lkml.org 
[lkml]   [2019]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 058/104] media: vb2: vb2_mmap: move lock up
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Hans Verkuil <hverkuil@xs4all.nl>

    commit cd26d1c4d1bc947b56ae404998ae2276df7b39b7 upstream.

    If a filehandle is dup()ped, then it is possible to close it from one fd
    and call mmap from the other. This creates a race condition in vb2_mmap
    where it is using queue data that __vb2_queue_free (called from close())
    is in the process of releasing.

    By moving up the mutex_lock(mmap_lock) in vb2_mmap this race is avoided
    since __vb2_queue_free is called with the same mutex locked. So vb2_mmap
    now reads consistent buffer data.

    Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
    Reported-by: syzbot+be93025dd45dccd8923c@syzkaller.appspotmail.com
    Signed-off-by: Hans Verkuil <hansverk@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/v4l2-core/videobuf2-core.c | 11 ++++++++---
    1 file changed, 8 insertions(+), 3 deletions(-)

    --- a/drivers/media/v4l2-core/videobuf2-core.c
    +++ b/drivers/media/v4l2-core/videobuf2-core.c
    @@ -1976,9 +1976,13 @@ int vb2_mmap(struct vb2_queue *q, struct
    return -EINVAL;
    }
    }
    +
    + mutex_lock(&q->mmap_lock);
    +
    if (vb2_fileio_is_active(q)) {
    dprintk(1, "mmap: file io in progress\n");
    - return -EBUSY;
    + ret = -EBUSY;
    + goto unlock;
    }

    /*
    @@ -1986,7 +1990,7 @@ int vb2_mmap(struct vb2_queue *q, struct
    */
    ret = __find_plane_by_offset(q, off, &buffer, &plane);
    if (ret)
    - return ret;
    + goto unlock;

    vb = q->bufs[buffer];

    @@ -2002,8 +2006,9 @@ int vb2_mmap(struct vb2_queue *q, struct
    return -EINVAL;
    }

    - mutex_lock(&q->mmap_lock);
    ret = call_memop(vb, mmap, vb->planes[plane].mem_priv, vma);
    +
    +unlock:
    mutex_unlock(&q->mmap_lock);
    if (ret)
    return ret;

    \
     
     \ /
      Last update: 2019-01-24 20:28    [W:4.207 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site