evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: sde: Protect concurrent access to resources in SDE rotator

Browse source 
ioctl32 handling in SDE rotator does not go through the V4L2 ioctl
lock protection, thus allowing concurrent access to some of the SDE
rotator internal resources. This change adds the mutex protection to
the SDE rotator ioctl32 handler.

CRs-Fixed: 2019300
Change-Id: Idca37e19b7d3812e90d143acfc6fef82df19ab97
Signed-off-by: Benjamin Chan <bkchan@codeaurora.org>
This commit is contained in:
Benjamin Chan 2017-03-21 14:21:41 -04:00
parent 687a4eb82b
commit 1f42db3852
1 changed files with 16 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
drivers/media/platform/msm/sde/rotator/sde_rotator_dev.c
View file

@ -1924,8 +1924,13 @@ static long sde_rotator_private_ioctl(struct file *file, void *fh,
static long sde_rotator_compat_ioctl32(struct file *file,
unsigned int cmd, unsigned long arg)
{
struct video_device *vdev = video_devdata(file);
struct sde_rotator_ctx *ctx =
sde_rotator_ctx_from_fh(file->private_data);
long ret;
mutex_lock(vdev->lock);
switch (cmd) {
case VIDIOC_S_SDE_ROTATOR_FENCE:
case VIDIOC_G_SDE_ROTATOR_FENCE:
@ -1934,14 +1939,14 @@ static long sde_rotator_compat_ioctl32(struct file *file,
if (copy_from_user(&fence, (void __user *)arg,
sizeof(struct msm_sde_rotator_fence)))
return -EFAULT;
goto ioctl32_error;
ret = sde_rotator_private_ioctl(file, file->private_data,
0, cmd, (void *)&fence);
if (copy_to_user((void __user *)arg, &fence,
sizeof(struct msm_sde_rotator_fence)))
return -EFAULT;
goto ioctl32_error;
break;
}
@ -1952,24 +1957,31 @@ static long sde_rotator_compat_ioctl32(struct file *file,
if (copy_from_user(&comp_ratio, (void __user *)arg,
sizeof(struct msm_sde_rotator_comp_ratio)))
return -EFAULT;
goto ioctl32_error;
ret = sde_rotator_private_ioctl(file, file->private_data,
0, cmd, (void *)&comp_ratio);
if (copy_to_user((void __user *)arg, &comp_ratio,
sizeof(struct msm_sde_rotator_comp_ratio)))
return -EFAULT;
goto ioctl32_error;
break;
}
default:
SDEDEV_ERR(ctx->rot_dev->dev, "invalid ioctl32 type:%x\n", cmd);
ret = -ENOIOCTLCMD;
break;
}
mutex_unlock(vdev->lock);
return ret;
ioctl32_error:
mutex_unlock(vdev->lock);
SDEDEV_ERR(ctx->rot_dev->dev, "error handling ioctl32 cmd:%x\n", cmd);
return -EFAULT;
}
#endif