[PATCH] media: v4l2-event: limit number of event subscriptions per file handle

[Cen Zhang (Microsoft)]

v4l2_event_subscribe() allows an unbounded number of event subscriptions
per file handle. Since the subscription id field is fully user-controlled
(32-bit), an unprivileged user with access to a V4L2 device node can
create up to 2^32 distinct subscriptions, each pinning a kernel
allocation (~200 bytes). This can exhaust kernel memory, causing an OOM
condition and kernel panic.

An unprivileged local user can trigger this by issuing repeated
VIDIOC_SUBSCRIBE_EVENT ioctls with incrementing id values. The allocated
objects reside in kernel slab (not accounted to the process cgroup), so
existing memory limits (ulimit, memcg) do not prevent this. Most V4L2
drivers are affected because the framework function v4l2_event_subscribe()
enforces no limit, such as uvcvideo (USB webcams) and the vicodec test
driver used to reproduce this issue. This leads to:

  Kernel panic - not syncing: Out of memory: compulsory panic_on_oom is enabled

Fix by adding a per-filehandle subscription counter and capping it at 256.

Fixes: 6e239399e580 ("[media] v4l2-ctrls: add control events")
Reported-by: Autonomous Code Security <AutonomousCodeSecurity@xxxxxxxxxxxxx>
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@xxxxxxxxx>
---
 drivers/media/v4l2-core/v4l2-event.c | 14 +++++++++++++-
 include/media/v4l2-fh.h              |  2 ++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index 9dd2aaa95a67..fcd8ce4addc1 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -18,6 +18,9 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 
+/* Per-filehandle limit on the number of event subscriptions. */
+#define V4L2_MAX_EVENT_SUBSCRIPTIONS	256
+
 static unsigned int sev_pos(const struct v4l2_subscribed_event *sev, unsigned int idx)
 {
 	idx += sev->first;
@@ -218,6 +221,7 @@ static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev)
 		fh->navailable--;
 	}
 	list_del(&sev->list);
+	fh->nsubscribed--;
 }
 
 int v4l2_event_subscribe(struct v4l2_fh *fh,
@@ -251,8 +255,16 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
 
 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
 	found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
-	if (!found_ev)
+	if (!found_ev) {
+		if (fh->nsubscribed >= V4L2_MAX_EVENT_SUBSCRIPTIONS) {
+			spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+			kvfree(sev);
+			mutex_unlock(&fh->subscribe_lock);
+			return -ENOSPC;
+		}
 		list_add(&sev->list, &fh->subscribed);
+		fh->nsubscribed++;
+	}
 	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
 
 	if (found_ev) {
diff --git a/include/media/v4l2-fh.h b/include/media/v4l2-fh.h
index aad4b3689d7e..65a7f31af889 100644
--- a/include/media/v4l2-fh.h
+++ b/include/media/v4l2-fh.h
@@ -33,6 +33,7 @@ struct v4l2_ctrl_handler;
  * @subscribe_lock: serialise changes to the subscribed list; guarantee that
  *		    the add and del event callbacks are orderly called
  * @subscribed: list of subscribed events
+ * @nsubscribed: number of subscribed events at @subscribed list
  * @available: list of events waiting to be dequeued
  * @navailable: number of available events at @available list
  * @sequence: event sequence number
@@ -49,6 +50,7 @@ struct v4l2_fh {
 	wait_queue_head_t	wait;
 	struct mutex		subscribe_lock;
 	struct list_head	subscribed;
+	unsigned int		nsubscribed;
 	struct list_head	available;
 	unsigned int		navailable;
 	u32			sequence;
-- 
2.53.0