V4L2 timeout leads to NULL pointer dereference in kernel in jetpack 4.6

[tim.cassens]

As you can see in my original post:

@tim.cassens

[  539.380027] Call trace:
[  539.382572] [<ffffff8008f6c6f0>] _raw_write_lock+0x30/0x58
[  539.387646] [<ffffff8008b4d280>] destroy_buffer_table+0x40/0xd8
[  539.392988] [<ffffff8008b3f58c>] vi_capture_shutdown+0xd4/0x130
[  539.398846] [<ffffff8008b3fbe4>] vi_channel_close_ex+0x34/0x88
[  539.404445] [<ffffff8008b410f0>] vi5_channel_error_recover+0x48/0x1c8
[  539.410397] [<ffffff8008b361c0>] tegra_channel_error_recover+0x58/0x90
[  539.416261] [<ffffff8008b419b0>] tegra_channel_kthread_capture_dequeue+0xf8/0x1c0

Yes, it is indeed calling tegra_channel_error_recover.

A look at the source suggests that deep inside that call, destroy_buffer_table is called with tab = NULL (since then &tab->hlock yields 16, and the access violation happens at address 16).

This implies that in vi_capture_shutdown, capture->buf_ctx is NULL. I don’t understand enough of how that code is supposed to work to understand why; but I think that is where whoever wrote it should have a look.