mirror of
https://github.com/torvalds/linux.git
synced 2024-11-15 08:31:55 +00:00
6f0dd24a08
Media devnode open/ioctl could be in progress when media device unregister
is initiated. System calls and ioctls check media device registered status
at the beginning, however, there is a window where unregister could be in
progress without changing the media devnode status to unregistered.
process 1 process 2
fd = open(/dev/media0)
media_devnode_is_registered()
(returns true here)
media_device_unregister()
(unregister is in progress
and devnode isn't
unregistered yet)
...
ioctl(fd, ...)
__media_ioctl()
media_devnode_is_registered()
(returns true here)
...
media_devnode_unregister()
...
(driver releases the media device
memory)
media_device_ioctl()
(By this point
devnode->media_dev does not
point to allocated memory.
use-after free in in mutex_lock_nested)
BUG: KASAN: use-after-free in mutex_lock_nested+0x79c/0x800 at addr
ffff8801ebe914f0
Fix it by clearing register bit when unregister starts to avoid the race.
process 1 process 2
fd = open(/dev/media0)
media_devnode_is_registered()
(could return true here)
media_device_unregister()
(clear the register bit,
then start unregister.)
...
ioctl(fd, ...)
__media_ioctl()
media_devnode_is_registered()
(return false here, ioctl
returns I/O error, and
will not access media
device memory)
...
media_devnode_unregister()
...
(driver releases the media device
memory)
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reported-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Tested-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
||
|---|---|---|
| .. | ||
| blackfin | ||
| davinci | ||
| drv-intf | ||
| i2c | ||
| i2c-addr.h | ||
| lirc_dev.h | ||
| lirc.h | ||
| media-device.h | ||
| media-devnode.h | ||
| media-entity.h | ||
| rc-core.h | ||
| rc-map.h | ||
| soc_camera.h | ||
| tuner-types.h | ||
| tuner.h | ||
| tveeprom.h | ||
| v4l2-async.h | ||
| v4l2-clk.h | ||
| v4l2-common.h | ||
| v4l2-ctrls.h | ||
| v4l2-dev.h | ||
| v4l2-device.h | ||
| v4l2-dv-timings.h | ||
| v4l2-event.h | ||
| v4l2-fh.h | ||
| v4l2-flash-led-class.h | ||
| v4l2-image-sizes.h | ||
| v4l2-ioctl.h | ||
| v4l2-mc.h | ||
| v4l2-mediabus.h | ||
| v4l2-mem2mem.h | ||
| v4l2-of.h | ||
| v4l2-rect.h | ||
| v4l2-subdev.h | ||
| v4l2-tpg-colors.h | ||
| v4l2-tpg.h | ||
| videobuf2-core.h | ||
| videobuf2-dma-contig.h | ||
| videobuf2-dma-sg.h | ||
| videobuf2-dvb.h | ||
| videobuf2-memops.h | ||
| videobuf2-v4l2.h | ||
| videobuf2-vmalloc.h | ||
| videobuf-core.h | ||
| videobuf-dma-contig.h | ||
| videobuf-dma-sg.h | ||
| videobuf-dvb.h | ||
| videobuf-vmalloc.h | ||
| vsp1.h | ||