From 9909ce33f91b4ce7e9c61a28dbf91b7b24fd1161 Mon Sep 17 00:00:00 2001 From: Paul Elder Date: Tue, 16 Jun 2020 19:32:34 +0900 Subject: v4l2: v4l2_camera: Clear pending requests on freeBuffers and streamOff V4L2 allows buffer queueing before streamon while libcamera does not. The compatibility layer thus saves these buffers in a pending queue until streamon, and then automatically queues them. However, this pending queue is not cleared when the buffers are freed, so the following sequence of actions will cause a use-after-free: 1. queue buffers 2. free buffers - buffers from 1. stay in pending queue but have been freed 3. queue buffers 4. streamon - buffers from 1. are enqueued, then the buffers from 3. are enqueued. Use-after-free segfault when libcamera tries to handle the enqueued buffers from 1. Fix this by clearing the pending request queue upon buffers being freed. Also clear the pending request queue on streamOff, for correctness. Signed-off-by: Paul Elder Reviewed-by: Jacopo Mondi Reviewed-by: Laurent Pinchart --- src/v4l2/v4l2_camera.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/v4l2') diff --git a/src/v4l2/v4l2_camera.cpp b/src/v4l2/v4l2_camera.cpp index f7df9b85..ffc1230e 100644 --- a/src/v4l2/v4l2_camera.cpp +++ b/src/v4l2/v4l2_camera.cpp @@ -147,6 +147,8 @@ int V4L2Camera::allocBuffers(unsigned int count) void V4L2Camera::freeBuffers() { + pendingRequests_.clear(); + Stream *stream = *camera_->streams().begin(); bufferAllocator_->free(stream); } @@ -188,10 +190,11 @@ int V4L2Camera::streamOn() int V4L2Camera::streamOff() { - /* \todo Restore buffers to reqbufs state? */ if (!isRunning_) return 0; + pendingRequests_.clear(); + int ret = camera_->stop(); if (ret < 0) return ret == -EACCES ? -EBUSY : ret; -- cgit v1.2.1