DF-2351 / panic.txt
login: RIG2351: === DF-2351: uint16->uint8 truncation of nfmt === RIG2351: crafted cdesc len=2869 (256 VS_FORMAT_MJPEG, 0 frames) RIG2351: production uvc_drv_init_data_fmt ret=0 RIG2351: counted nfmt=256 (uint16_t local) -> stored data->nfmt=0 nfrm=0 nitv=0 fmt=0xfffff80118496000 <-- TRUNCATION if nfmt==0 RIG2351: production uvc_drv_parse_data ret=0 (data->nfmt=0) RIG2351: entering production uvc_drv_init_cur_fmt_frm with data->nfmt==0 -- search loop is skipped, fmt stays NULL, fmt->nfrm dereferences NULL (uvc_drv.c:1463). Expect panic. Fatal user address access from kernel mode from sysctl at ffffffff82618d73 Fatal trap 12: page fault while in kernel mode cpuid = 3; lapic id = 3 fault virtual address = 0x8 fault code = supervisor read data, page not present instruction pointer = 0x8:0xffffffff82618d73 stack pointer = 0x10:0xfffff80117cd76e0 frame pointer = 0x10:0xfffff80117cd7798 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 0, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 1026 current thread = pri 6 kernel: type 12 trap, code=0 CPU3 stopping CPUs: 0x00000037 stopped Stopped at uvc_drv_init_cur_fmt_frm.cold.36: movq 0x8,%rax db>