[RESEND PATCH v2] media: mtk-jpeg: Fix use after free bug due to uncanceled work

[Zheng Hacker]

Thanks for your patch. I think this should fix the problem. As I have
no experience in reverting, can I submit the patch with your fix as
well as reverting my fix?

Best regards,
Zheng

Dmitry Osipenko <dmitry.osipenko at collabora.com> 于2023年10月20日周五 03:56写道：
>
> On 10/8/23 12:13, Zheng Hacker wrote:
> > Dmitry Osipenko <dmitry.osipenko at collabora.com> 于2023年9月20日周三 02:24写道：
> >>
> >> On 8/31/23 11:18, Zheng Hacker wrote:
> >>>> The v4l2_m2m_ctx_release() already should wait for the job_timeout_work
> >>>> completion or for the interrupt fire. Apparently it doesn't work in
> >>>> yours case. You'll need to debug why v4l job or job_timeout_work is
> >>>> running after v4l2_m2m_ctx_release(), it shouldn't happen.
> >>>>
> >>> Yes, v4l2_m2m_cancel_job waits for m2m_ctx->job_flags to be  ~TRANS_RUNNING,
> >>> the mtk_jpeg_job_timeout_work will finally invoke v4l2_m2m_job_finish
> >>> to trigger that.
> >>>
> >>> However, this is not the only path to call v4l2_m2m_job_finish. Here
> >>> is a invoking chain:
> >>> v4l_streamon
> >>>   ->v4l2_m2m_ioctl_streamon
> >>>     ->v4l2_m2m_streamon
> >>>       ->v4l2_m2m_try_schedule
> >>>         ->v4l2_m2m_try_run
> >>>           ->mtk_jpeg_dec_device_run
> >>>             ->schedule_delayed_work(&jpeg->job_timeout_work...
> >>>             ->error path goto dec_end
> >>>             ->v4l2_m2m_job_finish
> >>>
> >>> In some specific situation, it starts the worker and also calls
> >>> v4l2_m2m_job_finish, which might
> >>> make v4l2_m2m_cancel_job continues.
> >>
> >> Then the error path should cancel the job_timeout_work, or better job
> >> needs to be run after the dec/enc has been started and not before.
> >>
> >
> > Hi,
> >
> > Sorry for my late reply for I just went on a long vacation.
> >
> > Get it. I'll write another patch and change the summary to the lack of
> > canceling job in error path.
> >
> >> Looking further at the code, I'm confused by this hunk:
> >>
> >>         mtk_jpeg_dec_start(comp_jpeg[hw_id]->reg_base);
> >>         v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
> >>
> >> The job should be marked as finished when h/w has finished processing
> >> the job and not right after the job has been started. So the job is
> >> always completed and mtk_jpeg_job_timeout_work() doesn't work as
> >> expected, am I missing something?
> >
> > After reading the code I still don't know. I didn't see any function
> > like mtk_jpeg_dec_end. The same thing
> > happens on mtk_jpeg_enc_start. I think I'd better fix the first
> > problem and wait for someone familiar with
> > the second part.
>
> I missed that the code mentioned above is related to the multi-core hw version, while you care about single-core. Nevertheless, the multi-core device_run() looks incorrect,
>
> So, the error code paths need to be corrected. Please try to revert yours fix and test this change:
>
> diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> index 0051f372a66c..fd3b0587fcad 100644
> --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> @@ -1254,9 +1254,6 @@ static void mtk_jpegdec_worker(struct work_struct *work)
>         v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
>         v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
>
> -       schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work,
> -                             msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
> -
>         mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);
>         if (mtk_jpeg_set_dec_dst(ctx,
>                                  &jpeg_src_buf->dec_param,
> @@ -1266,6 +1263,9 @@ static void mtk_jpegdec_worker(struct work_struct *work)
>                 goto setdst_end;
>         }
>
> +       schedule_delayed_work(&comp_jpeg[hw_id]->job_timeout_work,
> +                             msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
> +
>         spin_lock_irqsave(&comp_jpeg[hw_id]->hw_lock, flags);
>         ctx->total_frame_num++;
>         mtk_jpeg_dec_reset(comp_jpeg[hw_id]->reg_base);
> @@ -1330,13 +1330,13 @@ static void mtk_jpeg_dec_device_run(void *priv)
>         if (ret < 0)
>                 goto dec_end;
>
> -       schedule_delayed_work(&jpeg->job_timeout_work,
> -                             msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
> -
>         mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);
>         if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb))
>                 goto dec_end;
>
> +       schedule_delayed_work(&jpeg->job_timeout_work,
> +                             msecs_to_jiffies(MTK_JPEG_HW_TIMEOUT_MSEC));
> +
>         spin_lock_irqsave(&jpeg->hw_lock, flags);
>         mtk_jpeg_dec_reset(jpeg->reg_base);
>         mtk_jpeg_dec_set_config(jpeg->reg_base,
>
> --
> Best regards,
> Dmitry
>