Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1329777

[PATCH 3.2 01/87] [media] gspca: ov534/topro: prevent a division by 0

Show all headers | View raw

3.2.77-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Antonio Ospite <ao2@ao2.it>

commit dcc7fdbec53a960588f2c40232db2c6466c09917 upstream.

v4l2-compliance sends a zeroed struct v4l2_streamparm in
v4l2-test-formats.cpp::testParmType(), and this results in a division by
0 in some gspca subdrivers:

  divide error: 0000 [#1] SMP
  Modules linked in: gspca_ov534 gspca_main ...
  CPU: 0 PID: 17201 Comm: v4l2-compliance Not tainted 4.3.0-rc2-ao2 #1
  Hardware name: System manufacturer System Product Name/M2N-E SLI, BIOS
    ASUS M2N-E SLI ACPI BIOS Revision 1301 09/16/2010
  task: ffff8800818306c0 ti: ffff880095c4c000 task.ti: ffff880095c4c000
  RIP: 0010:[<ffffffffa079bd62>]  [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
  RSP: 0018:ffff880095c4fce8  EFLAGS: 00010296
  RAX: 0000000000000000 RBX: ffff8800c9522000 RCX: ffffffffa077a140
  RDX: 0000000000000000 RSI: ffff880095e0c100 RDI: ffff8800c9522000
  RBP: ffff880095e0c100 R08: ffffffffa077a100 R09: 00000000000000cc
  R10: ffff880067ec7740 R11: 0000000000000016 R12: ffffffffa07bb400
  R13: 0000000000000000 R14: ffff880081b6a800 R15: 0000000000000000
  FS:  00007fda0de78740(0000) GS:ffff88012fc00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00000000014630f8 CR3: 00000000cf349000 CR4: 00000000000006f0
  Stack:
   ffffffffa07a6431 ffff8800c9522000 ffffffffa077656e 00000000c0cc5616
   ffff8800c9522000 ffffffffa07a5e20 ffff880095e0c100 0000000000000000
   ffff880067ec7740 ffffffffa077a140 ffff880067ec7740 0000000000000016
  Call Trace:
   [<ffffffffa07a6431>] ? v4l_s_parm+0x21/0x50 [videodev]
   [<ffffffffa077656e>] ? vidioc_s_parm+0x4e/0x60 [gspca_main]
   [<ffffffffa07a5e20>] ? __video_do_ioctl+0x280/0x2f0 [videodev]
   [<ffffffffa07a5ba0>] ? video_ioctl2+0x20/0x20 [videodev]
   [<ffffffffa07a59b9>] ? video_usercopy+0x319/0x4e0 [videodev]
   [<ffffffff81182dc1>] ? page_add_new_anon_rmap+0x71/0xa0
   [<ffffffff811afb92>] ? mem_cgroup_commit_charge+0x52/0x90
   [<ffffffff81179b18>] ? handle_mm_fault+0xc18/0x1680
   [<ffffffffa07a15cc>] ? v4l2_ioctl+0xac/0xd0 [videodev]
   [<ffffffff811c846f>] ? do_vfs_ioctl+0x28f/0x480
   [<ffffffff811c86d4>] ? SyS_ioctl+0x74/0x80
   [<ffffffff8154a8b6>] ? entry_SYSCALL_64_fastpath+0x16/0x75
  Code: c7 93 d9 79 a0 5b 5d e9 f1 f3 9a e0 0f 1f 00 66 2e 0f 1f 84 00
    00 00 00 00 66 66 66 66 90 53 31 d2 48 89 fb 48 83 ec 08 8b 46 10 <f7>
    76 0c 80 bf ac 0c 00 00 00 88 87 4e 0e 00 00 74 09 80 bf 4f
  RIP  [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
   RSP <ffff880095c4fce8>
  ---[ end trace 279710c2c6c72080 ]---

Following what the doc says about a zeroed timeperframe (see
http://www.linuxtv.org/downloads/v4l-dvb-apis/vidioc-g-parm.html):

  ...
  To reset manually applications can just set this field to zero.

fix the issue by resetting the frame rate to a default value in case of
an unusable timeperframe.

The fix is done in the subdrivers instead of gspca.c because only the
subdrivers have notion of a default frame rate to reset the camera to.

Signed-off-by: Antonio Ospite <ao2@ao2.it>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[bwh: Backported to 3.2: adjust filenames]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/media/video/gspca/ov534.c | 9 +++++++--
 drivers/media/video/gspca/topro.c | 6 +++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

--- a/drivers/media/video/gspca/ov534.c
+++ b/drivers/media/video/gspca/ov534.c
@@ -1481,8 +1481,13 @@ static void sd_set_streamparm(struct gsp
 	struct v4l2_fract *tpf = &cp->timeperframe;
 	struct sd *sd = (struct sd *) gspca_dev;
 
-	/* Set requested framerate */
-	sd->frame_rate = tpf->denominator / tpf->numerator;
+	if (tpf->numerator == 0 || tpf->denominator == 0)
+		/* Set default framerate */
+		sd->frame_rate = 30;
+	else
+		/* Set requested framerate */
+		sd->frame_rate = tpf->denominator / tpf->numerator;
+
 	if (gspca_dev->streaming)
 		set_frame_rate(gspca_dev);
 
--- a/drivers/media/video/gspca/topro.c
+++ b/drivers/media/video/gspca/topro.c
@@ -4789,7 +4789,11 @@ static void sd_set_streamparm(struct gsp
 	struct v4l2_fract *tpf = &cp->timeperframe;
 	int fr, i;
 
-	sd->framerate = tpf->denominator / tpf->numerator;
+	if (tpf->numerator == 0 || tpf->denominator == 0)
+		sd->framerate = 30;
+	else
+		sd->framerate = tpf->denominator / tpf->numerator;
+
 	if (gspca_dev->streaming)
 		setframerate(gspca_dev);
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 79/87] crypto: af_alg - Forbid bind(2) when nokey  child sockets are present Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 17/87] asix: silence log message from oversize packet Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 73/87] crypto: algif_hash - Require setkey before  accept(2) Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 18/87] futex: Drop refcount if requeue_pi() acquired  the rtmutex Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 60/87] crypto: af_alg - Fix socket double-free when  accept fails Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 72/87] crypto: hash - Add crypto_ahash_has_setkey Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 70/87] crypto: af_alg - Add nokey compatibility path Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 57/87] ALSA: timer: Harden slave timer list handling Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 61/87] ALSA: hrtimer: Fix stall by hrtimer_cancel() Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 82/87] crypto: algif_skcipher - Load TX SG list after  waiting Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 11/87] rtlwifi: fix memory leak for USB device Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 64/87] ALSA: control: Avoid kernel warnings from tlv  ioctl with numid 0 Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 01/87] [media] gspca: ov534/topro: prevent a division by 0 Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:20 +0100
  [PATCH 3.2 08/87] mtd: nand: fix ONFI parameter page layout Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 80/87] crypto: algif_hash - Fix race condition in  hash_check_key Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 04/87] SCSI: initio: remove duplicate module device table Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 87/87] [media] usbvision: fix crash on detecting  device with invalid configuration Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 15/87] powerpc: Make value-returning atomics fully ordered Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 10/87] xhci: refuse loading if nousb is used Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 05/87] KVM: x86: expose MSR_TSC_AUX to userspace Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 86/87] [media] usbvision fix overflow of interfaces array Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 85/87] [media] usbvision: fix leak of usb_dev on  failure paths in  usbvision_probe() Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 07/87] ath9k_htc: check for underflow in  ath9k_htc_rx_msg() Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 13/87] wlcore/wl12xx: spi: fix oops on firmware load Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 14/87] EDAC: Robustify workqueues destruction Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 19/87] ALSA: fm801: propagate TUNER_ONLY bit when  autodetected Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 84/87] [media] usbvision-video: fix memory leak of  alt_max_pkt_size Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 12/87] wlcore: SPI - fix spi transfer_list Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 16/87] powerpc: Make {cmp}xchg* and their atomic_  versions fully ordered Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 78/87] crypto: algif_skcipher - Remove custom release  parent function Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  [PATCH 3.2 03/87] [media] rc: allow rc modules to be loaded if  rc-main is not a module Ben Hutchings <ben@decadent.org.uk> - 2016-02-09 01:30 +0100
  Re: [PATCH 3.2 00/87] 3.2.77-rc1 review Guenter Roeck <linux@roeck-us.net> - 2016-02-09 05:00 +0100
    Re: [PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-02-10 02:10 +0100

csiph-web