korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-15 08:14:15 +08:00
Code Issues Packages Projects Releases Wiki Activity
f7e3ac300e
linux/drivers
History
Ricardo Ribalda c666d46b3f media: uvcvideo: Fix integer overflow calculating timestamp 
commit 8676a5e796 upstream.

The function uvc_video_clock_update() supports a single SOF overflow. Or
in other words, the maximum difference between the first ant the last
timestamp can be 4096 ticks or 4.096 seconds.

This results in a maximum value for y2 of: 0x12FBECA00, that overflows
32bits.
y2 = (u32)ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1;

Extend the size of y2 to u64 to support all its values.

Without this patch:
 # yavta -s 1920x1080 -f YUYV -t 1/5 -c /dev/video0
Device /dev/v4l/by-id/usb-Shine-Optics_Integrated_Camera_0001-video-index0 opened.
Device `Integrated Camera: Integrated C' on `usb-0000:00:14.0-6' (driver 'uvcvideo') supports video, capture, without mplanes.
Video format set: YUYV (56595559) 1920x1080 (stride 3840) field none buffer size 4147200
Video format: YUYV (56595559) 1920x1080 (stride 3840) field none buffer size 4147200
Current frame rate: 1/5
Setting frame rate to: 1/5
Frame rate set: 1/5
8 buffers requested.
length: 4147200 offset: 0 timestamp type/source: mono/SoE
Buffer 0/0 mapped at address 0x7947ea94c000.
length: 4147200 offset: 4149248 timestamp type/source: mono/SoE
Buffer 1/0 mapped at address 0x7947ea557000.
length: 4147200 offset: 8298496 timestamp type/source: mono/SoE
Buffer 2/0 mapped at address 0x7947ea162000.
length: 4147200 offset: 12447744 timestamp type/source: mono/SoE
Buffer 3/0 mapped at address 0x7947e9d6d000.
length: 4147200 offset: 16596992 timestamp type/source: mono/SoE
Buffer 4/0 mapped at address 0x7947e9978000.
length: 4147200 offset: 20746240 timestamp type/source: mono/SoE
Buffer 5/0 mapped at address 0x7947e9583000.
length: 4147200 offset: 24895488 timestamp type/source: mono/SoE
Buffer 6/0 mapped at address 0x7947e918e000.
length: 4147200 offset: 29044736 timestamp type/source: mono/SoE
Buffer 7/0 mapped at address 0x7947e8d99000.
0 (0) [-] none 0 4147200 B 507.554210 508.874282 242.836 fps ts mono/SoE
1 (1) [-] none 2 4147200 B 508.886298 509.074289 0.751 fps ts mono/SoE
2 (2) [-] none 3 4147200 B 509.076362 509.274307 5.261 fps ts mono/SoE
3 (3) [-] none 4 4147200 B 509.276371 509.474336 5.000 fps ts mono/SoE
4 (4) [-] none 5 4147200 B 509.476394 509.674394 4.999 fps ts mono/SoE
5 (5) [-] none 6 4147200 B 509.676506 509.874345 4.997 fps ts mono/SoE
6 (6) [-] none 7 4147200 B 509.876430 510.074370 5.002 fps ts mono/SoE
7 (7) [-] none 8 4147200 B 510.076434 510.274365 5.000 fps ts mono/SoE
8 (0) [-] none 9 4147200 B 510.276421 510.474333 5.000 fps ts mono/SoE
9 (1) [-] none 10 4147200 B 510.476391 510.674429 5.001 fps ts mono/SoE
10 (2) [-] none 11 4147200 B 510.676434 510.874283 4.999 fps ts mono/SoE
11 (3) [-] none 12 4147200 B 510.886264 511.074349 4.766 fps ts mono/SoE
12 (4) [-] none 13 4147200 B 511.070577 511.274304 5.426 fps ts mono/SoE
13 (5) [-] none 14 4147200 B 511.286249 511.474301 4.637 fps ts mono/SoE
14 (6) [-] none 15 4147200 B 511.470542 511.674251 5.426 fps ts mono/SoE
15 (7) [-] none 16 4147200 B 511.672651 511.874337 4.948 fps ts mono/SoE
16 (0) [-] none 17 4147200 B 511.873988 512.074462 4.967 fps ts mono/SoE
17 (1) [-] none 18 4147200 B 512.075982 512.278296 4.951 fps ts mono/SoE
18 (2) [-] none 19 4147200 B 512.282631 512.482423 4.839 fps ts mono/SoE
19 (3) [-] none 20 4147200 B 518.986637 512.686333 0.149 fps ts mono/SoE
20 (4) [-] none 21 4147200 B 518.342709 512.886386 -1.553 fps ts mono/SoE
21 (5) [-] none 22 4147200 B 517.909812 513.090360 -2.310 fps ts mono/SoE
22 (6) [-] none 23 4147200 B 517.590775 513.294454 -3.134 fps ts mono/SoE
23 (7) [-] none 24 4147200 B 513.298465 513.494335 -0.233 fps ts mono/SoE
24 (0) [-] none 25 4147200 B 513.510273 513.698375 4.721 fps ts mono/SoE
25 (1) [-] none 26 4147200 B 513.698904 513.902327 5.301 fps ts mono/SoE
26 (2) [-] none 27 4147200 B 513.895971 514.102348 5.074 fps ts mono/SoE
27 (3) [-] none 28 4147200 B 514.099091 514.306337 4.923 fps ts mono/SoE
28 (4) [-] none 29 4147200 B 514.310348 514.510567 4.734 fps ts mono/SoE
29 (5) [-] none 30 4147200 B 514.509295 514.710367 5.026 fps ts mono/SoE
30 (6) [-] none 31 4147200 B 521.532513 514.914398 0.142 fps ts mono/SoE
31 (7) [-] none 32 4147200 B 520.885277 515.118385 -1.545 fps ts mono/SoE
32 (0) [-] none 33 4147200 B 520.411140 515.318336 -2.109 fps ts mono/SoE
33 (1) [-] none 34 4147200 B 515.325425 515.522278 -0.197 fps ts mono/SoE
34 (2) [-] none 35 4147200 B 515.538276 515.726423 4.698 fps ts mono/SoE
35 (3) [-] none 36 4147200 B 515.720767 515.930373 5.480 fps ts mono/SoE

Cc: stable@vger.kernel.org
Fixes: 66847ef013 ("[media] uvcvideo: Add UVC timestamps support")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/20240610-hwtimestamp-followup-v1-2-f9eaed7be7f0@chromium.org
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-08-19 05:45:14 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-16 13:39:11 +02:00
acpi ACPI: EC: Avoid returning AE_OK on errors in address space handler 2024-07-27 10:46:07 +02:00
amba
android binder: fix max_thread type inconsistency 2024-05-25 16:20:18 +02:00
ata ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error 2024-08-19 05:45:12 +02:00
atm atm: idt77252: fix a memleak in open_card_ubr0 2024-02-23 08:54:57 +01:00
auxdisplay
base regmap-i2c: Subtract reg size from max_write 2024-07-18 13:07:35 +02:00
bcma
block null_blk: fix validation of block size 2024-07-27 10:46:09 +02:00
bluetooth Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot 2024-07-18 13:07:33 +02:00
bus bus: tegra-aconnect: Update dependency to ARCH_TEGRA 2024-03-26 18:21:19 -04:00
cdrom
char char: tpm: Fix possible memory leak in tpm_bios_measurements_open() 2024-08-19 05:45:11 +02:00
clk clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock 2024-08-19 05:45:04 +02:00
clocksource clocksource/drivers/arm_global_timer: Fix maximum prescaler value 2024-04-10 16:18:46 +02:00
comedi comedi: vmk80xx: fix incomplete endpoint checking 2024-04-27 17:05:26 +02:00
connector
counter
cpufreq cppc_cpufreq: Fix possible null pointer dereference 2024-06-16 13:39:21 +02:00
cpuidle cpuidle: Avoid potential overflow in integer multiplication 2024-04-13 13:01:43 +02:00
crypto crypto: hisilicon/sec - Fix memory leak for sec resource release 2024-07-05 09:14:24 +02:00
cxl cxl/mem: Fix shutdown order 2023-11-20 11:08:27 +01:00
dax
dca
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-23 08:54:38 +01:00
dio
dma dmaengine: ioatdma: Fix missing kmem_cache_destroy() 2024-07-05 09:14:33 +02:00
dma-buf dma-buf/sw-sync: don't enable IRQ from sync_print_obj() 2024-06-16 13:39:49 +02:00
edac EDAC, i10nm: make skx_common.o a separate module 2024-08-19 05:44:49 +02:00
eisa
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-16 13:39:39 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:51:01 +02:00
firmware firmware: turris-mox-rwtm: Initialize completion before mailbox 2024-08-19 05:44:55 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-16 13:39:38 +02:00
fsi
gnss
gpio gpiolib: of: add polarity quirk for TSC2005 2024-07-18 13:07:32 +02:00
gpu drm/amd/display: Check for NULL pointer 2024-08-19 05:45:12 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-07-05 09:14:23 +02:00
hid HID: Add quirk for Logitech Casa touchpad 2024-07-05 09:14:26 +02:00
hsi
hv
hwmon hwmon: (max6697) Fix swapped temp{1,8} critical alarms 2024-08-19 05:44:51 +02:00
hwspinlock
hwtracing coresight: Fix ref leak when of_coresight_parse_endpoint() fails 2024-08-19 05:45:04 +02:00
i2c i2c: rcar: fix error code in probe() 2024-07-18 13:07:45 +02:00
i3c i3c: master: svc: fix invalidate IBI type and miss call client IBI handler 2024-06-16 13:40:00 +02:00
idle
iio iio: chemical: bme680: Fix sensor data read operation 2024-07-05 09:14:46 +02:00
infiniband bnxt_re: Fix imm_data endianness 2024-08-19 05:45:07 +02:00
input Input: elan_i2c - do not leave interrupt disabled on suspend failure 2024-08-19 05:45:05 +02:00
interconnect Revert "interconnect: Teach lockdep about icc_bw_lock order" 2024-03-06 14:38:50 +00:00
iommu iommu/arm-smmu-v3: Free MSIs in case of ENOMEM 2024-07-05 09:14:27 +02:00
ipack
irqchip irqchip/loongson-pch-msi: Fix off-by-one on allocation error path 2024-06-16 13:39:20 +02:00
isdn
leds leds: ss4200: Convert PCIBIOS_* return codes to errnos 2024-08-19 05:45:14 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-19 05:45:06 +02:00
mailbox mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt 2024-02-23 08:54:50 +01:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 16:56:31 +00:00
md bcache: fix variable length array abuse in btree_iter 2024-07-05 09:14:36 +02:00
media media: uvcvideo: Fix integer overflow calculating timestamp 2024-08-19 05:45:14 +02:00
memory memory: fsl_ifc: Make FSL_IFC config visible and selectable 2024-08-19 05:44:52 +02:00
memstick
message
mfd mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-19 05:45:03 +02:00
misc mei: demote client disconnect warning on suspend to debug 2024-07-27 10:46:10 +02:00
mmc mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() 2024-07-05 09:14:45 +02:00
most
mtd mtd: make mtd_test.c a separate module 2024-08-19 05:45:05 +02:00
mux
net wifi: mwifiex: Fix interface type change 2024-08-19 05:45:14 +02:00
nfc nfc/nci: Add the inconsistency check between the input data length and count 2024-07-18 13:07:36 +02:00
ntb NTB: fix possible name leak in ntb_register_device() 2024-03-26 18:21:28 -04:00
nubus
nvdimm nd_btt: Make BTT lanes preemptible 2023-11-20 11:08:22 +01:00
nvme nvme: avoid double free special payload 2024-07-27 10:46:10 +02:00
nvmem nvmem: core: only change name to fram for current attribute 2024-07-18 13:07:42 +02:00
of cma: factor out minimum alignment requirement 2024-07-05 09:14:13 +02:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:21:23 -04:00
parisc
parport parport: parport_serial: Add Brainboxes device IDs and geometry 2024-01-25 14:52:31 -08:00
pci PCI: endpoint: Clean up error handling in vpci_scan_bus() 2024-08-19 05:45:06 +02:00
pcmcia pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() 2023-11-20 11:08:27 +01:00
perf perf: hisi: Fix use-after-free when register pmu fails 2023-11-20 11:08:21 +01:00
phy phy: tegra: xusb: Add API to retrieve the port number of phy 2024-04-10 16:18:40 +02:00
pinctrl pinctrl: freescale: mxs: Fix refcount of child 2024-08-19 05:45:09 +02:00
platform platform/chrome: cros_ec_debugfs: fix wrong EC message version 2024-08-19 05:44:49 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-23 08:54:38 +01:00
power power: supply: cros_usbpd: provide ID table for avoiding fallback match 2024-07-05 09:14:27 +02:00
powercap
pps
ps3
ptp ptp: fix integer overflow in max_vclocks_store 2024-07-05 09:14:31 +02:00
pwm pwm: stm32: Always do lazy disabling 2024-08-19 05:44:51 +02:00
rapidio
ras
regulator regulator: bd71815: fix ramp values 2024-07-05 09:14:33 +02:00
remoteproc remoteproc: mediatek: Make sure IPI buffer fits in L2TCM 2024-05-25 16:20:18 +02:00
reset reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning 2024-01-25 14:52:30 -08:00
rpmsg rpmsg: virtio: Free driver_override when rpmsg_remove() 2024-02-23 08:54:24 +01:00
rtc rtc: interface: Add RTC offset to alarm after fix-up 2024-08-19 05:45:10 +02:00
s390 s390/sclp: Fix sclp_init() cleanup on failure 2024-07-27 10:46:11 +02:00
sbus
scsi scsi: qla2xxx: Fix optrom version displayed in FDMI 2024-08-19 05:45:12 +02:00
sh
siox
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-17 11:51:04 +02:00
soc soc: qcom: pdr: fix parsing of domains lists 2024-08-19 05:44:52 +02:00
soundwire soundwire: cadence: fix invalid PDI offset 2024-06-16 13:39:34 +02:00
spi spi: mux: set ctlr->bits_per_word_mask 2024-07-27 10:46:14 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-07-05 09:14:20 +02:00
ssb
staging greybus: arche-ctrl: move device table to its right location 2024-06-16 13:39:35 +02:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-05-17 11:50:54 +02:00
tc
tee tee: optee: Fix kernel panic caused by incorrect error handling 2024-04-10 16:18:46 +02:00
thermal thermal/drivers/qcom/lmh: Check for SCM availability at probe 2024-06-16 13:39:55 +02:00
thunderbolt thunderbolt: Fix wake configurations after device unplug 2024-04-27 17:05:26 +02:00
tty serial: 8250_omap: Fix Errata i2310 with RX FIFO level check 2024-07-05 09:14:52 +02:00
uio uio: Fix use-after-free in uio_open 2024-01-25 14:52:31 -08:00
usb USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor 2024-07-18 13:07:41 +02:00
vdpa vduse: Temporarily fail if control queue feature requested 2024-07-05 09:14:42 +02:00
vfio vfio/fsl-mc: Block calling interrupt handler without trigger 2024-04-10 16:19:30 +02:00
vhost vhost/vsock: always initialize seqpacket_allow 2024-08-19 05:45:06 +02:00
video fbdev: savage: Handle err return when savagefb_check_var failed 2024-06-16 13:39:57 +02:00
virt drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() 2024-06-16 13:39:32 +02:00
virtio virtio: delete vq in vp_find_vqs_msix() when request_irq() fails 2024-06-16 13:39:47 +02:00
visorbus
vlynq
vme
w1
watchdog watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin 2024-06-16 13:39:59 +02:00
xen xen/events: close evtchn after mapping cleanup 2024-04-10 16:18:46 +02:00
zorro
Kconfig
Makefile