linux-kernel - [PATCH v2] staging: media: atomisp: add missing mutex lock in atomisp_s_fmt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250717013003.20936-1-abdelrahmanfekry375@gmail.com>
Date: Thu, 17 Jul 2025 04:30:03 +0300
From: Abdelrahman Fekry <abdelrahmanfekry375@...il.com>
To: hansg@...nel.org,
	mchehab@...nel.org,
	sakari.ailus@...ux.intel.com,
	andy@...nel.org,
	gregkh@...uxfoundation.org
Cc: linux-media@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	linux-staging@...ts.linux.dev,
	linux-kernel-mentees@...ts.linux.dev,
	skhan@...uxfoundation.org,
	dan.carpenter@...aro.org,
	Abdelrahman Fekry <abdelrahmanfekry375@...il.com>
Subject: [PATCH v2] staging: media: atomisp: add missing mutex lock in atomisp_s_fmt_cap

The function atomisp_set_fmt() modifies shared device state and expects
callers to hold the isp->mutex for synchronization. While most internal
callers correctly lock the mutex before invoking atomisp_set_fmt(), the
V4L2 ioctl handler atomisp_s_fmt_cap() does not.

This results in an unsafe execution path for VIDIOC_S_FMT ioctls
(e.g. via v4l2-ctl), where shared structures such as pipe->pix and
pipe->frame_info may be modified concurrently without proper protection.

- Fix this by explicitly locking isp->mutex in atomisp_s_fmt_cap().

Fixes: 4bdab80981ca ("media: atomisp: Make it possible to call atomisp_set_fmt() without a file handle")
Signed-off-by: Abdelrahman Fekry <abdelrahmanfekry375@...il.com>
---
v2:
- Add Fixes tag
- use cleanup.h micros instead of explicitly calling mutex_lock/unlock

v1: https://lore.kernel.org/all/20250716014225.15279-1-abdelrahmanfekry375@gmail.com/
 drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
index bb8b2f2213b0..d3b8e480065e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
@@ -9,6 +9,7 @@
 
 #include <linux/delay.h>
 #include <linux/pci.h>
+#include <linux/cleanup.h>
 
 #include <media/v4l2-ioctl.h>
 #include <media/v4l2-event.h>
@@ -416,8 +417,15 @@ static int atomisp_s_fmt_cap(struct file *file, void *fh,
 			     struct v4l2_format *f)
 {
 	struct video_device *vdev = video_devdata(file);
+	struct atomisp_device *isp = video_get_drvdata(vdev);
+
+	int ret;
 
-	return atomisp_set_fmt(vdev, f);
+	scoped_guard(mutex, &isp->mutex)
+	{
+		ret = atomisp_set_fmt(vdev, f);
+	}
+	return ret;
 }
 
 /*
-- 
2.25.1