diff options
| author | Trishansh Bhardwaj <tbhardwa@codeaurora.org> | 2018-09-01 00:32:08 -0700 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2018-09-01 00:32:08 -0700 |
| commit | bd10cc3febf010282110623d1fb1af3acb75ec8b (patch) | |
| tree | 021ca1c78e91ef28cf5411bcfe1d12ee8c0294f4 | |
| parent | e79c259abc8f4f547fba50c2327b8e69d8e8bf5b (diff) | |
| parent | 59c94cd72ac55c778ea7c2dd3cbd42ac46454eb2 (diff) | |
| download | qcom-msm8x53-v3.18-bd10cc3febf010282110623d1fb1af3acb75ec8b.tar.gz | |
msm: camera: Prevent use-after-free in v4l2_event_subscribe.
am: 59c94cd72a
Change-Id: I95afd9c1d9c9f5c395a87657e692faf53244a3ca
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/msm.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/drivers/media/platform/msm/camera_v2/msm.c b/drivers/media/platform/msm/camera_v2/msm.c index cf013e10520..4297d3863d7 100644 --- a/drivers/media/platform/msm/camera_v2/msm.c +++ b/drivers/media/platform/msm/camera_v2/msm.c @@ -35,6 +35,7 @@ static struct v4l2_device *msm_v4l2_dev; static struct list_head ordered_sd_list; static struct mutex ordered_sd_mtx; +static struct mutex v4l2_event_mtx; static struct pm_qos_request msm_v4l2_pm_qos_request; @@ -837,13 +838,25 @@ static long msm_private_ioctl(struct file *file, void *fh, static int msm_unsubscribe_event(struct v4l2_fh *fh, const struct v4l2_event_subscription *sub) { - return v4l2_event_unsubscribe(fh, sub); + int rc; + + mutex_lock(&v4l2_event_mtx); + rc = v4l2_event_unsubscribe(fh, sub); + mutex_unlock(&v4l2_event_mtx); + + return rc; } static int msm_subscribe_event(struct v4l2_fh *fh, const struct v4l2_event_subscription *sub) { - return v4l2_event_subscribe(fh, sub, 5, NULL); + int rc; + + mutex_lock(&v4l2_event_mtx); + rc = v4l2_event_subscribe(fh, sub, 5, NULL); + mutex_unlock(&v4l2_event_mtx); + + return rc; } static const struct v4l2_ioctl_ops g_msm_ioctl_ops = { @@ -1361,6 +1374,7 @@ static int msm_probe(struct platform_device *pdev) spin_lock_init(&msm_eventq_lock); spin_lock_init(&msm_pid_lock); mutex_init(&ordered_sd_mtx); + mutex_init(&v4l2_event_mtx); INIT_LIST_HEAD(&ordered_sd_list); cam_debugfs_root = debugfs_create_dir(MSM_CAM_LOGSYNC_FILE_BASEDIR, |