b882fcc49c
commit 6f0dd24a084a17f9984dd49dffbf7055bf123993 upstream.
Media devnode open/ioctl could be in progress when media device unregister
is initiated. System calls and ioctls check media device registered status
at the beginning, however, there is a window where unregister could be in
progress without changing the media devnode status to unregistered.
process 1 process 2
fd = open(/dev/media0)
media_devnode_is_registered()
(returns true here)
media_device_unregister()
(unregister is in progress
and devnode isn't
unregistered yet)
...
ioctl(fd, ...)
__media_ioctl()
media_devnode_is_registered()
(returns true here)
...
media_devnode_unregister()
...
(driver releases the media device
memory)
media_device_ioctl()
(By this point
devnode->media_dev does not
point to allocated memory.
use-after free in in mutex_lock_nested)
BUG: KASAN: use-after-free in mutex_lock_nested+0x79c/0x800 at addr
ffff8801ebe914f0
Fix it by clearing register bit when unregister starts to avoid the race.
process 1 process 2
fd = open(/dev/media0)
media_devnode_is_registered()
(could return true here)
media_device_unregister()
(clear the register bit,
then start unregister.)
...
ioctl(fd, ...)
__media_ioctl()
media_devnode_is_registered()
(return false here, ioctl
returns I/O error, and
will not access media
device memory)
...
media_devnode_unregister()
...
(driver releases the media device
memory)
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reported-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Tested-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[bwh: Backported to 4.4: adjut filename, context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
126 lines
3.9 KiB
C
126 lines
3.9 KiB
C
/*
|
|
* Media device node
|
|
*
|
|
* Copyright (C) 2010 Nokia Corporation
|
|
*
|
|
* Contacts: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
|
|
* Sakari Ailus <sakari.ailus@iki.fi>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*
|
|
* --
|
|
*
|
|
* Common functions for media-related drivers to register and unregister media
|
|
* device nodes.
|
|
*/
|
|
|
|
#ifndef _MEDIA_DEVNODE_H
|
|
#define _MEDIA_DEVNODE_H
|
|
|
|
#include <linux/poll.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/device.h>
|
|
#include <linux/cdev.h>
|
|
|
|
struct media_device;
|
|
|
|
/*
|
|
* Flag to mark the media_devnode struct as registered. Drivers must not touch
|
|
* this flag directly, it will be set and cleared by media_devnode_register and
|
|
* media_devnode_unregister.
|
|
*/
|
|
#define MEDIA_FLAG_REGISTERED 0
|
|
|
|
struct media_file_operations {
|
|
struct module *owner;
|
|
ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
|
|
ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
|
|
unsigned int (*poll) (struct file *, struct poll_table_struct *);
|
|
long (*ioctl) (struct file *, unsigned int, unsigned long);
|
|
long (*compat_ioctl) (struct file *, unsigned int, unsigned long);
|
|
int (*open) (struct file *);
|
|
int (*release) (struct file *);
|
|
};
|
|
|
|
/**
|
|
* struct media_devnode - Media device node
|
|
* @fops: pointer to struct media_file_operations with media device ops
|
|
* @dev: struct device pointer for the media controller device
|
|
* @cdev: struct cdev pointer character device
|
|
* @parent: parent device
|
|
* @minor: device node minor number
|
|
* @flags: flags, combination of the MEDIA_FLAG_* constants
|
|
* @release: release callback called at the end of media_devnode_release()
|
|
*
|
|
* This structure represents a media-related device node.
|
|
*
|
|
* The @parent is a physical device. It must be set by core or device drivers
|
|
* before registering the node.
|
|
*/
|
|
struct media_devnode {
|
|
struct media_device *media_dev;
|
|
|
|
/* device ops */
|
|
const struct media_file_operations *fops;
|
|
|
|
/* sysfs */
|
|
struct device dev; /* media device */
|
|
struct cdev cdev; /* character device */
|
|
struct device *parent; /* device parent */
|
|
|
|
/* device info */
|
|
int minor;
|
|
unsigned long flags; /* Use bitops to access flags */
|
|
|
|
/* callbacks */
|
|
void (*release)(struct media_devnode *devnode);
|
|
};
|
|
|
|
/* dev to media_devnode */
|
|
#define to_media_devnode(cd) container_of(cd, struct media_devnode, dev)
|
|
|
|
int __must_check media_devnode_register(struct media_device *mdev,
|
|
struct media_devnode *devnode,
|
|
struct module *owner);
|
|
|
|
/**
|
|
* media_devnode_unregister_prepare - clear the media device node register bit
|
|
* @devnode: the device node to prepare for unregister
|
|
*
|
|
* This clears the passed device register bit. Future open calls will be met
|
|
* with errors. Should be called before media_devnode_unregister() to avoid
|
|
* races with unregister and device file open calls.
|
|
*
|
|
* This function can safely be called if the device node has never been
|
|
* registered or has already been unregistered.
|
|
*/
|
|
void media_devnode_unregister_prepare(struct media_devnode *devnode);
|
|
|
|
void media_devnode_unregister(struct media_devnode *devnode);
|
|
|
|
static inline struct media_devnode *media_devnode_data(struct file *filp)
|
|
{
|
|
return filp->private_data;
|
|
}
|
|
|
|
static inline int media_devnode_is_registered(struct media_devnode *devnode)
|
|
{
|
|
if (!devnode)
|
|
return false;
|
|
|
|
return test_bit(MEDIA_FLAG_REGISTERED, &devnode->flags);
|
|
}
|
|
|
|
#endif /* _MEDIA_DEVNODE_H */
|