linux-kernel - [PATCH] media:fimc-capture: Fix a possible data inconsistency due to a data race in fimc_subdev_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20231223164351.3521588-1-islituo@gmail.com>
Date: Sun, 24 Dec 2023 00:43:51 +0800
From: Tuo Li <islituo@...il.com>
To: s.nawrocki@...sung.com,
	mchehab@...nel.org,
	krzysztof.kozlowski@...aro.org,
	alim.akhtar@...sung.com
Cc: linux-media@...r.kernel.org,
	linux-arm-kernel@...ts.infradead.org,
	linux-samsung-soc@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	baijiaju1990@...il.com,
	Tuo Li <islituo@...il.com>,
	stable@...r.kernel.org,
	BassCheck <bass@...a.edu.cn>
Subject: [PATCH] media:fimc-capture: Fix a possible data inconsistency due to a data race in fimc_subdev_set_fmt()

Accesses to ctx->s_frame.width and ctx->s_frame.height should be protected
by the lock fimc->lock to guarantee that width and height are consistent.
Here is an example in fimc_subdev_get_fmt():

  struct fimc_frame *ff = &ctx->s_frame; // Alias
  mutex_lock(&fimc->lock);
  mf->width = ff->width;
  mf->height = ff->height;

However, ctx->s_frame.width and ctx->s_frame.height are accessed without 
holding the lock fimc->lock in fimc_subdev_set_fmt():

  mf->width = ctx->s_frame.width;
  mf->height = ctx->s_frame.height;

And thus a harmful data race can occur, which can make ctx->s_frame.width
inconsistent with ctx->s_frame.height, if ctx->s_frame.height is updated 
right after ctx->s_frame.width is accessed by another thread.

This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 6.2.

To fix this possible data race, the lock operation mutex_lock(&fimc->lock)
is moved to the front of the accesses to these two variables. With this 
patch applied, our tool no longer reports the bug, with the kernel 
configuration allyesconfig for x86_64. Due to the lack of associated 
hardware, we cannot test the patch in runtime testing, and just verify it 
according to the code logic.

[1] https://sites.google.com/view/basscheck/

Fixes: 88fa8311ee36 ("[media] s5p-fimc: Add support for ISP Writeback ...")
Signed-off-by: Tuo Li <islituo@...il.com>
Cc: stable@...r.kernel.org
Reported-by: BassCheck <bass@...a.edu.cn>
---
 drivers/media/platform/samsung/exynos4-is/fimc-capture.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/samsung/exynos4-is/fimc-capture.c b/drivers/media/platform/samsung/exynos4-is/fimc-capture.c
index a0d43bf892e6..5c8b67f92c65 100644
--- a/drivers/media/platform/samsung/exynos4-is/fimc-capture.c
+++ b/drivers/media/platform/samsung/exynos4-is/fimc-capture.c
@@ -1546,6 +1546,7 @@ static int fimc_subdev_set_fmt(struct v4l2_subdev *sd,
 	fimc_alpha_ctrl_update(ctx);

 	fimc_capture_mark_jpeg_xfer(ctx, ffmt->color);
+	mutex_lock(&fimc->lock);
 	if (fmt->pad == FIMC_SD_PAD_SOURCE) {
 		ff = &ctx->d_frame;
 		/* Sink pads crop rectangle size */
@@ -1555,7 +1556,6 @@ static int fimc_subdev_set_fmt(struct v4l2_subdev *sd,
 		ff = &ctx->s_frame;
 	}

-	mutex_lock(&fimc->lock);
 	set_frame_bounds(ff, mf->width, mf->height);

 	if (fmt->pad == FIMC_SD_PAD_SINK_FIFO)
-- 
2.34.1