media: gspca/sunplus: fix zero-length control requests

commit b4bb4d425b7b02424afea2dfdcd77b3b4794175e upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Control transfers without a data stage are treated as OUT requests by
the USB stack and should be using usb_sndctrlpipe(). Failing to do so
will now trigger a warning.

Fix the single zero-length control request which was using the
read-register helper, and update the helper so that zero-length reads
fail with an error message instead.

Fixes: 6a7eba24e4f0 ("V4L/DVB (8157): gspca: all subdrivers")
Cc: stable@vger.kernel.org      # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
index ace3da4..971dee0 100644 (file)
--- a/drivers/media/usb/gspca/sunplus.c
+++ b/drivers/media/usb/gspca/sunplus.c
@@ -242,6 +242,10 @@ static void reg_r(struct gspca_dev *gspca_dev,
                gspca_err(gspca_dev, "reg_r: buffer overflow\n");
                return;
        }
+       if (len == 0) {
+               gspca_err(gspca_dev, "reg_r: zero-length read\n");
+               return;
+       }
        if (gspca_dev->usb_err < 0)
                return;
        ret = usb_control_msg(gspca_dev->dev,
@@ -250,7 +254,7 @@ static void reg_r(struct gspca_dev *gspca_dev,
                        USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                        0,              /* value */
                        index,
-                       len ? gspca_dev->usb_buf : NULL, len,
+                       gspca_dev->usb_buf, len,
                        500);
        if (ret < 0) {
                pr_err("reg_r err %d\n", ret);
@@ -727,7 +731,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
                case MegaImageVI:
                        reg_w_riv(gspca_dev, 0xf0, 0, 0);
                        spca504B_WaitCmdStatus(gspca_dev);
-                       reg_r(gspca_dev, 0xf0, 4, 0);
+                       reg_w_riv(gspca_dev, 0xf0, 4, 0);
                        spca504B_WaitCmdStatus(gspca_dev);
                        break;
                default: