[PATCH V2,0/1] media: change media_device_request_alloc to match media_ioctl_info

[PATCH V2,0/1] media: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

Hello,

This patch is to modify media_device_request_alloc() so that it can pass
CFI(Control Flow Integrity) check. I would like some review comments.

media_device_request_alloc() is saved in fn of media_ioctl_info struct,
which is defined as long (*fn)(struct media_device *dev, void *arg). The
type of the second parameter of media_device_request_alloc() is int* now,
but it is void* in fn of media_ioctl_info. We got some ABI violation here.
Therefore, we would like to use void* instead of int* for the second
parameter of media_device_request_alloc().

static long media_device_request_alloc(struct media_device *mdev,
                                       int *alloc_fd);

struct media_ioctl_info {
        unsigned int cmd;
        unsigned short flags;
        long (*fn)(struct media_device *dev, void *arg);
        long (*arg_from_user)(void *karg, void __user *uarg, unsigned int cmd);
        long (*arg_to_user)(void __user *uarg, void *karg, unsigned int cmd);
};


Here is an example. With Android’s CFI checking, we got the following error
without this change.

[   23.502477] mtk-cam soc:camisp: sd:mtk-cam raw-0 pad:2 set format w/h/code 2328/1748/0x3007
[   23.518690] Kernel panic - not syncing: CFI failure (target: media_device_request_alloc+0x0/0x4)
[   23.519804] CPU: 7 PID: 818 Comm: mtkv4l2_ut Tainted: G S         O      5.4.39-g02c0a4858bed-dirty #45
[   23.521553] Call trace:
[   23.521868]  dump_backtrace.cfi_jt+0x0/0x4
[   23.522389]  dump_stack+0xb8/0x114
[   23.522824]  panic+0x170/0x3e0
[   23.523215]  __ubsan_handle_cfi_check_fail_abort+0x0/0x14
[   23.523896]  perf_proc_update_handler+0x0/0xcc
[   23.524460]  __cfi_check+0x610cc/0x68ef0
[   23.524959]  media_device_ioctl+0x218/0x238
[   23.525488]  media_device_compat_ioctl+0x60/0x7c
[   23.526072]  media_compat_ioctl+0x58/0x9c
[   23.526581]  __arm64_compat_sys_ioctl+0x10c/0x434
[   23.527176]  el0_svc_common+0xb4/0x18c
[   23.527651]  el0_svc_compat_handler+0x1c/0x28
[   23.528202]  el0_svc_compat+0x8/0x24
[   23.528659] SMP: stopping secondary CPUs
[   23.529161] Kernel Offset: 0x24b8c00000 from 0xffffffc010000000
[   23.529906] PHYS_OFFSET: 0xffffffdd00000000
[   23.530434] CPU features: 0x00000006,2a80a238
[   23.530983] Memory Limit: none
PPL_LOG_STORE: check once, sig value 0x27, addr 0x116000.

==================
 Changes in v2
==================
We also removed the type cast in the MEDIA_IOC_ARG define .


Frederic Chen (1):
  media: mc-device.c: change media_device_request_alloc to match
    media_ioctl_info

 drivers/media/mc/mc-device.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

[PATCH V2, 0/1] media: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

Hello,

This patch is to modify media_device_request_alloc() so that it can pass
CFI(Control Flow Integrity) check. I would like some review comments.

media_device_request_alloc() is saved in fn of media_ioctl_info struct,
which is defined as long (*fn)(struct media_device *dev, void *arg). The
type of the second parameter of media_device_request_alloc() is int* now,
but it is void* in fn of media_ioctl_info. We got some ABI violation here.
Therefore, we would like to use void* instead of int* for the second
parameter of media_device_request_alloc().

static long media_device_request_alloc(struct media_device *mdev,
                                       int *alloc_fd);

struct media_ioctl_info {
        unsigned int cmd;
        unsigned short flags;
        long (*fn)(struct media_device *dev, void *arg);
        long (*arg_from_user)(void *karg, void __user *uarg, unsigned int cmd);
        long (*arg_to_user)(void __user *uarg, void *karg, unsigned int cmd);
};


Here is an example. With Android’s CFI checking, we got the following error
without this change.

[   23.502477] mtk-cam soc:camisp: sd:mtk-cam raw-0 pad:2 set format w/h/code 2328/1748/0x3007
[   23.518690] Kernel panic - not syncing: CFI failure (target: media_device_request_alloc+0x0/0x4)
[   23.519804] CPU: 7 PID: 818 Comm: mtkv4l2_ut Tainted: G S         O      5.4.39-g02c0a4858bed-dirty #45
[   23.521553] Call trace:
[   23.521868]  dump_backtrace.cfi_jt+0x0/0x4
[   23.522389]  dump_stack+0xb8/0x114
[   23.522824]  panic+0x170/0x3e0
[   23.523215]  __ubsan_handle_cfi_check_fail_abort+0x0/0x14
[   23.523896]  perf_proc_update_handler+0x0/0xcc
[   23.524460]  __cfi_check+0x610cc/0x68ef0
[   23.524959]  media_device_ioctl+0x218/0x238
[   23.525488]  media_device_compat_ioctl+0x60/0x7c
[   23.526072]  media_compat_ioctl+0x58/0x9c
[   23.526581]  __arm64_compat_sys_ioctl+0x10c/0x434
[   23.527176]  el0_svc_common+0xb4/0x18c
[   23.527651]  el0_svc_compat_handler+0x1c/0x28
[   23.528202]  el0_svc_compat+0x8/0x24
[   23.528659] SMP: stopping secondary CPUs
[   23.529161] Kernel Offset: 0x24b8c00000 from 0xffffffc010000000
[   23.529906] PHYS_OFFSET: 0xffffffdd00000000
[   23.530434] CPU features: 0x00000006,2a80a238
[   23.530983] Memory Limit: none
PPL_LOG_STORE: check once, sig value 0x27, addr 0x116000.

==================
 Changes in v2
==================
We also removed the type cast in the MEDIA_IOC_ARG define .


Frederic Chen (1):
  media: mc-device.c: change media_device_request_alloc to match
    media_ioctl_info

 drivers/media/mc/mc-device.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

[PATCH V2, 0/1] media: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

Hello,

This patch is to modify media_device_request_alloc() so that it can pass
CFI(Control Flow Integrity) check. I would like some review comments.

media_device_request_alloc() is saved in fn of media_ioctl_info struct,
which is defined as long (*fn)(struct media_device *dev, void *arg). The
type of the second parameter of media_device_request_alloc() is int* now,
but it is void* in fn of media_ioctl_info. We got some ABI violation here.
Therefore, we would like to use void* instead of int* for the second
parameter of media_device_request_alloc().

static long media_device_request_alloc(struct media_device *mdev,
                                       int *alloc_fd);

struct media_ioctl_info {
        unsigned int cmd;
        unsigned short flags;
        long (*fn)(struct media_device *dev, void *arg);
        long (*arg_from_user)(void *karg, void __user *uarg, unsigned int cmd);
        long (*arg_to_user)(void __user *uarg, void *karg, unsigned int cmd);
};


Here is an example. With Android’s CFI checking, we got the following error
without this change.

[   23.502477] mtk-cam soc:camisp: sd:mtk-cam raw-0 pad:2 set format w/h/code 2328/1748/0x3007
[   23.518690] Kernel panic - not syncing: CFI failure (target: media_device_request_alloc+0x0/0x4)
[   23.519804] CPU: 7 PID: 818 Comm: mtkv4l2_ut Tainted: G S         O      5.4.39-g02c0a4858bed-dirty #45
[   23.521553] Call trace:
[   23.521868]  dump_backtrace.cfi_jt+0x0/0x4
[   23.522389]  dump_stack+0xb8/0x114
[   23.522824]  panic+0x170/0x3e0
[   23.523215]  __ubsan_handle_cfi_check_fail_abort+0x0/0x14
[   23.523896]  perf_proc_update_handler+0x0/0xcc
[   23.524460]  __cfi_check+0x610cc/0x68ef0
[   23.524959]  media_device_ioctl+0x218/0x238
[   23.525488]  media_device_compat_ioctl+0x60/0x7c
[   23.526072]  media_compat_ioctl+0x58/0x9c
[   23.526581]  __arm64_compat_sys_ioctl+0x10c/0x434
[   23.527176]  el0_svc_common+0xb4/0x18c
[   23.527651]  el0_svc_compat_handler+0x1c/0x28
[   23.528202]  el0_svc_compat+0x8/0x24
[   23.528659] SMP: stopping secondary CPUs
[   23.529161] Kernel Offset: 0x24b8c00000 from 0xffffffc010000000
[   23.529906] PHYS_OFFSET: 0xffffffdd00000000
[   23.530434] CPU features: 0x00000006,2a80a238
[   23.530983] Memory Limit: none
PPL_LOG_STORE: check once, sig value 0x27, addr 0x116000.

==================
 Changes in v2
==================
We also removed the type cast in the MEDIA_IOC_ARG define .


Frederic Chen (1):
  media: mc-device.c: change media_device_request_alloc to match
    media_ioctl_info

 drivers/media/mc/mc-device.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH V2,1/1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

From: Frederic Chen <frederic.chen@mediatek.com>

We modified the type of media_device_request_alloc()'s second
parameter from int* to void* so that it can match the interface
defined in struct media_ioctl_info.

Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
---
 drivers/media/mc/mc-device.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
index da8088351135..6b66c2091bae 100644
--- a/drivers/media/mc/mc-device.c
+++ b/drivers/media/mc/mc-device.c
@@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
 	return ret;
 }
 
-static long media_device_request_alloc(struct media_device *mdev,
-				       int *alloc_fd)
+static long media_device_request_alloc(struct media_device *mdev, void *arg)
 {
+	int *alloc_fd = arg;
+
 #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
 	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
 		return -ENOTTY;
@@ -407,7 +408,7 @@ static long copy_arg_to_user(void __user *uarg, void *karg, unsigned int cmd)
 #define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)		\
 	[_IOC_NR(MEDIA_IOC_##__cmd)] = {				\
 		.cmd = MEDIA_IOC_##__cmd,				\
-		.fn = (long (*)(struct media_device *, void *))func,	\
+		.fn = func,						\
 		.flags = fl,						\
 		.arg_from_user = from_user,				\
 		.arg_to_user = to_user,					\
-- 
2.18.0

[PATCH V2, 1/1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

From: Frederic Chen <frederic.chen@mediatek.com>

We modified the type of media_device_request_alloc()'s second
parameter from int* to void* so that it can match the interface
defined in struct media_ioctl_info.

Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
---
 drivers/media/mc/mc-device.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
index da8088351135..6b66c2091bae 100644
--- a/drivers/media/mc/mc-device.c
+++ b/drivers/media/mc/mc-device.c
@@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
 	return ret;
 }
 
-static long media_device_request_alloc(struct media_device *mdev,
-				       int *alloc_fd)
+static long media_device_request_alloc(struct media_device *mdev, void *arg)
 {
+	int *alloc_fd = arg;
+
 #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
 	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
 		return -ENOTTY;
@@ -407,7 +408,7 @@ static long copy_arg_to_user(void __user *uarg, void *karg, unsigned int cmd)
 #define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)		\
 	[_IOC_NR(MEDIA_IOC_##__cmd)] = {				\
 		.cmd = MEDIA_IOC_##__cmd,				\
-		.fn = (long (*)(struct media_device *, void *))func,	\
+		.fn = func,						\
 		.flags = fl,						\
 		.arg_from_user = from_user,				\
 		.arg_to_user = to_user,					\
-- 
2.18.0
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

[PATCH V2, 1/1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

From: Frederic Chen <frederic.chen@mediatek.com>

We modified the type of media_device_request_alloc()'s second
parameter from int* to void* so that it can match the interface
defined in struct media_ioctl_info.

Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
---
 drivers/media/mc/mc-device.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
index da8088351135..6b66c2091bae 100644
--- a/drivers/media/mc/mc-device.c
+++ b/drivers/media/mc/mc-device.c
@@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
 	return ret;
 }
 
-static long media_device_request_alloc(struct media_device *mdev,
-				       int *alloc_fd)
+static long media_device_request_alloc(struct media_device *mdev, void *arg)
 {
+	int *alloc_fd = arg;
+
 #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
 	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
 		return -ENOTTY;
@@ -407,7 +408,7 @@ static long copy_arg_to_user(void __user *uarg, void *karg, unsigned int cmd)
 #define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)		\
 	[_IOC_NR(MEDIA_IOC_##__cmd)] = {				\
 		.cmd = MEDIA_IOC_##__cmd,				\
-		.fn = (long (*)(struct media_device *, void *))func,	\
+		.fn = func,						\
 		.flags = fl,						\
 		.arg_from_user = from_user,				\
 		.arg_to_user = to_user,					\
-- 
2.18.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH V2,1/1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[Laurent Pinchart]

Hi Frederic,

Thank you for the patch.

On Thu, Aug 06, 2020 at 11:58:22PM +0800, frederic.chen@mediatek.com wrote:
> From: Frederic Chen <frederic.chen@mediatek.com>
> 
> We modified the type of media_device_request_alloc()'s second
> parameter from int* to void* so that it can match the interface
> defined in struct media_ioctl_info.
> 
> Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>

This looks fine to me.

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/media/mc/mc-device.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> index da8088351135..6b66c2091bae 100644
> --- a/drivers/media/mc/mc-device.c
> +++ b/drivers/media/mc/mc-device.c
> @@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
>  	return ret;
>  }
>  
> -static long media_device_request_alloc(struct media_device *mdev,
> -				       int *alloc_fd)
> +static long media_device_request_alloc(struct media_device *mdev, void *arg)
>  {
> +	int *alloc_fd = arg;
> +
>  #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
>  	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
>  		return -ENOTTY;
> @@ -407,7 +408,7 @@ static long copy_arg_to_user(void __user *uarg, void *karg, unsigned int cmd)
>  #define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)		\
>  	[_IOC_NR(MEDIA_IOC_##__cmd)] = {				\
>  		.cmd = MEDIA_IOC_##__cmd,				\
> -		.fn = (long (*)(struct media_device *, void *))func,	\
> +		.fn = func,						\
>  		.flags = fl,						\
>  		.arg_from_user = from_user,				\
>  		.arg_to_user = to_user,					\

-- 
Regards,

Laurent Pinchart

Re: [PATCH V2,1/1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[Laurent Pinchart]

Hi Frederic,

Thank you for the patch.

On Thu, Aug 06, 2020 at 11:58:22PM +0800, frederic.chen@mediatek.com wrote:
> From: Frederic Chen <frederic.chen@mediatek.com>
> 
> We modified the type of media_device_request_alloc()'s second
> parameter from int* to void* so that it can match the interface
> defined in struct media_ioctl_info.
> 
> Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>

This looks fine to me.

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/media/mc/mc-device.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> index da8088351135..6b66c2091bae 100644
> --- a/drivers/media/mc/mc-device.c
> +++ b/drivers/media/mc/mc-device.c
> @@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
>  	return ret;
>  }
>  
> -static long media_device_request_alloc(struct media_device *mdev,
> -				       int *alloc_fd)
> +static long media_device_request_alloc(struct media_device *mdev, void *arg)
>  {
> +	int *alloc_fd = arg;
> +
>  #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
>  	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
>  		return -ENOTTY;
> @@ -407,7 +408,7 @@ static long copy_arg_to_user(void __user *uarg, void *karg, unsigned int cmd)
>  #define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)		\
>  	[_IOC_NR(MEDIA_IOC_##__cmd)] = {				\
>  		.cmd = MEDIA_IOC_##__cmd,				\
> -		.fn = (long (*)(struct media_device *, void *))func,	\
> +		.fn = func,						\
>  		.flags = fl,						\
>  		.arg_from_user = from_user,				\
>  		.arg_to_user = to_user,					\

-- 
Regards,

Laurent Pinchart

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

Re: [PATCH V2,1/1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[Laurent Pinchart]

Hi Frederic,

Thank you for the patch.

On Thu, Aug 06, 2020 at 11:58:22PM +0800, frederic.chen@mediatek.com wrote:
> From: Frederic Chen <frederic.chen@mediatek.com>
> 
> We modified the type of media_device_request_alloc()'s second
> parameter from int* to void* so that it can match the interface
> defined in struct media_ioctl_info.
> 
> Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>

This looks fine to me.

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/media/mc/mc-device.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> index da8088351135..6b66c2091bae 100644
> --- a/drivers/media/mc/mc-device.c
> +++ b/drivers/media/mc/mc-device.c
> @@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
>  	return ret;
>  }
>  
> -static long media_device_request_alloc(struct media_device *mdev,
> -				       int *alloc_fd)
> +static long media_device_request_alloc(struct media_device *mdev, void *arg)
>  {
> +	int *alloc_fd = arg;
> +
>  #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
>  	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
>  		return -ENOTTY;
> @@ -407,7 +408,7 @@ static long copy_arg_to_user(void __user *uarg, void *karg, unsigned int cmd)
>  #define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)		\
>  	[_IOC_NR(MEDIA_IOC_##__cmd)] = {				\
>  		.cmd = MEDIA_IOC_##__cmd,				\
> -		.fn = (long (*)(struct media_device *, void *))func,	\
> +		.fn = func,						\
>  		.flags = fl,						\
>  		.arg_from_user = from_user,				\
>  		.arg_to_user = to_user,					\

-- 
Regards,

Laurent Pinchart

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel