From: Hans Verkuil hverkuil-cisco@xs4all.nl
stable inclusion from stable-v5.10.219 commit 5103090f4e55252cb1b1a6084da53d63434dc24b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YC89 CVE: CVE-2024-23848
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit 47c82aac10a6954d68f29f10d9758d016e8e5af1 ]
Keep track if cec_claim_log_addrs() is running, and return -EBUSY if it is when calling CEC_ADAP_S_LOG_ADDRS.
This prevents a case where cec_claim_log_addrs() could be called while it was still in progress.
Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Reported-by: Yang, Chenyuan cy54@illinois.edu Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@P... Fixes: ca684386e6e2 ("[media] cec: add HDMI CEC framework (api)") Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org Conflicts: include/media/cec.h [Yongqiang: context fix] Signed-off-by: Yongqiang Liu liuyongqiang13@huawei.com --- drivers/media/cec/cec-adap.c | 6 +++++- drivers/media/cec/cec-api.c | 2 +- include/media/cec.h | 1 + 3 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c index a9b8c6636e50c..5ba3b358c0d56 100644 --- a/drivers/media/cec/cec-adap.c +++ b/drivers/media/cec/cec-adap.c @@ -1481,9 +1481,12 @@ static int cec_config_thread_func(void *arg) */ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block) { - if (WARN_ON(adap->is_configuring || adap->is_configured)) + if (WARN_ON(adap->is_claiming_log_addrs || + adap->is_configuring || adap->is_configured)) return;
+ adap->is_claiming_log_addrs = true; + init_completion(&adap->config_completion);
/* Ready to kick off the thread */ @@ -1497,6 +1500,7 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block) wait_for_completion(&adap->config_completion); mutex_lock(&adap->lock); } + adap->is_claiming_log_addrs = false; }
/* Set a new physical address and send an event notifying userspace of this. diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c index d4c848c2f3764..911b09fe2e17d 100644 --- a/drivers/media/cec/cec-api.c +++ b/drivers/media/cec/cec-api.c @@ -178,7 +178,7 @@ static long cec_adap_s_log_addrs(struct cec_adapter *adap, struct cec_fh *fh, CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU | CEC_LOG_ADDRS_FL_CDC_ONLY; mutex_lock(&adap->lock); - if (!adap->is_configuring && + if (!adap->is_claiming_log_addrs && !adap->is_configuring && (!log_addrs.num_log_addrs || !adap->is_configured) && !cec_is_busy(adap, fh)) { err = __cec_s_log_addrs(adap, &log_addrs, block); diff --git a/include/media/cec.h b/include/media/cec.h index 59bf280e9715c..604149ae0e127 100644 --- a/include/media/cec.h +++ b/include/media/cec.h @@ -171,6 +171,7 @@ struct cec_adapter {
u16 phys_addr; bool needs_hpd; + bool is_claiming_log_addrs; bool is_configuring; bool is_configured; bool cec_pin_is_high;