linux-kernel - Re: [PATCH v5 00/39] i.MX Media Driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170312210952.GV21222@n2100.armlinux.org.uk>
Date:   Sun, 12 Mar 2017 21:09:53 +0000
From:   Russell King - ARM Linux <linux@...linux.org.uk>
To:     Steve Longerbeam <slongerbeam@...il.com>
Cc:     mark.rutland@....com, andrew-ct.chen@...iatek.com,
        minghsiu.tsai@...iatek.com, nick@...anahar.org,
        songjun.wu@...rochip.com, hverkuil@...all.nl, pavel@....cz,
        shuah@...nel.org, devel@...verdev.osuosl.org,
        markus.heiser@...marIT.de,
        Steve Longerbeam <steve_longerbeam@...tor.com>,
        robert.jarzmik@...e.fr, geert@...ux-m68k.org,
        p.zabel@...gutronix.de, linux-media@...r.kernel.org,
        devicetree@...r.kernel.org, kernel@...gutronix.de, arnd@...db.de,
        tiffany.lin@...iatek.com, bparrot@...com, robh+dt@...nel.org,
        horms+renesas@...ge.net.au, mchehab@...nel.org,
        laurent.pinchart+renesas@...asonboard.com,
        linux-arm-kernel@...ts.infradead.org,
        niklas.soderlund+renesas@...natech.se, gregkh@...uxfoundation.org,
        linux-kernel@...r.kernel.org, jean-christophe.trotin@...com,
        sakari.ailus@...ux.intel.com, fabio.estevam@....com,
        shawnguo@...nel.org, sudipm.mukherjee@...il.com
Subject: Re: [PATCH v5 00/39] i.MX Media Driver

On Sun, Mar 12, 2017 at 08:40:37PM +0000, Russell King - ARM Linux wrote:
> On Sun, Mar 12, 2017 at 01:36:32PM -0700, Steve Longerbeam wrote:
> > But hold on, if my logic is correct, then why did the CSI power-off
> > get reached in your case, multiple times? Yes I think there is a bug,
> > link_notify() is not checking if the link has already been disabled.
> > I will fix this. But I'm surprised media core's link_notify handling
> > doesn't do this.
> 
> Well, I think there's something incredibly fishy going on here.  I
> turned that dev_dbg() at the top of the function into a dev_info(),
> and I get:
> 
> root@...2ex:~# dmesg |grep -A2 imx-ipuv3-csi
> [   53.370949] imx-ipuv3-csi imx-ipuv3-csi.0: power OFF
> [   53.371015] ------------[ cut here ]------------
> [   53.371075] WARNING: CPU: 0 PID: 1515 at drivers/staging/media/imx/imx-media-csi.c:806 csi_s_power+0xb8/0xd0 [imx_media_csi]
> --
> [   53.372624] imx-ipuv3-csi imx-ipuv3-csi.0: power OFF
> [   53.372637] ------------[ cut here ]------------
> [   53.372663] WARNING: CPU: 0 PID: 1515 at drivers/staging/media/imx/imx-media-csi.c:806 csi_s_power+0xb8/0xd0 [imx_media_csi]
> 
> There isn't a power on event being generated before these two power
> off events.  I don't see a power on event even when I attempt to
> start streaming either (which fails due to the lack of bayer
> support.)

Found it - my imx219 driver returns '1' from its s_power function when
powering up, which triggers a bug in your code - when imx_media_set_power()
fails to power up, you call imx_media_set_power() telling it to power
everything off - including devices that are already powered off.

This is really bad news - s_power() may be called via other paths,
such as when the subdev is opened.

-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up
according to speedtest.net.