lkml.org 
[lkml]   [2021]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.12 275/700] media: exynos4-is: Fix a use after free in isp_video_release
    Date
    From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>

    [ Upstream commit 01fe904c9afd26e79c1f73aa0ca2e3d785e5e319 ]

    In isp_video_release, file->private_data is freed via
    _vb2_fop_release()->v4l2_fh_release(). But the freed
    file->private_data is still used in v4l2_fh_is_singular_file()
    ->v4l2_fh_is_singular(file->private_data), which is a use
    after free bug.

    My patch uses a variable 'is_singular_file' to avoid the uaf.
    v3: https://lore.kernel.org/patchwork/patch/1419058/

    Fixes: 34947b8aebe3f ("[media] exynos4-is: Add the FIMC-IS ISP capture DMA driver")
    Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/platform/exynos4-is/fimc-isp-video.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c
    index 8d9dc597deaa..83688a7982f7 100644
    --- a/drivers/media/platform/exynos4-is/fimc-isp-video.c
    +++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c
    @@ -305,17 +305,20 @@ static int isp_video_release(struct file *file)
    struct fimc_is_video *ivc = &isp->video_capture;
    struct media_entity *entity = &ivc->ve.vdev.entity;
    struct media_device *mdev = entity->graph_obj.mdev;
    + bool is_singular_file;

    mutex_lock(&isp->video_lock);

    - if (v4l2_fh_is_singular_file(file) && ivc->streaming) {
    + is_singular_file = v4l2_fh_is_singular_file(file);
    +
    + if (is_singular_file && ivc->streaming) {
    media_pipeline_stop(entity);
    ivc->streaming = 0;
    }

    _vb2_fop_release(file, NULL);

    - if (v4l2_fh_is_singular_file(file)) {
    + if (is_singular_file) {
    fimc_pipeline_call(&ivc->ve, close);

    mutex_lock(&mdev->graph_mutex);
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-12 09:35    [W:2.399 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site