OSDN Git Service

media: v4l2-ctrl: Lock main_hdl on operations of requests_queued.
authorPi-Hsun Shih <pihsun@chromium.org>
Sun, 10 Nov 2019 06:29:10 +0000 (07:29 +0100)
committerMauro Carvalho Chehab <mchehab@kernel.org>
Sun, 10 Nov 2019 06:29:10 +0000 (07:29 +0100)
commitdf4a3e7f88e3b0d7ae46d70b9ff8e3c0ea730785
treea5d2f4308b8536a97e704d63af4addfbdee99d26
parent2df200ab234a86836a8879a05a8007d6b884eb14
media: v4l2-ctrl: Lock main_hdl on operations of requests_queued.

There's a race condition between the list_del_init in the
v4l2_ctrl_request_complete, and the list_add_tail in the
v4l2_ctrl_request_queue, since they can be called in different thread
and the requests_queued list is not protected by a lock. This can lead
to that the v4l2_ctrl_handler is still in the requests_queued list while
the request_is_queued is already set to false, which would cause
use-after-free if the v4l2_ctrl_handler is later released.

Fix this by locking the ->lock of main_hdl (which is the owner of the
requests_queued list) when doing list operations on the
->requests_queued list.

Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
drivers/media/v4l2-core/v4l2-ctrls.c