summaryrefslogtreecommitdiffstats
path: root/drivers/media
diff options
context:
space:
mode:
authorSakari Ailus <sakari.ailus@linux.intel.com>2019-01-30 05:09:41 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-03-23 14:35:30 +0100
commitc1ce0ea53e5bc2ea4b4d918d8fb0fac3e46b8c46 (patch)
tree1e4504ff09d139732e6111bfbd84560c208fc21b /drivers/media
parentebebfe3410444733ee6ba84bc0b7cc86bab066c4 (diff)
downloadlinux-stable-c1ce0ea53e5bc2ea4b4d918d8fb0fac3e46b8c46.tar.gz
linux-stable-c1ce0ea53e5bc2ea4b4d918d8fb0fac3e46b8c46.tar.bz2
linux-stable-c1ce0ea53e5bc2ea4b4d918d8fb0fac3e46b8c46.zip
media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
commit 9dd0627d8d62a7ddb001a75f63942d92b5336561 upstream. The UVC video driver converts the timestamp from hardware specific unit to one known by the kernel at the time when the buffer is dequeued. This is fine in general, but the streamoff operation consists of the following steps (among other things): 1. uvc_video_clock_cleanup --- the hardware clock sample array is released and the pointer to the array is set to NULL, 2. buffers in active state are returned to the user and 3. buf_finish callback is called on buffers that are prepared. buf_finish includes calling uvc_video_clock_update that accesses the hardware clock sample array. The above is serialised by a queue specific mutex. Address the problem by skipping the clock conversion if the hardware clock sample array is already released. Fixes: 9c0863b1cc48 ("[media] vb2: call buf_finish from __queue_cancel") Reported-by: Chiranjeevi Rapolu <chiranjeevi.rapolu@intel.com> Tested-by: Chiranjeevi Rapolu <chiranjeevi.rapolu@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: stable@vger.kernel.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/usb/uvc/uvc_video.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index a6d800291883..393371916381 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -638,6 +638,14 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
if (!uvc_hw_timestamps_param)
return;
+ /*
+ * We will get called from __vb2_queue_cancel() if there are buffers
+ * done but not dequeued by the user, but the sample array has already
+ * been released at that time. Just bail out in that case.
+ */
+ if (!clock->samples)
+ return;
+
spin_lock_irqsave(&clock->lock, flags);
if (clock->count < clock->size)