evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: Synchronize v4l2 subscribe and unsubscribe event in camera.c

Browse source 
If same event is unsubscribed before v4l2_event_subscribe returned,
Then function v4l2_event_subscribe have possibility use-after-free.

Serialize msm_subscribe_event and msm_unsubscribe_event to
prevent parallel invocation of v4l2_event_subscribe and
v4l2_event_unsubscribe.

Change-Id: Ia28cfb9d46550d58221f157337a1468f524753e3
Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
This commit is contained in:
Trishansh Bhardwaj 2017-11-22 14:55:32 +05:30 • committed by Gerrit - the friendly Code Review server
parent 2e22873571
commit 5553436c21
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/media/platform/msm/camera_v2/camera/camera.c
View file

@ -459,7 +459,9 @@ static int camera_v4l2_subscribe_event(struct v4l2_fh *fh,
int rc = 0;
struct camera_v4l2_private *sp = fh_to_private(fh);
mutex_lock(&sp->lock);
rc = v4l2_event_subscribe(&sp->fh, sub, 5, NULL);
mutex_unlock(&sp->lock);
return rc;
}
@ -470,7 +472,9 @@ static int camera_v4l2_unsubscribe_event(struct v4l2_fh *fh,
int rc = 0;
struct camera_v4l2_private *sp = fh_to_private(fh);
mutex_lock(&sp->lock);
rc = v4l2_event_unsubscribe(&sp->fh, sub);
mutex_unlock(&sp->lock);
return rc;
}