linux-stable.git/drivers/staging/media, branch linux-6.2.y

media: rkvdec: fix use after free bug in rkvdec_remove

2023-05-11T14:11:05+00:00

[ Upstream commit 3228cec23b8b29215e18090c6ba635840190993d ]

In rkvdec_probe, rkvdec->watchdog_work is bound with
rkvdec_watchdog_func. Then rkvdec_vp9_run may
be called to start the work.

If we remove the module which will call rkvdec_remove
 to make cleanup, there may be a unfinished work.
 The possible sequence is as follows, which will
 cause a typical UAF bug.

Fix it by canceling the work before cleanup in rkvdec_remove.

CPU0                  CPU1

                    |rkvdec_watchdog_func
rkvdec_remove       |
 rkvdec_v4l2_cleanup|
  v4l2_m2m_release  |
    kfree(m2m_dev); |
                    |
                    | v4l2_m2m_get_curr_priv
                    |   m2m_dev->curr_ctx //use

Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver")
Signed-off-by: Zheng Wang 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: cedrus: fix use after free bug in cedrus_remove due to race condition

2023-05-11T14:11:05+00:00

[ Upstream commit 50d0a7aea4809cef87979d4669911276aa23b71f ]

In cedrus_probe, dev->watchdog_work is bound with cedrus_watchdog function.
In cedrus_device_run, it will started by schedule_delayed_work. If there is
an unfinished work in cedrus_remove, there may be a race condition and
trigger UAF bug.

CPU0                  CPU1

                    |cedrus_watchdog
cedrus_remove       |
  v4l2_m2m_release  |
  kfree(m2m_dev)    |
                    |
                    | v4l2_m2m_get_curr_priv
                    |   m2m_dev //use

Fix it by canceling the worker in cedrus_remove.

Fixes: 7c38a551bda1 ("media: cedrus: Add watchdog for job completion")
Signed-off-by: Zheng Wang 
Acked-by: Jernej Skrabec 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: av7110: prevent underflow in write_ts_to_decoder()

2023-05-11T14:11:00+00:00

[ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ]

The buf[4] value comes from the user via ts_play().  It is a value in
the u8 range.  The final length we pass to av7110_ipack_instant_repack()
is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is
not negative.  It's not clear that passing a negative len value does
anything bad necessarily, but it's not best practice.

With the new bounds checking the "if (!len)" condition is no longer
possible or required so remove that.

Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability")
Signed-off-by: Dan Carpenter 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: atomisp: Only set default_run_mode on first open of a stream/asd

2023-03-10T08:29:03+00:00

[ Upstream commit 60ec70a71a9f9975a5d2dd4a7d97c20da0e41976 ]

Calling v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode) when
the stream is already active (through another /dev/video# node) causes
the stream to stop.

Move the call to set the default run-mode so that it is only done
on the first open of one of the 4 /dev/video# nodes of one of
the 2 streams (atomisp-sub-devices / asd-s).

Fixes: 2c45e343c581 ("media: atomisp: set per-device's default mode")
Reviewed-by: Andy Shevchenko 
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

media: atomisp: fix videobuf2 Kconfig depenendency

2023-03-10T08:29:03+00:00

[ Upstream commit be94be1b7fc7e51f9ccef20a0ef76583587275f3 ]

The recent conversion missed the Kconfig bit, so it can now
end up in a link error on randconfig builds:

ld.lld: error: undefined symbol: vb2_vmalloc_memops
>>> referenced by atomisp_fops.c
>>>               drivers/staging/media/atomisp/pci/atomisp_fops.o:(atomisp_open) in archive vmlinux.a

Link: https://lore.kernel.org/r/20230104082212.3770415-1-arnd@kernel.org

Fixes: cb48ae89be3b ("media: atomisp: Convert to videobuf2")
Signed-off-by: Arnd Bergmann 
Tested-by: Andy Shevchenko 
Signed-off-by: Hans de Goede 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

treewide: Convert del_timer() to timer_shutdown()

2022-12-25T21:38:09+00:00

Due to several bugs caused by timers being re-armed after they are
shutdown and just before they are freed, a new state of timers was added
called "shutdown".  After a timer is set to this state, then it can no
longer be re-armed.

The following script was run to find all the trivial locations where
del_timer() or del_timer_sync() is called in the same function that the
object holding the timer is freed.  It also ignores any locations where
the timer->function is modified between the del_timer*() and the free(),
as that is not considered a "trivial" case.

This was created by using a coccinelle script and the following
commands:

    $ cat timer.cocci
    @@
    expression ptr, slab;
    identifier timer, rfield;
    @@
    (
    -       del_timer(&ptr->timer);
    +       timer_shutdown(&ptr->timer);
    |
    -       del_timer_sync(&ptr->timer);
    +       timer_shutdown_sync(&ptr->timer);
    )
      ... when strict
          when != ptr->timer
    (
            kfree_rcu(ptr, rfield);
    |
            kmem_cache_free(slab, ptr);
    |
            kfree(ptr);
    )

    $ spatch timer.cocci . > /tmp/t.patch
    $ patch -p1 < /tmp/t.patch

Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/
Signed-off-by: Steven Rostedt (Google) 
Acked-by: Pavel Machek  [ LED ]
Acked-by: Kalle Valo  [ wireless ]
Acked-by: Paolo Abeni  [ networking ]
Signed-off-by: Linus Torvalds

media: sun6i-isp: params: Unregister pending buffer on cleanup

2022-12-14T18:12:32+00:00

The state cleanup helper should unregister the pending buffer from
the state after returning it to v4l2, like it is done for other
buffers in the wait queue.

Before this change, the pending buffer from a previous run might have
been returned at the beginning of the next run, causing an error.

Signed-off-by: Paul Kocialkowski 
Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP")
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil

media: sun6i-isp: params: Fix incorrect indentation

2022-12-14T18:12:32+00:00

Remove a heading whitespace that results in a smatch warning.

Signed-off-by: Paul Kocialkowski 
Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP")
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil

media: sun6i-isp: capture: Fix uninitialized variable use

2022-12-14T18:12:31+00:00

While the stride_chroma variable was previously initialized to zero,
it's actually stride_chroma_div4 that is set to hardware registers.

Initialize it to zero instead to avoid an uninitialized variable use
and get rid of the associated smatch warning.

Signed-off-by: Paul Kocialkowski 
Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP")
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil

media: sun6i-isp: proc: Declare subdev ops as static

2022-12-14T18:12:31+00:00

The static keyword is missing in the v4l2 subdev ops definition for the
proc.

Signed-off-by: Paul Kocialkowski 
Fixes: e3185e1d7c14 ("media: staging: media: Add support for the Allwinner A31 ISP")
Signed-off-by: Sakari Ailus 
Signed-off-by: Hans Verkuil

linux-stable.git/drivers/staging/media, branch linux-6.2.y

media: rkvdec: fix use after free bug in rkvdec_remove

media: cedrus: fix use after free bug in cedrus_remove due to race condition

media: av7110: prevent underflow in write_ts_to_decoder()

media: atomisp: Only set default_run_mode on first open of a stream/asd

media: atomisp: fix videobuf2 Kconfig depenendency

treewide: Convert del_timer*() to timer_shutdown*()

media: sun6i-isp: params: Unregister pending buffer on cleanup

media: sun6i-isp: params: Fix incorrect indentation

media: sun6i-isp: capture: Fix uninitialized variable use

media: sun6i-isp: proc: Declare subdev ops as static

treewide: Convert del_timer() to timer_shutdown()