• Shuah Khan's avatar
    media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable() · 898bc40b
    Shuah Khan authored
    Fix au0828_analog_stream_enable() to check if device is in the right
    state first. When unbind happens while bind is in progress, usbdev
    pointer could be invalid in au0828_analog_stream_enable() and a call
    to usb_ifnum_to_if() will result in the null pointer dereference.
    
    This problem is found with the new media_dev_allocator.sh test.
    
    kernel: [  590.359623] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e8
    kernel: [  590.359627] #PF error: [normal kernel read fault]
    kernel: [  590.359629] PGD 0 P4D 0
    kernel: [  590.359632] Oops: 0000 [#1] SMP PTI
    kernel: [  590.359634] CPU: 3 PID: 1458 Comm: v4l_id Not tainted 5.1.0-rc2+ #30
    kernel: [  590.359636] Hardware name: Dell Inc. OptiPlex 7 90/0HY9JP, BIOS A18 09/24/2013
    kernel: [  590.359641] RIP: 0010:usb_ifnum_to_if+0x6/0x60
    kernel: [  590.359643] Code: 5d 41 5e 41 5f 5d c3 48 83 c4
     10 b8 fa ff ff ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 b8 fa ff ff ff c3 0f 1f 00 6
    6 66 66 66 90 55 <48> 8b 97 e8 04 00 00 48 89 e5 48 85 d2 74 41 0f b6 4a 04 84 c
    9 74
    kernel: [  590.359645] RSP: 0018:ffffad3cc3c1fc00 EFLAGS: 00010246
    kernel: [  590.359646] RAX: 0000000000000000 RBX: ffff8ded b1f3c000 RCX: 1f377e4500000000
    kernel: [  590.359648] RDX: ffff8dedfa3a6b50 RSI: 00000000 00000000 RDI: 0000000000000000
    kernel: [  590.359649] RBP: ffffad3cc3c1fc28 R08: 00000000 8574acc2 R09: ffff8dedfa3a6b50
    kernel: [  590.359650] R10: 0000000000000001 R11: 00000000 00000000 R12: 0000000000000000
    kernel: [  590.359652] R13: ffff8dedb1f3f0f0 R14: ffffffff adcf7ec0 R15: 0000000000000000
    kernel: [  590.359654] FS:  00007f7917198540(0000) GS:ffff 8dee258c0000(0000) knlGS:0000000000000000
    kernel: [  590.359655] CS:  0010 DS: 0000 ES: 0000 CR0: 00 00000080050033
    kernel: [  590.359657] CR2: 00000000000004e8 CR3: 00000001 a388e002 CR4: 00000000000606e0
    kernel: [  590.359658] Call Trace:
    kernel: [  590.359664]  ? au0828_analog_stream_enable+0x2c/0x180
    kernel: [  590.359666]  au0828_v4l2_open+0xa4/0x110
    kernel: [  590.359670]  v4l2_open+0x8b/0x120
    kernel: [  590.359674]  chrdev_open+0xa6/0x1c0
    kernel: [  590.359676]  ? cdev_put.part.3+0x20/0x20
    kernel: [  590.359678]  do_dentry_open+0x1f6/0x360
    kernel: [  590.359681]  vfs_open+0x2f/0x40
    kernel: [  590.359684]  path_openat+0x299/0xc20
    kernel: [  590.359688]  do_filp_open+0x9b/0x110
    kernel: [  590.359695]  ? _raw_spin_unlock+0x27/0x40
    kernel: [  590.359697]  ? __alloc_fd+0xb2/0x160
    kernel: [  590.359700]  do_sys_open+0x1ba/0x260
    kernel: [  590.359702]  ? do_sys_open+0x1ba/0x260
    kernel: [  590.359712]  __x64_sys_openat+0x20/0x30
    kernel: [  590.359715]  do_syscall_64+0x5a/0x120
    kernel: [  590.359718]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
    Signed-off-by: default avatarShuah Khan <shuah@kernel.org>
    Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
    898bc40b
au0828-video.c 53 KB