lkml.org 
[lkml]   [2020]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] usb: core: Null deref in kernel with USB webcams.
On Fri, Nov 13, 2020 at 04:45:52PM +0000, John Boero wrote:
> Sorry I wanted to include a pastebin or link but was trying to follow maillist
> guidelines and not include links or exceed wrap guidelines. Full contents:
> https://paste.centos.org/view/3746bc40
>
> Yes I understand the return dodges the config dereference.
>
> Original line usb.c:281 is the original error:
>
> 280| for (i = 0; i < config->desc.bNumInterfaces; i++)
> 281| if (config->interface[i]->altsetting[0]
> 282| .desc.bInterfaceNumber == ifnum)
> 283| return config->interface[i];

Okay. Without having looked at the code, I would guess that uvcvideo's
uvc_ioctl_streamon() handler -- or some routine beneath it -- either
doesn't lock the USB interface while starting I/O, or doesn't check
(while holding the lock) to see whether the driver has been unbound.

This sort of error (config->interface[i] == NULL) is what you expect to
see if a driver tries to carry out I/O to a device that has been
unplugged and that it has been unbound from.

Alan Stern

\
 
 \ /
  Last update: 2020-11-13 18:17    [W:0.077 / U:0.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site