renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-24 05:04:00 +08:00
Code

[media] s5p-fimc: Don't allocate fimc-lite video device structure dynamically

Browse Source 
This fixes potential invalid pointer de-reference, when
media_entity_cleanup() is called after video_unregister_device,
and video device structure memory is already freed.

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Sylwester Nawrocki 2012-07-26 07:13:08 -03:00 committed by Mauro Carvalho Chehab
parent 8cf5e2a976
commit 1bcd704194
4 changed files with 19 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/media/platform/s5p-fimc/fimc-lite-reg.c
View File

@ -137,7 +137,7 @@ void flite_hw_set_source_format(struct fimc_lite *dev, struct flite_frame *f)
}
if (i == 0 && src_pixfmt_map[i][0] != pixelcode) {
v4l2_err(dev->vfd,
v4l2_err(&dev->vfd,
"Unsupported pixel code, falling back to %#08x\n",
src_pixfmt_map[i][0]);
}

42
drivers/media/platform/s5p-fimc/fimc-lite.c
View File

@ -374,7 +374,7 @@ static int buffer_prepare(struct vb2_buffer *vb)
unsigned long size = fimc->payload[i];
if (vb2_plane_size(vb, i) < size) {
v4l2_err(fimc->vfd,
v4l2_err(&fimc->vfd,
"User buffer too small (%ld < %ld)\n",
vb2_plane_size(vb, i), size);
return -EINVAL;
@ -467,7 +467,7 @@ static int fimc_lite_open(struct file *file)
if (++fimc->ref_count == 1 && fimc->out_path == FIMC_IO_DMA) {
ret = fimc_pipeline_initialize(&fimc->pipeline,
&fimc->vfd->entity, true);
&fimc->vfd.entity, true);
if (ret < 0) {
pm_runtime_put_sync(&fimc->pdev->dev);
fimc->ref_count--;
@ -1215,18 +1215,14 @@ static int fimc_lite_subdev_registered(struct v4l2_subdev *sd)
{
struct fimc_lite *fimc = v4l2_get_subdevdata(sd);
struct vb2_queue *q = &fimc->vb_queue;
struct video_device *vfd;
struct video_device *vfd = &fimc->vfd;
int ret;
memset(vfd, 0, sizeof(*vfd));
fimc->fmt = &fimc_lite_formats[0];
fimc->out_path = FIMC_IO_DMA;
vfd = video_device_alloc();
if (!vfd) {
v4l2_err(sd->v4l2_dev, "Failed to allocate video device\n");
return -ENOMEM;
}
snprintf(vfd->name, sizeof(vfd->name), "fimc-lite.%d.capture",
fimc->index);
@ -1234,9 +1230,8 @@ static int fimc_lite_subdev_registered(struct v4l2_subdev *sd)
vfd->ioctl_ops = &fimc_lite_ioctl_ops;
vfd->v4l2_dev = sd->v4l2_dev;
vfd->minor = -1;
vfd->release = video_device_release;
vfd->release = video_device_release_empty;
vfd->lock = &fimc->lock;
fimc->vfd = vfd;
fimc->ref_count = 0;
fimc->reqbufs_count = 0;
@ -1255,24 +1250,20 @@ static int fimc_lite_subdev_registered(struct v4l2_subdev *sd)
fimc->vd_pad.flags = MEDIA_PAD_FL_SINK;
ret = media_entity_init(&vfd->entity, 1, &fimc->vd_pad, 0);
if (ret)
goto err;
if (ret < 0)
return ret;
video_set_drvdata(vfd, fimc);
ret = video_register_device(vfd, VFL_TYPE_GRABBER, -1);
if (ret)
goto err_vd;
if (ret < 0) {
media_entity_cleanup(&vfd->entity);
return ret;
}
v4l2_info(sd->v4l2_dev, "Registered %s as /dev/%s\n",
vfd->name, video_device_node_name(vfd));
return 0;
err_vd:
media_entity_cleanup(&vfd->entity);
err:
video_device_release(vfd);
return ret;
}
static void fimc_lite_subdev_unregistered(struct v4l2_subdev *sd)
@ -1282,10 +1273,9 @@ static void fimc_lite_subdev_unregistered(struct v4l2_subdev *sd)
if (fimc == NULL)
return;
if (fimc->vfd) {
video_unregister_device(fimc->vfd);
media_entity_cleanup(&fimc->vfd->entity);
fimc->vfd = NULL;
if (video_is_registered(&fimc->vfd)) {
video_unregister_device(&fimc->vfd);
media_entity_cleanup(&fimc->vfd.entity);
}
}
@ -1515,7 +1505,7 @@ static int fimc_lite_resume(struct device *dev)
return 0;
INIT_LIST_HEAD(&fimc->active_buf_q);
fimc_pipeline_initialize(&fimc->pipeline, &fimc->vfd->entity, false);
fimc_pipeline_initialize(&fimc->pipeline, &fimc->vfd.entity, false);
fimc_lite_hw_init(fimc);
clear_bit(ST_FLITE_SUSPENDED, &fimc->state);

2
drivers/media/platform/s5p-fimc/fimc-lite.h
View File

@ -132,7 +132,7 @@ struct fimc_lite {
struct platform_device *pdev;
struct flite_variant *variant;
struct v4l2_device *v4l2_dev;
struct video_device *vfd;
struct video_device vfd;
struct v4l2_fh fh;
struct vb2_alloc_ctx *alloc_ctx;
struct v4l2_subdev subdev;

2
drivers/media/platform/s5p-fimc/fimc-mdevice.c
View File

@ -591,7 +591,7 @@ static int __fimc_md_create_flite_source_links(struct fimc_md *fmd)
if (fimc == NULL)
continue;
source = &fimc->subdev.entity;
sink = &fimc->vfd->entity;
sink = &fimc->vfd.entity;
/* FIMC-LITE's subdev and video node */
ret = media_entity_create_link(source, FIMC_SD_PAD_SOURCE,
sink, 0, flags);