diff options
| author | Trishansh Bhardwaj <tbhardwa@codeaurora.org> | 2017-11-22 14:55:32 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-11-29 00:03:04 -0800 |
| commit | 5553436c218b889be3bc3a4fb344d4443aa054f4 (patch) | |
| tree | 66f8898579dd4e50600b7cc9ed669d7191e12edf | |
| parent | 2e22873571a7e0d6b8e9f54943de851598c8863c (diff) | |
msm: camera: Synchronize v4l2 subscribe and unsubscribe event in camera.c
If same event is unsubscribed before v4l2_event_subscribe returned,
Then function v4l2_event_subscribe have possibility use-after-free.
Serialize msm_subscribe_event and msm_unsubscribe_event to
prevent parallel invocation of v4l2_event_subscribe and
v4l2_event_unsubscribe.
Change-Id: Ia28cfb9d46550d58221f157337a1468f524753e3
Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/camera/camera.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/camera/camera.c b/drivers/media/platform/msm/camera_v2/camera/camera.c index aeeb5cae3096..ccdd4622c120 100644 --- a/drivers/media/platform/msm/camera_v2/camera/camera.c +++ b/drivers/media/platform/msm/camera_v2/camera/camera.c @@ -459,7 +459,9 @@ static int camera_v4l2_subscribe_event(struct v4l2_fh *fh, int rc = 0; struct camera_v4l2_private *sp = fh_to_private(fh); + mutex_lock(&sp->lock); rc = v4l2_event_subscribe(&sp->fh, sub, 5, NULL); + mutex_unlock(&sp->lock); return rc; } @@ -470,7 +472,9 @@ static int camera_v4l2_unsubscribe_event(struct v4l2_fh *fh, int rc = 0; struct camera_v4l2_private *sp = fh_to_private(fh); + mutex_lock(&sp->lock); rc = v4l2_event_unsubscribe(&sp->fh, sub); + mutex_unlock(&sp->lock); return rc; } |