Sakari Ailus 0daf8a201b media: v4l: event: Prevent freeing event subscriptions while accessed ... commit ad608fbcf166fec809e402d548761768f602702c upstream. The event subscriptions are added to the subscribed event list while holding a spinlock, but that lock is subsequently released while still accessing the subscription object. This makes it possible to unsubscribe the event --- and freeing the subscription object's memory --- while the subscription object is simultaneously accessed. Prevent this by adding a mutex to serialise the event subscription and unsubscription. This also gives a guarantee to the callback ops that the add op has returned before the del op is called. This change also results in making the elems field less special: subscriptions are only added to the event list once they are fully initialised. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: stable@vger.kernel.org # for 4.14 and up Fixes: c3b5b0241f ("V4L/DVB: V4L: Events: Add backend") Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-07-27 21:51:55 +02:00
..
blackfin	[media] blackfin: add error frame support	2013-02-06 09:16:58 -02:00
davinci	[media] v4l2: pass std by value to the write-only s_std ioctl	2013-03-24 06:47:00 -03:00
ad9389b.h	…
adp1653.h	…
adv7183.h	…
adv7343.h	[media] media: adv7343: accept configuration through platform data	2013-02-05 18:45:47 -02:00
adv7393.h	…
adv7604.h	[media] adv7604: Replace prim_mode by mode	2012-11-21 17:43:49 -02:00
ak881x.h	…
as3645a.h	[media] as3645a: Add driver for LED flash controller	2011-12-20 09:36:18 -02:00
atmel-isi.h	[media] atmel-isi: add code to enable/disable ISI_MCK clock	2012-01-06 11:01:11 -02:00
bt819.h	…
camera2.h	msm: camera: add logic for sensor compatibility issue	2015-05-19 19:40:50 +08:00
cs53l32a.h	…
cs5345.h	…
cx2341x.h	…
cx25840.h	…
gpio-ir-recv.h	Update copyright to The Linux Foundation	2013-09-04 15:53:09 -07:00
i2c-addr.h	…
ir-kbd-i2c.h	…
ir-rx51.h	…
lirc.h	Fix common misspellings	2011-03-31 11:26:23 -03:00
lirc_dev.h	…
m5mols.h	…
m52790.h	…
media-device.h	…
media-devnode.h	[media] media: Add 64--32 bit compat ioctl handler	2013-03-18 20:44:36 -03:00
media-entity.h	…
mmp-camera.h	…
msm_cam_sensor.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
msm_camera.h	msm: camera: reimplement camera sensor driver	2013-09-04 15:49:07 -07:00
msm_camsensor_sdk.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
msm_fd.h	msm: camera: MSM FD face detection driver	2014-04-22 13:21:13 +03:00
msm_jpeg.h	camera_v2:jpeg_10: Multiple porting changes	2013-12-18 14:45:54 +02:00
msm_media_info.h	Revert "msm: vidc: Increase extradata size to 16k"	2015-07-20 00:32:28 -07:00
msm_vidc.h	msm: vidc: free registered buffers when closing session	2015-08-24 00:00:07 -07:00
msmb_camera.h	msm: camera: Return correct code when camera open fails	2015-06-11 18:08:30 -07:00
msmb_isp.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
msmb_ispif.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
msmb_pproc.h	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
msp3400.h	…
mt9m032.h	…
mt9p031.h	[media] mt9p031: Use the common clock framework	2013-04-14 16:03:22 -03:00
mt9t001.h	[media] mt9t001: Implement V4L2_CID_PIXEL_RATE control	2012-05-24 09:25:15 -03:00
mt9t112.h	…
mt9v011.h	…
mt9v022.h	…
mt9v032.h	…
noon010pc30.h	…
omap1_camera.h	…
omap3isp.h	[media] omap3isp: Use the common clock framework	2013-04-14 20:21:12 -03:00
ov772x.h	…
ov7670.h	[media] media: ov7670: Add possibility to disable pixclk during hblank	2013-02-08 14:35:06 -02:00
ov9650.h	…
radio-si4713.h	V4L/DVB (12551): FM TX: si4713: Add files to add radio interface for si4713	2009-09-12 12:19:19 -03:00
rc-core.h	[media] rc-core: don't treat dev->rc_map.rc_type as a bitmap	2013-03-23 11:25:54 -03:00
rc-map.h	msm: rc: Add support for MSM GPIO TSOP IR Reciever driver.	2013-09-04 14:48:14 -07:00
rj54n1cb0c.h	…
s3c_camif.h	…
s5c73m3.h	…
s5k4ecgx.h	…
s5k6aa.h	…
s5p_fimc.h	[media] exynos4-is: Move the subdev group ID definitions to public header	2013-04-14 15:46:40 -03:00
s5p_hdmi.h	…
saa6588.h	…
saa6752hs.h	…
saa7115.h	[media] saa7115: add support for double-rate ASCLK	2013-03-24 12:10:18 -03:00
saa7127.h	…
saa7146.h	…
saa7146_vv.h	…
sh_mobile_ceu.h	…
sh_mobile_csi2.h	…
sh_vou.h	[media] sh_vou: Don't use module names to load I2C modules	2010-10-22 21:53:33 -02:00
si476x.h	[media] v4l2: Add a V4L2 driver for SI476X MFD	2013-04-18 21:20:34 -03:00
si4713.h	…
sii9234.h	…
smiapp.h	…
soc_camera.h	[media] soc_camera: Add RGB666 & RGB888 formats	2013-04-04 19:40:08 -03:00
soc_camera_platform.h	…
soc_mediabus.h	[media] soc_camera: Add RGB666 & RGB888 formats	2013-04-04 19:40:08 -03:00
sr030pc30.h	…
ths7303.h	[media] media: ths7353: add support for ths7353 video amplifier	2013-03-21 14:04:47 -03:00
timb_radio.h	…
timb_video.h	…
tuner-types.h	V4L/DVB (7352): tuner-simple: enable digital tuning support for Philips FMD1216ME	2008-04-24 14:07:50 -03:00
tuner.h	[media] tuner-core: Change config from unsigned int to void *	2013-04-08 07:01:36 -03:00
tvaudio.h	…
tveeprom.h	…
tvp514x.h	[media] media: tvp514x: remove field description	2013-02-06 08:18:49 -02:00
tvp5150.h	…
tvp7002.h	…
tw9910.h	…
uda1342.h	[media] uda1342: add new uda1342 audio codec driver	2013-03-24 12:24:11 -03:00
upd64031a.h	…
upd64083.h	…
v4l2-chip-ident.h	[media] media: ths7353: add support for ths7353 video amplifier	2013-03-21 14:04:47 -03:00
v4l2-common.h	[media] v4l2-common: remove obsolete v4l_fill_dv_preset_info	2013-03-24 13:37:10 -03:00
v4l2-ctrls.h	Merge upstream linux-stable v3.10.28 into msm-3.10	2014-03-24 14:28:34 -07:00
v4l2-dev.h	…
v4l2-device.h	[media] v4l2-core: add code to check for specific ops	2013-03-24 11:59:02 -03:00
v4l2-event.h	…
v4l2-fh.h	media: v4l: event: Prevent freeing event subscriptions while accessed	2019-07-27 21:51:55 +02:00
v4l2-image-sizes.h	…
v4l2-int-device.h	…
v4l2-ioctl.h	v4l2-ioctl: Initialize the dqbuf function pointer	2013-10-24 12:00:17 -07:00
v4l2-mediabus.h	…
v4l2-mem2mem.h	[media] v4l2-mem2mem: add v4l2_m2m_create_bufs helper	2013-06-03 15:51:11 -03:00
v4l2-of.h	[media] V4L: Remove incorrect EXPORT_SYMBOL() usage at v4l2-of.c	2013-04-04 19:57:13 -03:00
v4l2-subdev.h	[media] v4l2-subdev: remove obsolete dv_preset ops	2013-03-24 13:38:33 -03:00
videobuf-core.h	…
videobuf-dma-contig.h	[media] videobuf-dma-contig: remove support for cached mem	2013-04-25 09:50:19 -03:00
videobuf-dma-sg.h	…
videobuf-dvb.h	…
videobuf-vmalloc.h	…
videobuf2-core.h	This is the 3.10.67 stable release	2015-04-24 18:04:40 -07:00
videobuf2-dma-contig.h	…
videobuf2-dma-sg.h	…
videobuf2-memops.h	…
videobuf2-msm-mem.h	iommu: msm: Move iommu_domains out of mach-msm	2013-12-10 18:18:45 -08:00
videobuf2-vmalloc.h	[media] Update Pawel Osciak's e-mail address	2011-03-22 04:55:05 -03:00
wm8775.h	…