Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4b754b4c authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: camera: Fix Use after free bug in msm_vb2.c"

parents 5e98ca34 9a2bcabc

drivers/media/platform/msm/ais/msm.c

+76 −14
Original line number Diff line number Diff line
@@ -147,7 +147,7 @@ typedef int (*msm_queue_find_func)(void *d1, void *d2); 
#define msm_queue_find(queue, type, member, func, data) ({\

	unsigned long flags;					\

	struct msm_queue_head *__q = (queue);			\

	type *node = 0; \

	type *node = NULL; \

	typeof(node) __ret = NULL; \

	msm_queue_find_func __f = (func); \

	spin_lock_irqsave(&__q->lock, flags);			\
@@ -283,22 +283,47 @@ void msm_delete_stream(unsigned int session_id, unsigned int stream_id) 
	struct msm_session *session = NULL;

	struct msm_stream  *stream = NULL;

	unsigned long flags;

	int try_count = 0;



	session = msm_queue_find(msm_session_q, struct msm_session,

		list, __msm_queue_find_session, &session_id);



	if (!session)

		return;



	while (1) {



		if (try_count > 5) {

			pr_err("%s : not able to delete stream %d\n",

				__func__, __LINE__);

			break;

		}



		write_lock(&session->stream_rwlock);

		try_count++;

		stream = msm_queue_find(&session->stream_q, struct msm_stream,

			list, __msm_queue_find_stream, &stream_id);

	if (!stream)



		if (!stream) {

			write_unlock(&session->stream_rwlock);

			return;

		}



		if (msm_vb2_get_stream_state(stream) != 1) {

			write_unlock(&session->stream_rwlock);

			continue;

		}



		spin_lock_irqsave(&(session->stream_q.lock), flags);

		list_del_init(&stream->list);

		session->stream_q.len--;

		kfree(stream);

		stream = NULL;

		spin_unlock_irqrestore(&(session->stream_q.lock), flags);

		write_unlock(&session->stream_rwlock);

		break;

	}



}

EXPORT_SYMBOL(msm_delete_stream);
@@ -446,6 +471,7 @@ int msm_create_session(unsigned int session_id, struct video_device *vdev) 
	mutex_init(&session->lock);

	mutex_init(&session->lock_q);

	mutex_init(&session->close_lock);

	rwlock_init(&session->stream_rwlock);

	return 0;

}

EXPORT_SYMBOL(msm_create_session);
@@ -1039,17 +1065,25 @@ static struct v4l2_file_operations msm_fops = { 
#endif

};



struct msm_stream *msm_get_stream(unsigned int session_id,

	unsigned int stream_id)

struct msm_session *msm_get_session(unsigned int session_id)

{

	struct msm_session *session;

	struct msm_stream *stream;



	session = msm_queue_find(msm_session_q, struct msm_session,

		list, __msm_queue_find_session, &session_id);

	if (!session)

		return ERR_PTR(-EINVAL);



	return session;

}

EXPORT_SYMBOL(msm_get_session);





struct msm_stream *msm_get_stream(struct msm_session *session,

	unsigned int stream_id)

{

	struct msm_stream *stream;



	stream = msm_queue_find(&session->stream_q, struct msm_stream,

		list, __msm_queue_find_stream, &stream_id);
@@ -1107,6 +1141,34 @@ struct msm_stream *msm_get_stream_from_vb2q(struct vb2_queue *q) 
}

EXPORT_SYMBOL(msm_get_stream_from_vb2q);



struct msm_session *msm_get_session_from_vb2q(struct vb2_queue *q)

{

	struct msm_session *session;

	struct msm_stream *stream;

	unsigned long flags1;

	unsigned long flags2;



	spin_lock_irqsave(&msm_session_q->lock, flags1);

	list_for_each_entry(session, &(msm_session_q->list), list) {

		spin_lock_irqsave(&(session->stream_q.lock), flags2);

		list_for_each_entry(

			stream, &(session->stream_q.list), list) {

			if (stream->vb2_q == q) {

				spin_unlock_irqrestore

					(&(session->stream_q.lock), flags2);

				spin_unlock_irqrestore

					(&msm_session_q->lock, flags1);

				return session;

			}

		}

		spin_unlock_irqrestore(&(session->stream_q.lock), flags2);

	}

	spin_unlock_irqrestore(&msm_session_q->lock, flags1);

	return NULL;

}

EXPORT_SYMBOL(msm_get_session_from_vb2q);





#ifdef CONFIG_COMPAT

long msm_copy_camera_private_ioctl_args(unsigned long arg,

	struct msm_camera_private_ioctl_arg *k_ioctl,

drivers/media/platform/msm/ais/msm.h

+4 −1
Original line number Diff line number Diff line
@@ -110,6 +110,7 @@ struct msm_session { 
	struct mutex lock;

	struct mutex lock_q;

	struct mutex close_lock;

	rwlock_t stream_rwlock;

};



static inline bool msm_is_daemon_present(void)
@@ -127,11 +128,13 @@ int msm_create_stream(unsigned int session_id, 
void msm_delete_stream(unsigned int session_id, unsigned int stream_id);

int  msm_create_command_ack_q(unsigned int session_id, unsigned int stream_id);

void msm_delete_command_ack_q(unsigned int session_id, unsigned int stream_id);

struct msm_stream *msm_get_stream(unsigned int session_id,

struct msm_session *msm_get_session(unsigned int session_id);

struct msm_stream *msm_get_stream(struct msm_session *session,

	unsigned int stream_id);

struct vb2_queue *msm_get_stream_vb2q(unsigned int session_id,

	unsigned int stream_id);

struct msm_stream *msm_get_stream_from_vb2q(struct vb2_queue *q);

struct msm_session *msm_get_session_from_vb2q(struct vb2_queue *q);

struct msm_session *msm_session_find(unsigned int session_id);

#ifdef CONFIG_COMPAT

long msm_copy_camera_private_ioctl_args(unsigned long arg,

drivers/media/platform/msm/ais/msm_vb2/msm_vb2.c

+130 −13
Original line number Diff line number Diff line
@@ -44,16 +44,24 @@ static int msm_vb2_queue_setup(struct vb2_queue *q, 
int msm_vb2_buf_init(struct vb2_buffer *vb)

{

	struct msm_stream *stream;

	struct msm_session *session;

	struct msm_vb2_buffer *msm_vb2_buf;



	session = msm_get_session_from_vb2q(vb->vb2_queue);

	if (IS_ERR_OR_NULL(session))

		return -EINVAL;



	read_lock(&session->stream_rwlock);



	stream = msm_get_stream_from_vb2q(vb->vb2_queue);

	if (!stream) {

		pr_err("%s: Couldn't find stream\n", __func__);

		read_unlock(&session->stream_rwlock);

		return -EINVAL;

	}

	msm_vb2_buf = container_of(vb, struct msm_vb2_buffer, vb2_buf);

	msm_vb2_buf->in_freeq = 0;



	read_unlock(&session->stream_rwlock);

	return 0;

}
@@ -61,6 +69,7 @@ static void msm_vb2_buf_queue(struct vb2_buffer *vb) 
{

	struct msm_vb2_buffer *msm_vb2;

	struct msm_stream *stream;

	struct msm_session *session;

	unsigned long flags;



	msm_vb2 = container_of(vb, struct msm_vb2_buffer, vb2_buf);
@@ -70,21 +79,30 @@ static void msm_vb2_buf_queue(struct vb2_buffer *vb) 
		return;

	}



	session = msm_get_session_from_vb2q(vb->vb2_queue);

	if (IS_ERR_OR_NULL(session))

		return;



	read_lock(&session->stream_rwlock);



	stream = msm_get_stream_from_vb2q(vb->vb2_queue);

	if (!stream) {

		pr_err("%s:%d] NULL stream", __func__, __LINE__);

		read_unlock(&session->stream_rwlock);

		return;

	}



	spin_lock_irqsave(&stream->stream_lock, flags);

	list_add_tail(&msm_vb2->list, &stream->queued_list);

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	read_unlock(&session->stream_rwlock);

}



static void msm_vb2_buf_finish(struct vb2_buffer *vb)

{

	struct msm_vb2_buffer *msm_vb2;

	struct msm_stream *stream;

	struct msm_session *session;

	unsigned long flags;

	struct msm_vb2_buffer *msm_vb2_entry, *temp;
@@ -95,9 +113,16 @@ static void msm_vb2_buf_finish(struct vb2_buffer *vb) 
		return;

	}



	session = msm_get_session_from_vb2q(vb->vb2_queue);

	if (IS_ERR_OR_NULL(session))

		return;



	read_lock(&session->stream_rwlock);



	stream = msm_get_stream_from_vb2q(vb->vb2_queue);

	if (!stream) {

		pr_err("%s:%d] NULL stream", __func__, __LINE__);

		read_unlock(&session->stream_rwlock);

		return;

	}
@@ -110,18 +135,27 @@ static void msm_vb2_buf_finish(struct vb2_buffer *vb) 
		}

	}

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	read_unlock(&session->stream_rwlock);

}



static void msm_vb2_stop_stream(struct vb2_queue *q)

{

	struct msm_vb2_buffer *msm_vb2, *temp;

	struct msm_stream *stream;

	struct msm_session *session;

	unsigned long flags;

	struct vb2_buffer *vb2_buf;



	session = msm_get_session_from_vb2q(q);

	if (IS_ERR_OR_NULL(session))

		return;



	read_lock(&session->stream_rwlock);



	stream = msm_get_stream_from_vb2q(q);

	if (!stream) {

		pr_err_ratelimited("%s:%d] NULL stream", __func__, __LINE__);

		read_unlock(&session->stream_rwlock);

		return;

	}
@@ -140,8 +174,28 @@ static void msm_vb2_stop_stream(struct vb2_queue *q) 
			msm_vb2->in_freeq = 0;

		}

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	read_unlock(&session->stream_rwlock);

}



int msm_vb2_get_stream_state(struct msm_stream *stream)

{

	struct msm_vb2_buffer *msm_vb2, *temp;

	unsigned long flags;

	int rc = 1;



	spin_lock_irqsave(&stream->stream_lock, flags);

	list_for_each_entry_safe(msm_vb2, temp, &(stream->queued_list), list) {

		if (msm_vb2->in_freeq != 0) {

			rc = 0;

			break;

		}

	}

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	return rc;

}

EXPORT_SYMBOL(msm_vb2_get_stream_state);





static struct vb2_ops msm_vb2_get_q_op = {

	.queue_setup	= msm_vb2_queue_setup,

	.buf_init	= msm_vb2_buf_init,
@@ -196,13 +250,22 @@ static struct vb2_buffer *msm_vb2_get_buf(int session_id, 
{

	struct msm_stream *stream;

	struct vb2_buffer *vb2_buf = NULL;

	struct msm_session *session;

	struct msm_vb2_buffer *msm_vb2 = NULL;

	unsigned long flags;



	stream = msm_get_stream(session_id, stream_id);

	if (IS_ERR_OR_NULL(stream))

	session = msm_get_session(session_id);

	if (IS_ERR_OR_NULL(session))

		return NULL;



	read_lock(&session->stream_rwlock);



	stream = msm_get_stream(session, stream_id);

	if (IS_ERR_OR_NULL(stream)) {

		read_unlock(&session->stream_rwlock);

		return NULL;

	}



	spin_lock_irqsave(&stream->stream_lock, flags);



	if (!stream->vb2_q) {
@@ -225,6 +288,7 @@ static struct vb2_buffer *msm_vb2_get_buf(int session_id, 
	vb2_buf = NULL;

end:

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	read_unlock(&session->stream_rwlock);

	return vb2_buf;

}
@@ -233,12 +297,22 @@ static struct vb2_buffer *msm_vb2_get_buf_by_idx(int session_id, 
{

	struct msm_stream *stream;

	struct vb2_buffer *vb2_buf = NULL;

	struct msm_session *session;

	struct msm_vb2_buffer *msm_vb2 = NULL;

	unsigned long flags;



	stream = msm_get_stream(session_id, stream_id);

	if (IS_ERR_OR_NULL(stream))

	session = msm_get_session(session_id);

	if (IS_ERR_OR_NULL(session))

		return NULL;



	read_lock(&session->stream_rwlock);



	stream = msm_get_stream(session, stream_id);



	if (IS_ERR_OR_NULL(stream)) {

		read_unlock(&session->stream_rwlock);

		return NULL;

	}



	spin_lock_irqsave(&stream->stream_lock, flags);
@@ -260,6 +334,7 @@ static struct vb2_buffer *msm_vb2_get_buf_by_idx(int session_id, 
	vb2_buf = NULL;

end:

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	read_unlock(&session->stream_rwlock);

	return vb2_buf;

}
@@ -267,15 +342,24 @@ static int msm_vb2_put_buf(struct vb2_buffer *vb, int session_id, 
				unsigned int stream_id)

{

	struct msm_stream *stream;

	struct msm_session *session;

	struct msm_vb2_buffer *msm_vb2;

	struct vb2_buffer *vb2_buf = NULL;

	int rc = 0;

	unsigned long flags;



	stream = msm_get_stream(session_id, stream_id);

	if (IS_ERR_OR_NULL(stream))

	session = msm_get_session(session_id);

	if (IS_ERR_OR_NULL(session))

		return -EINVAL;



	read_lock(&session->stream_rwlock);



	stream = msm_get_stream(session, stream_id);

	if (IS_ERR_OR_NULL(stream)) {

		read_unlock(&session->stream_rwlock);

		return -EINVAL;

	}



	spin_lock_irqsave(&stream->stream_lock, flags);

	if (vb) {

		list_for_each_entry(msm_vb2, &(stream->queued_list), list) {
@@ -302,6 +386,7 @@ static int msm_vb2_put_buf(struct vb2_buffer *vb, int session_id, 
		rc = -EINVAL;

	}

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	read_unlock(&session->stream_rwlock);

	return rc;

}
@@ -313,11 +398,21 @@ static int msm_vb2_buf_done(struct vb2_buffer *vb, int session_id, 
	struct msm_vb2_buffer *msm_vb2;

	struct msm_stream *stream;

	struct vb2_buffer *vb2_buf = NULL;

	struct msm_session *session;

	int rc = 0;



	stream = msm_get_stream(session_id, stream_id);

	if (IS_ERR_OR_NULL(stream))

	session = msm_get_session(session_id);

	if (IS_ERR_OR_NULL(session))

		return -EINVAL;



	read_lock(&session->stream_rwlock);



	stream = msm_get_stream(session, stream_id);

	if (IS_ERR_OR_NULL(stream)) {

		read_unlock(&session->stream_rwlock);

		return -EINVAL;

	}



	spin_lock_irqsave(&stream->stream_lock, flags);

	if (vb) {

		list_for_each_entry(msm_vb2, &(stream->queued_list), list) {
@@ -349,6 +444,7 @@ static int msm_vb2_buf_done(struct vb2_buffer *vb, int session_id, 
		rc = -EINVAL;

	}

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	read_unlock(&session->stream_rwlock);

	return rc;

}
@@ -357,14 +453,23 @@ long msm_vb2_return_buf_by_idx(int session_id, unsigned int stream_id, 
{

	struct msm_stream *stream;

	struct vb2_buffer *vb2_buf = NULL;

	struct msm_session *session;

	struct msm_vb2_buffer *msm_vb2 = NULL;

	unsigned long flags;

	long rc = -EINVAL;



	stream = msm_get_stream(session_id, stream_id);

	if (IS_ERR_OR_NULL(stream))

	session = msm_get_session(session_id);

	if (IS_ERR_OR_NULL(session))

		return rc;



	read_lock(&session->stream_rwlock);



	stream = msm_get_stream(session, stream_id);

	if (IS_ERR_OR_NULL(stream)) {

		read_unlock(&session->stream_rwlock);

		return -EINVAL;

	}



	spin_lock_irqsave(&stream->stream_lock, flags);



	if (!stream->vb2_q) {
@@ -389,6 +494,7 @@ long msm_vb2_return_buf_by_idx(int session_id, unsigned int stream_id, 


end:

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	read_unlock(&session->stream_rwlock);

	return rc;

}

EXPORT_SYMBOL(msm_vb2_return_buf_by_idx);
@@ -399,10 +505,20 @@ static int msm_vb2_flush_buf(int session_id, unsigned int stream_id) 
	struct msm_vb2_buffer *msm_vb2;

	struct msm_stream *stream;

	struct vb2_buffer *vb2_buf = NULL;

	struct msm_session *session;



	session = msm_get_session(session_id);

	if (IS_ERR_OR_NULL(session))

		return -EINVAL;



	stream = msm_get_stream(session_id, stream_id);

	if (IS_ERR_OR_NULL(stream))

	read_lock(&session->stream_rwlock);



	stream = msm_get_stream(session, stream_id);

	if (IS_ERR_OR_NULL(stream)) {

		read_unlock(&session->stream_rwlock);

		return -EINVAL;

	}



	spin_lock_irqsave(&stream->stream_lock, flags);

	list_for_each_entry(msm_vb2, &(stream->queued_list), list) {

		vb2_buf = &(msm_vb2->vb2_buf);
@@ -411,6 +527,7 @@ static int msm_vb2_flush_buf(int session_id, unsigned int stream_id) 
		msm_vb2->in_freeq = 0;

	}

	spin_unlock_irqrestore(&stream->stream_lock, flags);

	read_unlock(&session->stream_rwlock);

	return 0;

}

drivers/media/platform/msm/ais/msm_vb2/msm_vb2.h

+1 −0
Original line number Diff line number Diff line
@@ -67,5 +67,6 @@ struct vb2_mem_ops *msm_vb2_get_q_mem_ops(void); 
int msm_vb2_request_cb(struct msm_sd_req_vb2_q *req_sd);

long msm_vb2_return_buf_by_idx(int session_id, unsigned int stream_id,

	uint32_t index);

int msm_vb2_get_stream_state(struct msm_stream *stream);



#endif /*_MSM_VB_H */