Messages in this thread | | | Date | Fri, 24 Oct 2008 12:31:29 -0200 | From | Mauro Carvalho Chehab <> | Subject | Re: [Linux-uvc-devel] [BUG] NULL pointer dereference caused by uvcvideo stress test |
| |
On Thu, 16 Oct 2008 11:01:27 +0100 Alan Jenkins <alan-jenkins@tuffmail.co.uk> wrote:
> Laurent Pinchart wrote: > > Hi Alan, > > > > On Wednesday 15 October 2008, Alan Jenkins wrote: > > > >> Laurent Pinchart wrote: > >> > >>> On Wednesday 15 October 2008, Alan Jenkins wrote: > >>> > >>>> If you look at the trace, it happens as "hald-probe-video" opens the > >>>> video device. This is from Ubuntu 8.04. Possibly it's significant that > >>>> I use the camera first, to make sure it works (I use Kopete, the > >>>> settings dialogue includes a video test). > >>>> > >>> The NULL pointer (or rather 0x00000030 pointer) dereference happens in > >>> video_open: > >>> > >>> file->f_op = fops_get(vfl->fops); > >>> if (file->f_op->open) > >>> err = file->f_op->open(inode, file); > >>> > >>> file->f_op ends up being NULL. Either vfl->fops is NULL to begin with, or > >>> fops_get failed to get a reference to the file_operations structure. > >>> > >>> I'd be surprised if vfl->fops was NULL. To rule out that case, can you > >>> add a BUG_ON(vfl->fops == NULL) before the call to fops_get ? > >>> > >>> I'm not too familiar with the module loader, but a quick look at the code > >>> shows that the module could be marked as being unloaded > >>> (MODULE_STATE_GOING) before its exit function is called. If this is the > >>> case video_open would still be called, as the video device would still be > >>> registered, but fops_get would fail in try_module_get and return a NULL > >>> pointer. It seems the pointer returned by fops_get should be tested in > >>> video_open. > >>> > >>> I've CC'ed the v4l maintainer to get his opinion on this.
Sorry for being late with this. Too much work here...
I suspect that you only hit this bug due to BKL removal from open/close fops. maybe you're calling open() before having the device fully initialized?
Anyway, I think that the proposed check is interesting on other places where there are similar code.
Cheers, Mauro
| |