xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Tükrözés 0
Kód Hibajegyek Egyesítési kérések Actions Packages Projektek Kiadások Wiki Tevékenység

media: v4l: async: Move async subdev notifier operations to a separate structure

Forráskód böngészése 
The async subdev notifier .bound(), .unbind() and .complete() operations
are function pointers stored directly in the v4l2_async_subdev
structure. As the structure isn't immutable, this creates a potential
security risk as the function pointers are mutable.

To fix this, move the function pointers to a new
v4l2_async_subdev_operations structure that can be made const in
drivers.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Laurent Pinchart
2017-08-30 13:18:04 -04:00
committed by Mauro Carvalho Chehab
szülő bce9e317ce
commit b6ee3f0dcf
18 fájl változott, egészen pontosan 143 új sor hozzáadva és 74 régi sor törölve
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/media/platform/xilinx/xilinx-vipp.c
Fájl megtekintése

@@ -351,6 +351,11 @@ static int xvip_graph_notify_bound(struct v4l2_async_notifier *notifier,
return -EINVAL;
}
static const struct v4l2_async_notifier_operations xvip_graph_notify_ops = {
.bound = xvip_graph_notify_bound,
.complete = xvip_graph_notify_complete,
};
static int xvip_graph_parse_one(struct xvip_composite_device *xdev,
struct device_node *node)
{
@@ -548,8 +553,7 @@ static int xvip_graph_init(struct xvip_composite_device *xdev)
xdev->notifier.subdevs = subdevs;
xdev->notifier.num_subdevs = num_subdevs;
xdev->notifier.bound = xvip_graph_notify_bound;
xdev->notifier.complete = xvip_graph_notify_complete;
xdev->notifier.ops = &xvip_graph_notify_ops;
ret = v4l2_async_notifier_register(&xdev->v4l2_dev, &xdev->notifier);
if (ret < 0) {