2018-11-12 00:50:33

by Myungho Jung

Subject: [PATCH] media: videobuf2-core: Fix error handling when fileio is deallocated

The mutex that is held from vb2_fop_read() can be unlocked while waiting
for a buffer if the queue is streaming and blocking. Meanwhile, fileio
can be released. So, it should return an error if the fileio address is
changed.

Signed-off-by: Myungho Jung <[email protected]>
Reported-by: [email protected]
---
drivers/media/common/videobuf2/videobuf2-core.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 975ff5669f72..bff94752eb27 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -2564,6 +2564,10 @@ static size_t __vb2_perform_fileio(struct vb2_queue *q, char __user *data, size_
dprintk(5, "vb2_dqbuf result: %d\n", ret);
if (ret)
return ret;
+ if (fileio != q->fileio) {
+ dprintk(3, "fileio deallocated\n");
+ return -EFAULT;
+ }
fileio->dq_count += 1;

fileio->cur_index = index;
--
2.17.1

2018-11-13 10:27:57

by Marek Szyprowski

Subject: Re: [PATCH] media: videobuf2-core: Fix error handling when fileio is deallocated

Hi Myungho,

On 2018-11-12 01:49, Myungho Jung wrote:
> The mutex that is held from vb2_fop_read() can be unlocked while waiting
> for a buffer if the queue is streaming and blocking. Meanwhile, fileio
> can be released. So, it should return an error if the fileio address is
> changed.
>
> Signed-off-by: Myungho Jung <[email protected]>
> Reported-by: [email protected]

Acked-by: Marek Szyprowski <[email protected]>

Thanks for analyzing the code and fixing this issue!

> ---
> drivers/media/common/videobuf2/videobuf2-core.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
> index 975ff5669f72..bff94752eb27 100644
> --- a/drivers/media/common/videobuf2/videobuf2-core.c
> +++ b/drivers/media/common/videobuf2/videobuf2-core.c
> @@ -2564,6 +2564,10 @@ static size_t __vb2_perform_fileio(struct vb2_queue *q, char __user *data, size_
> dprintk(5, "vb2_dqbuf result: %d\n", ret);
> if (ret)
> return ret;
> + if (fileio != q->fileio) {
> + dprintk(3, "fileio deallocated\n");
> + return -EFAULT;
> + }
> fileio->dq_count += 1;
>
> fileio->cur_index = index;

Best regards
--
Marek Szyprowski, PhD
Samsung R&D Institute Poland

2018-11-13 11:57:06

by Hans Verkuil

Subject: Re: [PATCH] media: videobuf2-core: Fix error handling when fileio is deallocated

On 11/13/18 11:27, Marek Szyprowski wrote:
> Hi Myungho,
>
> On 2018-11-12 01:49, Myungho Jung wrote:
>> The mutex that is held from vb2_fop_read() can be unlocked while waiting
>> for a buffer if the queue is streaming and blocking. Meanwhile, fileio
>> can be released. So, it should return an error if the fileio address is
>> changed.
>>
>> Signed-off-by: Myungho Jung <[email protected]>
>> Reported-by: [email protected]
>
> Acked-by: Marek Szyprowski <[email protected]>

Sorry:

Nacked-by: Hans Verkuil <[email protected]>

This addresses the symptom, not the underlying cause.

I have a patch that fixes the actual cause that I plan to post soon
after I review it a bit more.

Regards,

Hans

>
> Thanks for analyzing the code and fixing this issue!
>
>> ---
>> drivers/media/common/videobuf2/videobuf2-core.c | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
>> index 975ff5669f72..bff94752eb27 100644
>> --- a/drivers/media/common/videobuf2/videobuf2-core.c
>> +++ b/drivers/media/common/videobuf2/videobuf2-core.c
>> @@ -2564,6 +2564,10 @@ static size_t __vb2_perform_fileio(struct vb2_queue *q, char __user *data, size_
>> dprintk(5, "vb2_dqbuf result: %d\n", ret);
>> if (ret)
>> return ret;
>> + if (fileio != q->fileio) {
>> + dprintk(3, "fileio deallocated\n");
>> + return -EFAULT;
>> + }
>> fileio->dq_count += 1;
>>
>> fileio->cur_index = index;
>
> Best regards
>

2018-11-13 17:41:09

by Myungho Jung

Subject: Re: [PATCH] media: videobuf2-core: Fix error handling when fileio is deallocated

On Tue, Nov 13, 2018 at 12:56:18PM +0100, Hans Verkuil wrote:
> On 11/13/18 11:27, Marek Szyprowski wrote:
> > Hi Myungho,
> >
> > On 2018-11-12 01:49, Myungho Jung wrote:
> >> The mutex that is held from vb2_fop_read() can be unlocked while waiting
> >> for a buffer if the queue is streaming and blocking. Meanwhile, fileio
> >> can be released. So, it should return an error if the fileio address is
> >> changed.
> >>
> >> Signed-off-by: Myungho Jung <[email protected]>
> >> Reported-by: [email protected]
> >
> > Acked-by: Marek Szyprowski <[email protected]>
>
> Sorry:
>
> Nacked-by: Hans Verkuil <[email protected]>
>
> This addresses the symptom, not the underlying cause.
>
> I have a patch that fixes the actual cause that I plan to post soon
> after I review it a bit more.
>
> Regards,
>
> Hans
>

Hi Hans,

Thanks for explaining the root cause. I was also thinking a similar
patch with your second one. It looks like the reported syzbot is needed
to be added to your first patch.

Regards,
Myungho

> >
> > Thanks for analyzing the code and fixing this issue!
> >
> >> ---
> >> drivers/media/common/videobuf2/videobuf2-core.c | 4 ++++
> >> 1 file changed, 4 insertions(+)
> >>
> >> diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
> >> index 975ff5669f72..bff94752eb27 100644
> >> --- a/drivers/media/common/videobuf2/videobuf2-core.c
> >> +++ b/drivers/media/common/videobuf2/videobuf2-core.c
> >> @@ -2564,6 +2564,10 @@ static size_t __vb2_perform_fileio(struct vb2_queue *q, char __user *data, size_
> >> dprintk(5, "vb2_dqbuf result: %d\n", ret);
> >> if (ret)
> >> return ret;
> >> + if (fileio != q->fileio) {
> >> + dprintk(3, "fileio deallocated\n");
> >> + return -EFAULT;
> >> + }
> >> fileio->dq_count += 1;
> >>
> >> fileio->cur_index = index;
> >
> > Best regards
> >
>