Merge "msm: camera: Prevent use-after-free in v4l2_event_subscribe." (fe59f156) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/media/platform/msm/camera_v2/msm.c

+16 −2

Original line number	Diff line number	Diff line
		@@ -35,6 +35,7 @@
		static struct v4l2_device *msm_v4l2_dev;
		static struct list_head ordered_sd_list;
		static struct mutex ordered_sd_mtx;
		static struct mutex v4l2_event_mtx;

		static struct pm_qos_request msm_v4l2_pm_qos_request;

		@@ -837,13 +838,25 @@ static long msm_private_ioctl(struct file file, void fh,
		static int msm_unsubscribe_event(struct v4l2_fh *fh,
		const struct v4l2_event_subscription *sub)
		{
		return v4l2_event_unsubscribe(fh, sub);
		int rc;

		mutex_lock(&v4l2_event_mtx);
		rc = v4l2_event_unsubscribe(fh, sub);
		mutex_unlock(&v4l2_event_mtx);

		return rc;
		}

		static int msm_subscribe_event(struct v4l2_fh *fh,
		const struct v4l2_event_subscription *sub)
		{
		return v4l2_event_subscribe(fh, sub, 5, NULL);
		int rc;

		mutex_lock(&v4l2_event_mtx);
		rc = v4l2_event_subscribe(fh, sub, 5, NULL);
		mutex_unlock(&v4l2_event_mtx);

		return rc;
		}

		static const struct v4l2_ioctl_ops g_msm_ioctl_ops = {
		@@ -1361,6 +1374,7 @@ static int msm_probe(struct platform_device *pdev)
		spin_lock_init(&msm_eventq_lock);
		spin_lock_init(&msm_pid_lock);
		mutex_init(&ordered_sd_mtx);
		mutex_init(&v4l2_event_mtx);
		INIT_LIST_HEAD(&ordered_sd_list);

		cam_debugfs_root = debugfs_create_dir(MSM_CAM_LOGSYNC_FILE_BASEDIR,