1. 21 Apr, 2022 9 commits
  2. 19 Apr, 2022 1 commit
    • Dan Vacura's avatar
      usb: gadget: uvc: Fix crash when encoding data for usb request · 71d471e3
      Dan Vacura authored
      During the uvcg_video_pump() process, if an error occurs and
      uvcg_queue_cancel() is called, the buffer queue will be cleared out, but
      the current marker (queue->buf_used) of the active buffer (no longer
      active) is not reset. On the next iteration of uvcg_video_pump() the
      stale buf_used count will be used and the logic of min((unsigned
      int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a
      nbytes size, causing an invalid memory access.
      
      [80802.185460][  T315] configfs-gadget gadget: uvc: VS request completed
      with status -18.
      [80802.185519][  T315] configfs-gadget gadget: uvc: VS request completed
      with status -18.
      ...
      uvcg_queue_cancel() is called and the queue is cleared out, but the
      marker queue->buf_used is not reset.
      ...
      [80802.262328][ T8682] Unable to handle kernel paging request at virtual
      address ffffffc03af9f000
      ...
      ...
      [80802.263138][ T8682] Call trace:
      [80802.263146][ T8682]  __memcpy+0x12c/0x180
      [80802.263155][ T8682]  uvcg_video_pump+0xcc/0x1e0
      [80802.263165][ T8682]  process_one_work+0x2cc/0x568
      [80802.263173][ T8682]  worker_thread+0x28c/0x518
      [80802.263181][ T8682]  kthread+0x160/0x170
      [80802.263188][ T8682]  ret_from_fork+0x10/0x18
      [80802.263198][ T8682] Code: a8c12829 a88130cb a8c130
      
      Fixes: d6925225 ("usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarDan Vacura <w36195@motorola.com>
      Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      71d471e3
  3. 14 Apr, 2022 2 commits
  4. 09 Apr, 2022 4 commits
  5. 03 Apr, 2022 8 commits
  6. 02 Apr, 2022 16 commits