xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: v4l: async: Move async subdev notifier operations to a separate structure

Browse Source 
The async subdev notifier .bound(), .unbind() and .complete() operations
are function pointers stored directly in the v4l2_async_subdev
structure. As the structure isn't immutable, this creates a potential
security risk as the function pointers are mutable.

To fix this, move the function pointers to a new
v4l2_async_subdev_operations structure that can be made const in
drivers.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Laurent Pinchart
2017-08-30 13:18:04 -04:00
committed by Mauro Carvalho Chehab
parent bce9e317ce
commit b6ee3f0dcf
18 changed files with 143 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/media/platform/rcar_drif.c
View File

@@ -1185,6 +1185,12 @@ error:
return ret;
}
static const struct v4l2_async_notifier_operations rcar_drif_notify_ops = {
.bound = rcar_drif_notify_bound,
.unbind = rcar_drif_notify_unbind,
.complete = rcar_drif_notify_complete,
};
/* Read endpoint properties */
static void rcar_drif_get_ep_properties(struct rcar_drif_sdr *sdr,
struct fwnode_handle *fwnode)
@@ -1347,9 +1353,7 @@ static int rcar_drif_sdr_probe(struct rcar_drif_sdr *sdr)
if (ret)
goto error;
sdr->notifier.bound = rcar_drif_notify_bound;
sdr->notifier.unbind = rcar_drif_notify_unbind;
sdr->notifier.complete = rcar_drif_notify_complete;
sdr->notifier.ops = &rcar_drif_notify_ops;
/* Register notifier */
ret = v4l2_async_notifier_register(&sdr->v4l2_dev, &sdr->notifier);