Hans Verkuil 5d0f6f5251 media: v4l2-ctrls: fix reference to freed memory ... commit ac34b79da14d67a9b494f6125186becbd067e225 upstream. When controls are used together with the Request API, then for each request a v4l2_ctrl_handler struct is allocated. This contains the controls that can be set in a request. If a control is *not* set in the request, then the value used in the most recent previous request must be used, or the current value if it is not found in any outstanding requests. The framework tried to find such a previous request and it would set the 'req' pointer in struct v4l2_ctrl_ref to the v4l2_ctrl_ref of the control in such a previous request. So far, so good. However, when that previous request was applied to the hardware, returned to userspace, and then userspace would re-init or free that request, any 'ref' pointer in still-queued requests would suddenly point to freed memory. This was not noticed before since the drivers that use this expected that each request would always have the controls set, so there was never any need to find a control in older requests. This requirement was relaxed, and now this bug surfaced. It was also made worse by changeset 2fae4d6aab ("media: v4l2-ctrls: v4l2_ctrl_request_complete() should always set ref->req") which increased the chance of this happening. The use of the 'req' pointer in v4l2_ctrl_ref was very fragile, so drop this entirely. Instead add a valid_p_req bool to indicate that p_req contains a valid value for this control. And if it is false, then just use the current value of the control. Note that VIDIOC_G_EXT_CTRLS will always return -EACCES when attempting to get a control from a request until the request is completed. And in that case, all controls in the request will have the control value set (i.e. valid_p_req is true). This means that the whole 'find the most recent previous request containing a control' idea is pointless, and the code can be simplified considerably. The v4l2_g_ext_ctrls_common() function was refactored a bit to make it more understandable. It also avoids updating volatile controls in a completed request since that was already done when the request was completed. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Fixes: 2fae4d6aab ("media: v4l2-ctrls: v4l2_ctrl_request_complete() should always set ref->req") Fixes: 6fa6f831f0 ("media: v4l2-ctrls: add core request support") Cc: <stable@vger.kernel.org> # for v5.9 and up Tested-by: Alexandre Courbot <acourbot@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-05-11 14:47:39 +02:00
..
acpi	ACPI: scan: Use unique number for instance_no	2021-03-30 14:32:06 +02:00
asm-generic	static_call: Allow module use without exposing static_call_key	2021-03-30 14:31:53 +02:00
clocksource
crypto	random: initialize ChaCha20 constants with correct endianness	2021-05-11 14:47:19 +02:00
drm	drm/dp/mst: Export drm_dp_get_vc_payload_bw()	2021-02-10 09:29:18 +01:00
dt-bindings	ASoC: dt-bindings: lpass: Fix and common up lpass dai ids	2021-02-03 23:28:46 +01:00
keys
kunit	kunit: fix display of failed expectations for strings	2020-11-10 13:45:15 -07:00
kvm
linux	perf: Rework perf_event_exit_event()	2021-05-11 14:47:31 +02:00
math-emu
media	media: v4l2-ctrls: fix reference to freed memory	2021-05-11 14:47:39 +02:00
memory
misc
net	sch_red: fix off-by-one checks in red_check_params()	2021-04-14 08:42:07 +02:00
pcmcia
ras
rdma	RDMA: Lift ibdev_to_node from rds to common code	2021-02-26 10:12:59 +01:00
scsi	Fix misc new gcc warnings	2021-05-11 14:47:36 +02:00
soc	net: dsa: felix: implement port flushing on .phylink_mac_link_down	2021-02-17 11:02:27 +01:00
sound	ALSA: hda: intel-nhlt: verify config type	2021-03-09 11:11:14 +01:00
target	scsi: target: core: Add cmd length set before cmd complete	2021-03-17 17:06:25 +01:00
trace	trace: fix potenial dangerous pointer	2020-11-25 13:03:44 +01:00
uapi	usb: webcam: Invalid size of Processing Unit Descriptor	2021-05-11 14:47:17 +02:00
vdso
video
xen	Xen/gntdev: correct error checking in gntdev_map_grant_pages()	2021-02-23 15:53:24 +01:00