xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: v4l: async: Move async subdev notifier operations to a separate structure

Browse Source 
The async subdev notifier .bound(), .unbind() and .complete() operations
are function pointers stored directly in the v4l2_async_subdev
structure. As the structure isn't immutable, this creates a potential
security risk as the function pointers are mutable.

To fix this, move the function pointers to a new
v4l2_async_subdev_operations structure that can be made const in
drivers.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Laurent Pinchart
2017-08-30 13:18:04 -04:00
committed by Mauro Carvalho Chehab
parent bce9e317ce
commit b6ee3f0dcf
18 changed files with 143 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/media/platform/stm32/stm32-dcmi.c
View File

@@ -1495,6 +1495,12 @@ static int dcmi_graph_notify_bound(struct v4l2_async_notifier *notifier,
return 0;
}
static const struct v4l2_async_notifier_operations dcmi_graph_notify_ops = {
.bound = dcmi_graph_notify_bound,
.unbind = dcmi_graph_notify_unbind,
.complete = dcmi_graph_notify_complete,
};
static int dcmi_graph_parse(struct stm32_dcmi *dcmi, struct device_node *node)
{
struct device_node *ep = NULL;
@@ -1542,9 +1548,7 @@ static int dcmi_graph_init(struct stm32_dcmi *dcmi)
dcmi->notifier.subdevs = subdevs;
dcmi->notifier.num_subdevs = 1;
dcmi->notifier.bound = dcmi_graph_notify_bound;
dcmi->notifier.unbind = dcmi_graph_notify_unbind;
dcmi->notifier.complete = dcmi_graph_notify_complete;
dcmi->notifier.ops = &dcmi_graph_notify_ops;
ret = v4l2_async_notifier_register(&dcmi->v4l2_dev, &dcmi->notifier);
if (ret < 0) {