Re: [PATCH 2/9] media: uvcvideo: Remove dangling pointers

[Resending in plain text, seem like today is not may day]

On Tue, 26 Nov 2024 at 17:20, Ricardo Ribalda ribalda@chromium.org wrote:

When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future.

If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use.

Keep a counter of all the pending async controls and clean all the dangling pointers during release().

Cc: stable@vger.kernel.org Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Signed-off-by: Ricardo Ribalda ribalda@chromium.org

---

drivers/media/usb/uvc/uvc_ctrl.c | 40 ++++++++++++++++++++++++++++++++++++++-- drivers/media/usb/uvc/uvc_v4l2.c | 2 ++ drivers/media/usb/uvc/uvcvideo.h | 3 +++ 3 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 5d3a28edf7f0..11287e81d91c 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1589,7 +1589,12 @@ void uvc_ctrl_status_event(struct uvc_video_chain *chain, mutex_lock(&chain->ctrl_mutex);

    handle = ctrl->handle;

•   ctrl->handle = NULL;
  

•   if (handle) {
  

•           ctrl->handle = NULL;
  

•           WARN_ON(!handle->pending_async_ctrls)
  

There is obviously a missing semicolon here. I screwed it up when I reordered the patches to move it to the first part of the set. Luckily we have CI :).

You can see the fixed version here: https://gitlab.freedesktop.org/linux-media/users/ribalda/-/commits/b4/uvc-gr...

I do not plan to resend the whole series until there are more comments. But I am sending the first two patches as a new set, they are fixes. I will also send the last patch alone, it is unrelated to this.

•           if (handle->pending_async_ctrls)
  

•                   handle->pending_async_ctrls--;
  

•   }
  
    list_for_each_entry(mapping, &ctrl->info.mappings, list) {
            s32 value = __uvc_ctrl_get_value(mapping, data);
  

@@ -2050,8 +2055,11 @@ int uvc_ctrl_set(struct uvc_fh *handle, mapping->set(mapping, value, uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT));

•   if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS)
  

•   if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) {
  

•           if (!ctrl->handle)
  

•                   handle->pending_async_ctrls++;
            ctrl->handle = handle;
  

•   }
  
    ctrl->dirty = 1;
    ctrl->modified = 1;
  

@@ -2774,6 +2782,34 @@ int uvc_ctrl_init_device(struct uvc_device *dev) return 0; }

+void uvc_ctrl_cleanup_fh(struct uvc_fh *handle) +{

•   struct uvc_entity *entity;
  

•   guard(mutex)(&handle->chain->ctrl_mutex);
  

•   if (!handle->pending_async_ctrls)
  

•           return;
  

•   list_for_each_entry(entity, &handle->chain->dev->entities, list) {
  

•           int i;
  

•           for (i = 0; i < entity->ncontrols; ++i) {
  

•                   struct uvc_control *ctrl = &entity->controls[i];
  

•                   if (!ctrl->handle || ctrl->handle != handle)
  

•                           continue;
  

•                   ctrl->handle = NULL;
  

•                   if (WARN_ON(!handle->pending_async_ctrls))
  

•                           continue;
  

•                   handle->pending_async_ctrls--;
  

•           }
  

•   }
  

•   WARN_ON(handle->pending_async_ctrls);
  

+}

/*

• Cleanup device controls.

*/ diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 97c5407f6603..b425306a3b8c 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -652,6 +652,8 @@ static int uvc_v4l2_release(struct file *file)

    uvc_dbg(stream->dev, CALLS, "%s\n", __func__);

•   uvc_ctrl_cleanup_fh(handle);
  

•   /* Only free resources if this is a privileged handle. */
    if (uvc_has_privileges(handle))
            uvc_queue_release(&stream->queue);
  

diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index 07f9921d83f2..2f8a9c48e32a 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -612,6 +612,7 @@ struct uvc_fh { struct uvc_video_chain *chain; struct uvc_streaming *stream; enum uvc_handle_state state;

•   unsigned int pending_async_ctrls; /* Protected by ctrl_mutex. */
  

};

struct uvc_driver { @@ -797,6 +798,8 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, int uvc_xu_ctrl_query(struct uvc_video_chain *chain, struct uvc_xu_control_query *xqry);

+void uvc_ctrl_cleanup_fh(struct uvc_fh *handle);

/* Utility functions */ struct usb_host_endpoint *uvc_find_endpoint(struct usb_host_interface *alts, u8 epaddr);

-- 2.47.0.338.g60cca15819-goog