From:   Sakari Ailus <sakari.ailus@linux.intel.com>
To:     laurent.pinchart@ideasonboard.com
Cc:     linux-media@vger.kernel.org, chiranjeevi.rapolu@intel.com
Subject: [PATCH v2 1/1] uvc: Avoid NULL pointer dereference at the end of streaming
Date:   Wed, 30 Jan 2019 12:09:41 +0200
Message-Id: <20190130100941.17589-1-sakari.ailus@linux.intel.com>
Sender: linux-media-owner@vger.kernel.org
Precedence: bulk

The UVC video driver converts the timestamp from hardware specific unit to
one known by the kernel at the time when the buffer is dequeued. This is
fine in general, but the streamoff operation consists of the following
steps (among other things):

1. uvc_video_clock_cleanup --- the hardware clock sample array is
   released and the pointer to the array is set to NULL,

2. buffers in active state are returned to the user and

3. buf_finish callback is called on buffers that are prepared. buf_finish
   includes calling uvc_video_clock_update that accesses the hardware
   clock sample array.

The above is serialised by a queue specific mutex. Address the problem by
skipping the clock conversion if the hardware clock sample array is
already released.

Fixes: 9c0863b1cc48 ("[media] vb2: call buf_finish from __queue_cancel")
Reported-by: Chiranjeevi Rapolu <chiranjeevi.rapolu@intel.com>
Tested-by: Chiranjeevi Rapolu <chiranjeevi.rapolu@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
---
since v1:

- Improve the comment in uvc_video_clock_update().

- Add appropriate Cc: stable, Reviewed-by: and Fixes: tags.

 drivers/media/usb/uvc/uvc_video.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 84525ff047450..e314657a1843a 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -676,6 +676,14 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
 	if (!uvc_hw_timestamps_param)
 		return;
 
+	/*
+	 * We will get called from __vb2_queue_cancel() if there are buffers
+	 * done but not dequeued by the user, but the sample array has already
+	 * been released at that time. Just bail out in that case.
+	 */
+	if (!clock->samples)
+		return;
+
 	spin_lock_irqsave(&clock->lock, flags);
 
 	if (clock->count < clock->size)
-- 
2.11.0