Received: by 2002:a25:7ec1:0:0:0:0:0 with SMTP id z184csp6000046ybc; Wed, 27 Nov 2019 13:10:26 -0800 (PST) X-Google-Smtp-Source: APXvYqxIHbQ0H5lrBfITaMfRlpvsdiBRD9H7caH0Vp3LLVteaXInGgnDN41eVkB4Aek1Z5ZY7LzZ X-Received: by 2002:a50:b4d6:: with SMTP id x22mr7573292edd.181.1574889026192; Wed, 27 Nov 2019 13:10:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1574889026; cv=none; d=google.com; s=arc-20160816; b=c3nca8zC8MzD+DTGCJwPbZmzzvbi+nCS4HlgBlJXsgfiKylsLR5oNTq/Hj5wuW0WYk jbct91buJbbuO4yqUrlSjd+y5xWWy6EV0S0cWrYa8KHoDarscgSl3HzJkCyDHKucn+m6 zHhZGh6BqaVA0lTZf8xoJBOU4emAKdjOxNBBZqB9usaTjYjpzZhbKIOhrKYM9w8un/Sb 5N5CSslqe3vD3zPIg2h94UQbcyLciThtZOybNImeq0Hn2JGWwYvfRrealoCC7nt7pBAc C0p+iZLrQAD+iQdFVAGPXFFn/lNe7er9r96CzpEgxh5K/sXOZxkqigJipxkC589OWbmr O5ZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=M2hezKiJLGRMcn1g8lvu/wrvEOojB3my+4Klfk/0YRE=; b=nRGhlqltI/USb9ZF+kCmQJFvwUHBKuZG84SvBFSzKG7bi47NFrcLMoukNs7NYHW2fJ AsGpj7ccVNOWbLP75y70x2NOKSzYH3nsQnciHBU4Q6EsAIVOx9iaxz9c9BlqFMUdtmnj nKt34l+dFefJ/cTOXFlMrN2iUwnZ3pnBEmCNtyYtB0rsM68EVHcby5uOuF7SU0FDR1iT NZAfKy0JEVHsQ/wwnu7blngnvNj2e5NDg2Hcd1wadbq7uAa4AmNTJTVtKyGWhnHu5G8i 7RxPonBKL7kLvUZi/bSuRKxEU1k6XwHIk6lXuIR2twTMAvDVt39CC8ReYmrlHKDFt25Z 6lSw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=hz3f2FPZ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z16si9982779eji.25.2019.11.27.13.10.01; Wed, 27 Nov 2019 13:10:26 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=hz3f2FPZ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732730AbfK0VIS (ORCPT + 99 others); Wed, 27 Nov 2019 16:08:18 -0500 Received: from mail.kernel.org ([198.145.29.99]:34688 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732720AbfK0VIQ (ORCPT ); Wed, 27 Nov 2019 16:08:16 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 47C192176D; Wed, 27 Nov 2019 21:08:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574888894; bh=r/6PnZsV0dHJK544Olh7r3lC8t0yb6V5BAUj0+ZXEI8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hz3f2FPZQReK3AYGLIG3Lru7hjtTNEbxjN2yQKkS1BmJQsqKDBes3zyapUNZXsUhw uDDjvGfKga0HmSwb3GPE4/D5jdyQ2j1CAV4lAqV7avGDPQdcdsgUW52oVbzBaQBykU 1O3fRYcSMMiw23SG/6YFOP6Ha5Dgp8iy8ElkeBis= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.19 285/306] media: usbvision: Fix races among open, close, and disconnect Date: Wed, 27 Nov 2019 21:32:15 +0100 Message-Id: <20191127203135.605793916@linuxfoundation.org> X-Mailer: git-send-email 2.24.0 In-Reply-To: <20191127203114.766709977@linuxfoundation.org> References: <20191127203114.766709977@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alan Stern commit 9e08117c9d4efc1e1bc6fce83dab856d9fd284b6 upstream. Visual inspection of the usbvision driver shows that it suffers from three races between its open, close, and disconnect handlers. In particular, the driver is careful to update its usbvision->user and usbvision->remove_pending flags while holding the private mutex, but: usbvision_v4l2_close() and usbvision_radio_close() don't hold the mutex while they check the value of usbvision->remove_pending; usbvision_disconnect() doesn't hold the mutex while checking the value of usbvision->user; and also, usbvision_v4l2_open() and usbvision_radio_open() don't check whether the device has been unplugged before allowing the user to open the device files. Each of these can potentially lead to usbvision_release() being called twice and use-after-free errors. This patch fixes the races by reading the flags while the mutex is still held and checking for pending removes before allowing an open to succeed. Signed-off-by: Alan Stern CC: Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/usbvision/usbvision-video.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) --- a/drivers/media/usb/usbvision/usbvision-video.c +++ b/drivers/media/usb/usbvision/usbvision-video.c @@ -327,6 +327,10 @@ static int usbvision_v4l2_open(struct fi if (mutex_lock_interruptible(&usbvision->v4l2_lock)) return -ERESTARTSYS; + if (usbvision->remove_pending) { + err_code = -ENODEV; + goto unlock; + } if (usbvision->user) { err_code = -EBUSY; } else { @@ -390,6 +394,7 @@ unlock: static int usbvision_v4l2_close(struct file *file) { struct usb_usbvision *usbvision = video_drvdata(file); + int r; PDEBUG(DBG_IO, "close"); @@ -404,9 +409,10 @@ static int usbvision_v4l2_close(struct f usbvision_scratch_free(usbvision); usbvision->user--; + r = usbvision->remove_pending; mutex_unlock(&usbvision->v4l2_lock); - if (usbvision->remove_pending) { + if (r) { printk(KERN_INFO "%s: Final disconnect\n", __func__); usbvision_release(usbvision); return 0; @@ -1090,6 +1096,11 @@ static int usbvision_radio_open(struct f if (mutex_lock_interruptible(&usbvision->v4l2_lock)) return -ERESTARTSYS; + + if (usbvision->remove_pending) { + err_code = -ENODEV; + goto out; + } err_code = v4l2_fh_open(file); if (err_code) goto out; @@ -1122,6 +1133,7 @@ out: static int usbvision_radio_close(struct file *file) { struct usb_usbvision *usbvision = video_drvdata(file); + int r; PDEBUG(DBG_IO, ""); @@ -1134,9 +1146,10 @@ static int usbvision_radio_close(struct usbvision_audio_off(usbvision); usbvision->radio = 0; usbvision->user--; + r = usbvision->remove_pending; mutex_unlock(&usbvision->v4l2_lock); - if (usbvision->remove_pending) { + if (r) { printk(KERN_INFO "%s: Final disconnect\n", __func__); v4l2_fh_release(file); usbvision_release(usbvision); @@ -1562,6 +1575,7 @@ err_usb: static void usbvision_disconnect(struct usb_interface *intf) { struct usb_usbvision *usbvision = to_usbvision(usb_get_intfdata(intf)); + int u; PDEBUG(DBG_PROBE, ""); @@ -1578,13 +1592,14 @@ static void usbvision_disconnect(struct v4l2_device_disconnect(&usbvision->v4l2_dev); usbvision_i2c_unregister(usbvision); usbvision->remove_pending = 1; /* Now all ISO data will be ignored */ + u = usbvision->user; usb_put_dev(usbvision->dev); usbvision->dev = NULL; /* USB device is no more */ mutex_unlock(&usbvision->v4l2_lock); - if (usbvision->user) { + if (u) { printk(KERN_INFO "%s: In use, disconnect pending\n", __func__); wake_up_interruptible(&usbvision->wait_frame);