leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
898bc40bfc
linux/drivers/media
History
Shuah Khan 898bc40bfc media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable() 
Fix au0828_analog_stream_enable() to check if device is in the right
state first. When unbind happens while bind is in progress, usbdev
pointer could be invalid in au0828_analog_stream_enable() and a call
to usb_ifnum_to_if() will result in the null pointer dereference.

This problem is found with the new media_dev_allocator.sh test.

kernel: [  590.359623] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e8
kernel: [  590.359627] #PF error: [normal kernel read fault]
kernel: [  590.359629] PGD 0 P4D 0
kernel: [  590.359632] Oops: 0000 [#1] SMP PTI
kernel: [  590.359634] CPU: 3 PID: 1458 Comm: v4l_id Not tainted 5.1.0-rc2+ #30
kernel: [  590.359636] Hardware name: Dell Inc. OptiPlex 7 90/0HY9JP, BIOS A18 09/24/2013
kernel: [  590.359641] RIP: 0010:usb_ifnum_to_if+0x6/0x60
kernel: [  590.359643] Code: 5d 41 5e 41 5f 5d c3 48 83 c4
 10 b8 fa ff ff ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 b8 fa ff ff ff c3 0f 1f 00 6
6 66 66 66 90 55 <48> 8b 97 e8 04 00 00 48 89 e5 48 85 d2 74 41 0f b6 4a 04 84 c
9 74
kernel: [  590.359645] RSP: 0018:ffffad3cc3c1fc00 EFLAGS: 00010246
kernel: [  590.359646] RAX: 0000000000000000 RBX: ffff8ded b1f3c000 RCX: 1f377e4500000000
kernel: [  590.359648] RDX: ffff8dedfa3a6b50 RSI: 00000000 00000000 RDI: 0000000000000000
kernel: [  590.359649] RBP: ffffad3cc3c1fc28 R08: 00000000 8574acc2 R09: ffff8dedfa3a6b50
kernel: [  590.359650] R10: 0000000000000001 R11: 00000000 00000000 R12: 0000000000000000
kernel: [  590.359652] R13: ffff8dedb1f3f0f0 R14: ffffffff adcf7ec0 R15: 0000000000000000
kernel: [  590.359654] FS:  00007f7917198540(0000) GS:ffff 8dee258c0000(0000) knlGS:0000000000000000
kernel: [  590.359655] CS:  0010 DS: 0000 ES: 0000 CR0: 00 00000080050033
kernel: [  590.359657] CR2: 00000000000004e8 CR3: 00000001 a388e002 CR4: 00000000000606e0
kernel: [  590.359658] Call Trace:
kernel: [  590.359664]  ? au0828_analog_stream_enable+0x2c/0x180
kernel: [  590.359666]  au0828_v4l2_open+0xa4/0x110
kernel: [  590.359670]  v4l2_open+0x8b/0x120
kernel: [  590.359674]  chrdev_open+0xa6/0x1c0
kernel: [  590.359676]  ? cdev_put.part.3+0x20/0x20
kernel: [  590.359678]  do_dentry_open+0x1f6/0x360
kernel: [  590.359681]  vfs_open+0x2f/0x40
kernel: [  590.359684]  path_openat+0x299/0xc20
kernel: [  590.359688]  do_filp_open+0x9b/0x110
kernel: [  590.359695]  ? _raw_spin_unlock+0x27/0x40
kernel: [  590.359697]  ? __alloc_fd+0xb2/0x160
kernel: [  590.359700]  do_sys_open+0x1ba/0x260
kernel: [  590.359702]  ? do_sys_open+0x1ba/0x260
kernel: [  590.359712]  __x64_sys_openat+0x20/0x30
kernel: [  590.359715]  do_syscall_64+0x5a/0x120
kernel: [  590.359718]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Signed-off-by: Shuah Khan <shuah@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-04-22 11:23:54 -04:00
..
cec media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
common media: vb2: Minor function naming fix 2019-04-22 10:30:49 -04:00
dvb-core media: dvbdev: remove double-unlock 2019-03-28 14:36:14 -04:00
dvb-frontends media: dvb: clean up redundant break statements 2019-04-22 11:03:26 -04:00
firewire media: firewire: Fix app_info parameter type in avc_ca{,_app}_info 2018-12-05 05:34:33 -05:00
i2c media: ov7740: enable to get exposure control in autoexposure mode 2019-03-29 10:44:47 -04:00
mmc media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
pci media: bt8xx: avoid a needless u8 to char conversion 2019-03-29 10:29:40 -04:00
platform media: stm32-dcmi: fix crash when subdev do not expose any formats 2019-04-22 11:09:23 -04:00
radio media: replace strncpy() by strscpy() 2019-03-29 10:26:13 -04:00
rc media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
spi media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
tuners media: tuners: fix several typos 2019-03-01 09:40:29 -05:00
usb media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable() 2019-04-22 11:23:54 -04:00
v4l2-core media: v4l2-common: add bayer formats in v4l2_format_info 2019-04-22 10:33:45 -04:00
Kconfig media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
Makefile media: Media Device Allocator API 2019-04-22 11:18:26 -04:00
media-dev-allocator.c media: Media Device Allocator API 2019-04-22 11:18:26 -04:00
media-device.c media: Add a Kconfig option for the Request API 2018-12-05 13:07:43 -05:00
media-devnode.c media: media-devnode: fill in media chardev kobject to ease debugging 2019-03-19 13:21:16 -04:00
media-entity.c media: replace WARN_ON in __media_pipeline_start() 2019-03-19 14:01:08 -04:00
media-request.c media: media requests: return EBADR instead of EACCES 2019-03-25 13:26:10 -04:00