Received: by 2002:a6b:500f:0:0:0:0:0 with SMTP id e15csp2896078iob; Fri, 6 May 2022 12:47:04 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzU7aDEtrX8ujJNZHa2DoqUrTeUCC7JWHkpc3Q2D6qBm1ZQuwSEL5Ftw8udN529OzyA3Yr4 X-Received: by 2002:a17:902:f549:b0:15e:aa35:425a with SMTP id h9-20020a170902f54900b0015eaa35425amr5295667plf.1.1651866424587; Fri, 06 May 2022 12:47:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651866424; cv=none; d=google.com; s=arc-20160816; b=CbGunE4dTcoSVSZu7glBHM9xUBgvyS8qgl0mGBgoeKdQrXIV9FC9xHH/czxUBjpruX p1sCBMxgaGOn46b/75o/NYjePcn+MKvoIVUNnXxg+YYdCbH8YeXzS1UeaRQO+vhYJbTE lZkonYgiLQjxfOrZtlLeSkkNzq6u9S/yR+O1ap8/2bXHnvdv1eZGPXG9lqdSoVpntvLe 2zwypcRQFbKitZ8Idgf1yH/4v8OIL71723acu+Kv0zHIt76rWAGU56GY+8TCk6ALFv8O iHYZ8MowrP0bAPpIpeYc5/WXTocUHRKomBz5sQQTLa4Qo+W1mwy0yn54qJHqyw+2Et9v 4ESA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=rH+8LHf34kLIAOdkGRjxuWjJxZc13JhjZFkA7n0+E24=; b=yc7aMGwVv4z45u6L8ljC2UkwGjatKoRqTCa8un4Y3SB2qS0H3nk9Pqmun9G2bd+ENi uMRhWXi/7lp676wJXOSk8CBdI3DYFOJL8Ala6gTUyrFfhDIn0x4ip3nkRcHUi9iLppvc Zz5SQ+W4xrsMkAoCevNUkgJM3m3i8xO0fSpuBpPIhcbMHBHtc0zEKtXGLBZW2lbx/hwb rYeK3i70s8Rh0ZePbEAI6KOEuuHILc8KzNKM20A4gE+GSo3p9jSPCGvVldzPTODlEE4s AuPgkSCRV1w44CqYwhwBiWp4Op0E0HE/BZk1igEd/t2KljKypm696e0vmtfuWWMrVG3j FZ3A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="z/6bVhjR"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id be3-20020a170902aa0300b0015823058edasi3088888plb.464.2022.05.06.12.46.49; Fri, 06 May 2022 12:47:04 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="z/6bVhjR"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356760AbiEDRav (ORCPT + 99 others); Wed, 4 May 2022 13:30:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38686 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356851AbiEDRJq (ORCPT ); Wed, 4 May 2022 13:09:46 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85B0840E53; Wed, 4 May 2022 09:56:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D0402617D5; Wed, 4 May 2022 16:55:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 264B4C385B0; Wed, 4 May 2022 16:55:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1651683359; bh=Q2lpK4+bCp+Mr6HtUngLVgevBZBlk+0P8PQoZDRroX0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z/6bVhjRNuLzigdghFOYx3VFVxkw9QbAM/tya9dDgrB6HTDSAZcYB86V/rhwHL71k nMST3AVFProqtuwLWGmx5jh4tsVIuM8eaxFzhRAaPaMviXTa83quYPAXBErU+rTsCA AYy5ZqX9M7OFk3+2Q6v64WAyzG5oeH/WTlKHn3hI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Vacura Subject: [PATCH 5.17 022/225] usb: gadget: uvc: Fix crash when encoding data for usb request Date: Wed, 4 May 2022 18:44:20 +0200 Message-Id: <20220504153112.304664490@linuxfoundation.org> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220504153110.096069935@linuxfoundation.org> References: <20220504153110.096069935@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dan Vacura commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream. During the uvcg_video_pump() process, if an error occurs and uvcg_queue_cancel() is called, the buffer queue will be cleared out, but the current marker (queue->buf_used) of the active buffer (no longer active) is not reset. On the next iteration of uvcg_video_pump() the stale buf_used count will be used and the logic of min((unsigned int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a nbytes size, causing an invalid memory access. [80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. [80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. ... uvcg_queue_cancel() is called and the queue is cleared out, but the marker queue->buf_used is not reset. ... [80802.262328][ T8682] Unable to handle kernel paging request at virtual address ffffffc03af9f000 ... ... [80802.263138][ T8682] Call trace: [80802.263146][ T8682] __memcpy+0x12c/0x180 [80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0 [80802.263165][ T8682] process_one_work+0x2cc/0x568 [80802.263173][ T8682] worker_thread+0x28c/0x518 [80802.263181][ T8682] kthread+0x160/0x170 [80802.263188][ T8682] ret_from_fork+0x10/0x18 [80802.263198][ T8682] Code: a8c12829 a88130cb a8c130 Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework") Cc: Signed-off-by: Dan Vacura Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/uvc_queue.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c index d852ac9e47e7..2cda982f3765 100644 --- a/drivers/usb/gadget/function/uvc_queue.c +++ b/drivers/usb/gadget/function/uvc_queue.c @@ -264,6 +264,8 @@ void uvcg_queue_cancel(struct uvc_video_queue *queue, int disconnect) buf->state = UVC_BUF_STATE_ERROR; vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); } + queue->buf_used = 0; + /* This must be protected by the irqlock spinlock to avoid race * conditions between uvc_queue_buffer and the disconnection event that * could result in an interruptible wait in uvc_dequeue_buffer. Do not -- 2.36.0