diff mbox series

[v4,1/5] media: uvc: Ignore empty TS packets

Message ID	20220920-resend-hwtimestamp-v4-1-a8ddc1358a29@chromium.org
State	New
Headers	Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; From: Ricardo Ribalda <ribalda@chromium.org> Date: Mon, 09 Jan 2023 11:00:48 +0100 Subject: [PATCH v4 1/5] media: uvc: Ignore empty TS packets MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20220920-resend-hwtimestamp-v4-1-a8ddc1358a29@chromium.org> References: <20220920-resend-hwtimestamp-v4-0-a8ddc1358a29@chromium.org> In-Reply-To: <20220920-resend-hwtimestamp-v4-0-a8ddc1358a29@chromium.org> To: Mauro Carvalho Chehab <mchehab@kernel.org>, Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Ricardo Ribalda <ribalda@chromium.org>, "hn.chen" <hn.chen@sunplusit.com>, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Precedence: bulk
Series	uvcvideo: Fixes for hw timestamping \| [v4,0/5] uvcvideo: Fixes for hw timestamping [v4,1/5] media: uvc: Ignore empty TS packets [v4,2/5] media: uvcvideo: Quirk for invalid dev_sof in Logitech C922 [v4,3/5] media: uvcvideo: Allow hw clock updates with buffers not full [v4,4/5] media: uvcvideo: Refactor clock circular buffer [v4,5/5] media: uvcvideo: Fix hw timestamp handling for slow FPS

Commit Message

Ricardo Ribalda Jan. 9, 2023, 10 a.m. UTC

  Some SunplusIT cameras took a borderline interpretation of the UVC 1.5
standard, and fill the PTS and SCR fields with invalid data if the
package does not contain data.

"STC must be captured when the first video data of a video frame is put
on the USB bus."

Eg:

buffer: 0xa7755c00 len 000012 header:0x8c stc 00000000 sof 0000 pts 00000000
buffer: 0xa7755c00 len 000012 header:0x8c stc 00000000 sof 0000 pts 00000000
buffer: 0xa7755c00 len 000668 header:0x8c stc 73779dba sof 070c pts 7376d37a

This borderline/buggy interpretation has been implemented in a variety
of devices, from directly SunplusIT and from other OEMs that rebrand
SunplusIT products. So quirking based on VID:PID will be problematic.

All the affected modules have the following extension unit:
VideoControl Interface Descriptor:
  guidExtensionCode         {82066163-7050-ab49-b8cc-b3855e8d221d}

But the vendor plans to use that GUID in the future and fix the bug,
this means that we should use heuristic to figure out the broken
packets.

This patch takes care of this.

lsusb of one of the affected cameras:

Bus 001 Device 003: ID 1bcf:2a01 Sunplus Innovation Technology Inc.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.01
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x1bcf Sunplus Innovation Technology Inc.
  idProduct          0x2a01
  bcdDevice            0.02
  iManufacturer           1 SunplusIT Inc
  iProduct                2 HanChen Wise Camera
  iSerial                 3 01.00.00
  bNumConfigurations      1

Tested-by: HungNien Chen <hn.chen@sunplusit.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 drivers/media/usb/uvc/uvc_video.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

Comments

Dan Carpenter Jan. 11, 2023, 4:19 a.m. UTC | #1

Hi Ricardo,

url:    https://github.com/intel-lab-lkp/linux/commits/Ricardo-Ribalda/media-uvc-Ignore-empty-TS-packets/20230109-180318
base:   73d6709376914f577a61bb29e596fa93ec66598c
patch link:    https://lore.kernel.org/r/20220920-resend-hwtimestamp-v4-1-a8ddc1358a29%40chromium.org
patch subject: [PATCH v4 1/5] media: uvc: Ignore empty TS packets
config: arc-randconfig-m031-20230108
compiler: arceb-elf-gcc (GCC) 12.1.0

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>

smatch warnings:
drivers/media/usb/uvc/uvc_video.c:538 uvc_video_clock_decode() error: we previously assumed 'buf' could be null (see line 514)

vim +/buf +538 drivers/media/usb/uvc/uvc_video.c

66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  469  static void
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  470  uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
2c6b222cee2d68e drivers/media/usb/uvc/uvc_video.c   Laurent Pinchart 2018-01-16  471  		       const u8 *data, int len)
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  472  {
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  473  	struct uvc_clock_sample *sample;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  474  	unsigned int header_size;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  475  	bool has_pts = false;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  476  	bool has_scr = false;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  477  	unsigned long flags;
828ee8c71950155 drivers/media/usb/uvc/uvc_video.c   Arnd Bergmann    2017-11-27  478  	ktime_t time;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  479  	u16 host_sof;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  480  	u16 dev_sof;
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  481  	u32 dev_stc;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  482  
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  483  	switch (data[1] & (UVC_STREAM_PTS | UVC_STREAM_SCR)) {
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  484  	case UVC_STREAM_PTS | UVC_STREAM_SCR:
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  485  		header_size = 12;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  486  		has_pts = true;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  487  		has_scr = true;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  488  		break;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  489  	case UVC_STREAM_PTS:
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  490  		header_size = 6;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  491  		has_pts = true;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  492  		break;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  493  	case UVC_STREAM_SCR:
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  494  		header_size = 8;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  495  		has_scr = true;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  496  		break;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  497  	default:
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  498  		header_size = 2;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  499  		break;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  500  	}
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  501  
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  502  	/* Check for invalid headers. */
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  503  	if (len < header_size)
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  504  		return;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  505  
699b9a86a3f03ad drivers/media/usb/uvc/uvc_video.c   Laurent Pinchart 2022-06-08  506  	/*
699b9a86a3f03ad drivers/media/usb/uvc/uvc_video.c   Laurent Pinchart 2022-06-08  507  	 * Extract the timestamps:
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  508  	 *
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  509  	 * - store the frame PTS in the buffer structure
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  510  	 * - if the SCR field is present, retrieve the host SOF counter and
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  511  	 *   kernel timestamps and store them with the SCR STC and SOF fields
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  512  	 *   in the ring buffer
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  513  	 */
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24 @514  	if (has_pts && buf != NULL)
                                                                                                       ^^^^^^^^^^^
This code checks for NULL.

66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  515  		buf->pts = get_unaligned_le32(&data[2]);
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  516  
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  517  	if (!has_scr)
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  518  		return;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  519  
699b9a86a3f03ad drivers/media/usb/uvc/uvc_video.c   Laurent Pinchart 2022-06-08  520  	/*
699b9a86a3f03ad drivers/media/usb/uvc/uvc_video.c   Laurent Pinchart 2022-06-08  521  	 * To limit the amount of data, drop SCRs with an SOF identical to the
a919bd4d768164c drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-04  522  	 * previous one. This filtering is also needed to support UVC 1.5, where
a919bd4d768164c drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-04  523  	 * all the data packets of the same frame contains the same SOF. In that
a919bd4d768164c drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-04  524  	 * case only the first one will match the host_sof.
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  525  	 */
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  526  	dev_sof = get_unaligned_le16(&data[header_size - 2]);
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  527  	if (dev_sof == stream->clock.last_sof)
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  528  		return;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  529  
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  530  	dev_stc = get_unaligned_le32(&data[header_size - 6]);
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  531  
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  532  	/*
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  533  	 * Some devices make a borderline interpretation of the UVC 1.5 standard
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  534  	 * and sends packets with no data contain undefined timestamps. Ignore
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  535  	 * such packages to avoid interfering with the clock interpolation
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  536  	 * algorithm.
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  537  	 */
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09 @538  	if (buf->bytesused == 0 && len == header_size &&
                                                                                            ^^^^^^^^^^^^^^
Unchecked dereference

febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  539  	    dev_stc == 0 && dev_sof == 0)
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  540  		return;
febd4163e286059 drivers/media/usb/uvc/uvc_video.c   Ricardo Ribalda  2023-01-09  541  
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  542  	stream->clock.last_sof = dev_sof;
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  543  
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  544  	host_sof = usb_get_current_frame_number(stream->dev->udev);
828ee8c71950155 drivers/media/usb/uvc/uvc_video.c   Arnd Bergmann    2017-11-27  545  	time = uvc_video_get_time();
66847ef013cc4ed drivers/media/video/uvc/uvc_video.c Laurent Pinchart 2011-09-24  546  
699b9a86a3f03ad drivers/media/usb/uvc/uvc_video.c   Laurent Pinchart 2022-06-08  547  	/*

diff mbox series

Patch

diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index d4b023d4de7c..710165502b5b 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -478,6 +478,7 @@  uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
 	ktime_t time;
 	u16 host_sof;
 	u16 dev_sof;
+	u32 dev_stc;
 
 	switch (data[1] & (UVC_STREAM_PTS | UVC_STREAM_SCR)) {
 	case UVC_STREAM_PTS | UVC_STREAM_SCR:
@@ -526,6 +527,18 @@  uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
 	if (dev_sof == stream->clock.last_sof)
 		return;
 
+	dev_stc = get_unaligned_le32(&data[header_size - 6]);
+
+	/*
+	 * Some devices make a borderline interpretation of the UVC 1.5 standard
+	 * and sends packets with no data contain undefined timestamps. Ignore
+	 * such packages to avoid interfering with the clock interpolation
+	 * algorithm.
+	 */
+	if (buf->bytesused == 0 && len == header_size &&
+	    dev_stc == 0 && dev_sof == 0)
+		return;
+
 	stream->clock.last_sof = dev_sof;
 
 	host_sof = usb_get_current_frame_number(stream->dev->udev);
@@ -564,7 +577,7 @@  uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
 	spin_lock_irqsave(&stream->clock.lock, flags);
 
 	sample = &stream->clock.samples[stream->clock.head];
-	sample->dev_stc = get_unaligned_le32(&data[header_size - 6]);
+	sample->dev_stc = dev_stc;
 	sample->dev_sof = dev_sof;
 	sample->host_sof = host_sof;
 	sample->host_time = time;