mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-15 16:46:49 +07:00
47b037a051
v4l2-async had several functions doing some operations and then
not undoing the operations in a failure situation. For example,
v4l2_async_test_notify() moved a subdev into notifier's done list
even if registering the subdev (v4l2_device_register_subdev) failed.
If the subdev was allocated and v4l2_async_register_subdev() called
from the driver's probe() function, as usually, the probe()
function freed the allocated subdev and returned a failure.
Nevertheless, the subdev was still left into the notifier's done
list, causing an access to already freed memory when the notifier
was later unregistered.
A hand-edited call trace leaving freed subdevs into the notifier:
v4l2_async_register_notifier(notifier, asd)
cameradrv_probe
sd = devm_kzalloc()
v4l2_async_register_subdev(sd)
v4l2_async_test_notify(notifier, sd, asd)
list_move(sd, ¬ifier->done)
v4l2_device_register_subdev(notifier->v4l2_dev, sd)
cameradrv_registered(sd) -> fails
->v4l2_async_register_subdev returns failure
->cameradrv_probe returns failure
->devres frees the allocated sd
->sd was freed but it still remains in the notifier's list.
This patch fixes this and several other cases where a failing
function could leave nodes into a linked list while the caller
might free the node due to a failure.
Signed-off-by: Tuukka Toivonen <tuukka.toivonen@intel.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| tuner-core.c | ||
| v4l2-async.c | ||
| v4l2-clk.c | ||
| v4l2-common.c | ||
| v4l2-compat-ioctl32.c | ||
| v4l2-ctrls.c | ||
| v4l2-dev.c | ||
| v4l2-device.c | ||
| v4l2-dv-timings.c | ||
| v4l2-event.c | ||
| v4l2-fh.c | ||
| v4l2-flash-led-class.c | ||
| v4l2-ioctl.c | ||
| v4l2-mc.c | ||
| v4l2-mem2mem.c | ||
| v4l2-of.c | ||
| v4l2-subdev.c | ||
| v4l2-trace.c | ||
| vb2-trace.c | ||
| videobuf2-core.c | ||
| videobuf2-dma-contig.c | ||
| videobuf2-dma-sg.c | ||
| videobuf2-dvb.c | ||
| videobuf2-memops.c | ||
| videobuf2-v4l2.c | ||
| videobuf2-vmalloc.c | ||
| videobuf-core.c | ||
| videobuf-dma-contig.c | ||
| videobuf-dma-sg.c | ||
| videobuf-dvb.c | ||
| videobuf-vmalloc.c | ||