linux-kernel - Re: [PATCH v2] media: usb: uvc: Fix NULL pointer dereference during USB device hot-unplug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <202511290057.kQLrar4L-lkp@intel.com>
Date: Sat, 29 Nov 2025 19:48:49 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: oe-kbuild@...ts.linux.dev, Jie Deng <dengjie03@...inos.cn>,
	laurent.pinchart@...asonboard.com
Cc: lkp@...el.com, oe-kbuild-all@...ts.linux.dev, hansg@...nel.org,
	mchehab@...nel.org, kieran.bingham@...asonboard.com,
	linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
	Jie Deng <dengjie03@...inos.cn>
Subject: Re: [PATCH v2] media: usb: uvc: Fix NULL pointer dereference during
 USB device hot-unplug

Hi Jie,

kernel test robot noticed the following build warnings:

https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Jie-Deng/media-usb-uvc-Fix-NULL-pointer-dereference-during-USB-device-hot-unplug/20251122-152814
base:   https://git.linuxtv.org/media-ci/media-pending.git master
patch link:    https://lore.kernel.org/r/20251122072558.2604753-1-dengjie03%40kylinos.cn
patch subject: [PATCH v2] media: usb: uvc: Fix NULL pointer dereference during USB device hot-unplug
config: x86_64-randconfig-r071-20251128 (https://download.01.org/0day-ci/archive/20251129/202511290057.kQLrar4L-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
| Closes: https://lore.kernel.org/r/202511290057.kQLrar4L-lkp@intel.com/

smatch warnings:
drivers/media/usb/uvc/uvc_video.c:2357 uvc_video_stop_streaming() error: we previously assumed 'stream' could be null (see line 2323)

vim +/stream +2357 drivers/media/usb/uvc/uvc_video.c

571e70dbd421056 Kieran Bingham   2018-11-05  2318  void uvc_video_stop_streaming(struct uvc_streaming *stream)
571e70dbd421056 Kieran Bingham   2018-11-05  2319  {
18ffa9a4cf426a8 Jie Deng         2025-11-22  2320  	struct usb_host_config *config;
18ffa9a4cf426a8 Jie Deng         2025-11-22  2321  	int i;
18ffa9a4cf426a8 Jie Deng         2025-11-22  2322  
18ffa9a4cf426a8 Jie Deng         2025-11-22 @2323  	if (!stream || !stream->dev || !stream->dev->udev || !stream->intf)

I don't think "stream" can be NULL,

18ffa9a4cf426a8 Jie Deng         2025-11-22  2324  		goto cleanup_clock;
18ffa9a4cf426a8 Jie Deng         2025-11-22  2325  
fb58e16bb783833 Kieran Bingham   2018-11-05  2326  	uvc_video_stop_transfer(stream, 1);
571e70dbd421056 Kieran Bingham   2018-11-05  2327  
18ffa9a4cf426a8 Jie Deng         2025-11-22  2328  	config = stream->dev->udev->actconfig;
18ffa9a4cf426a8 Jie Deng         2025-11-22  2329  	if (stream->intf->num_altsetting > 1 && config) {
18ffa9a4cf426a8 Jie Deng         2025-11-22  2330  		/* Security Check: Check if the interface exists and is valid */
18ffa9a4cf426a8 Jie Deng         2025-11-22  2331  		for (i = 0; i < config->desc.bNumInterfaces; i++) {
18ffa9a4cf426a8 Jie Deng         2025-11-22  2332  			if (config->interface[i] &&
18ffa9a4cf426a8 Jie Deng         2025-11-22  2333  			    config->interface[i]->altsetting[0]
18ffa9a4cf426a8 Jie Deng         2025-11-22  2334  				.desc.bInterfaceNumber == stream->intfnum) {
571e70dbd421056 Kieran Bingham   2018-11-05  2335  				usb_set_interface(stream->dev->udev, stream->intfnum, 0);
18ffa9a4cf426a8 Jie Deng         2025-11-22  2336  				break;
18ffa9a4cf426a8 Jie Deng         2025-11-22  2337  			}
18ffa9a4cf426a8 Jie Deng         2025-11-22  2338  		}
571e70dbd421056 Kieran Bingham   2018-11-05  2339  	} else {
699b9a86a3f03ad Laurent Pinchart 2022-06-08  2340  		/*
699b9a86a3f03ad Laurent Pinchart 2022-06-08  2341  		 * UVC doesn't specify how to inform a bulk-based device
571e70dbd421056 Kieran Bingham   2018-11-05  2342  		 * when the video stream is stopped. Windows sends a
571e70dbd421056 Kieran Bingham   2018-11-05  2343  		 * CLEAR_FEATURE(HALT) request to the video streaming
571e70dbd421056 Kieran Bingham   2018-11-05  2344  		 * bulk endpoint, mimic the same behaviour.
571e70dbd421056 Kieran Bingham   2018-11-05  2345  		 */
571e70dbd421056 Kieran Bingham   2018-11-05  2346  		unsigned int epnum = stream->header.bEndpointAddress
571e70dbd421056 Kieran Bingham   2018-11-05  2347  				   & USB_ENDPOINT_NUMBER_MASK;
571e70dbd421056 Kieran Bingham   2018-11-05  2348  		unsigned int dir = stream->header.bEndpointAddress
571e70dbd421056 Kieran Bingham   2018-11-05  2349  				 & USB_ENDPOINT_DIR_MASK;
571e70dbd421056 Kieran Bingham   2018-11-05  2350  		unsigned int pipe;
571e70dbd421056 Kieran Bingham   2018-11-05  2351  
571e70dbd421056 Kieran Bingham   2018-11-05  2352  		pipe = usb_sndbulkpipe(stream->dev->udev, epnum) | dir;
571e70dbd421056 Kieran Bingham   2018-11-05  2353  		usb_clear_halt(stream->dev->udev, pipe);
571e70dbd421056 Kieran Bingham   2018-11-05  2354  	}
571e70dbd421056 Kieran Bingham   2018-11-05  2355  
18ffa9a4cf426a8 Jie Deng         2025-11-22  2356  cleanup_clock:
141270bd95d48ea Ricardo Ribalda  2024-03-23 @2357  	uvc_video_clock_cleanup(&stream->clock);
                                                                                ^^^^^^^^^^^^^^
But if it is then we are toasted.


-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki