Apply patch to fix uvcvideo crash (rhbz 836742)

This commit is contained in:
Josh Boyer 2012-07-26 10:17:19 -04:00
parent edee8fca9a
commit 9b66eee4c5
2 changed files with 43 additions and 0 deletions

View File

@ -745,6 +745,9 @@ Patch22051: crypto-aesni-intel-fix-wrong-kfree-pointer.patch
#rhbz 772730
Patch22058: ACPI-AC-check-the-return-value-of-power_supply_register.patch
#rhbz 836742
Patch22059: uvcvideo-Reset-bytesused-field-when-recycling-erroneous-buffer.patch
# END OF PATCH DEFINITIONS
%endif
@ -1435,6 +1438,9 @@ ApplyPatch crypto-aesni-intel-fix-wrong-kfree-pointer.patch
#rhbz 772730
ApplyPatch ACPI-AC-check-the-return-value-of-power_supply_register.patch
#rhbz 836742
ApplyPatch uvcvideo-Reset-bytesused-field-when-recycling-erroneous-buffer.patch
# END OF PATCH APPLICATIONS
%endif
@ -2293,6 +2299,7 @@ fi
# || ||
%changelog
* Thu Jul 26 2012 Josh Boyer <jwboyer@redhat.com>
- Apply patch to fix uvcvideo crash (rhbz 836742)
- Enable Intel MEI driver (rhbz 842444)
* Wed Jul 25 2012 Justin M. Forbes <jforbes@redhat.com> - 3.6.0-0.rc0.git2.1

View File

@ -0,0 +1,36 @@
From 3771973542a4807b251352253ed22c50e688e573 Mon Sep 17 00:00:00 2001
From: Jayakrishnan Memana <jayakrishnan.memana@maxim-ic.com>
Date: Sun, 15 Jul 2012 15:54:03 +0200
Subject: [PATCH] uvcvideo: Reset the bytesused field when recycling an erroneous buffer
Buffers marked as erroneous are recycled immediately by the driver if
the nodrop module parameter isn't set. The buffer payload size is reset
to 0, but the buffer bytesused field isn't. This results in the buffer
being immediately considered as complete, leading to an infinite loop in
interrupt context.
Fix the problem by resetting the bytesused field when recycling the
buffer.
Cc: <stable@vger.kernel.org>
Signed-off-by: Jayakrishnan Memana <jayakrishnan.memana@maxim-ic.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
---
drivers/media/video/uvc/uvc_queue.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/media/video/uvc/uvc_queue.c b/drivers/media/video/uvc/uvc_queue.c
index 9288fbd..5577381 100644
--- a/drivers/media/video/uvc/uvc_queue.c
+++ b/drivers/media/video/uvc/uvc_queue.c
@@ -338,6 +338,7 @@ struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue,
if ((queue->flags & UVC_QUEUE_DROP_CORRUPTED) && buf->error) {
buf->error = 0;
buf->state = UVC_BUF_STATE_QUEUED;
+ buf->bytesused = 0;
vb2_set_plane_payload(&buf->buf, 0, 0);
return buf;
}
--
1.7.2.5