CVE-2024-50175: media: qcom: camss: Remove use_count guard in stop_streaming
In the Linux kernel, the following vulnerability has been resolved:
media: qcom: camss: Remove usecount guard in stopstreaming
The usecount check was introduced so that multiple concurrent Raw Data Interfaces RDIs could be driven by different virtual channels VCs on the CSIPHY input driving the video pipeline.
This is an invalid use of usecount though as usecount pertains to the number of times a video entity has been opened by user-space not the number of active streams.
If usecount and stream-on count don't agree then stopstreaming() will break as is currently the case and has become apparent when using CAMSS with libcamera's released softisp 0.3.
The use of usecount like this is a bit hacky and right now breaks regular usage of CAMSS for a single stream case. Stopping qcam results in the splat below, and then it cannot be started again and any attempts to do so fails with -EBUSY.
[ 1265.509831] WARNING: CPU: 5 PID: 919 at drivers/media/common/videobuf2/videobuf2-core.c:2183 vb2queuecancel+0x230/0x2c8 [videobuf2common] ... [ 1265.510630] Call trace: [ 1265.510636] vb2queuecancel+0x230/0x2c8 [videobuf2common] [ 1265.510648] vb2corestreamoff+0x24/0xcc [videobuf2common] [ 1265.510660] vb2ioctlstreamoff+0x5c/0xa8 [videobuf2v4l2] [ 1265.510673] v4lstreamoff+0x24/0x30 [videodev] [ 1265.510707] videodoioctl+0x190/0x3f4 [videodev] [ 1265.510732] videousercopy+0x304/0x8c4 [videodev] [ 1265.510757] videoioctl2+0x18/0x34 [videodev] [ 1265.510782] v4l2ioctl+0x40/0x60 [videodev] ... [ 1265.510944] videobuf2common: driver bug: stopstreaming operation is leaving buffer 0 in active state [ 1265.511175] videobuf2common: driver bug: stopstreaming operation is leaving buffer 1 in active state [ 1265.511398] videobuf2common: driver bug: stopstreaming operation is leaving buffer 2 in active st
One CAMSS specific way to handle multiple VCs on the same RDI might be:
- Reference count each pipeline enable for CSIPHY, CSID, VFE and RDIx. - The video buffers are already associated with msmvfeNrdiX so release video buffers when told to do so by stopstreaming. - Only release the power-domains for the CSIPHY, CSID and VFE when their internal refcounts drop.
Either way refusing to release video buffers based on usecount is erroneous and should be reverted. The silicon enabling code for selecting VCs is perfectly fine. Its a "known missing feature" that concurrent VCs won't work with CAMSS right now.
Initial testing with this code didn't show an error but, SoftISP and "real" usage with Google Hangouts breaks the upstream code pretty quickly, we need to do a partial revert and take another pass at VCs.
This commit partially reverts commit 89013969e232 ("media: camss: sm8250: Pipeline starting and stopping for multiple virtual channels")
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernel (media: qcom: camss)to a version that resolves this vulnerability.Patch media: qcom: camss: Remove use_count guard in stop_streaming - Configuration
Only release the power-domains for the CSIPHY, CSID and VFE when their internal refcounts drop (revert/avoid logic that bases release on use_count or stream-on count mismatch).
CSIPHY/CSID/VFE power-domain release logic release power-domains only when internal refcounts drop = Implement conditional release gated on internal refcounts dropping - Configuration
Reference count each pipeline enable for CSIPHY, CSID, VFE and RDIx so that power domains are released only when the corresponding internal refcounts drop.
CSIPHY/CSID/VFE/RDI pipeline enable reference counting reference count each pipeline enable = Reference count each pipeline enable for CSIPHY, CSID, VFE and RDIx
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50175?
CVE-2024-50175 has been classified with a moderate severity level due to its potential impact on the Linux kernel's camera subsystem.
How do I fix CVE-2024-50175?
To address CVE-2024-50175, upgrade the Linux kernel to a version that includes the patch for this vulnerability.
What versions of the Linux kernel are affected by CVE-2024-50175?
CVE-2024-50175 affects Linux kernel versions between 6.4 and 6.6.55, 6.7 and 6.10.14, and 6.11 and 6.11.3.
What components are impacted by CVE-2024-50175?
CVE-2024-50175 impacts the camera subsystem in the Linux kernel, specifically the Raw Data Interfaces and virtual channels.
Is there a public reference for CVE-2024-50175?
Yes, details and patches for CVE-2024-50175 can be found in the official Linux kernel community resources.