diff options
| author | Hans Verkuil <hans.verkuil@cisco.com> | 2018-08-27 11:20:10 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2018-09-11 09:54:50 -0400 |
| commit | ca6c163399a9f1913efdbeab654a185b3cde03c4 (patch) | |
| tree | 3f008b705b15b014def990fff07b3a4093b88f87 /drivers/media | |
| parent | 6736f4e948817ca8385bdc6feb5475cdf1eb1ec8 (diff) | |
| download | linux-stable-ca6c163399a9f1913efdbeab654a185b3cde03c4.tar.gz linux-stable-ca6c163399a9f1913efdbeab654a185b3cde03c4.tar.bz2 linux-stable-ca6c163399a9f1913efdbeab654a185b3cde03c4.zip | |
media: v4l2-ctrls: use media_request_(un)lock_for_access
When getting control values from a completed request, we have
to protect the request against being re-inited when it is
being accessed by calling media_request_(un)lock_for_access.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/v4l2-core/v4l2-ctrls.c | 21 |
1 files changed, 15 insertions, 6 deletions
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c index ccaf3068de6d..cc266a4a6e88 100644 --- a/drivers/media/v4l2-core/v4l2-ctrls.c +++ b/drivers/media/v4l2-core/v4l2-ctrls.c @@ -3289,11 +3289,10 @@ int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct media_device *mdev, struct v4l2_ext_controls *cs) { struct media_request_object *obj = NULL; + struct media_request *req = NULL; int ret; if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL) { - struct media_request *req; - if (!mdev || cs->request_fd < 0) return -EINVAL; @@ -3306,11 +3305,18 @@ int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct media_device *mdev, return -EACCES; } + ret = media_request_lock_for_access(req); + if (ret) { + media_request_put(req); + return ret; + } + obj = v4l2_ctrls_find_req_obj(hdl, req, false); - /* Reference to the request held through obj */ - media_request_put(req); - if (IS_ERR(obj)) + if (IS_ERR(obj)) { + media_request_unlock_for_access(req); + media_request_put(req); return PTR_ERR(obj); + } hdl = container_of(obj, struct v4l2_ctrl_handler, req_obj); @@ -3318,8 +3324,11 @@ int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct media_device *mdev, ret = v4l2_g_ext_ctrls_common(hdl, cs); - if (obj) + if (obj) { + media_request_unlock_for_access(req); media_request_object_put(obj); + media_request_put(req); + } return ret; } EXPORT_SYMBOL(v4l2_g_ext_ctrls); |