Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5bc65481 authored by Trishansh Bhardwaj's avatar Trishansh Bhardwaj Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: Synchronize v4l2 subscribe and unsubscribe event in camera.c 



If same event is unsubscribed before v4l2_event_subscribe returned,
Then function v4l2_event_subscribe have possibility use-after-free.

Serialize msm_subscribe_event and msm_unsubscribe_event to
prevent parallel invocation of v4l2_event_subscribe and
v4l2_event_unsubscribe.

Change-Id: Ia28cfb9d46550d58221f157337a1468f524753e3
Signed-off-by: default avatarTrishansh Bhardwaj <tbhardwa@codeaurora.org>
parent 579d5fea

drivers/media/platform/msm/camera_v2/camera/camera.c

+4 −0
Original line number Diff line number Diff line
@@ -458,7 +458,9 @@ static int camera_v4l2_subscribe_event(struct v4l2_fh *fh, 
	int rc = 0;

	struct camera_v4l2_private *sp = fh_to_private(fh);



	mutex_lock(&sp->lock);

	rc = v4l2_event_subscribe(&sp->fh, sub, 5, NULL);

	mutex_unlock(&sp->lock);



	return rc;

}
@@ -469,7 +471,9 @@ static int camera_v4l2_unsubscribe_event(struct v4l2_fh *fh, 
	int rc = 0;

	struct camera_v4l2_private *sp = fh_to_private(fh);



	mutex_lock(&sp->lock);

	rc = v4l2_event_unsubscribe(&sp->fh, sub);

	mutex_unlock(&sp->lock);



	return rc;

}