xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[media] media-device: dynamically allocate struct media_devnode

Browse Source 
struct media_devnode is currently embedded at struct media_device.

While this works fine during normal usage, it leads to a race
condition during devnode unregister. the problem is that drivers
assume that, after calling media_device_unregister(), the struct
that contains media_device can be freed. This is not true, as it
can't be freed until userspace closes all opened /dev/media devnodes.

In other words, if the media devnode is still open, and media_device
gets freed, any call to an ioctl will make the core to try to access
struct media_device, with will cause an use-after-free and even GPF.

Fix this by dynamically allocating the struct media_devnode and only
freeing it when it is safe.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Mauro Carvalho Chehab
2016-04-27 19:28:26 -03:00
committed by Mauro Carvalho Chehab
parent 163f1e93e9
commit a087ce704b
6 changed files with 54 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
include/media/media-device.h
View File

@@ -347,7 +347,7 @@ struct media_entity_notify {
struct media_device {
/* dev->driver_data points to this struct. */
struct device *dev;
struct media_devnode devnode;
struct media_devnode *devnode;
char model[32];
char driver_name[32];
@@ -393,9 +393,6 @@ struct usb_device;
#define MEDIA_DEV_NOTIFY_PRE_LINK_CH 0
#define MEDIA_DEV_NOTIFY_POST_LINK_CH 1
/* media_devnode to media_device */
#define to_media_device(node) container_of(node, struct media_device, devnode)
/**
* media_entity_enum_init - Initialise an entity enumeration
*