Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp670541img; Fri, 22 Mar 2019 06:17:12 -0700 (PDT) X-Google-Smtp-Source: APXvYqxA+CPggti1+IUWCfRg8bu3DD6bMn6XF68yHDB6m1F9U6MbrCYkfUhpKasxmiEB+BNw2yPC X-Received: by 2002:a17:902:9008:: with SMTP id a8mr9533867plp.38.1553260632889; Fri, 22 Mar 2019 06:17:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553260632; cv=none; d=google.com; s=arc-20160816; b=ZXntmxvj749z72y5C77C98Dz6Vh+sb6NGo4UNVziMfltb7ktV2611CbqoIXTrn/aLD 9EsMdxe44BjumbAlus+OYHHwMGxuTvfSu3WoSPIZK6+ugoZye2aNzB8eFd/gy6wQARzM 6J3yzVWNTouyCg6Pf+qpiR3TDEH5C2ObsxGOt9+udkhjJlu5TAB5we4TTMj+BRiBy3Yc lhw/QdLFopnjh23w34H2741PkbeuHKeUkTxr9paC4nutxn4BZ/ywH/EkzElFJ05nBkAg KxsiN6QD9hb8ZUBrSLRrKevkfYeVlQXOusQ2SEcMsKotYtGmERGBU9kbwPo1bZq6Hgf1 a1pg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=zbI9XEd/idSEVkPX/ecGJomHel/lBpeeoaiImJQrKgk=; b=iEKS5hLtEEinZL+ZJLZsijiVJAPnxVe6T9RWS8PHowP0JMwq9zu73vYyiWX3ENErBt SZ25GWt6osPGTEiW9EllqjXwmR8zTbLRg5U8bfI+E0vQcIF4JpmTGOWjhgtOLFtNaWzC KhTGsYTMWRJgdwHGgvQvqsL9J9NIaprcmMpZ/K3c+uJ5GYl40swGhaimrs7m+Ptg5Lq+ g8qQ8dg3ETZxup1FUswzCnVrYFk7BFpSQknG9k4bf0TKapTpcXfhopWYse/GIcfUUbz+ PT7pjV3GPSa5Zlm61LOuoeMTdmXb9V9tL13G/XX6O17kkwBxZtZ0hFjX9rqzh5x7j7/b KrGQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=gLidCS2y; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v5si917070pgr.121.2019.03.22.06.16.57; Fri, 22 Mar 2019 06:17:12 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=gLidCS2y; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729485AbfCVL06 (ORCPT + 99 others); Fri, 22 Mar 2019 07:26:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:54692 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729156AbfCVL05 (ORCPT ); Fri, 22 Mar 2019 07:26:57 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2DC7221B24; Fri, 22 Mar 2019 11:26:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553254016; bh=aumAjMVBbcN1iTAZBxqRgDOay8HHYtyOjOsGO9txkM0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gLidCS2ygFAqVA2AlA9hpoux7sknbZjrKlCHTsIHXn41mZ0pvMs48/HF8qCrKFBvw 9pCuGU7I4/dKZazUjVio4xoQivzVme8r0IYi6bY+7IlrPzYIsaTavj1spqCzIx2lcr tfyPbFtvjw8Opq5h+xV1D/QBzFg9nRF+lPxAvVtM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chiranjeevi Rapolu , Sakari Ailus , Laurent Pinchart , Mauro Carvalho Chehab Subject: [PATCH 3.18 133/134] media: uvcvideo: Avoid NULL pointer dereference at the end of streaming Date: Fri, 22 Mar 2019 12:15:46 +0100 Message-Id: <20190322111220.190717235@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sakari Ailus commit 9dd0627d8d62a7ddb001a75f63942d92b5336561 upstream. The UVC video driver converts the timestamp from hardware specific unit to one known by the kernel at the time when the buffer is dequeued. This is fine in general, but the streamoff operation consists of the following steps (among other things): 1. uvc_video_clock_cleanup --- the hardware clock sample array is released and the pointer to the array is set to NULL, 2. buffers in active state are returned to the user and 3. buf_finish callback is called on buffers that are prepared. buf_finish includes calling uvc_video_clock_update that accesses the hardware clock sample array. The above is serialised by a queue specific mutex. Address the problem by skipping the clock conversion if the hardware clock sample array is already released. Fixes: 9c0863b1cc48 ("[media] vb2: call buf_finish from __queue_cancel") Reported-by: Chiranjeevi Rapolu Tested-by: Chiranjeevi Rapolu Signed-off-by: Sakari Ailus Cc: stable@vger.kernel.org Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/uvc/uvc_video.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/drivers/media/usb/uvc/uvc_video.c +++ b/drivers/media/usb/uvc/uvc_video.c @@ -627,6 +627,14 @@ void uvc_video_clock_update(struct uvc_s u32 rem; u64 y; + /* + * We will get called from __vb2_queue_cancel() if there are buffers + * done but not dequeued by the user, but the sample array has already + * been released at that time. Just bail out in that case. + */ + if (!clock->samples) + return; + spin_lock_irqsave(&clock->lock, flags); if (clock->count < clock->size)