evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: ais: Synchronize camera open/close calls

Browse source 
Synchronize camera_v4l2_open and camera_v4l2_close to avoid use
after free.

Change-Id: I4055f00ff30408cc0469015b3e49d877632726bf
CRs-fixed: 2048964
Signed-off-by: Rahul Sharma <sharah@codeaurora.org>
This commit is contained in:
Sankalp Sharma 2017-09-13 18:01:10 +05:30 • committed by Rahul Sharma
parent 414269dd95
commit 062e9f67de
2 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/media/platform/msm/ais/camera/camera.c
View file

@ -628,6 +628,7 @@ static int camera_v4l2_open(struct file *filep)
if (WARN_ON(!pvdev))
return -EIO;
mutex_lock(&pvdev->video_drvdata_mutex);
rc = camera_v4l2_fh_open(filep);
if (rc < 0) {
pr_err("%s : camera_v4l2_fh_open failed Line %d rc %d\n",
@ -698,6 +699,7 @@ static int camera_v4l2_open(struct file *filep)
idx |= (1 << find_first_zero_bit((const unsigned long *)&opn_idx,
MSM_CAMERA_STREAM_CNT_BITS));
atomic_cmpxchg(&pvdev->opened, opn_idx, idx);
mutex_unlock(&pvdev->video_drvdata_mutex);
return rc;
@ -712,6 +714,7 @@ stream_fail:
vb2_q_fail:
camera_v4l2_fh_release(filep);
fh_open_fail:
mutex_unlock(&pvdev->video_drvdata_mutex);
return rc;
}
@ -746,6 +749,7 @@ static int camera_v4l2_close(struct file *filep)
if (WARN_ON(!session))
return -EIO;
mutex_lock(&pvdev->video_drvdata_mutex);
mutex_lock(&session->close_lock);
opn_idx = atomic_read(&pvdev->opened);
mask = (1 << sp->stream_id);
@ -788,6 +792,7 @@ static int camera_v4l2_close(struct file *filep)
}
camera_v4l2_fh_release(filep);
mutex_unlock(&pvdev->video_drvdata_mutex);
return 0;
}
@ -936,6 +941,7 @@ int camera_init_v4l2(struct device *dev, unsigned int *session)
*session = pvdev->vdev->num;
atomic_set(&pvdev->opened, 0);
mutex_init(&pvdev->video_drvdata_mutex);
video_set_drvdata(pvdev->vdev, pvdev);
device_init_wakeup(&pvdev->vdev->dev, 1);
goto init_end;

1
drivers/media/platform/msm/ais/msm.h
View file

@ -46,6 +46,7 @@ extern bool is_daemon_status;
struct msm_video_device {
struct video_device *vdev;
atomic_t opened;
struct mutex video_drvdata_mutex;
};
struct msm_queue_head {