Sakari Ailus 0daf8a201b media: v4l: event: Prevent freeing event subscriptions while accessed ... commit ad608fbcf166fec809e402d548761768f602702c upstream. The event subscriptions are added to the subscribed event list while holding a spinlock, but that lock is subsequently released while still accessing the subscription object. This makes it possible to unsubscribe the event --- and freeing the subscription object's memory --- while the subscription object is simultaneously accessed. Prevent this by adding a mutex to serialise the event subscription and unsubscription. This also gives a guarantee to the callback ops that the add op has returned before the del op is called. This change also results in making the elems field less special: subscriptions are only added to the event list once they are fully initialised. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: stable@vger.kernel.org # for 4.14 and up Fixes: c3b5b0241f ("V4L/DVB: V4L: Events: Add backend") Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-07-27 21:51:55 +02:00
..
blackfin	[media] blackfin: add error frame support	2013-02-06 09:16:58 -02:00
davinci	[media] v4l2: pass std by value to the write-only s_std ioctl	2013-03-24 06:47:00 -03:00
ad9389b.h
adp1653.h	[media] v4l, smiapp, smiapp-pll, adp1653: Update contact information	2012-11-21 13:34:50 -02:00
adv7183.h
adv7343.h	[media] media: adv7343: accept configuration through platform data	2013-02-05 18:45:47 -02:00
adv7393.h
adv7604.h	[media] adv7604: Replace prim_mode by mode	2012-11-21 17:43:49 -02:00
ak881x.h
as3645a.h
atmel-isi.h
bt819.h
camera2.h	msm: camera: add logic for sensor compatibility issue	2015-05-19 19:40:50 +08:00
cs53l32a.h
cs5345.h
cx2341x.h
cx25840.h
gpio-ir-recv.h	Update copyright to The Linux Foundation	2013-09-04 15:53:09 -07:00
i2c-addr.h
ir-kbd-i2c.h	[media] rc-core: add separate defines for protocol bitmaps and numbers	2012-10-27 11:49:51 -02:00
ir-rx51.h
lirc.h
lirc_dev.h
m5mols.h
m52790.h
media-device.h
media-devnode.h	[media] media: Add 64--32 bit compat ioctl handler	2013-03-18 20:44:36 -03:00
media-entity.h
mmp-camera.h
msm_cam_sensor.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
msm_camera.h	msm: camera: reimplement camera sensor driver	2013-09-04 15:49:07 -07:00
msm_camsensor_sdk.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
msm_fd.h	msm: camera: MSM FD face detection driver	2014-04-22 13:21:13 +03:00
msm_jpeg.h	camera_v2:jpeg_10: Multiple porting changes	2013-12-18 14:45:54 +02:00
msm_media_info.h	Revert "msm: vidc: Increase extradata size to 16k"	2015-07-20 00:32:28 -07:00
msm_vidc.h	msm: vidc: free registered buffers when closing session	2015-08-24 00:00:07 -07:00
msmb_camera.h	msm: camera: Return correct code when camera open fails	2015-06-11 18:08:30 -07:00
msmb_isp.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
msmb_ispif.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
msmb_pproc.h	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
msp3400.h
mt9m032.h
mt9p031.h	[media] mt9p031: Use the common clock framework	2013-04-14 16:03:22 -03:00
mt9t001.h
mt9t112.h
mt9v011.h
mt9v022.h	[media] mt9v022: set y_skip_top field to zero as default	2012-11-22 11:36:50 -02:00
mt9v032.h
noon010pc30.h
omap1_camera.h
omap3isp.h	[media] omap3isp: Use the common clock framework	2013-04-14 20:21:12 -03:00
ov772x.h
ov7670.h	[media] media: ov7670: Add possibility to disable pixclk during hblank	2013-02-08 14:35:06 -02:00
ov9650.h	[media] V4L: Add driver for OV9650/52 image sensors	2013-02-05 15:21:15 -02:00
radio-si4713.h
rc-core.h	[media] rc-core: don't treat dev->rc_map.rc_type as a bitmap	2013-03-23 11:25:54 -03:00
rc-map.h	msm: rc: Add support for MSM GPIO TSOP IR Reciever driver.	2013-09-04 14:48:14 -07:00
rj54n1cb0c.h
s3c_camif.h	[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface	2012-11-28 09:43:34 -02:00
s5c73m3.h	[media] V4L: Add S5C73M3 camera driver	2013-02-05 17:39:04 -02:00
s5k4ecgx.h
s5k6aa.h
s5p_fimc.h	[media] exynos4-is: Move the subdev group ID definitions to public header	2013-04-14 15:46:40 -03:00
s5p_hdmi.h	[media] media: s5p-hdmi: add HPD GPIO to platform data	2012-10-05 23:11:51 -03:00
saa6588.h
saa6752hs.h
saa7115.h	[media] saa7115: add support for double-rate ASCLK	2013-03-24 12:10:18 -03:00
saa7127.h
saa7146.h
saa7146_vv.h
sh_mobile_ceu.h
sh_mobile_csi2.h
sh_vou.h
si476x.h	[media] v4l2: Add a V4L2 driver for SI476X MFD	2013-04-18 21:20:34 -03:00
si4713.h
sii9234.h
smiapp.h	[media] v4l, smiapp, smiapp-pll, adp1653: Update contact information	2012-11-21 13:34:50 -02:00
soc_camera.h	[media] soc_camera: Add RGB666 & RGB888 formats	2013-04-04 19:40:08 -03:00
soc_camera_platform.h	[media] soc-camera: split struct soc_camera_link into host and subdevice parts	2013-01-05 01:38:02 -02:00
soc_mediabus.h	[media] soc_camera: Add RGB666 & RGB888 formats	2013-04-04 19:40:08 -03:00
sr030pc30.h
ths7303.h	[media] media: ths7353: add support for ths7353 video amplifier	2013-03-21 14:04:47 -03:00
timb_radio.h
timb_video.h
tuner-types.h
tuner.h	[media] tuner-core: Change config from unsigned int to void *	2013-04-08 07:01:36 -03:00
tvaudio.h
tveeprom.h
tvp514x.h	[media] media: tvp514x: remove field description	2013-02-06 08:18:49 -02:00
tvp5150.h
tvp7002.h
tw9910.h
uda1342.h	[media] uda1342: add new uda1342 audio codec driver	2013-03-24 12:24:11 -03:00
upd64031a.h
upd64083.h
v4l2-chip-ident.h	[media] media: ths7353: add support for ths7353 video amplifier	2013-03-21 14:04:47 -03:00
v4l2-common.h	[media] v4l2-common: remove obsolete v4l_fill_dv_preset_info	2013-03-24 13:37:10 -03:00
v4l2-ctrls.h	Merge upstream linux-stable v3.10.28 into msm-3.10	2014-03-24 14:28:34 -07:00
v4l2-dev.h
v4l2-device.h	[media] v4l2-core: add code to check for specific ops	2013-03-24 11:59:02 -03:00
v4l2-event.h	[media] V4L: Add v4l2_event_subdev_unsubscribe() helper function	2013-02-05 15:04:55 -02:00
v4l2-fh.h	media: v4l: event: Prevent freeing event subscriptions while accessed	2019-07-27 21:51:55 +02:00
v4l2-image-sizes.h	[media] V4L: Add header file defining standard image sizes	2013-02-05 14:59:41 -02:00
v4l2-int-device.h
v4l2-ioctl.h	v4l2-ioctl: Initialize the dqbuf function pointer	2013-10-24 12:00:17 -07:00
v4l2-mediabus.h
v4l2-mem2mem.h	[media] v4l2-mem2mem: add v4l2_m2m_create_bufs helper	2013-06-03 15:51:11 -03:00
v4l2-of.h	[media] V4L: Remove incorrect EXPORT_SYMBOL() usage at v4l2-of.c	2013-04-04 19:57:13 -03:00
v4l2-subdev.h	[media] v4l2-subdev: remove obsolete dv_preset ops	2013-03-24 13:38:33 -03:00
videobuf-core.h
videobuf-dma-contig.h	[media] videobuf-dma-contig: remove support for cached mem	2013-04-25 09:50:19 -03:00
videobuf-dma-sg.h
videobuf-dvb.h
videobuf-vmalloc.h
videobuf2-core.h	This is the 3.10.67 stable release	2015-04-24 18:04:40 -07:00
videobuf2-dma-contig.h
videobuf2-dma-sg.h
videobuf2-memops.h	[media] v4l: vb2-dma-contig: let mmap method to use dma_mmap_coherent call	2012-11-25 17:20:25 -02:00
videobuf2-msm-mem.h	iommu: msm: Move iommu_domains out of mach-msm	2013-12-10 18:18:45 -08:00
videobuf2-vmalloc.h
wm8775.h