| From 9011f68b14a117a5e28e5f9ea5db32fd6c6cfb23 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 9 May 2021 10:12:31 +0200 |
| Subject: media: exynos4-is: Fix a use after free in isp_video_release |
| |
| From: Lv Yunlong <lyl2019@mail.ustc.edu.cn> |
| |
| [ Upstream commit 01fe904c9afd26e79c1f73aa0ca2e3d785e5e319 ] |
| |
| In isp_video_release, file->private_data is freed via |
| _vb2_fop_release()->v4l2_fh_release(). But the freed |
| file->private_data is still used in v4l2_fh_is_singular_file() |
| ->v4l2_fh_is_singular(file->private_data), which is a use |
| after free bug. |
| |
| My patch uses a variable 'is_singular_file' to avoid the uaf. |
| v3: https://lore.kernel.org/patchwork/patch/1419058/ |
| |
| Fixes: 34947b8aebe3f ("[media] exynos4-is: Add the FIMC-IS ISP capture DMA driver") |
| Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/platform/exynos4-is/fimc-isp-video.c | 7 +++++-- |
| 1 file changed, 5 insertions(+), 2 deletions(-) |
| |
| diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c |
| index 8d9dc597deaa..83688a7982f7 100644 |
| --- a/drivers/media/platform/exynos4-is/fimc-isp-video.c |
| +++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c |
| @@ -305,17 +305,20 @@ static int isp_video_release(struct file *file) |
| struct fimc_is_video *ivc = &isp->video_capture; |
| struct media_entity *entity = &ivc->ve.vdev.entity; |
| struct media_device *mdev = entity->graph_obj.mdev; |
| + bool is_singular_file; |
| |
| mutex_lock(&isp->video_lock); |
| |
| - if (v4l2_fh_is_singular_file(file) && ivc->streaming) { |
| + is_singular_file = v4l2_fh_is_singular_file(file); |
| + |
| + if (is_singular_file && ivc->streaming) { |
| media_pipeline_stop(entity); |
| ivc->streaming = 0; |
| } |
| |
| _vb2_fop_release(file, NULL); |
| |
| - if (v4l2_fh_is_singular_file(file)) { |
| + if (is_singular_file) { |
| fimc_pipeline_call(&ivc->ve, close); |
| |
| mutex_lock(&mdev->graph_mutex); |
| -- |
| 2.30.2 |
| |