[PATCH] media: dvb-core: fix race between dvb_dvr_read() and dvb_dvr_set_buffer_size()

[PATCH] media: dvb-core: fix race between dvb_dvr_read() and dvb_dvr_set_buffer_size()

[Cen Zhang (Microsoft)]

dvb_dvr_read() accesses the DVR ring buffer without holding
dmxdev->mutex, while ioctl(DMX_SET_BUFFER_SIZE) replaces the backing
memory of the buffer under that mutex. A concurrent resize can free
the vmalloc region while the reader is still copying from it,
resulting in a use-after-free read.

  BUG: KASAN: vmalloc-out-of-bounds in _copy_to_user+0x4e/0x80

    _copy_to_user+0x4e/0x80
    dvb_ringbuffer_read_user+0x141/0x390 (dvb_ringbuffer.c:151)
    dvb_dmxdev_buffer_read.isra.0+0x310/0x3e0
    dvb_dvr_read+0xc6/0x110
    vfs_read+0x1ac/0x940

This is a re-discovery of an issue noted by the original author:
https://lore.kernel.org/all/47E45138.1030107@googlemail.com/.

Fix by protecting dvb_dvr_read() with dmxdev->mutex.

Fixes: a095be4b030c ("V4L/DVB (7659): dvb-core: Implement DMX_SET_BUFFER_SIZE for dvr")
Cc: stable@vger.kernel.org
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
---
 drivers/media/dvb-core/dmxdev.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 3c8bc75e4d6c..b4aa8d37ff03 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -270,13 +270,23 @@ static ssize_t dvb_dvr_read(struct file *file, char __user *buf, size_t count,
 {
 	struct dvb_device *dvbdev = file->private_data;
 	struct dmxdev *dmxdev = dvbdev->priv;
+	ssize_t ret;
 
-	if (dmxdev->exit)
+	if (mutex_lock_interruptible(&dmxdev->mutex))
+		return -ERESTARTSYS;
+
+	if (dmxdev->exit) {
+		mutex_unlock(&dmxdev->mutex);
 		return -ENODEV;
+	}
+
+	ret = dvb_dmxdev_buffer_read(&dmxdev->dvr_buffer,
+				     file->f_flags & O_NONBLOCK,
+				     buf, count, ppos);
 
-	return dvb_dmxdev_buffer_read(&dmxdev->dvr_buffer,
-				      file->f_flags & O_NONBLOCK,
-				      buf, count, ppos);
+	mutex_unlock(&dmxdev->mutex);
+
+	return ret;
 }
 
 static int dvb_dvr_set_buffer_size(struct dmxdev *dmxdev,
-- 
2.53.0