lkml.org 
[lkml]   [2022]   [May]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 022/225] usb: gadget: uvc: Fix crash when encoding data for usb request
    Date
    From: Dan Vacura <w36195@motorola.com>

    commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream.

    During the uvcg_video_pump() process, if an error occurs and
    uvcg_queue_cancel() is called, the buffer queue will be cleared out, but
    the current marker (queue->buf_used) of the active buffer (no longer
    active) is not reset. On the next iteration of uvcg_video_pump() the
    stale buf_used count will be used and the logic of min((unsigned
    int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a
    nbytes size, causing an invalid memory access.

    [80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed
    with status -18.
    [80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed
    with status -18.
    ...
    uvcg_queue_cancel() is called and the queue is cleared out, but the
    marker queue->buf_used is not reset.
    ...
    [80802.262328][ T8682] Unable to handle kernel paging request at virtual
    address ffffffc03af9f000
    ...
    ...
    [80802.263138][ T8682] Call trace:
    [80802.263146][ T8682] __memcpy+0x12c/0x180
    [80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0
    [80802.263165][ T8682] process_one_work+0x2cc/0x568
    [80802.263173][ T8682] worker_thread+0x28c/0x518
    [80802.263181][ T8682] kthread+0x160/0x170
    [80802.263188][ T8682] ret_from_fork+0x10/0x18
    [80802.263198][ T8682] Code: a8c12829 a88130cb a8c130

    Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Dan Vacura <w36195@motorola.com>
    Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/gadget/function/uvc_queue.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c
    index d852ac9e47e7..2cda982f3765 100644
    --- a/drivers/usb/gadget/function/uvc_queue.c
    +++ b/drivers/usb/gadget/function/uvc_queue.c
    @@ -264,6 +264,8 @@ void uvcg_queue_cancel(struct uvc_video_queue *queue, int disconnect)
    buf->state = UVC_BUF_STATE_ERROR;
    vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR);
    }
    + queue->buf_used = 0;
    +
    /* This must be protected by the irqlock spinlock to avoid race
    * conditions between uvc_queue_buffer and the disconnection event that
    * could result in an interruptible wait in uvc_dequeue_buffer. Do not
    --
    2.36.0


    \
     
     \ /
      Last update: 2022-05-04 19:28    [W:5.184 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site