diff mbox series

[v7,1/6] media: uvcvideo: Fix underflow addressing on hw timestamp

Message ID 20220920-resend-hwtimestamp-v7-1-cf1d78bb8821@chromium.org
State New
Headers
Series uvcvideo: Fixes for hw timestamping |

Commit Message

Ricardo Ribalda March 10, 2023, 9:01 a.m. UTC 
  If head is 0, we will be addressing clock->samples[-1], which will
result in undefined behaviour.

Fixes: 66847ef013cc ("[media] uvcvideo: Add UVC timestamps support")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 drivers/media/usb/uvc/uvc_video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Sergey Senozhatsky March 10, 2023, 12:18 p.m. UTC | #1 
On (23/03/10 10:01), Ricardo Ribalda wrote:
> If head is 0, we will be addressing clock->samples[-1], which will
> result in undefined behaviour.

[..]

>  	first = &clock->samples[clock->head];
> -	last = &clock->samples[(clock->head - 1) % clock->size];
> +	last = &clock->samples[(clock->head - 1 + clock->size) % clock->size];

Just for visibility:

Per offline discussion with Ricardo, this should not cause a samples[-1]
access, as all arithmetic operations there `unsigned`

    75ef:       41 8d 46 ff             lea    -0x1(%r14),%eax
    75f3:       31 d2                   xor    %edx,%edx
    75f5:       f7 f1                   div    %ecx
    75f7:       41 89 d5                mov    %edx,%r13d

Regardless of that, Ricardo still has a point, there is a bug in the code.
diff mbox series

Patch

diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index d4b023d4de7c..4ff4ab4471fe 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -732,7 +732,7 @@  void uvc_video_clock_update(struct uvc_streaming *stream,
 		goto done;
 
 	first = &clock->samples[clock->head];
-	last = &clock->samples[(clock->head - 1) % clock->size];
+	last = &clock->samples[(clock->head - 1 + clock->size) % clock->size];
 
 	/* First step, PTS to SOF conversion. */
 	delta_stc = buf->pts - (1UL << 31);