• Shuah Khan's avatar
    [media] media: fix media devnode ioctl/syscall and unregister race · 6f0dd24a
    Shuah Khan authored
    Media devnode open/ioctl could be in progress when media device unregister
    is initiated. System calls and ioctls check media device registered status
    at the beginning, however, there is a window where unregister could be in
    progress without changing the media devnode status to unregistered.
    
    process 1				process 2
    fd = open(/dev/media0)
    media_devnode_is_registered()
    	(returns true here)
    
    					media_device_unregister()
    						(unregister is in progress
    						and devnode isn't
    						unregistered yet)
    					...
    ioctl(fd, ...)
    __media_ioctl()
    media_devnode_is_registered()
    	(returns true here)
    					...
    					media_devnode_unregister()
    					...
    					(driver releases the media device
    					memory)
    
    media_device_ioctl()
    	(By this point
    	devnode->media_dev does not
    	point to allocated memory.
    	use-after free in in mutex_lock_nested)
    
    BUG: KASAN: use-after-free in mutex_lock_nested+0x79c/0x800 at addr
    ffff8801ebe914f0
    
    Fix it by clearing register bit when unregister starts to avoid the race.
    
    process 1                               process 2
    fd = open(/dev/media0)
    media_devnode_is_registered()
            (could return true here)
    
                                            media_device_unregister()
                                                    (clear the register bit,
    						 then start unregister.)
                                            ...
    ioctl(fd, ...)
    __media_ioctl()
    media_devnode_is_registered()
            (return false here, ioctl
    	 returns I/O error, and
    	 will not access media
    	 device memory)
                                            ...
                                            media_devnode_unregister()
                                            ...
                                            (driver releases the media device
    					 memory)
    Signed-off-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
    Suggested-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
    Reported-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
    Tested-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
    6f0dd24a
media-device.c 22.7 KB