diff options
| author | Trishansh Bhardwaj <tbhardwa@codeaurora.org> | 2017-10-06 12:48:29 +0530 |
|---|---|---|
| committer | Prashanth Swaminathan <prashanthsw@google.com> | 2018-08-31 13:26:48 -0700 |
| commit | 59c94cd72ac55c778ea7c2dd3cbd42ac46454eb2 (patch) | |
| tree | 7ae424efd32e62641d78f9d8ebb5e59d4fdfbdd3 | |
| parent | fe6e6443b6d61e8e0b6d62d3676a98a54204f48b (diff) | |
| download | qcom-msm8x53-v3.18-59c94cd72ac55c778ea7c2dd3cbd42ac46454eb2.tar.gz | |
msm: camera: Prevent use-after-free in v4l2_event_subscribe.
If same event is unsubscribed before v4l2_event_subscribe returned,
Then function v4l2_event_subscribe have possibility use-after-free.
Serialize msm_subscribe_event and msm_unsubscribe_event to
prevent parallel invocation of v4l2_event_subscribe and
v4l2_event_unsubscribe.
Bug: 110941020
Change-Id: I321fc66a9acbfb6e511b553be4cedffd26a558db
Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/msm.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/drivers/media/platform/msm/camera_v2/msm.c b/drivers/media/platform/msm/camera_v2/msm.c index cf013e10520..4297d3863d7 100644 --- a/drivers/media/platform/msm/camera_v2/msm.c +++ b/drivers/media/platform/msm/camera_v2/msm.c @@ -35,6 +35,7 @@ static struct v4l2_device *msm_v4l2_dev; static struct list_head ordered_sd_list; static struct mutex ordered_sd_mtx; +static struct mutex v4l2_event_mtx; static struct pm_qos_request msm_v4l2_pm_qos_request; @@ -837,13 +838,25 @@ static long msm_private_ioctl(struct file *file, void *fh, static int msm_unsubscribe_event(struct v4l2_fh *fh, const struct v4l2_event_subscription *sub) { - return v4l2_event_unsubscribe(fh, sub); + int rc; + + mutex_lock(&v4l2_event_mtx); + rc = v4l2_event_unsubscribe(fh, sub); + mutex_unlock(&v4l2_event_mtx); + + return rc; } static int msm_subscribe_event(struct v4l2_fh *fh, const struct v4l2_event_subscription *sub) { - return v4l2_event_subscribe(fh, sub, 5, NULL); + int rc; + + mutex_lock(&v4l2_event_mtx); + rc = v4l2_event_subscribe(fh, sub, 5, NULL); + mutex_unlock(&v4l2_event_mtx); + + return rc; } static const struct v4l2_ioctl_ops g_msm_ioctl_ops = { @@ -1361,6 +1374,7 @@ static int msm_probe(struct platform_device *pdev) spin_lock_init(&msm_eventq_lock); spin_lock_init(&msm_pid_lock); mutex_init(&ordered_sd_mtx); + mutex_init(&v4l2_event_mtx); INIT_LIST_HEAD(&ordered_sd_list); cam_debugfs_root = debugfs_create_dir(MSM_CAM_LOGSYNC_FILE_BASEDIR, |