From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "Antonio Ospite" <ao2@ao2.it>,
"Hans Verkuil" <hans.verkuil@cisco.com>,
"Hans de Goede" <hdegoede@redhat.com>,
"Mauro Carvalho Chehab" <mchehab@osg.samsung.com>
Subject: [PATCH 3.2 01/87] [media] gspca: ov534/topro: prevent a division by 0
Date: Mon, 08 Feb 2016 23:53:51 +0000 [thread overview]
Message-ID: <lsq.1454975631.863732640@decadent.org.uk> (raw)
In-Reply-To: <lsq.1454975630.125133756@decadent.org.uk>
3.2.77-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Ospite <ao2@ao2.it>
commit dcc7fdbec53a960588f2c40232db2c6466c09917 upstream.
v4l2-compliance sends a zeroed struct v4l2_streamparm in
v4l2-test-formats.cpp::testParmType(), and this results in a division by
0 in some gspca subdrivers:
divide error: 0000 [#1] SMP
Modules linked in: gspca_ov534 gspca_main ...
CPU: 0 PID: 17201 Comm: v4l2-compliance Not tainted 4.3.0-rc2-ao2 #1
Hardware name: System manufacturer System Product Name/M2N-E SLI, BIOS
ASUS M2N-E SLI ACPI BIOS Revision 1301 09/16/2010
task: ffff8800818306c0 ti: ffff880095c4c000 task.ti: ffff880095c4c000
RIP: 0010:[<ffffffffa079bd62>] [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
RSP: 0018:ffff880095c4fce8 EFLAGS: 00010296
RAX: 0000000000000000 RBX: ffff8800c9522000 RCX: ffffffffa077a140
RDX: 0000000000000000 RSI: ffff880095e0c100 RDI: ffff8800c9522000
RBP: ffff880095e0c100 R08: ffffffffa077a100 R09: 00000000000000cc
R10: ffff880067ec7740 R11: 0000000000000016 R12: ffffffffa07bb400
R13: 0000000000000000 R14: ffff880081b6a800 R15: 0000000000000000
FS: 00007fda0de78740(0000) GS:ffff88012fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000014630f8 CR3: 00000000cf349000 CR4: 00000000000006f0
Stack:
ffffffffa07a6431 ffff8800c9522000 ffffffffa077656e 00000000c0cc5616
ffff8800c9522000 ffffffffa07a5e20 ffff880095e0c100 0000000000000000
ffff880067ec7740 ffffffffa077a140 ffff880067ec7740 0000000000000016
Call Trace:
[<ffffffffa07a6431>] ? v4l_s_parm+0x21/0x50 [videodev]
[<ffffffffa077656e>] ? vidioc_s_parm+0x4e/0x60 [gspca_main]
[<ffffffffa07a5e20>] ? __video_do_ioctl+0x280/0x2f0 [videodev]
[<ffffffffa07a5ba0>] ? video_ioctl2+0x20/0x20 [videodev]
[<ffffffffa07a59b9>] ? video_usercopy+0x319/0x4e0 [videodev]
[<ffffffff81182dc1>] ? page_add_new_anon_rmap+0x71/0xa0
[<ffffffff811afb92>] ? mem_cgroup_commit_charge+0x52/0x90
[<ffffffff81179b18>] ? handle_mm_fault+0xc18/0x1680
[<ffffffffa07a15cc>] ? v4l2_ioctl+0xac/0xd0 [videodev]
[<ffffffff811c846f>] ? do_vfs_ioctl+0x28f/0x480
[<ffffffff811c86d4>] ? SyS_ioctl+0x74/0x80
[<ffffffff8154a8b6>] ? entry_SYSCALL_64_fastpath+0x16/0x75
Code: c7 93 d9 79 a0 5b 5d e9 f1 f3 9a e0 0f 1f 00 66 2e 0f 1f 84 00
00 00 00 00 66 66 66 66 90 53 31 d2 48 89 fb 48 83 ec 08 8b 46 10 <f7>
76 0c 80 bf ac 0c 00 00 00 88 87 4e 0e 00 00 74 09 80 bf 4f
RIP [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
RSP <ffff880095c4fce8>
---[ end trace 279710c2c6c72080 ]---
Following what the doc says about a zeroed timeperframe (see
http://www.linuxtv.org/downloads/v4l-dvb-apis/vidioc-g-parm.html):
...
To reset manually applications can just set this field to zero.
fix the issue by resetting the frame rate to a default value in case of
an unusable timeperframe.
The fix is done in the subdrivers instead of gspca.c because only the
subdrivers have notion of a default frame rate to reset the camera to.
Signed-off-by: Antonio Ospite <ao2@ao2.it>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[bwh: Backported to 3.2: adjust filenames]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/video/gspca/ov534.c | 9 +++++++--
drivers/media/video/gspca/topro.c | 6 +++++-
2 files changed, 12 insertions(+), 3 deletions(-)
--- a/drivers/media/video/gspca/ov534.c
+++ b/drivers/media/video/gspca/ov534.c
@@ -1481,8 +1481,13 @@ static void sd_set_streamparm(struct gsp
struct v4l2_fract *tpf = &cp->timeperframe;
struct sd *sd = (struct sd *) gspca_dev;
- /* Set requested framerate */
- sd->frame_rate = tpf->denominator / tpf->numerator;
+ if (tpf->numerator == 0 || tpf->denominator == 0)
+ /* Set default framerate */
+ sd->frame_rate = 30;
+ else
+ /* Set requested framerate */
+ sd->frame_rate = tpf->denominator / tpf->numerator;
+
if (gspca_dev->streaming)
set_frame_rate(gspca_dev);
--- a/drivers/media/video/gspca/topro.c
+++ b/drivers/media/video/gspca/topro.c
@@ -4789,7 +4789,11 @@ static void sd_set_streamparm(struct gsp
struct v4l2_fract *tpf = &cp->timeperframe;
int fr, i;
- sd->framerate = tpf->denominator / tpf->numerator;
+ if (tpf->numerator == 0 || tpf->denominator == 0)
+ sd->framerate = 30;
+ else
+ sd->framerate = tpf->denominator / tpf->numerator;
+
if (gspca_dev->streaming)
setframerate(gspca_dev);
next prev parent reply other threads:[~2016-02-09 0:14 UTC|newest]
Thread overview: 91+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-08 23:53 [PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 32/87] udf: Prevent buffer overrun with multi-byte characters Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 52/87] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 50/87] cifs: Ratelimit kernel log messages Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 13/87] wlcore/wl12xx: spi: fix oops on firmware load Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 74/87] crypto: skcipher - Add crypto_skcipher_has_setkey Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 26/87] rtlwifi: rtl8192se: Fix module parameter initialization Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 17/87] asix: silence log message from oversize packet Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 56/87] ocfs2/dlm: ignore cleaning the migration mle that is inuse Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 86/87] [media] usbvision fix overflow of interfaces array Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 34/87] power: test_power: correctly handle empty writes Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 16/87] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 58/87] memcg: only free spare array when readers are done Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 21/87] udf: limit the maximum number of indirect extents in a row Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 63/87] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 67/87] ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 81/87] crypto: algif_skcipher - Fix race condition in skcipher_check_key Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 09/87] drm/radeon: call hpd_irq_event on resume Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 25/87] rtlwifi: rtl8192de: Fix incorrect module parameter descriptions Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 45/87] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 05/87] KVM: x86: expose MSR_TSC_AUX to userspace Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 80/87] crypto: algif_hash - Fix race condition in hash_check_key Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 29/87] NFS: Fix attribute cache revalidation Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 06/87] KVM: x86: correctly print #AC in traces Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 10/87] xhci: refuse loading if nousb is used Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 11/87] rtlwifi: fix memory leak for USB device Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 75/87] crypto: algif_skcipher - Add key check exception for cipher_null Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 28/87] rtlwifi: rtl8192cu: Add missing parameter setup Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 42/87] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 68/87] crypto: algif_skcipher - Require setkey before accept(2) Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 15/87] powerpc: Make value-returning atomics fully ordered Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 78/87] crypto: algif_skcipher - Remove custom release parent function Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 48/87] ALSA: timer: Fix race among timer ioctls Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 60/87] crypto: af_alg - Fix socket double-free when accept fails Ben Hutchings
2016-02-08 23:53 ` Ben Hutchings [this message]
2016-02-08 23:53 ` [PATCH 3.2 72/87] crypto: hash - Add crypto_ahash_has_setkey Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 38/87] uml: flush stdout before forking Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 77/87] crypto: algif_hash - Remove custom release parent function Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 24/87] x86/LDT: Print the real LDT base address Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 47/87] ALSA: timer: Fix double unlink of active_list Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 40/87] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 18/87] futex: Drop refcount if requeue_pi() acquired the rtmutex Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 37/87] uml: fix hostfs mknod() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 31/87] x86/xen: don't reset vcpu_info on a cancelled suspend Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 79/87] crypto: af_alg - Forbid bind(2) when nokey child sockets are present Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 65/87] IB/qib: fix mcast detach when qp not attached Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 14/87] EDAC: Robustify workqueues destruction Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 66/87] IB/mlx4: Initialize hop_limit when creating address handle Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 61/87] ALSA: hrtimer: Fix stall by hrtimer_cancel() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 82/87] crypto: algif_skcipher - Load TX SG list after waiting Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 02/87] [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 84/87] [media] usbvision-video: fix memory leak of alt_max_pkt_size Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 51/87] cifs: fix race between call_async() and reconnect() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 87/87] [media] usbvision: fix crash on detecting device with invalid configuration Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 04/87] SCSI: initio: remove duplicate module device table Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 46/87] x86/mm: Improve switch_mm() barrier comments Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 30/87] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 07/87] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 12/87] wlcore: SPI - fix spi transfer_list Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 27/87] rtlwifi: rtl8192ce: Fix handling of module parameters Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 57/87] ALSA: timer: Harden slave timer list handling Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 43/87] ALSA: seq: Fix missing NULL check at remove_events ioctl Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 83/87] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 69/87] crypto: af_alg - Disallow bind/setkey/... after accept(2) Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 53/87] m32r: fix m32104ut_defconfig build fail Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 33/87] udf: Check output buffer length when converting name to CS0 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 08/87] mtd: nand: fix ONFI parameter page layout Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 49/87] sparc64: fix incorrect sign extension in sys_sparc64_personality Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 44/87] ALSA: seq: Fix race at timer setup and close Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 59/87] printk: help pr_debug and pr_devel to optimize out arguments Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 03/87] [media] rc: allow rc modules to be loaded if rc-main is not a module Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 54/87] dma-debug: switch check from _text to _stext Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 71/87] crypto: algif_skcipher - Add nokey compatibility path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 20/87] drm/radeon: clean up fujitsu quirks Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 73/87] crypto: algif_hash - Require setkey before accept(2) Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 70/87] crypto: af_alg - Add nokey compatibility path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 22/87] USB: cp210x: add ID for ELV Marble Sound Board 1 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 55/87] scripts/bloat-o-meter: fix python3 syntax error Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 41/87] x86/boot: Double BOOT_HEAP_SIZE to 64KB Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 39/87] ipv6: tcp: add rcu locking in tcp_v6_send_synack() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 35/87] locks: fix unlock when fcntl_setlk races with a close Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 64/87] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 76/87] crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 62/87] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 85/87] [media] usbvision: fix leak of usb_dev on failure paths in usbvision_probe() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 19/87] ALSA: fm801: propagate TUNER_ONLY bit when autodetected Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 36/87] dm snapshot: fix hung bios when copy error occurs Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 23/87] posix-clock: Fix return code on the poll method's error path Ben Hutchings
2016-02-09 0:21 ` [PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings
2016-02-09 3:58 ` Guenter Roeck
2016-02-10 1:00 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1454975631.863732640@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=ao2@ao2.it \
--cc=hans.verkuil@cisco.com \
--cc=hdegoede@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@osg.samsung.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®