From patchwork Tue Sep 8 19:45:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Guenter Roeck X-Patchwork-Id: 11764119 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D1F461599 for ; Tue, 8 Sep 2020 19:46:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AF217207DE for ; Tue, 8 Sep 2020 19:46:20 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QThMjlLv" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732121AbgIHTqS (ORCPT ); Tue, 8 Sep 2020 15:46:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732441AbgIHTqF (ORCPT ); Tue, 8 Sep 2020 15:46:05 -0400 Received: from mail-ot1-x341.google.com (mail-ot1-x341.google.com [IPv6:2607:f8b0:4864:20::341]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 46CE1C061573; Tue, 8 Sep 2020 12:46:05 -0700 (PDT) Received: by mail-ot1-x341.google.com with SMTP id 60so264759otw.3; Tue, 08 Sep 2020 12:46:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=JmiVWVDB3TpbnIb/5gCkSZi9W6L4r23R5cfyKL7mkAo=; b=QThMjlLvd5iNXbd9On5sMrcIp9yZfNJse35xtUEnHgvzg6Gxmcr27dqoj5gkYKez1m OCxvkQrdRZmUmhCQF0TQ83rl1NMy2NVd7+cUoTDLJby+IhYgD6hDcKFnzTFPX8AP3Wkf LnaKSn9vvMr5PGuG4x3AmKGJPkrnPNmuFpd5aTK9Vfj420EoWg37CAhk73t7ivAXn3Bt wbZsgSIJdkUjKvVMvHNNdicqXnrKgNyiI7lgf/iXh1Z2RoA7N7g+O1GQCI97TtgHTmuD jacKpRgituabLtjpaz4QQlonRNVW4Cyn6OGRUDuCJ/0bZRtCmajN5RjtkPZN3NNxacLq LIVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=JmiVWVDB3TpbnIb/5gCkSZi9W6L4r23R5cfyKL7mkAo=; b=iYHW4yExnDKQdrWmA0a1fNJLAqjay2rssgyn+BK/jjj3/DivUl6u9eybxFCyl8bIec IJfdUA1KF+Qn1GkjnKB81CxjfY3JDwBGAqMuWXq2W5kc8r7Rm/fssvTzIrM8h0fOIKdb ugVoFIJj01KPYXVEjWJ6Fi2srI3bxCoMhVburzHRLrdPPpfoswQ/8W0+jQxhfZBE/Cni uWlKmQR/IYaku29OJJdLde2K2kRHcxQ2BzUYC3zuuLS0nSFrb4ERg9HvVenx2S19hNCg tY732X6F0XtoGp9uHfnSzH8n5/9epmQG3ilL8ai23z4mE+mlKQZNvQF5bfVITAvQo4F7 CzMg== X-Gm-Message-State: AOAM532EKeweCKB+Ew6bF2NiYsT01YeiOOOU5l5koGL7rNpUsdlxyQqb 2M+attnb49uIijFynKt6h40= X-Google-Smtp-Source: ABdhPJzKwnake8Bgg7vdXO/V5ROgBS7wYgHdU3WNyCWJMT7DpjD1EyWNp+aF2dk3LqalbfLXpBX7pw== X-Received: by 2002:a9d:6492:: with SMTP id g18mr421329otl.331.1599594364674; Tue, 08 Sep 2020 12:46:04 -0700 (PDT) Received: from localhost ([2600:1700:e321:62f0:329c:23ff:fee3:9d7c]) by smtp.gmail.com with ESMTPSA id f50sm31012otf.47.2020.09.08.12.46.03 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Tue, 08 Sep 2020 12:46:04 -0700 (PDT) From: Guenter Roeck To: Laurent Pinchart Cc: Mauro Carvalho Chehab , Sakari Ailus , linux-uvc-devel@lists.sourceforge.net, linux-usb@vger.kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Guenter Roeck , Alan Stern , Hans Verkuil Subject: [PATCH v2 1/5] media: uvcvideo: Cancel async worker earlier Date: Tue, 8 Sep 2020 12:45:53 -0700 Message-Id: <20200908194557.198335-2-linux@roeck-us.net> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200908194557.198335-1-linux@roeck-us.net> References: <20200908194557.198335-1-linux@roeck-us.net> Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org So far the asynchronous control worker was canceled only in uvc_ctrl_cleanup_device. This is much later than the call to uvc_disconnect. However, after the call to uvc_disconnect returns, there must be no more USB activity. This can result in all kinds of problems in the USB code. One observed example: URB ffff993e83d0bc00 submitted while active WARNING: CPU: 0 PID: 4046 at drivers/usb/core/urb.c:364 usb_submit_urb+0x4ba/0x55e Modules linked in: <...> CPU: 0 PID: 4046 Comm: kworker/0:35 Not tainted 4.19.139 #18 Hardware name: Google Phaser/Phaser, BIOS Google_Phaser.10952.0.0 08/09/2018 Workqueue: events uvc_ctrl_status_event_work [uvcvideo] RIP: 0010:usb_submit_urb+0x4ba/0x55e Code: <...> RSP: 0018:ffffb08d471ebde8 EFLAGS: 00010246 RAX: a6da85d923ea5d00 RBX: ffff993e71985928 RCX: 0000000000000000 RDX: ffff993f37a1de90 RSI: ffff993f37a153d0 RDI: ffff993f37a153d0 RBP: ffffb08d471ebe28 R08: 000000000000003b R09: 001424bf85822e96 R10: 0000001000000000 R11: ffffffff975a4398 R12: ffff993e83d0b000 R13: ffff993e83d0bc00 R14: 0000000000000000 R15: 00000000fffffff0 FS: 0000000000000000(0000) GS:ffff993f37a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000ec9c0000 CR3: 000000025b160000 CR4: 0000000000340ef0 Call Trace: uvc_ctrl_status_event_work+0xd6/0x107 [uvcvideo] process_one_work+0x19b/0x4c5 worker_thread+0x10d/0x286 kthread+0x138/0x140 ? process_one_work+0x4c5/0x4c5 ? kthread_associate_blkcg+0xc1/0xc1 ret_from_fork+0x1f/0x40 Introduce new function uvc_ctrl_stop_device() to cancel the worker and call it from uvc_unregister_video() to solve the problem. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Signed-off-by: Guenter Roeck --- v2: No change drivers/media/usb/uvc/uvc_ctrl.c | 11 +++++++---- drivers/media/usb/uvc/uvc_driver.c | 1 + drivers/media/usb/uvc/uvcvideo.h | 1 + 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index e399b9fad757..130c56e0063d 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -2340,14 +2340,17 @@ static void uvc_ctrl_cleanup_mappings(struct uvc_device *dev, } } -void uvc_ctrl_cleanup_device(struct uvc_device *dev) +void uvc_ctrl_stop_device(struct uvc_device *dev) { - struct uvc_entity *entity; - unsigned int i; - /* Can be uninitialized if we are aborting on probe error. */ if (dev->async_ctrl.work.func) cancel_work_sync(&dev->async_ctrl.work); +} + +void uvc_ctrl_cleanup_device(struct uvc_device *dev) +{ + struct uvc_entity *entity; + unsigned int i; /* Free controls and control mappings for all entities. */ list_for_each_entry(entity, &dev->entities, list) { diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index 431d86e1c94b..bfba67a69185 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1952,6 +1952,7 @@ static void uvc_unregister_video(struct uvc_device *dev) } uvc_status_unregister(dev); + uvc_ctrl_stop_device(dev); if (dev->vdev.dev) v4l2_device_unregister(&dev->vdev); diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index 6ab972c643e3..543afcd9fd26 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -830,6 +830,7 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain, int uvc_ctrl_add_mapping(struct uvc_video_chain *chain, const struct uvc_control_mapping *mapping); int uvc_ctrl_init_device(struct uvc_device *dev); +void uvc_ctrl_stop_device(struct uvc_device *dev); void uvc_ctrl_cleanup_device(struct uvc_device *dev); int uvc_ctrl_restore_values(struct uvc_device *dev); bool uvc_ctrl_status_event(struct urb *urb, struct uvc_video_chain *chain, From patchwork Tue Sep 8 19:45:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Guenter Roeck X-Patchwork-Id: 11764135 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9B98415E4 for ; Tue, 8 Sep 2020 19:47:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7CD85207DE for ; Tue, 8 Sep 2020 19:47:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="n657yzjo" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732447AbgIHTqU (ORCPT ); Tue, 8 Sep 2020 15:46:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33476 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732143AbgIHTqH (ORCPT ); Tue, 8 Sep 2020 15:46:07 -0400 Received: from mail-oi1-x244.google.com (mail-oi1-x244.google.com [IPv6:2607:f8b0:4864:20::244]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D6A01C061755; Tue, 8 Sep 2020 12:46:06 -0700 (PDT) Received: by mail-oi1-x244.google.com with SMTP id u126so17586118oif.13; Tue, 08 Sep 2020 12:46:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=Y37AOa3G4QMcyk1Wx1haiDnAcKZ7oI5qI1U1eVD/2Y8=; b=n657yzjoNd6tmxK11OuetuCi+f1J7zuGkbGspUrtUhjbVbBi7tJhGtYoa56vqCCx3X Ytp3O+at5CDjEq+xu0T0FtJGzodnobliMeg1M4gzmaMlfoN6M+z57YQwnoat5zFEeGAX cqfimUTLvEcyPJVBPN/o7gIUsfhwybTdjgRaCDSV8jlcCZpOWM5Xgm8pGKZsG85KlV2z AFDGMsAYRu1ToGqugfugvJ2jTBfk9P8w4Kwo+Jyp6QxE2W5mwXD0RMlnZWNoUMFDWUML JW6NspubSAm/Xtqiy1eEf/w4bo0oQCZUwKDrsYuOba/wzNWh74jJsxZoL6ul+1WiVg9V AJCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=Y37AOa3G4QMcyk1Wx1haiDnAcKZ7oI5qI1U1eVD/2Y8=; b=Tf0dKS8zIVYgxBNuCa7DTC0wCWdjaAb0lzbVx74mAEOxG8Q7s4LdDue9ga0NJiqzjq ls5Bu6Svm+J6QRHPOoU18+ldspRyswEWY4FVDt8gv+WUXCIDvjMI99cp1pPQbrMT4ZoE YLw/nS28ohvX2cPIswPxstfiHX1J8hhohQA9Xk9kciSZlWYyg9wgRSDFFYDVzBZUhAqh +Udj5rBMcyF8upbB5nYoV11eflLe4IvPumLVzin5dp7bKJvK7q47wUHf+RvA4AYi1ngU ayAcsX7Gl02qia3ptqqDzsL+yxLOXnbvFvvtYh3P0g2fC9aLS6YRLyFySPYG0LfPYJ2P ESeQ== X-Gm-Message-State: AOAM531f6eHmLgA/5zhs9LjN8egPMcaclRcbFTb+M1vJm+OUtkYC9Jv0 LKmPF1fVr/U6CpM5ezxjMdU= X-Google-Smtp-Source: ABdhPJzcv6b2lbC07AT25hZ4YE5HQblKPRkOajG7TH6QGVXwozUfU0gMW9i0rxvla+qv0bOpvczVyw== X-Received: by 2002:a05:6808:9a9:: with SMTP id e9mr416156oig.114.1599594366221; Tue, 08 Sep 2020 12:46:06 -0700 (PDT) Received: from localhost ([2600:1700:e321:62f0:329c:23ff:fee3:9d7c]) by smtp.gmail.com with ESMTPSA id t107sm33694otb.27.2020.09.08.12.46.05 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Tue, 08 Sep 2020 12:46:05 -0700 (PDT) From: Guenter Roeck To: Laurent Pinchart Cc: Mauro Carvalho Chehab , Sakari Ailus , linux-uvc-devel@lists.sourceforge.net, linux-usb@vger.kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Guenter Roeck , Alan Stern , Hans Verkuil Subject: [PATCH v2 2/5] media: uvcvideo: Lock video streams and queues while unregistering Date: Tue, 8 Sep 2020 12:45:54 -0700 Message-Id: <20200908194557.198335-3-linux@roeck-us.net> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200908194557.198335-1-linux@roeck-us.net> References: <20200908194557.198335-1-linux@roeck-us.net> Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The call to uvc_disconnect() is not protected by any mutex. This means it can and will be called while other accesses to the video device are in progress. This can cause all kinds of race conditions, including crashes such as the following. usb 1-4: USB disconnect, device number 3 BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 5633 Comm: V4L2CaptureThre Not tainted 4.19.113-08536-g5d29ca36db06 #1 Hardware name: GOOGLE Edgar, BIOS Google_Edgar.7287.167.156 03/25/2019 RIP: 0010:usb_ifnum_to_if+0x29/0x40 Code: <...> RSP: 0018:ffffa46f42a47a80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff904a396c9000 RDX: ffff904a39641320 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffa46f42a47a80 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000000009975 R11: 0000000000000009 R12: 0000000000000000 R13: ffff904a396b3800 R14: ffff904a39e88000 R15: 0000000000000000 FS: 00007f396448e700(0000) GS:ffff904a3ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000016cb46000 CR4: 00000000001006f0 Call Trace: usb_hcd_alloc_bandwidth+0x1ee/0x30f usb_set_interface+0x1a3/0x2b7 uvc_video_start_transfer+0x29b/0x4b8 [uvcvideo] uvc_video_start_streaming+0x91/0xdd [uvcvideo] uvc_start_streaming+0x28/0x5d [uvcvideo] vb2_start_streaming+0x61/0x143 [videobuf2_common] vb2_core_streamon+0xf7/0x10f [videobuf2_common] uvc_queue_streamon+0x2e/0x41 [uvcvideo] uvc_ioctl_streamon+0x42/0x5c [uvcvideo] __video_do_ioctl+0x33d/0x42a video_usercopy+0x34e/0x5ff ? video_ioctl2+0x16/0x16 v4l2_ioctl+0x46/0x53 do_vfs_ioctl+0x50a/0x76f ksys_ioctl+0x58/0x83 __x64_sys_ioctl+0x1a/0x1e do_syscall_64+0x54/0xde usb_set_interface() should not be called after the USB device has been unregistered. However, in the above case the disconnect happened after v4l2_ioctl() was called, but before the call to usb_ifnum_to_if(). Acquire various mutexes in uvc_unregister_video() to fix the majority (maybe all) of the observed race conditions. The uvc_device lock prevents races against suspend and resume calls and the poll function. The uvc_streaming lock prevents races against stream related functions; for the most part, those are ioctls. This lock also requires other functions using this lock to check if a video device is still registered after acquiring it. For example, it was observed that the video device was already unregistered by the time the stream lock was acquired in uvc_ioctl_streamon(). The uvc_queue lock prevents races against queue functions, Most of those are already protected by the uvc_streaming lock, but some are called directly. This is done as added protection; an actual race was not (yet) observed. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Signed-off-by: Guenter Roeck --- v2: No change drivers/media/usb/uvc/uvc_driver.c | 9 +++++++ drivers/media/usb/uvc/uvc_v4l2.c | 39 +++++++++++++++++++++++++++++- 2 files changed, 47 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index bfba67a69185..a5808305f1e3 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1941,14 +1941,22 @@ static void uvc_unregister_video(struct uvc_device *dev) { struct uvc_streaming *stream; + mutex_lock(&dev->lock); + list_for_each_entry(stream, &dev->streams, list) { if (!video_is_registered(&stream->vdev)) continue; + mutex_lock(&stream->mutex); + mutex_lock(&stream->queue.mutex); + video_unregister_device(&stream->vdev); video_unregister_device(&stream->meta.vdev); uvc_debugfs_cleanup_stream(stream); + + mutex_unlock(&stream->queue.mutex); + mutex_unlock(&stream->mutex); } uvc_status_unregister(dev); @@ -1960,6 +1968,7 @@ static void uvc_unregister_video(struct uvc_device *dev) if (media_devnode_is_registered(dev->mdev.devnode)) media_device_unregister(&dev->mdev); #endif + mutex_unlock(&dev->lock); } int uvc_register_video_device(struct uvc_device *dev, diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 0335e69b70ab..7e5e583dae5e 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -237,6 +237,12 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream, * the Windows driver). */ mutex_lock(&stream->mutex); + if (!video_is_registered(&stream->vdev)) { + mutex_unlock(&stream->mutex); + ret = -ENODEV; + goto done; + } + if (stream->dev->quirks & UVC_QUIRK_PROBE_EXTRAFIELDS) probe->dwMaxVideoFrameSize = stream->ctrl.dwMaxVideoFrameSize; @@ -274,6 +280,12 @@ static int uvc_v4l2_get_format(struct uvc_streaming *stream, return -EINVAL; mutex_lock(&stream->mutex); + + if (!video_is_registered(&stream->vdev)) { + ret = -ENODEV; + goto done; + } + format = stream->cur_format; frame = stream->cur_frame; @@ -312,6 +324,11 @@ static int uvc_v4l2_set_format(struct uvc_streaming *stream, mutex_lock(&stream->mutex); + if (!video_is_registered(&stream->vdev)) { + ret = -ENODEV; + goto done; + } + if (uvc_queue_allocated(&stream->queue)) { ret = -EBUSY; goto done; @@ -387,6 +404,11 @@ static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream, mutex_lock(&stream->mutex); + if (!video_is_registered(&stream->vdev)) { + mutex_unlock(&stream->mutex); + return -ENODEV; + } + if (uvc_queue_streaming(&stream->queue)) { mutex_unlock(&stream->mutex); return -EBUSY; @@ -713,6 +735,10 @@ static int uvc_ioctl_reqbufs(struct file *file, void *fh, return ret; mutex_lock(&stream->mutex); + if (!video_is_registered(&stream->vdev)) { + mutex_unlock(&stream->mutex); + return -ENODEV; + } ret = uvc_request_buffers(&stream->queue, rb); mutex_unlock(&stream->mutex); if (ret < 0) @@ -797,7 +823,12 @@ static int uvc_ioctl_streamon(struct file *file, void *fh, return -EBUSY; mutex_lock(&stream->mutex); + if (!video_is_registered(&stream->vdev)) { + ret = -ENODEV; + goto unlock; + } ret = uvc_queue_streamon(&stream->queue, type); +unlock: mutex_unlock(&stream->mutex); return ret; @@ -808,15 +839,21 @@ static int uvc_ioctl_streamoff(struct file *file, void *fh, { struct uvc_fh *handle = fh; struct uvc_streaming *stream = handle->stream; + int ret = 0; if (!uvc_has_privileges(handle)) return -EBUSY; mutex_lock(&stream->mutex); + if (!video_is_registered(&stream->vdev)) { + ret = -ENODEV; + goto unlock; + } uvc_queue_streamoff(&stream->queue, type); +unlock: mutex_unlock(&stream->mutex); - return 0; + return ret; } static int uvc_ioctl_enum_input(struct file *file, void *fh, From patchwork Tue Sep 8 19:45:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Guenter Roeck X-Patchwork-Id: 11764131 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B069359D for ; Tue, 8 Sep 2020 19:47:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8CABB2145D for ; Tue, 8 Sep 2020 19:47:49 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Gzwxbpfu" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732428AbgIHTqW (ORCPT ); Tue, 8 Sep 2020 15:46:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33482 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731669AbgIHTqJ (ORCPT ); Tue, 8 Sep 2020 15:46:09 -0400 Received: from mail-ot1-x344.google.com (mail-ot1-x344.google.com [IPv6:2607:f8b0:4864:20::344]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6828AC061756; Tue, 8 Sep 2020 12:46:08 -0700 (PDT) Received: by mail-ot1-x344.google.com with SMTP id 60so264900otw.3; Tue, 08 Sep 2020 12:46:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=R4o90DJRIMo4vx0ZN35Oj1htaD4YzPST5CK/AWBPOL4=; b=GzwxbpfuITLqbrgw/jqq6v0Rb5gAwJa+PReXvCUY6TKa0ltHRZrwDDJFXDE7hai7EM 37xGkwEZsS5NFq7q5TeeMMhHBcRy+9CDkKg+UOxqhVxBKRHdqnbHsFrO0ETpLmYHT/RE 75COCCfjaK7x5Tj1eH7+c37m5mkLa8TPcLnAzWLNoeeLO8JuOhj2ItXEm1sBO1Os3fVc oTuOqNjtG/DL15Q0VKJemPTupCPBYAA8XLqTP5bKMFZVmwXJwWwrjiG6hBEApKE0a8aE aPXOO+sf5q/Wj0RNfgG1usajNo4Y/IN7c317LM+rf/0EgfkhRUzXJZhSJ8/JWzn47EjE vzmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=R4o90DJRIMo4vx0ZN35Oj1htaD4YzPST5CK/AWBPOL4=; b=O97X27xP+RmQr7KMkG1lTkvHvoJSl76k3bS0+i9e2gkJHcHiRwvr3snMs2pnnY0gDv P/sf+7doDvx2kArWHhPXQ0dQXUK8Wa83BO+pR4A2y2FdaGPKcWsILH3HaCMDdYQ4HNSM 0usJaMXdYZp1lR0CUwJrSta6bze8kQJZM0G9Dq+h0ZKY47qe2V0fib4Ul1Re/4iUU4Om S0I9pqs8lX81DtYg6cOJbcZdB2tEGAYA3XCK8mdr13ycrDSezqF3+rhV3vKXEJKsviGF cmY09HM3BqzP6VyOsfsc0nenkellBDHy5K+J/Qgi0XiUy5ONrRGXxEiSu2dwZmMYRP0s tDOw== X-Gm-Message-State: AOAM5331BWegJC1pdC52JSkWW0CQqYQoNJYpffUruIuHiS3TBeZGOZmh jQF+zbUj5nTiO2P+D1G8/cc= X-Google-Smtp-Source: ABdhPJzf8VAeeueLEtTfYJnUxfyRGYu2KTfv7tpSaefRvJ77/lBojaemGZkVIYETMnNEvCvBHXhOwA== X-Received: by 2002:a9d:67d0:: with SMTP id c16mr451629otn.347.1599594367765; Tue, 08 Sep 2020 12:46:07 -0700 (PDT) Received: from localhost ([2600:1700:e321:62f0:329c:23ff:fee3:9d7c]) by smtp.gmail.com with ESMTPSA id k19sm32216otb.45.2020.09.08.12.46.07 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Tue, 08 Sep 2020 12:46:07 -0700 (PDT) From: Guenter Roeck To: Laurent Pinchart Cc: Mauro Carvalho Chehab , Sakari Ailus , linux-uvc-devel@lists.sourceforge.net, linux-usb@vger.kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Guenter Roeck , Alan Stern , Hans Verkuil Subject: [PATCH v2 3/5] media: uvcvideo: Release stream queue when unregistering video device Date: Tue, 8 Sep 2020 12:45:55 -0700 Message-Id: <20200908194557.198335-4-linux@roeck-us.net> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200908194557.198335-1-linux@roeck-us.net> References: <20200908194557.198335-1-linux@roeck-us.net> Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The following traceback was observed when stress testing the uvcvideo driver. config->interface[0] is NULL WARNING: CPU: 0 PID: 2757 at drivers/usb/core/usb.c:285 usb_ifnum_to_if+0x81/0x85 ^^^ added log message and WARN() to prevent crash Modules linked in: <...> CPU: 0 PID: 2757 Comm: inotify_reader Not tainted 4.19.139 #20 Hardware name: Google Phaser/Phaser, BIOS Google_Phaser.10952.0.0 08/09/2018 RIP: 0010:usb_ifnum_to_if+0x81/0x85 Code: <...> RSP: 0018:ffff9ee20141fa58 EFLAGS: 00010246 RAX: 438a0e5a525f1800 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff975477a1de90 RSI: ffff975477a153d0 RDI: ffff975477a153d0 RBP: ffff9ee20141fa70 R08: 000000000000002c R09: 002daec189138d78 R10: 0000001000000000 R11: ffffffffa7da42e6 R12: ffff975459594800 R13: 0000000000000001 R14: 0000000000000001 R15: ffff975465376400 FS: 00007ddebffd6700(0000) GS:ffff975477a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000012c83000 CR3: 00000001bbaf8000 CR4: 0000000000340ef0 Call Trace: usb_set_interface+0x3b/0x2f3 uvc_video_stop_streaming+0x38/0x81 [uvcvideo] uvc_stop_streaming+0x21/0x49 [uvcvideo] __vb2_queue_cancel+0x33/0x249 [videobuf2_common] vb2_core_queue_release+0x1c/0x45 [videobuf2_common] uvc_queue_release+0x26/0x32 [uvcvideo] uvc_v4l2_release+0x41/0xdd [uvcvideo] v4l2_release+0x99/0xed __fput+0xf0/0x1ea task_work_run+0x7f/0xa7 do_exit+0x1d1/0x6eb do_group_exit+0x9d/0xac get_signal+0x135/0x482 do_signal+0x4a/0x63c exit_to_usermode_loop+0x86/0xa5 do_syscall_64+0x171/0x269 ? __do_page_fault+0x272/0x474 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7ddec156dc26 Code: Bad RIP value. RSP: 002b:00007ddebffd5c10 EFLAGS: 00000293 ORIG_RAX: 0000000000000017 RAX: fffffffffffffdfe RBX: 000000000000000a RCX: 00007ddec156dc26 RDX: 0000000000000000 RSI: 00007ddebffd5d28 RDI: 000000000000000a RBP: 00007ddebffd5c50 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 00007ddebffd5d28 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 When this was observed, a USB disconnect was in progress, uvc_disconnect() had returned, but usb_disable_device() was still running. Drivers are not supposed to call any USB functions after the driver disconnect function has been called. The uvcvideo driver does not follow that convention and tries to write to the disconnected USB interface anyway. This results in a variety of race conditions. To solve this specific problem, release the uvc queue from uvc_unregister_video() after the associated video devices have been unregistered. Since the function already holds the uvc queue mutex, bypass uvc_queue_release() and call vb2_queue_release() directly. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Signed-off-by: Guenter Roeck --- v2: No change drivers/media/usb/uvc/uvc_driver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index a5808305f1e3..27b72806b9b9 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1955,6 +1955,8 @@ static void uvc_unregister_video(struct uvc_device *dev) uvc_debugfs_cleanup_stream(stream); + vb2_queue_release(&stream->queue.queue); + mutex_unlock(&stream->queue.mutex); mutex_unlock(&stream->mutex); } From patchwork Tue Sep 8 19:45:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Guenter Roeck X-Patchwork-Id: 11764123 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C87AC59D for ; Tue, 8 Sep 2020 19:47:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AC8EA21741 for ; Tue, 8 Sep 2020 19:47:24 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eKu/N0u3" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732464AbgIHTqY (ORCPT ); Tue, 8 Sep 2020 15:46:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33490 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731941AbgIHTqK (ORCPT ); Tue, 8 Sep 2020 15:46:10 -0400 Received: from mail-ot1-x341.google.com (mail-ot1-x341.google.com [IPv6:2607:f8b0:4864:20::341]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB5D3C061573; Tue, 8 Sep 2020 12:46:09 -0700 (PDT) Received: by mail-ot1-x341.google.com with SMTP id y5so255943otg.5; Tue, 08 Sep 2020 12:46:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=Ppa+VFlA0URsOyfSfA/7zkYsruytaIg7Y/lMhDsaJoU=; b=eKu/N0u39OquTX3D0Rgot+H8qc5szZqDlLFTyc4nK3vUUd8pr6x2qm3jQL/X/viA0t 0iZ+KXureb+iNlUdW/u6Iyq1PW/BflC85aHLXV4MDeQtZuvdU4p1Tnn4ocV6YJfXly68 YltOIb5Hjnth3FAvlb/JUxV6WJkkKPM33MQu/B3dGs9+h3reiqzH8ixsHAaJex1PI4kP WQ5IPRyhWWdoaLgIGxxkqCL6m1udEAV36KLfV+2yomWGGsCJiDjFOFoBf+3xxT97nXjZ IK22HxxA0sMR6xD6MgN5x153onZ8+7nKr8bL72u0TX3dN19SNIBUUTMTzvZIH9lJFI69 Rj8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=Ppa+VFlA0URsOyfSfA/7zkYsruytaIg7Y/lMhDsaJoU=; b=jKbP9e1WVKkR5ooyMV+wS1i2BMUcjlaF/F/KIPSk6QL/y4/VPJoBgRC74pDBScc1io RTJ6W4fB0hssKO5kMMuC3uxtbRwdcV1kk2HGGN0/eyB16zvR2foo6vthhztgQ5to99Gg itRnlHISpFzqvVXyA9hQ7+CgBCbHLJgVWvkVtnwUZ+LoUtkQQUzLOxJwLJf/Qh0HzjBk 6o+d4Dloq8h+p2nqG3vJrmqPhwhKJbGbXf0umberNf3yF0mIi6CQCv9nWTqUJlhAcEOH 2TQzj1VOdOr+xNaOOCSZBkhzPc21jc3UFHBCtt1uD80B5VEE83OGc4M2owJULoi/WvsM rgAQ== X-Gm-Message-State: AOAM533Mo3afKOHuVRZWiCZqAhh2vo5+x5oYxpwJoL1XwSi4iEon9gNA nfBXlRy55LwnoGGv9udXcVs= X-Google-Smtp-Source: ABdhPJyEpajpIfdBDo4ccv6sfhyDIcoUR1YDEdSFH0ObeXczmyOux4lumesGfNl663FjvCdM+TS1Ew== X-Received: by 2002:a9d:850:: with SMTP id 74mr501171oty.29.1599594369252; Tue, 08 Sep 2020 12:46:09 -0700 (PDT) Received: from localhost ([2600:1700:e321:62f0:329c:23ff:fee3:9d7c]) by smtp.gmail.com with ESMTPSA id 92sm31995ota.38.2020.09.08.12.46.08 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Tue, 08 Sep 2020 12:46:08 -0700 (PDT) From: Guenter Roeck To: Laurent Pinchart Cc: Mauro Carvalho Chehab , Sakari Ailus , linux-uvc-devel@lists.sourceforge.net, linux-usb@vger.kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Guenter Roeck , Alan Stern , Hans Verkuil Subject: [PATCH v2 4/5] media: uvcvideo: Protect uvc queue file operations against disconnect Date: Tue, 8 Sep 2020 12:45:56 -0700 Message-Id: <20200908194557.198335-5-linux@roeck-us.net> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200908194557.198335-1-linux@roeck-us.net> References: <20200908194557.198335-1-linux@roeck-us.net> Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org uvc queue file operations have no mutex protection against USB disconnect. This is questionable at least for the poll operation, which has to wait for the uvc queue mutex. By the time that mutex has been acquired, is it possible that the video device has been unregistered. Protect all file operations by using the queue mutex to avoid possible race conditions. After acquiring the mutex, check if the video device is still registered, and bail out if not. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Signed-off-by: Guenter Roeck --- v2: Return EPOLLERR instead of -ENODEV on poll errors drivers/media/usb/uvc/uvc_queue.c | 32 +++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c index cd60c6c1749e..b2c59ce38008 100644 --- a/drivers/media/usb/uvc/uvc_queue.c +++ b/drivers/media/usb/uvc/uvc_queue.c @@ -358,24 +358,52 @@ int uvc_queue_streamoff(struct uvc_video_queue *queue, enum v4l2_buf_type type) int uvc_queue_mmap(struct uvc_video_queue *queue, struct vm_area_struct *vma) { - return vb2_mmap(&queue->queue, vma); + struct uvc_streaming *stream = uvc_queue_to_stream(queue); + int ret; + + mutex_lock(&queue->mutex); + if (!video_is_registered(&stream->vdev)) { + ret = -ENODEV; + goto unlock; + } + ret = vb2_mmap(&queue->queue, vma); +unlock: + mutex_unlock(&queue->mutex); + return ret; } #ifndef CONFIG_MMU unsigned long uvc_queue_get_unmapped_area(struct uvc_video_queue *queue, unsigned long pgoff) { - return vb2_get_unmapped_area(&queue->queue, 0, 0, pgoff, 0); + struct uvc_streaming *stream = uvc_queue_to_stream(queue); + unsigned long ret; + + mutex_lock(&queue->mutex); + if (!video_is_registered(&stream->vdev)) { + ret = -ENODEV; + goto unlock; + } + ret = vb2_get_unmapped_area(&queue->queue, 0, 0, pgoff, 0); +unlock: + mutex_unlock(&queue->mutex); + return ret; } #endif __poll_t uvc_queue_poll(struct uvc_video_queue *queue, struct file *file, poll_table *wait) { + struct uvc_streaming *stream = uvc_queue_to_stream(queue); __poll_t ret; mutex_lock(&queue->mutex); + if (!video_is_registered(&stream->vdev)) { + ret = EPOLLERR; + goto unlock; + } ret = vb2_poll(&queue->queue, file, wait); +unlock: mutex_unlock(&queue->mutex); return ret; From patchwork Tue Sep 8 19:45:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Guenter Roeck X-Patchwork-Id: 11764127 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 12FD81599 for ; Tue, 8 Sep 2020 19:47:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EAC7A2145D for ; Tue, 8 Sep 2020 19:47:46 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="q6JsxEBf" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732459AbgIHTqX (ORCPT ); Tue, 8 Sep 2020 15:46:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33500 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730656AbgIHTqM (ORCPT ); Tue, 8 Sep 2020 15:46:12 -0400 Received: from mail-oo1-xc42.google.com (mail-oo1-xc42.google.com [IPv6:2607:f8b0:4864:20::c42]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0981C061757; Tue, 8 Sep 2020 12:46:11 -0700 (PDT) Received: by mail-oo1-xc42.google.com with SMTP id r10so30741oor.5; Tue, 08 Sep 2020 12:46:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=sB5cXzWSwS8xZ3/r8jsVyeeT+zbo9/MGNsGrKz2xEhE=; b=q6JsxEBfFsN852oOLbFZceYKHBIQK84dqs1vWfUDcU9FsLwmxPaAmYJg0hra091o6F 3Ip2BlbfsiKxpuoOxLCXyaC5+iG4FNLalgIn+7TmiMF6dFpWKE/3l//H+FMa/eKtdjQV b2t1KH73I1X8UOrAuB+6HwjDF9LeD7RXUtfzjOyCWm0RkZYVSGyuJ0201il+U2kVtKSb WAUWqQfnmy5FeHo1KRPtKIbGM6U1/y6NqID4cjs+7MX6jSHD6qN4b0vmLOEgUCJbtkZq Ufnqd7jlpG9qbMGL6wys7ddC/vUGPKq7BXnSDTT5zxUmA0K3l0HXWuIe5w0WKt7RLew3 zi8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=sB5cXzWSwS8xZ3/r8jsVyeeT+zbo9/MGNsGrKz2xEhE=; b=GWal8wIu0N+Q4mouzhZzucYoMdGmOGkqVqUF8eOc1fgI/Yktv6IzgKkBqiLHCNdqEL d1wD5EamdUR2IvqhDtc75Hfqiku8Kc0kWBu8VnIKZ0nBQRvDCKmWhhTbvHEyiOex4lAW 0xGYm2CHzX9tAfLFQIJd20RYo3rKNLOimnASTUL+NsfD3DqcxWc+Fxly/CnS7jsSH8Da nOZYXt1pnD4g6iuQZRec+hFXwpm9H5E/ySvyExZbuQjBkYNs8gsCgJMKQVtjM9wzfny2 pz1EC0vVRwgHc1gzbHtgeAIfmAT6c+xc1K606LfIU0SWau+Kc1K+qna2Ws70gqYIWy+v GWJQ== X-Gm-Message-State: AOAM533xJnoNSBAs5Vr68ev3bx5Irx+LmkuVldw9yHxrusGrHqMr7AU6 k1DhtazUQO8BMUPPSbnyFyg= X-Google-Smtp-Source: ABdhPJwaavyJz3F8NhRPdRYQHTMWe9HkuD/34zNDgHToIdid7v1qQ0w4/fYa9Ra8+cZM3P48DW8fmg== X-Received: by 2002:a4a:5258:: with SMTP id d85mr197181oob.72.1599594370867; Tue, 08 Sep 2020 12:46:10 -0700 (PDT) Received: from localhost ([2600:1700:e321:62f0:329c:23ff:fee3:9d7c]) by smtp.gmail.com with ESMTPSA id z16sm31422oth.43.2020.09.08.12.46.10 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Tue, 08 Sep 2020 12:46:10 -0700 (PDT) From: Guenter Roeck To: Laurent Pinchart Cc: Mauro Carvalho Chehab , Sakari Ailus , linux-uvc-devel@lists.sourceforge.net, linux-usb@vger.kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Guenter Roeck , Alan Stern , Hans Verkuil Subject: [PATCH v2 5/5] media: uvcvideo: Abort uvc_v4l2_open if video device is unregistered Date: Tue, 8 Sep 2020 12:45:57 -0700 Message-Id: <20200908194557.198335-6-linux@roeck-us.net> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200908194557.198335-1-linux@roeck-us.net> References: <20200908194557.198335-1-linux@roeck-us.net> Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org uvc_v4l2_open() acquires the uvc device mutex. After doing so, it does not check if the video device is still registered. This may result in race conditions and can result in an attempt to submit an urb to a disconnected USB interface (from uvc_status_start). The problem was observed after adding a call to msleep() just before acquiring the mutex and disconnecting the camera during the sleep. Check if the video device is still registered after acquiring the mutex to avoid the problem. In the release function, only call uvc_status_stop() if the video device is still registered. If the video device has been unregistered, the urb associated with uvc status has already been killed in uvc_status_unregister(). Trying to kill it again won't do any good and might have unexpected side effects. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Signed-off-by: Guenter Roeck Reported-by: kernel test robot Reported-by: Dan Carpenter --- v2: Fix typo in description. The USB message is sent from uvc_status_start() in the open function, not from uvc_v4l2_open(). drivers/media/usb/uvc/uvc_v4l2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 7e5e583dae5e..1f7d454557b9 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -548,6 +548,10 @@ static int uvc_v4l2_open(struct file *file) } mutex_lock(&stream->dev->lock); + if (!video_is_registered(&stream->vdev)) { + mutex_unlock(&stream->dev->lock); + return -ENODEV; + } if (stream->dev->users == 0) { ret = uvc_status_start(stream->dev, GFP_KERNEL); if (ret < 0) { @@ -590,7 +594,7 @@ static int uvc_v4l2_release(struct file *file) file->private_data = NULL; mutex_lock(&stream->dev->lock); - if (--stream->dev->users == 0) + if (--stream->dev->users == 0 && video_is_registered(&stream->vdev)) uvc_status_stop(stream->dev); mutex_unlock(&stream->dev->lock);