[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <9b47d551-991b-5a60-39cf-3d47fbf68ea4@collabora.com>
Date: Tue, 19 Sep 2023 21:25:47 +0300
From: Dmitry Osipenko <dmitry.osipenko@...labora.com>
To: Zheng Hacker <hackerzheng666@...il.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@...labora.com>
Cc: Zheng Wang <zyytlz.wz@....com>, Kyrie.Wu@...iatek.com,
bin.liu@...iatek.com, mchehab@...nel.org, matthias.bgg@...il.com,
linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org,
linux-mediatek@...ts.infradead.org, Irui.Wang@...iatek.com,
security@...nel.org, 1395428693sheep@...il.com,
alex000young@...il.com, Collabora Kernel ML <kernel@...labora.com>
Subject: Re: [RESEND PATCH v2] media: mtk-jpeg: Fix use after free bug due to
uncanceled work
On 9/19/23 21:24, Dmitry Osipenko wrote:
> On 8/31/23 11:18, Zheng Hacker wrote:
>>> The v4l2_m2m_ctx_release() already should wait for the job_timeout_work
>>> completion or for the interrupt fire. Apparently it doesn't work in
>>> yours case. You'll need to debug why v4l job or job_timeout_work is
>>> running after v4l2_m2m_ctx_release(), it shouldn't happen.
>>>
>> Yes, v4l2_m2m_cancel_job waits for m2m_ctx->job_flags to be ~TRANS_RUNNING,
>> the mtk_jpeg_job_timeout_work will finally invoke v4l2_m2m_job_finish
>> to trigger that.
>>
>> However, this is not the only path to call v4l2_m2m_job_finish. Here
>> is a invoking chain:
>> v4l_streamon
>> ->v4l2_m2m_ioctl_streamon
>> ->v4l2_m2m_streamon
>> ->v4l2_m2m_try_schedule
>> ->v4l2_m2m_try_run
>> ->mtk_jpeg_dec_device_run
>> ->schedule_delayed_work(&jpeg->job_timeout_work...
>> ->error path goto dec_end
>> ->v4l2_m2m_job_finish
>>
>> In some specific situation, it starts the worker and also calls
>> v4l2_m2m_job_finish, which might
>> make v4l2_m2m_cancel_job continues.
>
> Then the error path should cancel the job_timeout_work, or better job
s/job/timeout work/
> needs to be run after the dec/enc has been started and not before.
>
> Looking further at the code, I'm confused by this hunk:
>
> mtk_jpeg_dec_start(comp_jpeg[hw_id]->reg_base);
> v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
>
> The job should be marked as finished when h/w has finished processing
> the job and not right after the job has been started. So the job is
> always completed and mtk_jpeg_job_timeout_work() doesn't work as
> expected, am I missing something?
>
--
Best regards,
Dmitry
Powered by blists - more mailing lists