#
0a0b79ea |
|
16-Feb-2024 |
Edward Adam Davis <eadavis@qq.com> |
media: pvrusb2: fix uaf in pvr2_context_set_notify [Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26 CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: usb_hub_wq hub_event Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline] pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272 Freed by task 906: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x105/0x340 mm/slub.c:4409 pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline] pvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158 [Analyze] Task A set disconnect_flag = !0, which resulted in Task B's condition being met and releasing mp, leading to this issue. [Fix] Place the disconnect_flag assignment operation after all code in pvr2_context_disconnect() to avoid this issue. Reported-and-tested-by: syzbot+ce750e124675d4599449@syzkaller.appspotmail.com Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") Signed-off-by: Edward Adam Davis <eadavis@qq.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
|
#
30baa4a9 |
|
13-Feb-2024 |
Arnd Bergmann <arnd@arndb.de> |
media: pvrusb2: fix pvr2_stream_callback casts clang-16 complains about a control flow integrity (KCFI) issue in pvrusb2, which casts three different prototypes into pvr2_stream_callback: drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1070:30: error: cast from 'void (*)(struct pvr2_v4l2_fh *)' to 'pvr2_stream_callback' (aka 'void (*)(void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict] 1070 | pvr2_stream_set_callback(sp,(pvr2_stream_callback)pvr2_v4l2_notify,fh); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/media/usb/pvrusb2/pvrusb2-context.c:110:6: error: cast from 'void (*)(struct pvr2_context *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] 110 | (void (*)(void *))pvr2_context_notify, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/media/usb/pvrusb2/pvrusb2-dvb.c:152:6: error: cast from 'void (*)(struct pvr2_dvb_adapter *)' to 'pvr2_stream_callback' (aka 'void (*)(void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict] 152 | (pvr2_stream_callback) pvr2_dvb_notify, adap); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Change the functions to actually take a void* argument so the cast is no longer needed. Fixes: bb8ce9d9143c ("V4L/DVB (7682): pvrusb2-dvb: finish up stream & buffer handling") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
|
#
ded85b0c |
|
12-Oct-2023 |
Ricardo B. Marliere <ricardo@marliere.net> |
media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack. Reported-and-tested-by: syzbot+621409285c4156a009b3@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a02a4205fff8eb92@google.com/ Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") Signed-off-by: Ricardo B. Marliere <ricardo@marliere.net> Acked-by: Mike Isely <isely@pobox.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
#
2504ba9f |
|
02-Jun-2019 |
Thomas Gleixner <tglx@linutronix.de> |
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 235 Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 53 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Reviewed-by: Alexios Zavras <alexios.zavras@intel.com> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190602204653.904365654@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
#
bcb63314 |
|
28-Oct-2016 |
Sakari Ailus <sakari.ailus@linux.intel.com> |
[media] media: Drop FSF's postal address from the source code files Drop the FSF's postal address from the source code files that typically contain mostly the license text. Of the 628 removed instances, 578 are outdated. The patch has been created with the following command without manual edits: git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \ drivers/media/ include/media|while read i; do i=$i perl -e ' open(F,"< $ENV{i}"); $a=join("", <F>); $a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m && $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m; close(F); open(F, "> $ENV{i}"); print F $a; close(F);'; done Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
#
bb07df8a |
|
04-Feb-2016 |
Insu Yun <wuninsu@gmail.com> |
[media] pvrusb2: correctly handling failed thread run Since kthread_run returns -ENOMEM if failed, it needs to be checked whether it is error, not whether it is null. Signed-off-by: Insu Yun <wuninsu@gmail.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
f419edd4 |
|
29-Apr-2015 |
Mauro Carvalho Chehab <mchehab@kernel.org> |
[media] pvrusb2: fix inconsistent indenting smatch complains about multiple issues here: drivers/media/usb/pvrusb2/pvrusb2-context.c:402 pvr2_channel_claim_stream() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-ioread.c:240 pvr2_ioread_setup() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-ioread.c:255 pvr2_ioread_set_enabled() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-ioread.c:485 pvr2_ioread_read() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:522 pvr2_stream_set_callback() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:561 pvr2_stream_set_buffer_count() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:640 pvr2_buffer_queue() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:667 pvr2_buffer_set_buffer() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-io.c:668 pvr2_buffer_set_buffer() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2614 pvr2_hdw_create() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2740 pvr2_hdw_destroy() warn: inconsistent indenting drivers/media/usb/pvrusb2/pvrusb2-hdw.c:3353 pvr2_hdw_trigger_module_log() warn: inconsistent indenting Let's get rid of those, in order to cleanup as much as possible the smatch error log. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
215cedec |
|
01-Dec-2014 |
Hans Verkuil <hans.verkuil@cisco.com> |
[media] media: remove emacs editor variables 1) This is not allowed by the kernel coding style 2) Just configure your editor correctly 3) It's really ugly Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
83f56f7c |
|
20-Nov-2014 |
Markus Elfring <elfring@users.sourceforge.net> |
[media] USB: Deletion of unnecessary checks before three function calls GIT_AUTHOR_DATE=1416486805 The functions pvr2_hdw_destroy(), rc_unregister_device() and vfree() perform also input parameter validation. Thus the test around the call is not needed. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
|
#
0c0d06ca |
|
13-Aug-2012 |
Mauro Carvalho Chehab <mchehab@kernel.org> |
[media] rename most media/video usb drivers to media/usb Rename all USB drivers with their own directory under drivers/media/video into drivers/media/usb and update the building system. Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|