From patchwork Wed Nov 22 10:19:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 746323 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="F7wxorbO" Received: from mail-qv1-xf34.google.com (mail-qv1-xf34.google.com [IPv6:2607:f8b0:4864:20::f34]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7199712A for ; Wed, 22 Nov 2023 02:19:47 -0800 (PST) Received: by mail-qv1-xf34.google.com with SMTP id 6a1803df08f44-67089696545so25602586d6.0 for ; Wed, 22 Nov 2023 02:19:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1700648386; x=1701253186; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=3jbUgexWSE+UkwxAykTeDpdOwZGPMwaBInU8mlrkF50=; b=F7wxorbOiTE0uDAQtEfKGrBeMd2wEhVSErzly03FhyI05NagpfT2xSZQR6TxDtE/Lj qznHJm6IDGkXuGUm7Ngi9LiI+IBp34S+NLGP7+5s5V/GjE8vhzY5rDHPzOwDpDi0F4o/ fsCzeUjHjTRdfe8mYVqQ3ALUCZj4d/Cs/oLhU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700648386; x=1701253186; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3jbUgexWSE+UkwxAykTeDpdOwZGPMwaBInU8mlrkF50=; b=GfK/CvNK42YYxOLBqGCem2tAT2pNo7t1eQFcWiHPuHjAj/1ZqxNWa2MkX4EDGaHpoK oaqf0vYJCaRfEMD4ftGIf6nHP2I/ijXK/5p8+IHKtwpdCVnWf4z26NTSyk8kWTfPhW2P BbTfzY9biZVLeI+0C16MhZHfFd5gfHiexcreLpmufVmqAon3THyH60tp2p0gE5az4EjI 8hUtPJ/aNq8gVKLNDFGr5pl8eP8ZrGNgJUHkTLViDFTYQ0dOHW31SMHE+pJFXCki8uuh 1kLvZAkJkUtsRHMy/u5zIqsJSBBVx/WVDxYEQGiTVYM1GRQX/BkHowX/UINFjTeIqgy0 x+Yw== X-Gm-Message-State: AOJu0YxwhwOxCjH/V/SM/TpNit8iofpcDKuFRzo4Q11GglGZyvdwgViJ saaCRjVzbDFVuuG671QdoLzd+w== X-Google-Smtp-Source: AGHT+IFPvXTb6KvF1t26bkBVeQdRb5LPbM3oabECQ9JvaZErAcqhrdGHM97bsBRhhWg8cgtBJlaStw== X-Received: by 2002:a05:6214:250d:b0:679:f6e4:5ed1 with SMTP id gf13-20020a056214250d00b00679f6e45ed1mr1464786qvb.60.1700648386567; Wed, 22 Nov 2023 02:19:46 -0800 (PST) Received: from denia.c.googlers.com (228.221.150.34.bc.googleusercontent.com. [34.150.221.228]) by smtp.gmail.com with ESMTPSA id di6-20020ad458e6000000b0066d1d2242desm4739352qvb.120.2023.11.22.02.19.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Nov 2023 02:19:45 -0800 (PST) From: Ricardo Ribalda Date: Wed, 22 Nov 2023 10:19:34 +0000 Subject: [PATCH v4 1/3] media: uvcvideo: Lock video streams and queues while unregistering Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20231122-guenter-mini-v4-1-3d94e1e34dc1@chromium.org> References: <20231122-guenter-mini-v4-0-3d94e1e34dc1@chromium.org> In-Reply-To: <20231122-guenter-mini-v4-0-3d94e1e34dc1@chromium.org> To: Mauro Carvalho Chehab Cc: Guenter Roeck , Tomasz Figa , Laurent Pinchart , Alan Stern , Hans Verkuil , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Sean Paul , Ricardo Ribalda , Sakari Ailus , Sergey Senozhatsky X-Mailer: b4 0.12.3 From: Guenter Roeck The call to uvc_disconnect() is not protected by any mutex. This means it can and will be called while other accesses to the video device are in progress. This can cause all kinds of race conditions, including crashes such as the following. usb 1-4: USB disconnect, device number 3 BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 5633 Comm: V4L2CaptureThre Not tainted 4.19.113-08536-g5d29ca36db06 #1 Hardware name: GOOGLE Edgar, BIOS Google_Edgar.7287.167.156 03/25/2019 RIP: 0010:usb_ifnum_to_if+0x29/0x40 Code: <...> RSP: 0018:ffffa46f42a47a80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff904a396c9000 RDX: ffff904a39641320 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffa46f42a47a80 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000000009975 R11: 0000000000000009 R12: 0000000000000000 R13: ffff904a396b3800 R14: ffff904a39e88000 R15: 0000000000000000 FS: 00007f396448e700(0000) GS:ffff904a3ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000016cb46000 CR4: 00000000001006f0 Call Trace: usb_hcd_alloc_bandwidth+0x1ee/0x30f usb_set_interface+0x1a3/0x2b7 uvc_video_start_transfer+0x29b/0x4b8 [uvcvideo] uvc_video_start_streaming+0x91/0xdd [uvcvideo] uvc_start_streaming+0x28/0x5d [uvcvideo] vb2_start_streaming+0x61/0x143 [videobuf2_common] vb2_core_streamon+0xf7/0x10f [videobuf2_common] uvc_queue_streamon+0x2e/0x41 [uvcvideo] uvc_ioctl_streamon+0x42/0x5c [uvcvideo] __video_do_ioctl+0x33d/0x42a video_usercopy+0x34e/0x5ff ? video_ioctl2+0x16/0x16 v4l2_ioctl+0x46/0x53 do_vfs_ioctl+0x50a/0x76f ksys_ioctl+0x58/0x83 __x64_sys_ioctl+0x1a/0x1e do_syscall_64+0x54/0xde usb_set_interface() should not be called after the USB device has been unregistered. However, in the above case the disconnect happened after v4l2_ioctl() was called, but before the call to usb_ifnum_to_if(). Acquire various mutexes in uvc_unregister_video() to fix the majority (maybe all) of the observed race conditions. The uvc_device lock prevents races against suspend and resume calls and the poll function. The uvc_streaming lock prevents races against stream related functions; for the most part, those are ioctls. This lock also requires other functions using this lock to check if a video device is still registered after acquiring it. For example, it was observed that the video device was already unregistered by the time the stream lock was acquired in uvc_ioctl_streamon(). The uvc_queue lock prevents races against queue functions, Most of those are already protected by the uvc_streaming lock, but some are called directly. This is done as added protection; an actual race was not (yet) observed. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Reviewed-by: Tomasz Figa Reviewed-by: Sean Paul Signed-off-by: Guenter Roeck Reviewed-by: Sergey Senozhatsky Signed-off-by: Ricardo Ribalda --- drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index 08fcd2ffa727..ded2cb6ce14f 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1907,14 +1907,22 @@ static void uvc_unregister_video(struct uvc_device *dev) { struct uvc_streaming *stream; + mutex_lock(&dev->lock); + list_for_each_entry(stream, &dev->streams, list) { if (!video_is_registered(&stream->vdev)) continue; + mutex_lock(&stream->mutex); + mutex_lock(&stream->queue.mutex); + video_unregister_device(&stream->vdev); video_unregister_device(&stream->meta.vdev); uvc_debugfs_cleanup_stream(stream); + + mutex_unlock(&stream->queue.mutex); + mutex_unlock(&stream->mutex); } uvc_status_unregister(dev); @@ -1925,6 +1933,7 @@ static void uvc_unregister_video(struct uvc_device *dev) if (media_devnode_is_registered(dev->mdev.devnode)) media_device_unregister(&dev->mdev); #endif + mutex_unlock(&dev->lock); } int uvc_register_video_device(struct uvc_device *dev, From patchwork Wed Nov 22 10:19:35 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 746322 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="I/HjlToi" Received: from mail-qv1-xf2c.google.com (mail-qv1-xf2c.google.com [IPv6:2607:f8b0:4864:20::f2c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 10B21197 for ; Wed, 22 Nov 2023 02:19:48 -0800 (PST) Received: by mail-qv1-xf2c.google.com with SMTP id 6a1803df08f44-678013cc22bso25410096d6.2 for ; Wed, 22 Nov 2023 02:19:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1700648387; x=1701253187; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=1y6RZGZZzUKyI0AjxKgp4LZORspR1wFnVoan2A/smok=; b=I/HjlToif65LhLdRS0B35L26u++dsWGjxAPPjcZLEAt73+yV3xFpJT+RYKw4jVJGKG w4ETGigoJAzffKSJHdz9fRJu8RmOnM7lGYXdF77FOTkhYnWJn99BXbMbtsvb1pvetZ5L MZLpbBxEdhwhW7x0ihj5geRP3EpukcCF9E400= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700648387; x=1701253187; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=1y6RZGZZzUKyI0AjxKgp4LZORspR1wFnVoan2A/smok=; b=r+JkcLAccRLrzfjH9Sw2Z+/PNAvT7Y4XhlZmATZSzVYX75j7mgYpKL7uK58YK6GNc7 1oQVUDXDd454PLArsN+6/2He8ZlZjIH5+M1pAxEe3XCVVv6jbQSZKHi8NppQhoo92HIx HNo0YIw3AVeHXjO2Am18Sp1DekpW55VnJInZACmTA6suV5FgRoJq4IgchXkymC4Lr2bc l8GM7zEC3C1M1f0RpcuKOCMbUEiBxYHHdyyYHl7Kx0kcIOFizpEAvNDBAKuociN1W0/6 NCw6EoisxHKBTBJEv0FDte8H+eqOL3PusfhBjvw3/swCPp611KxtkRlzdtWP0ymB4PQT Onpw== X-Gm-Message-State: AOJu0YyKWF7TOL2TV/WbzyfEDTYKMXn6cwEL2LZ+pInUgFRqiQ8cigw2 UUt6U2RbwXN3U1UEFX/6R/iLHw== X-Google-Smtp-Source: AGHT+IFEsCJ45XVX1lArkw/YPBxax3uJbusPHME8iW0AJ3NFgR82vx54nuQtKxpCgoZhDZ7EzAQl9g== X-Received: by 2002:ad4:5e86:0:b0:672:118e:e368 with SMTP id jl6-20020ad45e86000000b00672118ee368mr2089387qvb.24.1700648387220; Wed, 22 Nov 2023 02:19:47 -0800 (PST) Received: from denia.c.googlers.com (228.221.150.34.bc.googleusercontent.com. [34.150.221.228]) by smtp.gmail.com with ESMTPSA id di6-20020ad458e6000000b0066d1d2242desm4739352qvb.120.2023.11.22.02.19.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Nov 2023 02:19:46 -0800 (PST) From: Ricardo Ribalda Date: Wed, 22 Nov 2023 10:19:35 +0000 Subject: [PATCH v4 2/3] media: uvcvideo: Always use uvc_status_stop() Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20231122-guenter-mini-v4-2-3d94e1e34dc1@chromium.org> References: <20231122-guenter-mini-v4-0-3d94e1e34dc1@chromium.org> In-Reply-To: <20231122-guenter-mini-v4-0-3d94e1e34dc1@chromium.org> To: Mauro Carvalho Chehab Cc: Guenter Roeck , Tomasz Figa , Laurent Pinchart , Alan Stern , Hans Verkuil , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Sean Paul , Ricardo Ribalda , Sakari Ailus , Sakari Ailus X-Mailer: b4 0.12.3 The only thread safe way to stop the status handler is with uvc_status. Let's remove all the code paths partially stopping uvc_status. Reviewed-by: Sakari Ailus Signed-off-by: Ricardo Ribalda --- drivers/media/usb/uvc/uvc_ctrl.c | 4 ---- drivers/media/usb/uvc/uvc_status.c | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index e59a463c2761..8e22a07e3e7b 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -2765,10 +2765,6 @@ void uvc_ctrl_cleanup_device(struct uvc_device *dev) struct uvc_entity *entity; unsigned int i; - /* Can be uninitialized if we are aborting on probe error. */ - if (dev->async_ctrl.work.func) - cancel_work_sync(&dev->async_ctrl.work); - /* Free controls and control mappings for all entities. */ list_for_each_entry(entity, &dev->entities, list) { for (i = 0; i < entity->ncontrols; ++i) { diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c index a78a88c710e2..0208612a9f12 100644 --- a/drivers/media/usb/uvc/uvc_status.c +++ b/drivers/media/usb/uvc/uvc_status.c @@ -292,7 +292,7 @@ int uvc_status_init(struct uvc_device *dev) void uvc_status_unregister(struct uvc_device *dev) { - usb_kill_urb(dev->int_urb); + uvc_status_stop(dev); uvc_input_unregister(dev); }