Received-SPF: pass (google.com: domain of linux-kernel+bounces-153919-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Mon, 22 Apr 2024 21:30:57 +0200
Message-ID: <87zftli49a.wl-tiwai@suse.de>
From: Takashi Iwai <tiwai@suse.de>
To: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Takashi Iwai <tiwai@suse.de>,
	"Yang, Chenyuan" <cy54@illinois.edu>,
	"linux-media@vger.kernel.org" <linux-media@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"jani.nikula@intel.com" <jani.nikula@intel.com>,
	"syzkaller@googlegroups.com" <syzkaller@googlegroups.com>,
	"mchehab@kernel.org" <mchehab@kernel.org>,
	"Zhao, Zijie"
 <zijie4@illinois.edu>,
	"Zhang, Lingming" <lingming@illinois.edu>
Subject: Re: [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)
In-Reply-To: <966f5847-d007-4425-a902-1e1c05a820ae@xs4all.nl>
References: <PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com>
	<f985d664-d907-48ed-9b3d-dc956c178b88@xs4all.nl>
	<526380BE-57AC-493D-A7B0-B8F0ECC0FE0A@illinois.edu>
	<f1855145-9562-4bef-800f-43bcacff6fc8@xs4all.nl>
	<2e5f1e92-7fad-4a74-b375-1e194ff08ce6@xs4all.nl>
	<F8D4A291-8CFB-4A25-B296-3CA07B56F459@illinois.edu>
	<49a68c10-9549-4fd8-b929-d4c7a9c8debf@xs4all.nl>
	<PH7PR11MB5768B0BC3C042A6EA4EC1EF0A0542@PH7PR11MB5768.namprd11.prod.outlook.com>
	<7E36CBBD-F2AD-4D98-8D4E-F52E62C3E812@illinois.edu>
	<87le59s8wi.wl-tiwai@suse.de>
	<966f5847-d007-4425-a902-1e1c05a820ae@xs4all.nl>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.2 Mule/6.0
Precedence: bulk
MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue")
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Mon, 22 Apr 2024 14:14:17 +0200,
Hans Verkuil wrote:
> 
> Hi Takashi,
> 
> On 19/04/2024 16:51, Takashi Iwai wrote:
> > On Mon, 26 Feb 2024 13:27:16 +0100,
> > Yang, Chenyuan wrote:
> >>
> >> Hi Hans,
> >>
> >> Thank you for your continued efforts in investigating this bug and implementing the new patch!
> >>
> >> Regarding the two warnings, they have been addressed by this new patch and are no longer reproducible. Additionally, I conducted a 48-hour fuzzing test on the CEC driver, which has successfully eliminated the previous hanging issue.
> >>
> >> One thing to note that the system will now log timeout events:
> >> ```
> >> [ 2281.265385][ T2034] cec-vivid-001-vid-out0: transmit timed out
> >> [ 2282.994510][ T2017] cec-vivid-000-vid-cap0: transmit timed out
> >> [ 2283.063484][ T2050] cec-vivid-002-vid-out0: transmit timed out
> >> [ 2283.073468][ T2065] cec-vivid-003-vid-cap0: transmit timed out
> >> [ 2283.373518][ T2033] cec-vivid-001-vid-cap0: transmit timed out
> >> [ 2285.113544][ T2018] cec-vivid-000-vid-out0: transmit timed out
> >> [ 2285.193502][ T2050] cec-vivid-002-vid-out0: transmit timed out
> >> [ 2285.193570][ T2065] cec-vivid-003-vid-cap0: transmit timed out
> >> [ 2285.513570][ T2033] cec-vivid-001-vid-cap0: transmit timed out
> 
> >> ```
> >>
> >> Best,
> >> Chenyuan
> > 
> > Hi Hans,
> > 
> > how is the current status of this bug fix?  It seems that the thread
> > stalled, and I wonder how we can go further.
> > 
> > I'm asking it because CVE-2024-23848 was assigned and we've been asked
> > about the bug fix.
> 
> I missed this reply, so I will take another look at the patch. Too many emails :-(
> 
> Two other patches relating to this I have just posted:
> 
> https://patchwork.linuxtv.org/project/linux-media/patch/2b043325-14c0-4e63-ae9c-0d685d96fd98@xs4all.nl/
> https://patchwork.linuxtv.org/project/linux-media/patch/f17f961b-3a19-48da-941a-c8970d9e1786@xs4all.nl/

Thanks!  If a full set of patches are ready, please let us know.


Takashi

> 
> Regards,
> 
> 	Hans
> 
> > 
> > 
> > Thanks!
> > 
> > Takashi
> > 
> >>
> >> From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
> >> Date: Friday, February 23, 2024 at 8:44 AM
> >> To: Yang, Chenyuan <cy54@illinois.edu>, linux-media@vger.kernel.org <linux-media@vger.kernel.org>, linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org>
> >> Cc: jani.nikula@intel.com <jani.nikula@intel.com>, syzkaller@googlegroups.com <syzkaller@googlegroups.com>, mchehab@kernel.org <mchehab@kernel.org>, Zhao, Zijie <zijie4@illinois.edu>, Zhang, Lingming <lingming@illinois.edu>
> >> Subject: Re: [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)
> >> Hi Chenyuan,
> >>
> >> Here is another patch for you to try. I think it is good for blocking CEC_ADAP_S_LOG_ADDRS
> >> ioctl calls, but if the filehandle is in non-blocking mode, I'm still not certain it
> >> is correct. But one issue at a time :-)
> >>
> >> Regards,
> >>
> >>         Hans
> >>
> >> diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
> >> index 559a172ebc6c..a493cbce2456 100644
> >> --- a/drivers/media/cec/core/cec-adap.c
> >> +++ b/drivers/media/cec/core/cec-adap.c
> >> @@ -936,8 +936,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
> >>           */
> >>          mutex_unlock(&adap->lock);
> >>          wait_for_completion_killable(&data->c);
> >> -       if (!data->completed)
> >> -               cancel_delayed_work_sync(&data->work);
> >> +       cancel_delayed_work_sync(&data->work);
> >>          mutex_lock(&adap->lock);
> >>
> >>          /* Cancel the transmit if it was interrupted */
> >> @@ -1575,9 +1574,12 @@ static int cec_config_thread_func(void *arg)
> >>   */
> >>  static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
> >>  {
> >> -       if (WARN_ON(adap->is_configuring || adap->is_configured))
> >> +       if (WARN_ON(adap->is_claiming_log_addrs ||
> >> +                   adap->is_configuring || adap->is_configured))
> >>                  return;
> >>
> >> +       adap->is_claiming_log_addrs = true;
> >> +
> >>          init_completion(&adap->config_completion);
> >>
> >>          /* Ready to kick off the thread */
> >> @@ -1592,6 +1594,7 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
> >>                  wait_for_completion(&adap->config_completion);
> >>                  mutex_lock(&adap->lock);
> >>          }
> >> +       adap->is_claiming_log_addrs = false;
> >>  }
> >>
> >>  /*
> >> diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c
> >> index 67dc79ef1705..3ef915344304 100644
> >> --- a/drivers/media/cec/core/cec-api.c
> >> +++ b/drivers/media/cec/core/cec-api.c
> >> @@ -178,7 +178,7 @@ static long cec_adap_s_log_addrs(struct cec_adapter *adap, struct cec_fh *fh,
> >>                             CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU |
> >>                             CEC_LOG_ADDRS_FL_CDC_ONLY;
> >>          mutex_lock(&adap->lock);
> >> -       if (!adap->is_configuring &&
> >> +       if (!adap->is_claiming_log_addrs && !adap->is_configuring &&
> >>              (!log_addrs.num_log_addrs || !adap->is_configured) &&
> >>              !cec_is_busy(adap, fh)) {
> >>                  err = __cec_s_log_addrs(adap, &log_addrs, block);
> >> @@ -664,6 +664,8 @@ static int cec_release(struct inode *inode, struct file *filp)
> >>                  list_del_init(&data->xfer_list);
> >>          }
> >>          mutex_unlock(&adap->lock);
> >> +
> >> +       mutex_lock(&fh->lock);
> >>          while (!list_empty(&fh->msgs)) {
> >>                  struct cec_msg_entry *entry =
> >>                          list_first_entry(&fh->msgs, struct cec_msg_entry, list);
> >> @@ -681,6 +683,7 @@ static int cec_release(struct inode *inode, struct file *filp)
> >>                          kfree(entry);
> >>                  }
> >>          }
> >> +       mutex_unlock(&fh->lock);
> >>          kfree(fh);
> >>
> >>          cec_put_device(devnode);
> >> diff --git a/include/media/cec.h b/include/media/cec.h
> >> index 10c9cf6058b7..cc3fcd0496c3 100644
> >> --- a/include/media/cec.h
> >> +++ b/include/media/cec.h
> >> @@ -258,6 +258,7 @@ struct cec_adapter {
> >>          u16 phys_addr;
> >>          bool needs_hpd;
> >>          bool is_enabled;
> >> +       bool is_claiming_log_addrs;
> >>          bool is_configuring;
> >>          bool must_reconfigure;
> >>          bool is_configured;
> >>
>