Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9507b854 authored by Karthik Anantha Ram's avatar Karthik Anantha Ram Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: reqmgr: Hold device lock while retrieving session info 



There is a possibility for destroy session and link to occur
concurrently, if this does we end up using a freed pointer while
linking. Avoid this by increasing the scope of the device lock.

Change-Id: I5cd37e7e6fedb283f97af672175a9ae93a0a89a5
Signed-off-by: default avatarKarthik Anantha Ram <kartanan@codeaurora.org>
parent 763429b2

drivers/media/platform/msm/ais/cam_req_mgr/cam_req_mgr_core.c

+4 −3
Original line number Diff line number Diff line 
/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -2389,16 +2389,17 @@ int cam_req_mgr_link(struct cam_req_mgr_link_info *link_info) 
		return -EINVAL;

	}



	mutex_lock(&g_crm_core_dev->crm_lock);



	/* session hdl's priv data is cam session struct */

	cam_session = (struct cam_req_mgr_core_session *)

		cam_get_device_priv(link_info->session_hdl);

	if (!cam_session) {

		CAM_DBG(CAM_CRM, "NULL pointer");

		mutex_unlock(&g_crm_core_dev->crm_lock);

		return -EINVAL;

	}



	mutex_lock(&g_crm_core_dev->crm_lock);



	/* Allocate link struct and map it with session's request queue */

	link = __cam_req_mgr_reserve_link(cam_session);

	if (!link) {