From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Sakari Ailus <sakari.ailus@linux.intel.com>,
Hans Verkuil <hans.verkuil@cisco.com>,
Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Subject: [PATCH 4.4 68/73] Revert "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing"
Date: Mon, 16 May 2016 18:15:38 -0700 [thread overview]
Message-ID: <20160517011454.780822233@linuxfoundation.org> (raw)
In-Reply-To: <20160517011451.827433776@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit 93f0750dcdaed083d6209b01e952e98ca730db66 upstream.
This patch causes a Kernel panic when called on a DVB driver.
This was also reported by David R <david@unsolicited.net>:
May 7 14:47:35 server kernel: [ 501.247123] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
May 7 14:47:35 server kernel: [ 501.247239] IP: [<ffffffffa0222c71>] __verify_planes_array.isra.3+0x1/0x80 [videobuf2_v4l2]
May 7 14:47:35 server kernel: [ 501.247354] PGD cae6f067 PUD ca99c067 PMD 0
May 7 14:47:35 server kernel: [ 501.247426] Oops: 0000 [#1] SMP
May 7 14:47:35 server kernel: [ 501.247482] Modules linked in: xfs tun
xt_connmark xt_TCPMSS xt_tcpmss xt_owner xt_REDIRECT nf_nat_redirect
xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4 ts_kmp ts_bm xt_string
ipt_REJECT nf_reject_ipv4 xt_recent xt_conntrack xt_multiport xt_pkttype
xt_tcpudp xt_mark nf_log_ipv4 nf_log_common xt_LOG xt_limit
iptable_mangle iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4
nf_nat nf_conntrack iptable_filter ip_tables ip6table_filter ip6_tables
x_tables pppoe pppox dm_crypt ts2020 regmap_i2c ds3000 cx88_dvb dvb_pll
cx88_vp3054_i2c mt352 videobuf2_dvb cx8800 cx8802 cx88xx pl2303 tveeprom
videobuf2_dma_sg ppdev videobuf2_memops videobuf2_v4l2 videobuf2_core
dvb_usb_digitv snd_hda_codec_via snd_hda_codec_hdmi
snd_hda_codec_generic radeon dvb_usb snd_hda_intel amd64_edac_mod
serio_raw snd_hda_codec edac_core fbcon k10temp bitblit softcursor
snd_hda_core font snd_pcm_oss i2c_piix4 snd_mixer_oss tileblit
drm_kms_helper syscopyarea snd_pcm snd_seq_dummy sysfillrect snd_seq_oss
sysimgblt fb_sys_fops ttm snd_seq_midi r8169 snd_rawmidi drm
snd_seq_midi_event e1000e snd_seq snd_seq_device snd_timer snd ptp
pps_core i2c_algo_bit soundcore parport_pc ohci_pci shpchp tpm_tis tpm
nfsd auth_rpcgss oid_registry hwmon_vid exportfs nfs_acl mii nfs bonding
lockd grace lp sunrpc parport
May 7 14:47:35 server kernel: [ 501.249564] CPU: 1 PID: 6889 Comm: vb2-cx88[0] Not tainted 4.5.3 #3
May 7 14:47:35 server kernel: [ 501.249644] Hardware name: System manufacturer System Product Name/M4A785TD-V EVO, BIOS 0211 07/08/2009
May 7 14:47:35 server kernel: [ 501.249767] task: ffff8800aebf3600 ti: ffff8801e07a0000 task.ti: ffff8801e07a0000
May 7 14:47:35 server kernel: [ 501.249861] RIP: 0010:[<ffffffffa0222c71>] [<ffffffffa0222c71>] __verify_planes_array.isra.3+0x1/0x80 [videobuf2_v4l2]
May 7 14:47:35 server kernel: [ 501.250002] RSP: 0018:ffff8801e07a3de8 EFLAGS: 00010086
May 7 14:47:35 server kernel: [ 501.250071] RAX: 0000000000000283 RBX: ffff880210dc5000 RCX: 0000000000000283
May 7 14:47:35 server kernel: [ 501.250161] RDX: ffffffffa0222cf0 RSI: 0000000000000000 RDI: ffff880210dc5014
May 7 14:47:35 server kernel: [ 501.250251] RBP: ffff8801e07a3df8 R08: ffff8801e07a0000 R09: 0000000000000000
May 7 14:47:35 server kernel: [ 501.250348] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800cda2a9d8
May 7 14:47:35 server kernel: [ 501.250438] R13: ffff880210dc51b8 R14: 0000000000000000 R15: ffff8800cda2a828
May 7 14:47:35 server kernel: [ 501.250528] FS: 00007f5b77fff700(0000) GS:ffff88021fc40000(0000) knlGS:00000000adaffb40
May 7 14:47:35 server kernel: [ 501.250631] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
May 7 14:47:35 server kernel: [ 501.250704] CR2: 0000000000000004 CR3: 00000000ca19d000 CR4: 00000000000006e0
May 7 14:47:35 server kernel: [ 501.250794] Stack:
May 7 14:47:35 server kernel: [ 501.250822] ffff8801e07a3df8 ffffffffa0222cfd ffff8801e07a3e70 ffffffffa0236beb
May 7 14:47:35 server kernel: [ 501.250937] 0000000000000283 ffff8801e07a3e94 0000000000000000 0000000000000000
May 7 14:47:35 server kernel: [ 501.251051] ffff8800aebf3600 ffffffff8108d8e0 ffff8801e07a3e38 ffff8801e07a3e38
May 7 14:47:35 server kernel: [ 501.251165] Call Trace:
May 7 14:47:35 server kernel: [ 501.251200] [<ffffffffa0222cfd>] ? __verify_planes_array_core+0xd/0x10 [videobuf2_v4l2]
May 7 14:47:35 server kernel: [ 501.251306] [<ffffffffa0236beb>] vb2_core_dqbuf+0x2eb/0x4c0 [videobuf2_core]
May 7 14:47:35 server kernel: [ 501.251398] [<ffffffff8108d8e0>] ? prepare_to_wait_event+0x100/0x100
May 7 14:47:35 server kernel: [ 501.251482] [<ffffffffa023855b>] vb2_thread+0x1cb/0x220 [videobuf2_core]
May 7 14:47:35 server kernel: [ 501.251569] [<ffffffffa0238390>] ? vb2_core_qbuf+0x230/0x230 [videobuf2_core]
May 7 14:47:35 server kernel: [ 501.251662] [<ffffffffa0238390>] ? vb2_core_qbuf+0x230/0x230 [videobuf2_core]
May 7 14:47:35 server kernel: [ 501.255982] [<ffffffff8106f984>] kthread+0xc4/0xe0
May 7 14:47:35 server kernel: [ 501.260292] [<ffffffff8106f8c0>] ? kthread_park+0x50/0x50
May 7 14:47:35 server kernel: [ 501.264615] [<ffffffff81697a5f>] ret_from_fork+0x3f/0x70
May 7 14:47:35 server kernel: [ 501.268962] [<ffffffff8106f8c0>] ? kthread_park+0x50/0x50
May 7 14:47:35 server kernel: [ 501.273216] Code: 0d 01 74 16 48 8b 46 28 48 8b 56 30 48 89 87 d0 01 00 00 48 89 97 d8 01 00 00 5d c3 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 <8b> 46 04 48 89 e5 8d 50 f7 31 c0 83 fa 01 76 02 5d c3 48 83 7e
May 7 14:47:35 server kernel: [ 501.282146] RIP [<ffffffffa0222c71>] __verify_planes_array.isra.3+0x1/0x80 [videobuf2_v4l2]
May 7 14:47:35 server kernel: [ 501.286391] RSP <ffff8801e07a3de8>
May 7 14:47:35 server kernel: [ 501.290619] CR2: 0000000000000004
May 7 14:47:35 server kernel: [ 501.294786] ---[ end trace b2b354153ccad110 ]---
This reverts commit 2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab.
Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: Hans Verkuil <hans.verkuil@cisco.com>
Fixes: 2c1f6951a8a8 ("[media] videobuf2-v4l2: Verify planes array in buffer dequeueing")
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/videobuf2-v4l2.c | 6 ------
1 file changed, 6 deletions(-)
--- a/drivers/media/v4l2-core/videobuf2-v4l2.c
+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c
@@ -67,11 +67,6 @@ static int __verify_planes_array(struct
return 0;
}
-static int __verify_planes_array_core(struct vb2_buffer *vb, const void *pb)
-{
- return __verify_planes_array(vb, pb);
-}
-
/**
* __verify_length() - Verify that the bytesused value for each plane fits in
* the plane length and that the data offset doesn't exceed the bytesused value.
@@ -437,7 +432,6 @@ static int __fill_vb2_buffer(struct vb2_
}
static const struct vb2_buf_ops v4l2_buf_ops = {
- .verify_planes_array = __verify_planes_array_core,
.fill_user_buffer = __fill_v4l2_buffer,
.fill_vb2_buffer = __fill_vb2_buffer,
.set_timestamp = __set_timestamp,
next prev parent reply other threads:[~2016-05-17 1:17 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-17 1:14 [PATCH 4.4 00/73] 4.4.11-stable review Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 01/73] decnet: Do not build routes to devices without decnet private data Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 02/73] route: do not cache fib route info on local routes with oif Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 03/73] packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 04/73] net: sched: do not requeue a NULL skb Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 05/73] bpf/verifier: reject invalid LD_ABS | BPF_DW instruction Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 08/73] net: use skb_postpush_rcsum instead of own implementations Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 09/73] vlan: pull on __vlan_insert_tag error path and fix csum correction Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 10/73] atl2: Disable unimplemented scatter/gather feature Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 11/73] openvswitch: use flow protocol when recalculating ipv6 checksums Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 12/73] net/mlx5e: Devices mtu field is u16 and not int Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 13/73] net/mlx5e: Fix minimum MTU Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 14/73] ipv4/fib: dont warn when primary address is missing if in_dev is dead Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 15/73] net/mlx4_en: fix spurious timestamping callbacks Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 16/73] bpf: fix double-fdput in replace_map_fd_with_map_ptr() Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 17/73] bpf: fix refcnt overflow Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 18/73] bpf: fix check_map_func_compatibility logic Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 19/73] samples/bpf: fix trace_output example Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 20/73] net: Implement net_dbg_ratelimited() for CONFIG_DYNAMIC_DEBUG case Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 21/73] gre: do not pull header in ICMP error processing Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 22/73] net_sched: introduce qdisc_replace() helper Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 23/73] net_sched: update hierarchical backlog too Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 24/73] sch_htb: update backlog as well Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 25/73] sch_dsmark: " Greg Kroah-Hartman
2016-05-17 1:14 ` [PATCH 4.4 26/73] netem: Segment GSO packets on enqueue Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 30/73] net/mlx4_en: Fix endianness bug in IPV6 csum calculation Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 31/73] VSOCK: do not disconnect socket when peer has shutdown SEND only Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 32/73] net: bridge: fix old ioctl unlocked net device walk Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 35/73] net: fix a kernel infoleak in x25 module Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 36/73] net: thunderx: avoid exposing kernel stack Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 37/73] tcp: refresh skb timestamp at retransmit time Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 38/73] net/route: enforce hoplimit max value Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 39/73] ocfs2: revert using ocfs2_acl_chmod to avoid inode cluster lock hang Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 40/73] ocfs2: fix posix_acl_create deadlock Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 41/73] zsmalloc: fix zs_can_compact() integer overflow Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 42/73] s390/mm: fix asce_bits handling with dynamic pagetable levels Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 43/73] crypto: qat - fix invalid pf2vf_resp_wq logic Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 44/73] crypto: hash - Fix page length clamping in hash walk Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 45/73] crypto: testmgr - Use kmalloc memory for RSA input Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 46/73] ALSA: usb-audio: Quirk for yet another Phoenix Audio devices (v2) Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 47/73] ALSA: usb-audio: Yet another Phoneix Audio device quirk Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 48/73] ALSA: hda - Fix subwoofer pin on ASUS N751 and N551 Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 49/73] ALSA: hda - Fix white noise on Asus UX501VW headset Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 50/73] ALSA: hda - Fix broken reconfig Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 51/73] spi: pxa2xx: Do not detect number of enabled chip selects on Intel SPT Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 52/73] spi: spi-ti-qspi: Fix FLEN and WLEN settings if bits_per_word is overridden Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 53/73] spi: spi-ti-qspi: Handle truncated frames properly Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 54/73] pinctrl: at91-pio4: fix pull-up/down logic Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 55/73] regmap: spmi: Fix regmap_spmi_ext_read in multi-byte case Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 56/73] perf/core: Disable the event on a truncated AUX record Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 57/73] vfs: add vfs_select_inode() helper Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 58/73] vfs: rename: check backing inode being equal Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 59/73] ARM: dts: at91: sam9x5: Fix the memory range assigned to the PMC Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 61/73] regulator: s2mps11: Fix invalid selector mask and voltages for buck9 Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 62/73] regulator: axp20x: Fix axp22x ldo_io voltage ranges Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 63/73] atomic_open(): fix the handling of create_error Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 64/73] qla1280: Dont allocate 512kb of host tags Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 65/73] tools lib traceevent: Do not reassign parg after collapse_tree() Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 66/73] get_rock_ridge_filename(): handle malformed NM entries Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 67/73] Input: max8997-haptic - fix NULL pointer dereference Greg Kroah-Hartman
2016-05-17 1:15 ` Greg Kroah-Hartman [this message]
2016-05-17 1:15 ` [PATCH 4.4 69/73] drm/radeon: fix PLL sharing on DCE6.1 (v2) Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 70/73] drm/i915: Bail out of pipe config compute loop on LPT Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 72/73] drm/radeon: fix DP link training issue with second 4K monitor Greg Kroah-Hartman
2016-05-17 1:15 ` [PATCH 4.4 73/73] nf_conntrack: avoid kernel pointer value leak in slab name Greg Kroah-Hartman
2016-05-17 17:27 ` [PATCH 4.4 00/73] 4.4.11-stable review Guenter Roeck
2016-05-17 17:28 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160517011454.780822233@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=hans.verkuil@cisco.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@osg.samsung.com \
--cc=sakari.ailus@linux.intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox