2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2025-01-01 10:13:58 +08:00
linux-next/drivers/media/usb/uvc
Sakari Ailus 9dd0627d8d media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
The UVC video driver converts the timestamp from hardware specific unit
to one known by the kernel at the time when the buffer is dequeued. This
is fine in general, but the streamoff operation consists of the
following steps (among other things):

1. uvc_video_clock_cleanup --- the hardware clock sample array is
   released and the pointer to the array is set to NULL,

2. buffers in active state are returned to the user and

3. buf_finish callback is called on buffers that are prepared.
   buf_finish includes calling uvc_video_clock_update that accesses the
   hardware clock sample array.

The above is serialised by a queue specific mutex. Address the problem
by skipping the clock conversion if the hardware clock sample array is
already released.

Fixes: 9c0863b1cc ("[media] vb2: call buf_finish from __queue_cancel")

Reported-by: Chiranjeevi Rapolu <chiranjeevi.rapolu@intel.com>
Tested-by: Chiranjeevi Rapolu <chiranjeevi.rapolu@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-02-07 11:55:49 -05:00
..
Kconfig [media] uvc: Depend on VIDEO_V4L2 2013-06-24 22:54:40 -03:00
Makefile media: uvcvideo: Add a metadata device node 2018-01-04 06:41:47 -05:00
uvc_ctrl.c media: v4l2-ctrls.c/uvc: zero v4l2_event 2019-01-16 11:22:39 -05:00
uvc_debugfs.c media: uvcvideo: Remove unnecessary NULL check before debugfs_remove_recursive 2018-09-11 08:42:10 -04:00
uvc_driver.c media: uvcvideo: Fix 'type' check leading to overflow 2019-02-07 11:54:14 -05:00
uvc_entity.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
uvc_isight.c media: uvcvideo: Convert decode functions to use new context structure 2018-12-05 03:07:41 -05:00
uvc_metadata.c media: use strscpy() instead of strlcpy() 2018-09-11 13:32:17 -04:00
uvc_queue.c media: uvcvideo: Split uvc_video_enable into two 2018-12-05 03:17:34 -05:00
uvc_status.c media: uvcvideo: Refactor teardown of uvc on USB disconnect 2018-12-03 14:16:02 -05:00
uvc_v4l2.c media updates for v4.20-rc1 2018-10-31 10:53:29 -07:00
uvc_video.c media: uvcvideo: Avoid NULL pointer dereference at the end of streaming 2019-02-07 11:55:49 -05:00
uvcvideo.h media: uvcvideo: Utilise for_each_uvc_urb iterator 2018-12-05 03:18:46 -05:00