0daf8a201b
commit ad608fbcf166fec809e402d548761768f602702c upstream.
The event subscriptions are added to the subscribed event list while
holding a spinlock, but that lock is subsequently released while still
accessing the subscription object. This makes it possible to unsubscribe
the event --- and freeing the subscription object's memory --- while
the subscription object is simultaneously accessed.
Prevent this by adding a mutex to serialise the event subscription and
unsubscription. This also gives a guarantee to the callback ops that the
add op has returned before the del op is called.
This change also results in making the elems field less special:
subscriptions are only added to the event list once they are fully
initialised.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org # for 4.14 and up
Fixes:
|
||
|---|---|---|
| .. | ||
| blackfin | ||
| davinci | ||
| ad9389b.h | ||
| adp1653.h | ||
| adv7183.h | ||
| adv7343.h | ||
| adv7393.h | ||
| adv7604.h | ||
| ak881x.h | ||
| as3645a.h | ||
| atmel-isi.h | ||
| bt819.h | ||
| camera2.h | ||
| cs53l32a.h | ||
| cs5345.h | ||
| cx2341x.h | ||
| cx25840.h | ||
| gpio-ir-recv.h | ||
| i2c-addr.h | ||
| ir-kbd-i2c.h | ||
| ir-rx51.h | ||
| lirc.h | ||
| lirc_dev.h | ||
| m5mols.h | ||
| m52790.h | ||
| media-device.h | ||
| media-devnode.h | ||
| media-entity.h | ||
| mmp-camera.h | ||
| msm_cam_sensor.h | ||
| msm_camera.h | ||
| msm_camsensor_sdk.h | ||
| msm_fd.h | ||
| msm_jpeg.h | ||
| msm_media_info.h | ||
| msm_vidc.h | ||
| msmb_camera.h | ||
| msmb_isp.h | ||
| msmb_ispif.h | ||
| msmb_pproc.h | ||
| msp3400.h | ||
| mt9m032.h | ||
| mt9p031.h | ||
| mt9t001.h | ||
| mt9t112.h | ||
| mt9v011.h | ||
| mt9v022.h | ||
| mt9v032.h | ||
| noon010pc30.h | ||
| omap1_camera.h | ||
| omap3isp.h | ||
| ov772x.h | ||
| ov7670.h | ||
| ov9650.h | ||
| radio-si4713.h | ||
| rc-core.h | ||
| rc-map.h | ||
| rj54n1cb0c.h | ||
| s3c_camif.h | ||
| s5c73m3.h | ||
| s5k4ecgx.h | ||
| s5k6aa.h | ||
| s5p_fimc.h | ||
| s5p_hdmi.h | ||
| saa6588.h | ||
| saa6752hs.h | ||
| saa7115.h | ||
| saa7127.h | ||
| saa7146.h | ||
| saa7146_vv.h | ||
| sh_mobile_ceu.h | ||
| sh_mobile_csi2.h | ||
| sh_vou.h | ||
| si476x.h | ||
| si4713.h | ||
| sii9234.h | ||
| smiapp.h | ||
| soc_camera.h | ||
| soc_camera_platform.h | ||
| soc_mediabus.h | ||
| sr030pc30.h | ||
| ths7303.h | ||
| timb_radio.h | ||
| timb_video.h | ||
| tuner-types.h | ||
| tuner.h | ||
| tvaudio.h | ||
| tveeprom.h | ||
| tvp514x.h | ||
| tvp5150.h | ||
| tvp7002.h | ||
| tw9910.h | ||
| uda1342.h | ||
| upd64031a.h | ||
| upd64083.h | ||
| v4l2-chip-ident.h | ||
| v4l2-common.h | ||
| v4l2-ctrls.h | ||
| v4l2-dev.h | ||
| v4l2-device.h | ||
| v4l2-event.h | ||
| v4l2-fh.h | ||
| v4l2-image-sizes.h | ||
| v4l2-int-device.h | ||
| v4l2-ioctl.h | ||
| v4l2-mediabus.h | ||
| v4l2-mem2mem.h | ||
| v4l2-of.h | ||
| v4l2-subdev.h | ||
| videobuf-core.h | ||
| videobuf-dma-contig.h | ||
| videobuf-dma-sg.h | ||
| videobuf-dvb.h | ||
| videobuf-vmalloc.h | ||
| videobuf2-core.h | ||
| videobuf2-dma-contig.h | ||
| videobuf2-dma-sg.h | ||
| videobuf2-memops.h | ||
| videobuf2-msm-mem.h | ||
| videobuf2-vmalloc.h | ||
| wm8775.h | ||