media: uvcvideo: Rollback non processed entities on error

commit a70705d3c020d0d5c3ab6a5cc93e011ac35e7d48 upstream.

If we fail to commit an entity, we need to restore the
UVC_CTRL_DATA_BACKUP for the other uncommitted entities. Otherwise the
control cache and the device would be out of sync.

Cc: stable@kernel.org
Fixes: b4012002f3a3 ("[media] uvcvideo: Add support for control events")
Reported-by: Hans de Goede <hdegoede@redhat.com>
Closes: https://lore.kernel.org/linux-media/fe845e04-9fde-46ee-9763-a6f00867929a@redhat.com/
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Message-ID: <20250224-uvc-data-backup-v2-3-de993ed9823b@chromium.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index a4b082df3b06316da6809f42c372ef3d947fab53..4f67ba3a7c028e7339ca3bdb998b2823555ca992 100644 (file)
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1577,7 +1577,7 @@ static int uvc_ctrl_commit_entity(struct uvc_device *dev,
        unsigned int processed_ctrls = 0;
        struct uvc_control *ctrl;
        unsigned int i;
-       int ret;
+       int ret = 0;
 
        if (entity == NULL)
                return 0;
@@ -1605,8 +1605,6 @@ static int uvc_ctrl_commit_entity(struct uvc_device *dev,
                                dev->intfnum, ctrl->info.selector,
                                uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT),
                                ctrl->info.size);
-               else
-                       ret = 0;
 
                if (!ret)
                        processed_ctrls++;
@@ -1618,14 +1616,22 @@ static int uvc_ctrl_commit_entity(struct uvc_device *dev,
 
                ctrl->dirty = 0;
 
-               if (ret < 0)
-                       return ret;
-
-               if (!rollback && handle &&
+               if (!rollback && handle && !ret &&
                    ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS)
                        uvc_ctrl_set_handle(handle, ctrl, handle);
+
+               if (ret < 0 && !rollback) {
+                       /*
+                        * If we fail to set a control, we need to rollback
+                        * the next ones.
+                        */
+                       rollback = 1;
+               }
        }
 
+       if (ret)
+               return ret;
+
        return processed_ctrls;
 }
 
@@ -1635,23 +1641,31 @@ int __uvc_ctrl_commit(struct uvc_fh *handle, int rollback,
 {
        struct uvc_video_chain *chain = handle->chain;
        struct uvc_entity *entity;
-       int ret = 0;
+       int ret_out = 0;
+       int ret;
 
        /* Find the control. */
        list_for_each_entry(entity, &chain->entities, chain) {
                ret = uvc_ctrl_commit_entity(chain->dev, handle, entity,
                                             rollback);
-               if (ret < 0)
-                       goto done;
-               else if (ret > 0 && !rollback)
+               if (ret < 0) {
+                       /*
+                        * When we fail to commit an entity, we need to
+                        * restore the UVC_CTRL_DATA_BACKUP for all the
+                        * controls in the other entities, otherwise our cache
+                        * and the hardware will be out of sync.
+                        */
+                       rollback = 1;
+
+                       ret_out = ret;
+               } else if (ret > 0 && !rollback) {
                        uvc_ctrl_send_events(handle, entity, xctrls,
                                             xctrls_count);
+               }
        }
 
-       ret = 0;
-done:
        mutex_unlock(&chain->ctrl_mutex);
-       return ret;
+       return ret_out;
 }
 
 int uvc_ctrl_get(struct uvc_video_chain *chain,