| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CANiDSCv3986=KjwWOXsKGZ58+YMViHeHvam=ax7iKr=x_h_pRw@mail.gmail.com>
Date: Sat, 30 Nov 2024 18:15:12 +0100
From: Ricardo Ribalda <ribalda@...omium.org>
To: Laurent Pinchart <laurent.pinchart@...asonboard.com>, Hans de Goede <hdegoede@...hat.com>,
Mauro Carvalho Chehab <mchehab@...nel.org>,
Guennadi Liakhovetski <guennadi.liakhovetski@...el.com>
Cc: Hans Verkuil <hverkuil@...all.nl>, Mauro Carvalho Chehab <mchehab+samsung@...nel.org>,
linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
stable@...r.kernel.org
Subject: Re: [PATCH v4 2/4] media: uvcvideo: Remove dangling pointers
nit:
After sleeping on it. I think this could be nicer expressed with:
uvc_ctrl_get_handle and uvc_ctrl_put_handle
Let me know what do you prefer:
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 88ef8fdc2be2..d4a010cdf805 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1579,6 +1579,35 @@ static void uvc_ctrl_send_slave_event(struct
uvc_video_chain *chain,
uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes);
}
+static int uvc_ctrl_get_handle(struct uvc_fh *handle, struct uvc_control *ctrl)
+{
+ /* NOTE: We must own the chain->ctrl_mutex to run this function. */
+
+ if (handle == ctrl->handle) /* Nothing to do here. */
+ return 0;
+
+ /* We can't change the original handler. */
+ if (ctrl->handle)
+ return -EBUSY;
+
+ ctrl->handle = handle;
+ handle->pending_async_ctrls++;
+ return 0;
+}
+
+static void uvc_ctrl_put_handle(struct uvc_fh *handle, struct
uvc_control *ctrl)
+{
+ /* NOTE: We must own the chain->ctrl_mutex to run this function. */
+
+ if (!ctrl->handle) /* Nothing to do here.*/
+ return;
+
+ ctrl->handle = NULL;
+ if (WARN_ON(!handle->pending_async_ctrls))
+ return;
+ handle->pending_async_ctrls--;
+}
+
void uvc_ctrl_status_event(struct uvc_video_chain *chain,
struct uvc_control *ctrl, const u8 *data)
{
@@ -1589,7 +1618,7 @@ void uvc_ctrl_status_event(struct uvc_video_chain *chain,
mutex_lock(&chain->ctrl_mutex);
handle = ctrl->handle;
- ctrl->handle = NULL;
+ uvc_ctrl_put_handle(handle, ctrl);
list_for_each_entry(mapping, &ctrl->info.mappings, list) {
s32 value = __uvc_ctrl_get_value(mapping, data);
@@ -2046,8 +2075,8 @@ int uvc_ctrl_set(struct uvc_fh *handle,
mapping->set(mapping, value,
uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT));
- if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS && !ctrl->handle)
- ctrl->handle = handle;
+ if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS)
+ uvc_ctrl_get_handle(handle, ctrl);
ctrl->dirty = 1;
ctrl->modified = 1;
@@ -2770,6 +2799,22 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
return 0;
}
+void uvc_ctrl_cleanup_fh(struct uvc_fh *handle)
+{
+ struct uvc_entity *entity;
+
+ guard(mutex)(&handle->chain->ctrl_mutex);
+
+ if (!handle->pending_async_ctrls)
+ return;
+
+ list_for_each_entry(entity, &handle->chain->dev->entities, list)
+ for (unsigned int i = 0; i < entity->ncontrols; ++i)
+ uvc_ctrl_put_handle(handle, &entity->controls[i]);
+
+ WARN_ON(handle->pending_async_ctrls);
+}
+
/*
* Cleanup device controls.
*/
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 97c5407f6603..b425306a3b8c 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -652,6 +652,8 @@ static int uvc_v4l2_release(struct file *file)
uvc_dbg(stream->dev, CALLS, "%s\n", __func__);
+ uvc_ctrl_cleanup_fh(handle);
+
/* Only free resources if this is a privileged handle. */
if (uvc_has_privileges(handle))
uvc_queue_release(&stream->queue);
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index ce688b80e986..e0e4f099a210 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -340,7 +340,11 @@ struct uvc_video_chain {
struct uvc_entity *processing; /* Processing unit */
struct uvc_entity *selector; /* Selector unit */
- struct mutex ctrl_mutex; /* Protects ctrl.info */
+ struct mutex ctrl_mutex; /*
+ * Protects ctrl.info,
+ * ctrl.handle and
+ * uvc_fh.pending_async_ctrls
+ */
struct v4l2_prio_state prio; /* V4L2 priority state */
u32 caps; /* V4L2 chain-wide caps */
@@ -615,6 +619,7 @@ struct uvc_fh {
struct uvc_video_chain *chain;
struct uvc_streaming *stream;
enum uvc_handle_state state;
+ unsigned int pending_async_ctrls;
};
struct uvc_driver {
@@ -800,6 +805,8 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain
*chain, u32 v4l2_id,
int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
struct uvc_xu_control_query *xqry);
+void uvc_ctrl_cleanup_fh(struct uvc_fh *handle);
+
/* Utility functions */
struct usb_host_endpoint *uvc_find_endpoint(struct usb_host_interface *alts,
u8 epaddr);
On Fri, 29 Nov 2024 at 22:30, Ricardo Ribalda <ribalda@...omium.org> wrote:
>
> When an async control is written, we copy a pointer to the file handle
> that started the operation. That pointer will be used when the device is
> done. Which could be anytime in the future.
>
> If the user closes that file descriptor, its structure will be freed,
> and there will be one dangling pointer per pending async control, that
> the driver will try to use.
>
> Clean all the dangling pointers during release().
>
> To avoid adding a performance penalty in the most common case (no async
> operation), a counter has been introduced with some logic to make sure
> that it is properly handled.
>
> Cc: stable@...r.kernel.org
> Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
> Signed-off-by: Ricardo Ribalda <ribalda@...omium.org>
> ---
> drivers/media/usb/uvc/uvc_ctrl.c | 54 ++++++++++++++++++++++++++++++++++++++--
> drivers/media/usb/uvc/uvc_v4l2.c | 2 ++
> drivers/media/usb/uvc/uvcvideo.h | 9 ++++++-
> 3 files changed, 62 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
> index 88ef8fdc2be2..bc96fb475b9c 100644
> --- a/drivers/media/usb/uvc/uvc_ctrl.c
> +++ b/drivers/media/usb/uvc/uvc_ctrl.c
> @@ -1579,6 +1579,33 @@ static void uvc_ctrl_send_slave_event(struct uvc_video_chain *chain,
> uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes);
> }
>
> +static void uvc_ctrl_set_handle(struct uvc_control *ctrl, struct uvc_fh *handle)
> +{
> + /* NOTE: We must own the chain->ctrl_mutex to run this function. */
> +
> + if (handle) {
> + if (handle == ctrl->handle) /* Nothing to do here. */
> + return;
> +
> + /* We can't change the original handler. */
> + if (WARN_ON(ctrl->handle))
> + return;
> +
> + ctrl->handle = handle;
> + handle->pending_async_ctrls++;
> + return;
> + }
> +
> + if (!ctrl->handle) /* Nothing to do here.*/
> + return;
> +
> + handle = ctrl->handle;
> + ctrl->handle = NULL;
> + if (WARN_ON(!handle->pending_async_ctrls))
> + return;
> + handle->pending_async_ctrls--;
> +}
> +
> void uvc_ctrl_status_event(struct uvc_video_chain *chain,
> struct uvc_control *ctrl, const u8 *data)
> {
> @@ -1589,7 +1616,7 @@ void uvc_ctrl_status_event(struct uvc_video_chain *chain,
> mutex_lock(&chain->ctrl_mutex);
>
> handle = ctrl->handle;
> - ctrl->handle = NULL;
> + uvc_ctrl_set_handle(ctrl, NULL);
>
> list_for_each_entry(mapping, &ctrl->info.mappings, list) {
> s32 value = __uvc_ctrl_get_value(mapping, data);
> @@ -2047,7 +2074,7 @@ int uvc_ctrl_set(struct uvc_fh *handle,
> uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT));
>
> if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS && !ctrl->handle)
> - ctrl->handle = handle;
> + uvc_ctrl_set_handle(ctrl, handle);
>
> ctrl->dirty = 1;
> ctrl->modified = 1;
> @@ -2770,6 +2797,29 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
> return 0;
> }
>
> +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle)
> +{
> + struct uvc_entity *entity;
> +
> + guard(mutex)(&handle->chain->ctrl_mutex);
> +
> + if (!handle->pending_async_ctrls)
> + return;
> +
> + list_for_each_entry(entity, &handle->chain->dev->entities, list) {
> + for (unsigned int i = 0; i < entity->ncontrols; ++i) {
> + struct uvc_control *ctrl = &entity->controls[i];
> +
> + if (ctrl->handle != handle)
> + continue;
> +
> + uvc_ctrl_set_handle(ctrl, NULL);
> + }
> + }
> +
> + WARN_ON(handle->pending_async_ctrls);
> +}
> +
> /*
> * Cleanup device controls.
> */
> diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
> index 97c5407f6603..b425306a3b8c 100644
> --- a/drivers/media/usb/uvc/uvc_v4l2.c
> +++ b/drivers/media/usb/uvc/uvc_v4l2.c
> @@ -652,6 +652,8 @@ static int uvc_v4l2_release(struct file *file)
>
> uvc_dbg(stream->dev, CALLS, "%s\n", __func__);
>
> + uvc_ctrl_cleanup_fh(handle);
> +
> /* Only free resources if this is a privileged handle. */
> if (uvc_has_privileges(handle))
> uvc_queue_release(&stream->queue);
> diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
> index ce688b80e986..e0e4f099a210 100644
> --- a/drivers/media/usb/uvc/uvcvideo.h
> +++ b/drivers/media/usb/uvc/uvcvideo.h
> @@ -340,7 +340,11 @@ struct uvc_video_chain {
> struct uvc_entity *processing; /* Processing unit */
> struct uvc_entity *selector; /* Selector unit */
>
> - struct mutex ctrl_mutex; /* Protects ctrl.info */
> + struct mutex ctrl_mutex; /*
> + * Protects ctrl.info,
> + * ctrl.handle and
> + * uvc_fh.pending_async_ctrls
> + */
>
> struct v4l2_prio_state prio; /* V4L2 priority state */
> u32 caps; /* V4L2 chain-wide caps */
> @@ -615,6 +619,7 @@ struct uvc_fh {
> struct uvc_video_chain *chain;
> struct uvc_streaming *stream;
> enum uvc_handle_state state;
> + unsigned int pending_async_ctrls;
> };
>
> struct uvc_driver {
> @@ -800,6 +805,8 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
> int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
> struct uvc_xu_control_query *xqry);
>
> +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle);
> +
> /* Utility functions */
> struct usb_host_endpoint *uvc_find_endpoint(struct usb_host_interface *alts,
> u8 epaddr);
>
> --
> 2.47.0.338.g60cca15819-goog
>
--
Ricardo Ribalda
Powered by blists - more mailing lists