Hans Verkuil ac34b79da1 media: v4l2-ctrls: fix reference to freed memory ... When controls are used together with the Request API, then for each request a v4l2_ctrl_handler struct is allocated. This contains the controls that can be set in a request. If a control is *not* set in the request, then the value used in the most recent previous request must be used, or the current value if it is not found in any outstanding requests. The framework tried to find such a previous request and it would set the 'req' pointer in struct v4l2_ctrl_ref to the v4l2_ctrl_ref of the control in such a previous request. So far, so good. However, when that previous request was applied to the hardware, returned to userspace, and then userspace would re-init or free that request, any 'ref' pointer in still-queued requests would suddenly point to freed memory. This was not noticed before since the drivers that use this expected that each request would always have the controls set, so there was never any need to find a control in older requests. This requirement was relaxed, and now this bug surfaced. It was also made worse by changeset 2fae4d6aab ("media: v4l2-ctrls: v4l2_ctrl_request_complete() should always set ref->req") which increased the chance of this happening. The use of the 'req' pointer in v4l2_ctrl_ref was very fragile, so drop this entirely. Instead add a valid_p_req bool to indicate that p_req contains a valid value for this control. And if it is false, then just use the current value of the control. Note that VIDIOC_G_EXT_CTRLS will always return -EACCES when attempting to get a control from a request until the request is completed. And in that case, all controls in the request will have the control value set (i.e. valid_p_req is true). This means that the whole 'find the most recent previous request containing a control' idea is pointless, and the code can be simplified considerably. The v4l2_g_ext_ctrls_common() function was refactored a bit to make it more understandable. It also avoids updating volatile controls in a completed request since that was already done when the request was completed. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Fixes: 2fae4d6aab ("media: v4l2-ctrls: v4l2_ctrl_request_complete() should always set ref->req") Fixes: 6fa6f831f0 ("media: v4l2-ctrls: add core request support") Cc: <stable@vger.kernel.org> # for v5.9 and up Tested-by: Alexandre Courbot <acourbot@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>		2021-04-15 13:18:09 +02:00
..
acpi	IOMMU Updates for Linux v5.12	2021-02-22 10:31:29 -08:00
asm-generic	RISC-V Patches for the 5.12 Merge Window	2021-02-26 10:28:35 -08:00
clocksource
crypto	Keyrings miscellany	2021-02-23 16:09:23 -08:00
drm	drm/drm_vblank: set the dma-fence timestamp during send_vblank_event	2021-02-24 21:05:54 +05:30
dt-bindings	RISC-V Patches for the 5.12 Merge Window	2021-02-26 10:28:35 -08:00
keys
kunit
kvm
linux	dt-bindings:iio:dac: update microchip,mcp4725.yaml reference	2021-04-06 14:45:03 +02:00
math-emu
media	media: v4l2-ctrls: fix reference to freed memory	2021-04-15 13:18:09 +02:00
memory
misc
net	net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending	2021-02-23 11:29:52 -08:00
pcmcia
ras
rdma	RDMA/ipoib: Remove racy Subnet Manager sendonly join checks	2021-02-16 14:42:58 -04:00
scsi
soc	RISC-V Patches for the 5.12 Merge Window	2021-02-26 10:28:35 -08:00
sound	ALSA/ASoC/SOF/SoundWire: fix Kconfig issues	2021-03-02 18:30:07 +01:00
target	scsi: target: core: Add cmd length set before cmd complete	2021-02-22 22:21:29 -05:00
trace	block-5.12-2021-02-27	2021-02-28 11:23:38 -08:00
uapi	media: v4l: Add HDR10 static metadata controls	2021-04-06 14:56:00 +02:00
vdso
video
xen	xen/events: add per-xenbus device event statistics and settings	2021-02-23 10:07:11 -06:00