From patchwork Thu Oct 5 18:08:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Avichal Rakesh X-Patchwork-Id: 148970 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2016:b0:403:3b70:6f57 with SMTP id fe22csp478266vqb; Thu, 5 Oct 2023 11:09:38 -0700 (PDT) X-Google-Smtp-Source: AGHT+IG4XzzEwjdR46drnNP845AvpPRtgKtsePD8HYO1YwuB6A6zDUvdNBRL9dTTttJoCSQag0QM X-Received: by 2002:a17:90a:12cd:b0:274:6d4e:e0d9 with SMTP id b13-20020a17090a12cd00b002746d4ee0d9mr5782816pjg.45.1696529377734; Thu, 05 Oct 2023 11:09:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696529377; cv=none; d=google.com; s=arc-20160816; b=zkAkam87SZ+PQ+JzcPAqw5q9qBjhX793kVHFMYFJSDj/K5XenyrlZZ39iZswpPOen3 jumxJMUXdOBhCFlz9DVxjtJruxHuI5E8RS4EP32tlSAwgDv/1oM3o6PGffhSK3eER0bI xLvq581hVdqCRYPk/fGckvEzwRq2WayawA5vMUlZQGJVkNhmQQN14riD3NXHUssCUnpJ Qcn5MFWNaWgqCo7YknO0WomICH1BirrjEn4d2a3aaxNEepyrb2Tfpzb30l1dZzwSPBe5 NQFmfOy5kk1TK3IPHpZ54OvmKoDGyoWtuzvvrIZ6zLqNByfvm182y/ZcuetOB5rz6gkh Hjhw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:dkim-signature; bh=Fulx3avKDjTg8wkMNU25aLrvIs7TbekfU944xGo/6Xc=; fh=q3sDYC4bBx/LQ35Tzyg5FsIVnW5P3mal7p7VS0xEYf0=; b=gKAMuRcgM5/3q4mWDKAYt6yXq1Rf1nxSiqwYyHN7EkqiTDF0SR69Bpk7YpA9xypJbJ snd2V4ZPp7cmaAfSOc0wpBjZNDhJ8lapEo2u9KJ8E8NzSu3YzcHRwkpHwgOaeEK4SfJM vBdGUJZyZyGmJMoTCb+9B1UZseZPsurYDbNeGPeNcrRxLpU/kFhDx1N6ykNlX5ecqfRj 2/OSedYCOf7qL5EEqPwHqrrmHyzx2J8FzZ6uOOOKEKK1dhQ/QfuHDI6KUwzoKAmQZHD3 fIWkmfPjtOOSK8N9HQim6ggzYFZJDRjhPqUDFkMbP3fFUw+RcuhtAhqwXnJnrYKd5M9l csnA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=duPIVGxZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from snail.vger.email (snail.vger.email. [23.128.96.37]) by mx.google.com with ESMTPS id sf9-20020a17090b51c900b0027749a1fe74si1988257pjb.182.2023.10.05.11.09.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Oct 2023 11:09:37 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=duPIVGxZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id 0406E835450C; Thu, 5 Oct 2023 11:09:37 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231827AbjJESJb (ORCPT + 18 others); Thu, 5 Oct 2023 14:09:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231932AbjJESIm (ORCPT ); Thu, 5 Oct 2023 14:08:42 -0400 Received: from mail-pl1-x64a.google.com (mail-pl1-x64a.google.com [IPv6:2607:f8b0:4864:20::64a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 303B810F for ; Thu, 5 Oct 2023 11:08:24 -0700 (PDT) Received: by mail-pl1-x64a.google.com with SMTP id d9443c01a7336-1c746bccbdcso11346505ad.2 for ; Thu, 05 Oct 2023 11:08:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1696529303; x=1697134103; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=Fulx3avKDjTg8wkMNU25aLrvIs7TbekfU944xGo/6Xc=; b=duPIVGxZJIfn1ybzQqTdHGHA6EMmzUxRvXFfhfPL9B2GOR4JpygthjcOVxt6oSk2fh IF0sEYSz3CqwD+MJV5MM3uiee5H7GSPDaUqum1o/hPyDY1qAGQPYR9CPh5r8eQQXE1eM HsbPP6gm0G0ikGpoSrY+1TlBSKoMgTO+0jmrXExlzb+pF1KbkW7Ba0olAT8Ol9MB4hdU Ei+blOUF8XuLdcDdIxdMc1DIB4vOCY9I1362iCfd3QKe/QFA7JQYzp/F5fiTQJl5V8P6 hRNSFCduc/Rt4vql5ip10hxJ1lFVefzY63x+G5wttQHw/MSG2rde2XgTi6eKZ+sYGISu L4ow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696529303; x=1697134103; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=Fulx3avKDjTg8wkMNU25aLrvIs7TbekfU944xGo/6Xc=; b=pVbQbm9j6XcQsTu0vQ9BlyfA3BZAKuc3BOzVGbES0yw2b0wK4kWNYVHHYw/P5L0oM8 g8couCwp7/70ugPXDKOcVngQPuQT1i5NUXpPBJ2NXZru9+G/ZVGuCoJC3cNBSX4nC3lD tsDeBZlYKmd1uLpFv2txu8yfERPRWtejHONWuo3/Y20HnxDumf9Qr4iR/nTuUfe0K9F4 ZWwyjfBtD7+WhLFMsHJxxkiF22XKxJieBlTzr75gHwlLXJ6+qi4ybL8pCSDCMYzsxUbo wxFy9jXEhq5sy0KjGrCnd1l/sGvWiBHObbOyAbACk+AqonlO72c4k9Jgjp8o25sISCxK 5LJg== X-Gm-Message-State: AOJu0YwM1hXghTWLCtQFfBLC3GxzuK7rfLUey+GaTaA1vqHQUyN/DEPI osxwH+NY0BtPi2U13wGo57y9AJS5mVfJ X-Received: from hi-h2o-specialist.c.googlers.com ([fda3:e722:ac3:cc00:24:72f4:c0a8:3cef]) (user=arakesh job=sendgmr) by 2002:a17:902:d4c4:b0:1b7:c944:edd4 with SMTP id o4-20020a170902d4c400b001b7c944edd4mr91628plg.2.1696529303598; Thu, 05 Oct 2023 11:08:23 -0700 (PDT) Date: Thu, 5 Oct 2023 11:08:14 -0700 In-Reply-To: <20231005180814.3278050-1-arakesh@google.com> Mime-Version: 1.0 References: <20230930184821.310143-1-arakesh@google.com> <20231005180814.3278050-1-arakesh@google.com> X-Mailer: git-send-email 2.42.0.609.gbb76f46606-goog Message-ID: <20231005180814.3278050-3-arakesh@google.com> Subject: [PATCH v3 3/3] usb: gadget: uvc: Fix use-after-free for inflight usb_requests From: Avichal Rakesh To: arakesh@google.com, dan.scally@ideasonboard.com, gregkh@linuxfoundation.org, laurent.pinchart@ideasonboard.com, m.grzeschik@pengutronix.de Cc: etalvala@google.com, jchowdhary@google.com, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, Michael Grzeschik X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Thu, 05 Oct 2023 11:09:37 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778517869169821913 X-GMAIL-MSGID: 1778939988513006701 Currently, the uvc gadget driver allocates all uvc_requests as one array and deallocates them all when the video stream stops. This includes de-allocating all the usb_requests associated with those uvc_requests. This can lead to use-after-free issues if any of those de-allocated usb_requests were still owned by the usb controller. This is patch 2 of 2 in fixing the use-after-free issue. It adds a new flag to uvc_request to mark it as 'abandoned'. When disabling the video stream, instead of de-allocating all uvc_requests and usb_requests, the gadget driver only de-allocates those usb_requests that are currently owned by the gadget driver (as present in req_free). Other usb_requests have their corresponding 'is_abandoned' flag tripped, and the usb_requests complete handler takes care of freeing the usb_request and its corresponding uvc_request. This should ensure that uvc gadget driver never accidentally de-allocates a usb_request that it doesn't own. Link: https://lore.kernel.org/7cd81649-2795-45b6-8c10-b7df1055020d@google.com Suggested-by: Michael Grzeschik Signed-off-by: Avichal Rakesh --- v1 -> v2: Rebased to ToT, and fixed deadlock reported in https://lore.kernel.org/all/ZRv2UnKztgyqk2pt@pengutronix.de/ v2 -> v3: Fix email threading goof-up drivers/usb/gadget/function/uvc.h | 1 + drivers/usb/gadget/function/uvc_video.c | 118 ++++++++++++++++++++---- 2 files changed, 102 insertions(+), 17 deletions(-) -- 2.42.0.609.gbb76f46606-goog diff --git a/drivers/usb/gadget/function/uvc.h b/drivers/usb/gadget/function/uvc.h index 993694da0bbc..e69cfb7cced1 100644 --- a/drivers/usb/gadget/function/uvc.h +++ b/drivers/usb/gadget/function/uvc.h @@ -82,6 +82,7 @@ struct uvc_request { u8 header[UVCG_REQUEST_HEADER_LEN]; struct uvc_buffer *last_buf; struct list_head list; + bool is_abandoned; }; struct uvc_video { diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c index 3c4d286d81c0..69521886d599 100644 --- a/drivers/usb/gadget/function/uvc_video.c +++ b/drivers/usb/gadget/function/uvc_video.c @@ -271,7 +271,21 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) struct uvc_video *video = ureq->video; struct uvc_video_queue *queue = &video->queue; struct uvc_device *uvc = video->uvc; + struct uvc_buffer *last_buf; unsigned long flags; + bool is_abandoned; + + spin_lock_irqsave(&video->req_lock, flags); + is_abandoned = ureq->is_abandoned; + last_buf = ureq->last_buf; + ureq->last_buf = NULL; + spin_unlock_irqrestore(&video->req_lock, flags); + + if (is_abandoned) { + uvcg_dbg(&video->uvc->func, "Freeing abandoned usb_request\n"); + uvc_video_free_request(ureq, ep); + return; + } if (uvc->state == UVC_STATE_CONNECTED) { usb_ep_free_request(video->ep, ureq->req); @@ -300,15 +314,29 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) uvcg_queue_cancel(queue, 0); } - if (ureq->last_buf) { - uvcg_complete_buffer(&video->queue, ureq->last_buf); - ureq->last_buf = NULL; + if (last_buf) { + spin_lock_irqsave(&video->queue.irqlock, flags); + uvcg_complete_buffer(&video->queue, last_buf); + spin_unlock_irqrestore(&video->queue.irqlock, flags); } + /* + * request might have been abandoned while being processed. + * do a last minute check before queueing the request back. + */ spin_lock_irqsave(&video->req_lock, flags); - list_add_tail(&req->list, &video->req_free); + is_abandoned = ureq->is_abandoned; + if (!is_abandoned) + list_add_tail(&req->list, &video->req_free); spin_unlock_irqrestore(&video->req_lock, flags); + if (is_abandoned) { + uvcg_dbg(&video->uvc->func, + "usb_request abandoned mid-processing - freeing.\n"); + uvc_video_free_request(ureq, ep); + return; + } + if (uvc->state == UVC_STATE_STREAMING) queue_work(video->async_wq, &video->pump); } @@ -372,7 +400,6 @@ uvc_video_alloc_requests(struct uvc_video *video) } video->req_size = req_size; - return 0; error: @@ -504,13 +531,80 @@ static void uvcg_video_pump(struct work_struct *work) return; } +/* + * Disable video stream. This ensures that any inflight usb requests are marked + * for clean up and all video buffers are dropped before returning. + */ +static void uvcg_video_disable(struct uvc_video *video) +{ + struct uvc_buffer *buf, *tmp_buf; + struct uvc_request *ureq, *temp; + struct list_head buf_list; /* track in-flight video buffers */ + struct usb_request *req; + unsigned long flags; + + INIT_LIST_HEAD(&buf_list); + + cancel_work_sync(&video->pump); + uvcg_queue_cancel(&video->queue, 0); + + list_for_each_entry(ureq, &video->ureqs, list) { + if (ureq->req) + usb_ep_dequeue(video->ep, ureq->req); + } + + /** + * acquiring req_lock here should prevent any more complete + * callbacks from processing until we've abandoned the + * requests that are still in-flight and let the complete + * callback handle cleanup + */ + spin_lock_irqsave(&video->req_lock, flags); + /* abandon all usb requests */ + list_for_each_entry_safe(ureq, temp, &video->ureqs, list) { + ureq->is_abandoned = true; + if (ureq->last_buf) { + list_add(&ureq->last_buf->queue, &buf_list); + ureq->last_buf = NULL; + } + list_del_init(&ureq->list); + } + /* + * re-add uvc_requests currently owned by the gadget to + * video->ureqs to be deallocated. This effectively leaves + * video->ureqs with the requests that we currently own. + */ + list_for_each_entry(req, &video->req_free, list) { + ureq = req->context; + list_add_tail(&ureq->list, &video->ureqs); + } + spin_unlock_irqrestore(&video->req_lock, flags); + + /* + * drop abandoned uvc_buffers, as the completion handler + * no longer will + */ + if (!list_empty(&buf_list)) { + spin_lock_irqsave(&video->queue.irqlock, flags); + list_for_each_entry_safe(buf, tmp_buf, + &buf_list, queue) { + video->queue.flags |= UVC_QUEUE_DROP_INCOMPLETE; + uvcg_complete_buffer(&video->queue, buf); + list_del(&buf->queue); + } + spin_unlock_irqrestore(&video->queue.irqlock, flags); + } + + uvc_video_free_requests(video); + uvcg_queue_enable(&video->queue, 0); +} + /* * Enable or disable the video stream. */ int uvcg_video_enable(struct uvc_video *video, int enable) { struct uvc_device *uvc = video->uvc; - struct uvc_request *ureq; int ret; if (video->ep == NULL) { @@ -521,17 +615,7 @@ int uvcg_video_enable(struct uvc_video *video, int enable) if (!enable) { uvc->state = UVC_STATE_CONNECTED; - - cancel_work_sync(&video->pump); - uvcg_queue_cancel(&video->queue, 0); - - list_for_each_entry(ureq, &video->ureqs, list) { - if (ureq->req) - usb_ep_dequeue(video->ep, ureq->req); - } - - uvc_video_free_requests(video); - uvcg_queue_enable(&video->queue, 0); + uvcg_video_disable(video); return 0; }