From c59d7ae21d0de702b2fed944992c191e6b691aee Mon Sep 17 00:00:00 2001 From: Joe Burks <joe@wavicle.org> Date: Fri, 6 Jun 2003 01:02:42 -0700 Subject: [PATCH] [PATCH] USB: vicam.c patch I noticed a version of vicam.c a few revisions ago had all the /proc fs writing removed because I was incorrectly using potentially tainted user space pointers. Here's a patch which I think fixes the pointer issue and restores the /proc fs interface to vicam. If this fix is still problematic, please let me know and I'll fix whatever comes up. --- drivers/usb/media/vicam.c | 57 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 53 insertions(+), 4 deletions(-) diff --git a/drivers/usb/media/vicam.c b/drivers/usb/media/vicam.c index 059f673f7f68..5fb2f3966286 100644 --- a/drivers/usb/media/vicam.c +++ b/drivers/usb/media/vicam.c @@ -1101,6 +1101,52 @@ static int vicam_read_proc_gain(char *page, char **start, off_t off, ((struct vicam_camera *)data)->gain); } +static int +vicam_write_proc_shutter(struct file *file, const char *buffer, + unsigned long count, void *data) +{ + u16 stmp; + char kbuf[8]; + struct vicam_camera *cam = (struct vicam_camera *) data; + + if (count > 6) + return -EINVAL; + + if (copy_from_user(kbuf, buffer, count)) + return -EFAULT; + + stmp = (u16) simple_strtoul(kbuf, NULL, 10); + if (stmp < 4 || stmp > 32000) + return -EINVAL; + + cam->shutter_speed = stmp; + + return count; +} + +static int +vicam_write_proc_gain(struct file *file, const char *buffer, + unsigned long count, void *data) +{ + u16 gtmp; + char kbuf[8]; + + struct vicam_camera *cam = (struct vicam_camera *) data; + + if (count > 4) + return -EINVAL; + + if (copy_from_user(kbuf, buffer, count)) + return -EFAULT; + + gtmp = (u16) simple_strtoul(kbuf, NULL, 10); + if (gtmp > 255) + return -EINVAL; + cam->gain = gtmp; + + return count; +} + static void vicam_create_proc_root(void) { @@ -1142,18 +1188,21 @@ vicam_create_proc_entry(struct vicam_camera *cam) if ( !cam->proc_dir ) return; // FIXME: We should probably return an error here - ent = - create_proc_entry("shutter", S_IFREG | S_IRUGO, cam->proc_dir); + ent = create_proc_entry("shutter", S_IFREG | S_IRUGO | S_IWUSR, + cam->proc_dir); if (ent) { ent->data = cam; ent->read_proc = vicam_read_proc_shutter; + ent->write_proc = vicam_write_proc_shutter; ent->size = 64; } - ent = create_proc_entry("gain", S_IFREG | S_IRUGO , cam->proc_dir); - if ( ent ) { + ent = create_proc_entry("gain", S_IFREG | S_IRUGO | S_IWUSR, + cam->proc_dir); + if (ent) { ent->data = cam; ent->read_proc = vicam_read_proc_gain; + ent->write_proc = vicam_write_proc_gain; ent->size = 64; } } -- 2.30.9