[BUG] NULL pointer dereference in pvr2_v4l2_internal_check

[Oleksandr Ostrenko]

Dear all,




[ 2128.129776] usb 1-1: USB disconnect, device number 6
[ 2128.129987] pvrusb2: Device being rendered inoperable

[ 2128.130082] IP: pvr2_v4l2_internal_check+0x41/0x60 [pvrusb2]
[ 2128.130085] PGD 0 P4D 0
[ 2128.130092] Oops: 0000 [#1] PREEMPT SMP

[ 2128.130306] task: ffff880cae4f6000 task.stack: ffffb3a7c2548000
[ 2128.130320] RIP: 0010:pvr2_v4l2_internal_check+0x41/0x60 [pvrusb2]
[ 2128.130324] RSP: 0018:ffffb3a7c254bec8 EFLAGS: 00010246

[ 2128.130347] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033

[ 2128.130359] Call Trace:
[ 2128.130378]  pvr2_context_thread_func+0xa6/0x2a0 [pvrusb2]
[ 2128.130388]  ? finish_wait+0x80/0x80
[ 2128.130394]  kthread+0x118/0x130
[ 2128.130399]  ? kthread_create_on_node+0x40/0x40
[ 2128.130406]  ret_from_fork+0x25/0x30

[ 2128.130494] CR2: 0000000000000360
[ 2128.130499] ---[ end trace b7d1a2a4867177f2 ]---



[ 2135.323115] usb 1-1: new high-speed USB device number 7 using xhci_hcd
[ 2135.481292] usb 1-1: New USB device found, idVendor=2040, idProduct=7300

[ 2135.481306] usb 1-1: Product: WinTV
[ 2135.481310] usb 1-1: Manufacturer: Hauppauge
[ 2135.481313] usb 1-1: SerialNumber: 7300-00-F04BADA0
[ 2135.482726] pvrusb2: Hardware description: WinTV HVR-1900 Model 73xxx



Thanks,
Oleksandr

Unplugging the TV tuner (WinTV HVR-1900) from USB port causes a NULL pointer dereference in pvr2_v4l2_internal_check: [ 2128.130055] BUG: unable to handle kernel NULL pointer dereference at 0000000000000360 [ 2128.130097] Modules linked in: tda10048 tda18271 tda8290 tuner lirc_zilog(C) lirc_dev cx25840 rc_core pvrusb2(O) tveeprom cx2341x dvb_core v4l2_common rfcomm af_packet 8021q garp mrp stp llc nf_log_ipv6 xt_comment nf_log_ipv4 nf_log_common xt_LOG xt_limit ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ipt_REJECT nf_reject_ipv4 xt_pkttype xt_tcpudp iptable_filter snd_hda_codec_hdmi ip6table_mangle nf_conntrack_netbios_ns nf_conntrack_broadcast nf_conntrack_ipv4 nf_defrag_ipv4 ip_tables xt_conntrack nf_conntrack ip6table_filter ip6_tables x_tables bnep arc4 xfs libcrc32c snd_hda_codec_realtek intel_rapl snd_hda_codec_generic x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm iwlmvm snd_hda_intel raid1 irqbypass crct10dif_pclmul snd_hda_codec mac80211 crc32_pclmul snd_hda_core [ 2128.130176] ghash_clmulni_intel snd_hwdep pcbc snd_pcm iwlwifi snd_timer dell_laptop aesni_intel md_mod hid_multitouch dell_wmi iTCO_wdt aes_x86_64 snd rtsx_pci_ms iTCO_vendor_support btusb crypto_simd uvcvideo dell_smbios btrtl glue_helper dell_smm_hwmon wmi_bmof dcdbas joydev hci_uart cryptd pcspkr cfg80211 videobuf2_vmalloc memstick btbcm serdev videobuf2_memops r8169 btqca soundcore btintel videobuf2_v4l2 mii int3403_thermal i2c_i801 videobuf2_core videodev bluetooth battery ac sparse_keymap ecdh_generic fan thermal idma64 pinctrl_sunrisepoint pinctrl_intel tpm_crb tpm_tis tpm_tis_core tpm processor_thermal_device intel_lpss_acpi intel_soc_dts_iosf int3402_thermal dell_rbtn int340x_thermal_zone mei_me rfkill int3400_thermal intel_lpss_pci acpi_pad mei acpi_thermal_rel intel_lpss intel_pch_thermal [ 2128.130252] acpi_als kfifo_buf shpchp industrialio btrfs xor zstd_decompress zstd_compress xxhash hid_generic usbhid i915 raid6_pq rtsx_pci_sdmmc mmc_core mxm_wmi crc32c_intel i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt xhci_pci fb_sys_fops serio_raw xhci_hcd rtsx_pci drm usbcore wmi video i2c_hid button sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua [ 2128.130300] CPU: 6 PID: 2310 Comm: pvrusb2-context Tainted: G C O 4.14.6-1.g45f120a-default #1 [ 2128.130303] Hardware name: Dell Inc. Inspiron 7559/0H0CC0, BIOS 1.1.8 04/17/2016 [ 2128.130328] RAX: 0000000000000000 RBX: ffff880caf05e780 RCX: ffffffffc0ffe970 [ 2128.130331] RDX: ffff880c90ca1b60 RSI: 0000000000000001 RDI: 0000000000000000 [ 2128.130334] RBP: ffff880cac83eb00 R08: ffffffffc1016a78 R09: 00000000000003d2 [ 2128.130337] R10: 00000000000003a9 R11: 00000000003d0900 R12: ffffb3a7c24ffc18 [ 2128.130340] R13: ffff880cae4f6000 R14: 0000000000000000 R15: ffffffffc1000ae0 [ 2128.130344] FS: 0000000000000000(0000) GS:ffff880cc1d80000(0000) knlGS:0000000000000000 [ 2128.130350] CR2: 0000000000000360 CR3: 000000024ec09005 CR4: 00000000003606e0 [ 2128.130354] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2128.130357] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2128.130412] Code: 8b 7f 38 e8 d2 e4 ff ff 48 8b 7b 40 e8 c9 e4 ff ff 48 8b 43 38 48 8b 90 60 03 00 00 48 05 60 03 00 00 48 39 d0 75 d6 48 8b 43 40 <48> 8b 90 60 03 00 00 48 05 60 03 00 00 48 39 d0 75 c0 48 89 df [ 2128.130491] RIP: pvr2_v4l2_internal_check+0x41/0x60 [pvrusb2] RSP: ffffb3a7c254bec8 Upon reconnect the device is no longer recognized by the driver and no firmware is uploaded: [ 2135.481302] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 This effectively breaks the driver until after a reboot of the kernel. Can this be fixed by simply adding respective checks in the function itself or is this a part of a bigger issue?

smime.p7s
Description: S/MIME Cryptographic Signature