linux-kernel - Re: [PATCH] media:fimc-capture: Fix a possible data inconsistency due to a data race in fimc_subdev_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 24 Dec 2023 11:11:00 +0100
From: Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
To: Tuo Li <islituo@...il.com>, s.nawrocki@...sung.com, mchehab@...nel.org,
 alim.akhtar@...sung.com
Cc: linux-media@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
 linux-samsung-soc@...r.kernel.org, linux-kernel@...r.kernel.org,
 baijiaju1990@...il.com, stable@...r.kernel.org, BassCheck <bass@...a.edu.cn>
Subject: Re: [PATCH] media:fimc-capture: Fix a possible data inconsistency due
 to a data race in fimc_subdev_set_fmt()

On 23/12/2023 17:43, Tuo Li wrote:
> Accesses to ctx->s_frame.width and ctx->s_frame.height should be protected
> by the lock fimc->lock to guarantee that width and height are consistent.
> Here is an example in fimc_subdev_get_fmt():
> 
>   struct fimc_frame *ff = &ctx->s_frame; // Alias
>   mutex_lock(&fimc->lock);
>   mf->width = ff->width;
>   mf->height = ff->height;
> 
> However, ctx->s_frame.width and ctx->s_frame.height are accessed without 
> holding the lock fimc->lock in fimc_subdev_set_fmt():
> 
>   mf->width = ctx->s_frame.width;
>   mf->height = ctx->s_frame.height;

Other places setting parts of s_frame, like fimc_capture_try_format() or
fimc_capture_try_selection(), do not have mutex.


> 
> And thus a harmful data race can occur, which can make ctx->s_frame.width

Harmful how?

> inconsistent with ctx->s_frame.height, if ctx->s_frame.height is updated 
> right after ctx->s_frame.width is accessed by another thread.
> 
> This possible bug is found by an experimental static analysis tool
> developed by our team, BassCheck[1]. This tool analyzes the locking APIs
> to extract function pairs that can be concurrently executed, and then
> analyzes the instructions in the paired functions to identify possible
> concurrency bugs including data races and atomicity violations. The above
> possible bug is reported when our tool analyzes the source code of
> Linux 6.2.
> 
> To fix this possible data race, the lock operation mutex_lock(&fimc->lock)
> is moved to the front of the accesses to these two variables. With this 
> patch applied, our tool no longer reports the bug, with the kernel 
> configuration allyesconfig for x86_64. Due to the lack of associated 
> hardware, we cannot test the patch in runtime testing, and just verify it 
> according to the code logic.

You wrote long four paragraphs which have basically almost zero relevant
information, whether this locking is needed or not. Your bass
description is not relevant... or actually making things worse because I
am certain you are fixing it just to fix your report, not to fix real issue.

> 
> [1] https://sites.google.com/view/basscheck/

Instead provide the report.

> 
> Fixes: 88fa8311ee36 ("[media] s5p-fimc: Add support for ISP Writeback ...")
> Signed-off-by: Tuo Li <islituo@...il.com>
> Cc: stable@...r.kernel.org
> Reported-by: BassCheck <bass@...a.edu.cn>

Run checkpatch, you will see the warning.


Best regards,
Krzysztof