iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: v4l2-ctrls: improve media_request_(un)lock_for_update

Browse Source 
The request reference count was decreased again once a reference to the
request object was taken. Postpone this until we finished using the object.

In theory I think it is possible that the request_fd can be closed by
the application from another thread. In that case when request_put is
called the whole request would be freed.

It's highly unlikely, but let's just be safe and fix this potential
race condition.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
This commit is contained in:
Hans Verkuil 2018-08-27 11:23:41 -04:00 committed by Mauro Carvalho Chehab
parent ca6c163399
commit ffda0b4c24
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/media/v4l2-core/v4l2-ctrls.c
View File

@ -3657,10 +3657,9 @@ static int try_set_ext_ctrls(struct v4l2_fh *fh,
}
obj = v4l2_ctrls_find_req_obj(hdl, req, set);
/* Reference to the request held through obj */
media_request_put(req);
if (IS_ERR(obj)) {
media_request_unlock_for_update(req);
media_request_put(req);
return PTR_ERR(obj);
}
hdl = container_of(obj, struct v4l2_ctrl_handler,
@ -3670,8 +3669,9 @@ static int try_set_ext_ctrls(struct v4l2_fh *fh,
ret = try_set_ext_ctrls_common(fh, hdl, cs, set);
if (obj) {
media_request_unlock_for_update(obj->req);
media_request_unlock_for_update(req);
media_request_object_put(obj);
media_request_put(req);
}
return ret;