[V2,0/1] media: change media_device_request_alloc to match media_ioctl_info

Message

Frederic Chen Aug. 6, 2020, 3:58 p.m. UTC

Hello,

This patch is to modify media_device_request_alloc() so that it can pass
CFI(Control Flow Integrity) check. I would like some review comments.

media_device_request_alloc() is saved in fn of media_ioctl_info struct,
which is defined as long (*fn)(struct media_device *dev, void *arg). The
type of the second parameter of media_device_request_alloc() is int* now,
but it is void* in fn of media_ioctl_info. We got some ABI violation here.
Therefore, we would like to use void* instead of int* for the second
parameter of media_device_request_alloc().

static long media_device_request_alloc(struct media_device *mdev,
                                       int *alloc_fd);

struct media_ioctl_info {
        unsigned int cmd;
        unsigned short flags;
        long (*fn)(struct media_device *dev, void *arg);
        long (*arg_from_user)(void *karg, void __user *uarg, unsigned int cmd);
        long (*arg_to_user)(void __user *uarg, void *karg, unsigned int cmd);
};


Here is an example. With Android’s CFI checking, we got the following error
without this change.

[   23.502477] mtk-cam soc:camisp: sd:mtk-cam raw-0 pad:2 set format w/h/code 2328/1748/0x3007
[   23.518690] Kernel panic - not syncing: CFI failure (target: media_device_request_alloc+0x0/0x4)
[   23.519804] CPU: 7 PID: 818 Comm: mtkv4l2_ut Tainted: G S         O      5.4.39-g02c0a4858bed-dirty #45
[   23.521553] Call trace:
[   23.521868]  dump_backtrace.cfi_jt+0x0/0x4
[   23.522389]  dump_stack+0xb8/0x114
[   23.522824]  panic+0x170/0x3e0
[   23.523215]  __ubsan_handle_cfi_check_fail_abort+0x0/0x14
[   23.523896]  perf_proc_update_handler+0x0/0xcc
[   23.524460]  __cfi_check+0x610cc/0x68ef0
[   23.524959]  media_device_ioctl+0x218/0x238
[   23.525488]  media_device_compat_ioctl+0x60/0x7c
[   23.526072]  media_compat_ioctl+0x58/0x9c
[   23.526581]  __arm64_compat_sys_ioctl+0x10c/0x434
[   23.527176]  el0_svc_common+0xb4/0x18c
[   23.527651]  el0_svc_compat_handler+0x1c/0x28
[   23.528202]  el0_svc_compat+0x8/0x24
[   23.528659] SMP: stopping secondary CPUs
[   23.529161] Kernel Offset: 0x24b8c00000 from 0xffffffc010000000
[   23.529906] PHYS_OFFSET: 0xffffffdd00000000
[   23.530434] CPU features: 0x00000006,2a80a238
[   23.530983] Memory Limit: none
PPL_LOG_STORE: check once, sig value 0x27, addr 0x116000.

==================
 Changes in v2
==================
We also removed the type cast in the MEDIA_IOC_ARG define .


Frederic Chen (1):
  media: mc-device.c: change media_device_request_alloc to match
    media_ioctl_info

 drivers/media/mc/mc-device.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)