From: Stanimir Varbanov <stanimir.varbanov@linaro.org>
To: Jeffrey Kardatzke <jkardatzke@google.com>, linux-media@vger.kernel.org
Cc: Andy Gross <agross@kernel.org>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] media: venus: fix use after free for registeredbufs
Date: Fri, 6 Mar 2020 11:03:17 +0200 [thread overview]
Message-ID: <892a0548-df6d-a4db-921f-7f4cfd69dc06@linaro.org> (raw)
In-Reply-To: <20200306002321.3344-1-jkardatzke@google.com>
Hi Jeff,
Thanks for the patch!
On 3/6/20 2:23 AM, Jeffrey Kardatzke wrote:
> In dynamic bufmode we do not manage the buffers in the registeredbufs
> list, so do not add them there when they are initialized. Adding them
> there was causing a use after free of the list_head struct in the buffer
> when new buffers were allocated after existing buffers were freed.
Is this fixing a real issue? How you come to it?
>
> Signed-off-by: Jeffrey Kardatzke <jkardatzke@google.com>
> ---
> drivers/media/platform/qcom/venus/helpers.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
> index bcc603804041..688a3593b49b 100644
> --- a/drivers/media/platform/qcom/venus/helpers.c
> +++ b/drivers/media/platform/qcom/venus/helpers.c
> @@ -1054,8 +1054,10 @@ int venus_helper_vb2_buf_init(struct vb2_buffer *vb)
> buf->size = vb2_plane_size(vb, 0);
> buf->dma_addr = sg_dma_address(sgt->sgl);
>
> - if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)
> + if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE &&
> + !is_dynamic_bufmode(inst)) {
If you add !is_dynamic_bufmode here, we will loose the reference frames
mechanism (see venus_helper_release_buf_ref()) which is not good.
Thus, I wonder (depending on when you observe the use-after-free issue)
does this is the correct resolution of the problem.
> list_add_tail(&buf->reg_list, &inst->registeredbufs);
> + }
>
> return 0;
> }
>
--
regards,
Stan
next prev parent reply other threads:[~2020-03-06 9:03 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-06 0:23 [PATCH] media: venus: fix use after free for registeredbufs Jeffrey Kardatzke
2020-03-06 9:03 ` Stanimir Varbanov [this message]
2020-03-06 20:10 ` Jeffrey Kardatzke
2020-03-07 17:24 ` Stanimir Varbanov
2020-03-09 21:19 ` Jeffrey Kardatzke
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=892a0548-df6d-a4db-921f-7f4cfd69dc06@linaro.org \
--to=stanimir.varbanov@linaro.org \
--cc=agross@kernel.org \
--cc=jkardatzke@google.com \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).