6c3da0e19c
commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream.
During the uvcg_video_pump() process, if an error occurs and
uvcg_queue_cancel() is called, the buffer queue will be cleared out, but
the current marker (queue->buf_used) of the active buffer (no longer
active) is not reset. On the next iteration of uvcg_video_pump() the
stale buf_used count will be used and the logic of min((unsigned
int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a
nbytes size, causing an invalid memory access.
[80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed
with status -18.
[80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed
with status -18.
...
uvcg_queue_cancel() is called and the queue is cleared out, but the
marker queue->buf_used is not reset.
...
[80802.262328][ T8682] Unable to handle kernel paging request at virtual
address ffffffc03af9f000
...
...
[80802.263138][ T8682] Call trace:
[80802.263146][ T8682] __memcpy+0x12c/0x180
[80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0
[80802.263165][ T8682] process_one_work+0x2cc/0x568
[80802.263173][ T8682] worker_thread+0x28c/0x518
[80802.263181][ T8682] kthread+0x160/0x170
[80802.263188][ T8682] ret_from_fork+0x10/0x18
[80802.263198][ T8682] Code: a8c12829 a88130cb a8c130
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| f_acm.c | ||
| f_ecm.c | ||
| f_eem.c | ||
| f_fs.c | ||
| f_hid.c | ||
| f_loopback.c | ||
| f_mass_storage.c | ||
| f_mass_storage.h | ||
| f_midi.c | ||
| f_ncm.c | ||
| f_obex.c | ||
| f_phonet.c | ||
| f_printer.c | ||
| f_rndis.c | ||
| f_serial.c | ||
| f_sourcesink.c | ||
| f_subset.c | ||
| f_tcm.c | ||
| f_uac1.c | ||
| f_uac1_legacy.c | ||
| f_uac2.c | ||
| f_uvc.c | ||
| f_uvc.h | ||
| g_zero.h | ||
| ndis.h | ||
| rndis.c | ||
| rndis.h | ||
| storage_common.c | ||
| storage_common.h | ||
| tcm.h | ||
| u_audio.c | ||
| u_audio.h | ||
| u_ecm.h | ||
| u_eem.h | ||
| u_ether.c | ||
| u_ether.h | ||
| u_ether_configfs.h | ||
| u_fs.h | ||
| u_gether.h | ||
| u_hid.h | ||
| u_midi.h | ||
| u_ncm.h | ||
| u_phonet.h | ||
| u_printer.h | ||
| u_rndis.h | ||
| u_serial.c | ||
| u_serial.h | ||
| u_tcm.h | ||
| u_uac1.h | ||
| u_uac1_legacy.c | ||
| u_uac1_legacy.h | ||
| u_uac2.h | ||
| u_uvc.h | ||
| uvc.h | ||
| uvc_configfs.c | ||
| uvc_configfs.h | ||
| uvc_queue.c | ||
| uvc_queue.h | ||
| uvc_v4l2.c | ||
| uvc_v4l2.h | ||
| uvc_video.c | ||
| uvc_video.h | ||