media: uvcvideo: Fix bit overflow in uvc_probe_video
authorHangyu Hua <hbh25y@gmail.com>
Thu, 24 Mar 2022 09:13:08 +0000 (10:13 +0100)
committerMauro Carvalho Chehab <mchehab@kernel.org>
Sun, 8 May 2022 05:09:12 +0000 (07:09 +0200)
probe->dwMaxPayloadTransferSize is a 32bit value, but bandwidth is 16bit. This
may lead to a bit overflow.

Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
drivers/media/usb/uvc/uvc_video.c

index 1b4cc934109e8ab51c841aaa8fc7b36ba1d4d5d3..e016f88bdf96528da23cad0a740ba9380760a7fb 100644 (file)
@@ -383,7 +383,6 @@ int uvc_probe_video(struct uvc_streaming *stream,
        struct uvc_streaming_control *probe)
 {
        struct uvc_streaming_control probe_min, probe_max;
-       u16 bandwidth;
        unsigned int i;
        int ret;
 
@@ -421,8 +420,7 @@ int uvc_probe_video(struct uvc_streaming *stream,
                if (stream->intf->num_altsetting == 1)
                        break;
 
-               bandwidth = probe->dwMaxPayloadTransferSize;
-               if (bandwidth <= stream->maxpsize)
+               if (probe->dwMaxPayloadTransferSize <= stream->maxpsize)
                        break;
 
                if (stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX) {