Hans Verkuil
eb376a62ac
media: vb2: vb2_mmap: move lock up ...
commit cd26d1c4d1bc947b56ae404998ae2276df7b39b7 upstream.
If a filehandle is dup()ped, then it is possible to close it from one fd
and call mmap from the other. This creates a race condition in vb2_mmap
where it is using queue data that __vb2_queue_free (called from close())
is in the process of releasing.
By moving up the mutex_lock(mmap_lock) in vb2_mmap this race is avoided
since __vb2_queue_free is called with the same mutex locked. So vb2_mmap
now reads consistent buffer data.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Reported-by: syzbot+be93025dd45dccd8923c@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-23 08:09:50 +01:00
2019-01-16 22:07:12 +01:00
2018-12-05 19:41:26 +01:00
2018-12-21 14:13:15 +01:00
2018-07-22 14:28:43 +02:00
2018-07-03 11:24:56 +02:00
2019-01-09 17:14:48 +01:00
2019-01-16 22:07:12 +01:00
2018-11-13 11:14:54 -08:00
2018-12-01 09:42:49 +01:00
2018-11-21 09:24:04 +01:00
2019-01-09 17:14:53 +01:00
2019-01-09 17:14:50 +01:00
2018-11-21 09:24:11 +01:00
2018-12-01 09:42:53 +01:00
2018-07-03 11:24:51 +02:00
2019-01-23 08:09:48 +01:00
2018-08-24 13:09:08 +02:00
2018-12-13 09:18:52 +01:00
2018-11-13 11:15:06 -08:00
2018-09-09 19:55:56 +02:00
2018-12-01 09:42:54 +01:00
2019-01-13 10:01:01 +01:00
2019-01-16 22:07:12 +01:00
2019-01-13 10:00:56 +01:00
2019-01-13 10:00:59 +01:00
2018-12-17 09:28:49 +01:00
2019-01-13 10:01:07 +01:00
2019-01-16 22:07:12 +01:00
2018-12-21 14:13:14 +01:00
2018-08-09 12:16:39 +02:00
2018-12-17 09:28:49 +01:00
2019-01-13 10:01:06 +01:00
2019-01-13 10:01:01 +01:00
2019-01-13 10:01:06 +01:00
2018-09-15 09:45:29 +02:00
2019-01-09 17:14:43 +01:00
2018-11-13 11:14:52 -08:00
2018-09-19 22:43:41 +02:00
2018-09-09 19:55:54 +02:00
2019-01-13 10:01:04 +01:00
2019-01-23 08:09:50 +01:00
2018-08-03 07:50:38 +02:00
2019-01-23 08:09:49 +01:00
2019-01-13 10:01:07 +01:00
2019-01-23 08:09:46 +01:00
2019-01-09 17:14:47 +01:00
2019-01-23 08:09:47 +01:00
2018-12-01 09:42:54 +01:00
2018-12-13 09:18:54 +01:00
2018-12-21 14:13:18 +01:00
2018-08-24 13:09:14 +02:00
2019-01-23 08:09:49 +01:00
2018-09-26 08:38:12 +02:00
2018-12-17 09:28:49 +01:00
2018-11-13 11:14:46 -08:00
2018-10-18 09:16:24 +02:00
2018-08-15 18:12:48 +02:00
2019-01-13 10:00:56 +01:00
2018-11-27 16:10:47 +01:00
2019-01-13 10:01:07 +01:00
2018-11-10 07:48:34 -08:00
2018-09-15 09:45:27 +02:00
2018-10-03 17:00:55 -07:00
2018-06-21 04:02:48 +09:00
2018-12-08 13:03:40 +01:00
2018-11-13 11:15:12 -08:00
2019-01-09 17:14:52 +01:00
2019-01-13 10:01:01 +01:00
2018-12-21 14:13:13 +01:00
2019-01-23 08:09:48 +01:00
2018-11-21 09:24:09 +01:00
2019-01-09 17:14:53 +01:00
2019-01-09 17:14:48 +01:00
2019-01-23 08:09:46 +01:00
2018-11-13 11:15:11 -08:00
2018-06-21 04:02:54 +09:00
2018-12-08 13:03:40 +01:00
2019-01-23 08:09:45 +01:00
2018-11-27 16:10:51 +01:00
2019-01-16 22:07:11 +01:00
2018-10-03 17:00:46 -07:00
2018-08-03 07:50:23 +02:00
2019-01-13 10:01:04 +01:00
2019-01-23 08:09:49 +01:00
2018-10-13 09:27:30 +02:00
2018-11-13 11:15:09 -08:00
2018-08-03 07:50:24 +02:00
2018-12-17 09:28:53 +01:00
eb376a62ac