evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: camera: Prevent use-after-free in v4l2_event_subscribe."

Browse source
This commit is contained in:
Linux Build Service Account 2017-11-25 16:21:07 -08:00 • committed by Gerrit - the friendly Code Review server
commit b9b5a66b01
1 changed files with 16 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
drivers/media/platform/msm/camera_v2/msm.c
View file

@ -35,6 +35,7 @@
static struct v4l2_device *msm_v4l2_dev;
static struct list_head ordered_sd_list;
static struct mutex ordered_sd_mtx;
static struct mutex v4l2_event_mtx;
static struct pm_qos_request msm_v4l2_pm_qos_request;
@ -852,13 +853,25 @@ static long msm_private_ioctl(struct file *file, void *fh,
static int msm_unsubscribe_event(struct v4l2_fh *fh,
const struct v4l2_event_subscription *sub)
{
return v4l2_event_unsubscribe(fh, sub);
int rc;
mutex_lock(&v4l2_event_mtx);
rc = v4l2_event_unsubscribe(fh, sub);
mutex_unlock(&v4l2_event_mtx);
return rc;
}
static int msm_subscribe_event(struct v4l2_fh *fh,
const struct v4l2_event_subscription *sub)
{
return v4l2_event_subscribe(fh, sub, 5, NULL);
int rc;
mutex_lock(&v4l2_event_mtx);
rc = v4l2_event_subscribe(fh, sub, 5, NULL);
mutex_unlock(&v4l2_event_mtx);
return rc;
}
static const struct v4l2_ioctl_ops g_msm_ioctl_ops = {
@ -1376,6 +1389,7 @@ static int msm_probe(struct platform_device *pdev)
spin_lock_init(&msm_eventq_lock);
spin_lock_init(&msm_pid_lock);
mutex_init(&ordered_sd_mtx);
mutex_init(&v4l2_event_mtx);
INIT_LIST_HEAD(&ordered_sd_list);
cam_debugfs_root = debugfs_create_dir(MSM_CAM_LOGSYNC_FILE_BASEDIR,