
-static void i2c_w8(struct usb_device *dev, __u8 *buffer)
+static void i2c_w8(struct usb_device *dev, const __u8 *buffer)
 {
 	reg_w(dev, 0x08, buffer, 8);
 	msleep(1);
@@ -565,7 +574,7 @@ static void i2c_w8(struct usb_device *dev, __u8 *buffer)
 
 /* read 5 bytes */
 static void i2c_r5(struct gspca_dev *gspca_dev, __u8 reg,
-			     __u8 *buffer)
+		   __u8 *buffer)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct usb_device *dev = gspca_dev->dev;
@@ -591,7 +600,7 @@ static int probesensor(struct gspca_dev *gspca_dev)
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct usb_device *dev = gspca_dev->dev;
 	__u8 reg02;
-	static __u8 datasend[] = { 2, 0 };
+	static const __u8 datasend[] = { 2, 0 };
 	/* reg val1 val2 val3 val4 */
 	__u8 datarecd[6];
 
@@ -618,18 +627,18 @@ static int probesensor(struct gspca_dev *gspca_dev)
 }
 
 static int configure_gpio(struct gspca_dev *gspca_dev,
-			  __u8 *sn9c1xx)
+			  const __u8 *sn9c1xx)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct usb_device *dev = gspca_dev->dev;
 	__u8 data;
 	__u8 regF1;
-	__u8 *reg9a;
-	static __u8 reg9a_def[] =
+	const __u8 *reg9a;
+	static const __u8 reg9a_def[] =
 		{0x08, 0x40, 0x20, 0x10, 0x00, 0x04};
-	static __u8 reg9a_sn9c120[] =			/* from win trace */
+	static const __u8 reg9a_sn9c120[] =		/* from win trace */
 		{0x00, 0x40, 0x38, 0x30, 0x00, 0x20};
-	static __u8 reg9a_sn9c325[] =
+	static const __u8 reg9a_sn9c325[] =
 		{0x0a, 0x40, 0x38, 0x30, 0x00, 0x20};
 
 
@@ -697,7 +706,7 @@ static void hv7131R_InitSensor(struct gspca_dev *gspca_dev)
 {
 	int i = 0;
 	struct usb_device *dev = gspca_dev->dev;
-	static __u8 SetSensorClk[] =		/* 0x08 Mclk */
+	static const __u8 SetSensorClk[] =	/* 0x08 Mclk */
 		{ 0xa1, 0x11, 0x01, 0x18, 0x00, 0x00, 0x00, 0x10 };
 
 	while (hv7131r_sensor_init[i][0]) {
@@ -971,11 +980,12 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	cam->epaddr = 0x01;
 	cam->cam_mode = vga_mode;
 	cam->nmodes = ARRAY_SIZE(vga_mode);
+
 	sd->qindex = 4;			/* set the quantization table */
-	sd->brightness = sd_ctrls[SD_BRIGHTNESS].qctrl.default_value;
-	sd->contrast = sd_ctrls[SD_CONTRAST].qctrl.default_value;
-	sd->colors = sd_ctrls[SD_COLOR].qctrl.default_value;
-	sd->autogain = sd_ctrls[SD_AUTOGAIN].qctrl.default_value;
+	sd->brightness = BRIGHTNESS_DEF;
+	sd->contrast = CONTRAST_DEF;
+	sd->colors = COLOR_DEF;
+	sd->autogain = AUTOGAIN_DEF;
 	return 0;
 }
 
@@ -984,7 +994,7 @@ static int sd_open(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct usb_device *dev = gspca_dev->dev;
-/*	__u8 *sn9c1xx; */
+/*	const __u8 *sn9c1xx; */
 	__u8 regF1;
 	__u8 regGpio[] = { 0x29, 0x74 };
 
@@ -1036,11 +1046,11 @@ static unsigned int setexposure(struct gspca_dev *gspca_dev,
 				unsigned int expo)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	static __u8 doit[] =			/* update sensor */
+	static const __u8 doit[] =		/* update sensor */
 		{ 0xb1, 0x5d, 0x07, 0x00, 0x03, 0x00, 0x00, 0x10 };
-	static __u8 sensorgo[] =		/* sensor on */
+	static const __u8 sensorgo[] =		/* sensor on */
 		{ 0xb1, 0x5d, 0x07, 0x00, 0x02, 0x00, 0x00, 0x10 };
-	static __u8 gainMo[] =
+	static const __u8 gainMo[] =
 		{ 0xa1, 0x21, 0x00, 0x10, 0x00, 0x00, 0x00, 0x1d };
 
 	switch (sd->sensor) {
@@ -1164,14 +1174,15 @@ static void sd_start(struct gspca_dev *gspca_dev)
 	__u8 data;
 	__u8 reg1;
 	__u8 reg17;
-	__u8 *sn9c1xx;
+	const __u8 *sn9c1xx;
 	int mode;
-	static __u8 DC29[] = { 0x6a, 0x50, 0x00, 0x00, 0x50, 0x3c };
-	static __u8 C0[] = { 0x2d, 0x2d, 0x3a, 0x05, 0x04, 0x3f };
-	static __u8 CA[] = { 0x28, 0xd8, 0x14, 0xec };
-	static __u8 CA_sn9c120[] = { 0x14, 0xec, 0x0a, 0xf6 }; /* SN9C120 */
-	static __u8 CE[] = { 0x32, 0xdd, 0x2d, 0xdd };	/* MI0360 */
-	static __u8 CE_sn9c325[] =
+	static const __u8 DC29[] = { 0x6a, 0x50, 0x00, 0x00, 0x50, 0x3c };
+	static const __u8 C0[] = { 0x2d, 0x2d, 0x3a, 0x05, 0x04, 0x3f };
+	static const __u8 CA[] = { 0x28, 0xd8, 0x14, 0xec };
+	static const __u8 CA_sn9c120[] =
+				 { 0x14, 0xec, 0x0a, 0xf6 };	/* SN9C120 */
+	static const __u8 CE[] = { 0x32, 0xdd, 0x2d, 0xdd };	/* MI0360 */
+	static const __u8 CE_sn9c325[] =
 			{ 0x32, 0xdd, 0x32, 0xdd };	/* OV7648 - SN9C325 */
 
 	sn9c1xx = sn_tb[(int) sd->sensor];
@@ -1311,13 +1322,13 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct usb_device *dev = gspca_dev->dev;
-	static __u8 stophv7131[] =
+	static const __u8 stophv7131[] =
 		{ 0xa1, 0x11, 0x02, 0x09, 0x00, 0x00, 0x00, 0x10 };
-	static __u8 stopmi0360[] =
+	static const __u8 stopmi0360[] =
 		{ 0xb1, 0x5d, 0x07, 0x00, 0x00, 0x00, 0x00, 0x10 };
 	__u8 regF1;
 	__u8 data;
-	__u8 *sn9c1xx;
+	const __u8 *sn9c1xx;
 
 	data = 0x0b;
 	switch (sd->sensor) {
@@ -1392,7 +1403,7 @@ static void setautogain(struct gspca_dev *gspca_dev)
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 			struct gspca_frame *frame,	/* target */
-			unsigned char *data,		/* isoc packet */
+			__u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -1567,7 +1578,7 @@ static int sd_getautogain(struct gspca_dev *gspca_dev, __s32 *val)
 }
 
 /* sub-driver description */
-static struct sd_desc sd_desc = {
+static const struct sd_desc sd_desc = {
 	.name = MODULE_NAME,
 	.ctrls = sd_ctrls,
 	.nctrls = ARRAY_SIZE(sd_ctrls),
@@ -1582,7 +1593,7 @@ static struct sd_desc sd_desc = {
 
 /* -- module initialisation -- */
 #define DVNM(name) .driver_info = (kernel_ulong_t) name
-static __devinitdata struct usb_device_id device_table[] = {
+static const __devinitdata struct usb_device_id device_table[] = {
 	{USB_DEVICE(0x0458, 0x7025), DVNM("Genius Eye 311Q")},
 	{USB_DEVICE(0x045e, 0x00f5), DVNM("MicroSoft VX3000")},
 	{USB_DEVICE(0x045e, 0x00f7), DVNM("MicroSoft VX1000")},