linux/include/media
Sakari Ailus d61ba3417e media: v4l: event: Prevent freeing event subscriptions while accessed
commit ad608fbcf1 upstream.

The event subscriptions are added to the subscribed event list while
holding a spinlock, but that lock is subsequently released while still
accessing the subscription object. This makes it possible to unsubscribe
the event --- and freeing the subscription object's memory --- while
the subscription object is simultaneously accessed.

Prevent this by adding a mutex to serialise the event subscription and
unsubscription. This also gives a guarantee to the callback ops that the
add op has returned before the del op is called.

This change also results in making the elems field less special:
subscriptions are only added to the event list once they are fully
initialised.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org # for 4.14 and up
Fixes: c3b5b0241f ("V4L/DVB: V4L: Events: Add backend")
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-03 17:01:00 -07:00
..
blackfin License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
davinci media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS 2017-07-26 06:14:33 -04:00
drv-intf License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
i2c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
cec-notifier.h Linux 4.13-rc4 2017-08-08 05:38:41 -04:00
cec-pin.h media: cec: replace pin->cur_value by adap->cec_pin_is_high 2017-08-26 08:35:10 -04:00
cec.h media: cec: replace pin->cur_value by adap->cec_pin_is_high 2017-08-26 08:35:10 -04:00
i2c-addr.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
imx.h [media] media: Add i.MX media core driver 2017-06-20 07:30:38 -03:00
lirc_dev.h [media] lirc_dev: cleanup header 2017-06-06 09:07:26 -03:00
lirc.h [media] bz#75751: Move internal header file lirc.h to uapi/ 2015-11-17 06:47:43 -02:00
media-device.h media: media-device: remove driver_version 2017-08-08 06:02:22 -04:00
media-devnode.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
media-entity.h media: Make parameter of media_entity_remote_pad() const 2017-07-20 16:54:04 -04:00
rc-core.h media: rc: rename RC_TYPE_* to RC_PROTO_* and RC_BIT_* to RC_PROTO_BIT_* 2017-08-20 10:02:48 -04:00
rc-map.h media: rc: rename RC_TYPE_* to RC_PROTO_* and RC_BIT_* to RC_PROTO_BIT_* 2017-08-20 10:02:48 -04:00
rcar-fcp.h v4l: rcar-fcp: Add an API to retrieve the FCP device 2017-06-09 12:25:36 +01:00
soc_camera.h [media] v4l: soc-camera: Remove videobuf1 support 2017-03-22 11:27:24 -03:00
tuner-types.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tuner.h [media] v4l2-mc.h: move tuner PAD definitions to this new header 2016-02-01 07:19:44 -02:00
tveeprom.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
v4l2-async.h [media] v4l: Switch from V4L2 OF not V4L2 fwnode API 2017-06-06 09:58:16 -03:00
v4l2-clk.h media: Convert to using %pOF instead of full_name 2017-08-20 08:20:20 -04:00
v4l2-common.h [media] v4l2-common: add a debug macro to be used with dev_foo() 2016-11-18 10:04:58 -02:00
v4l2-ctrls.h media: v4l2-ctrls.h: better document the arguments for v4l2_ctrl_fill 2017-08-20 08:11:40 -04:00
v4l2-dev.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
v4l2-device.h [media] v4l2-device.h: fix some doc tags 2016-09-09 09:41:12 -03:00
v4l2-dv-timings.h [media] v4l2-dv-timings: add helpers for vic and pixelaspect ratio 2016-11-16 15:20:03 -02:00
v4l2-event.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
v4l2-fh.h media: v4l: event: Prevent freeing event subscriptions while accessed 2018-10-03 17:01:00 -07:00
v4l2-flash-led-class.h media: v4l2-flash-led-class: Document v4l2_flash_init() references 2017-08-26 20:26:57 -04:00
v4l2-fwnode.h media: v4l: fwnode: Use a less clash-prone name for MAX_DATA_LANES macro 2017-08-26 13:52:28 -04:00
v4l2-image-sizes.h [media] media: v4l2-image-sizes.h: correct the SVGA height definition 2014-12-04 13:56:56 -02:00
v4l2-ioctl.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
v4l2-mc.h [media] get rid of a number of problems at the cross references 2016-09-22 10:00:23 -03:00
v4l2-mediabus.h media: v4l2-mediabus: Add helper functions 2017-07-20 06:54:35 -04:00
v4l2-mem2mem.h [media] media: v4l2-mem2mem: extend m2m APIs for more accurate buffer management 2017-06-20 08:53:39 -03:00
v4l2-rect.h [media] v4l2-rect.h: new header with struct v4l2_rect helper functions 2016-04-20 16:11:33 -03:00
v4l2-subdev.h media: fix warning on v4l2_subdev_call() result interpreted as bool 2017-07-26 13:43:17 -04:00
v4l2-tpg-colors.h [media] tpg: Export the tpg code from vivid as a module 2016-04-20 16:14:39 -03:00
v4l2-tpg.h [media] vivid: Add support for HSV encoding 2016-10-21 15:54:16 -02:00
videobuf2-core.h media: vb2: add bidirectional flag in vb2_queue 2017-08-26 14:15:54 -04:00
videobuf2-dma-contig.h dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
videobuf2-dma-sg.h [media] vb2: replace void *alloc_ctxs by struct device *alloc_devs 2016-07-08 14:45:07 -03:00
videobuf2-dvb.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
videobuf2-memops.h [media] vb2: convert vb2_vmarea_handler refcount from atomic_t to refcount_t 2017-04-05 15:31:57 -03:00
videobuf2-v4l2.h [media] videobuf2-v4l2: document two helper functions 2016-09-09 10:19:06 -03:00
videobuf2-vmalloc.h [media] media: videobuf2: Replace videobuf2-core with videobuf2-v4l2 2015-10-01 08:48:18 -03:00
videobuf-core.h treewide: fix typos in comment blocks 2015-08-07 14:46:24 +02:00
videobuf-dma-contig.h [media] videobuf-dma-contig: remove support for cached mem 2013-04-25 09:50:19 -03:00
videobuf-dma-sg.h [media] videobuf: make unused exported functions static 2015-01-27 10:01:33 -02:00
videobuf-dvb.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
videobuf-vmalloc.h V4L/DVB: videobuf: add ext_lock argument to the queue init functions 2010-10-21 01:06:14 -02:00
vsp1.h drm: rcar-du: Repair vblank for DRM page flips using the VSP 2017-08-03 16:17:30 +03:00