linux_dsm_epyc7002/drivers/media/usb/uvc
Mauro Carvalho Chehab a087ce704b [media] media-device: dynamically allocate struct media_devnode
struct media_devnode is currently embedded at struct media_device.

While this works fine during normal usage, it leads to a race
condition during devnode unregister. the problem is that drivers
assume that, after calling media_device_unregister(), the struct
that contains media_device can be freed. This is not true, as it
can't be freed until userspace closes all opened /dev/media devnodes.

In other words, if the media devnode is still open, and media_device
gets freed, any call to an ioctl will make the core to try to access
struct media_device, with will cause an use-after-free and even GPF.

Fix this by dynamically allocating the struct media_devnode and only
freeing it when it is safe.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-15 17:57:24 -03:00
..
Kconfig [media] uvc: Depend on VIDEO_V4L2 2013-06-24 22:54:40 -03:00
Makefile
uvc_ctrl.c [media] uvcvideo: Fix reading the current exposure value of UVC 2015-12-18 15:21:34 -02:00
uvc_debugfs.c
uvc_driver.c [media] media-device: dynamically allocate struct media_devnode 2016-06-15 17:57:24 -03:00
uvc_entity.c [media] uvcvideo: register entity subdev on init 2016-01-11 12:19:09 -02:00
uvc_isight.c
uvc_queue.c [media] vb2: drop v4l2_format argument from queue_setup 2015-12-18 13:48:19 -02:00
uvc_status.c [media] uvcvideo: Fix open/close race condition 2013-06-08 19:51:16 -03:00
uvc_v4l2.c [media] uvcvideo: Fix bytesperline calculation for planar YUV 2016-06-07 11:33:41 -03:00
uvc_video.c [media] uvcvideo: Correct speed testing 2016-06-07 11:34:24 -03:00
uvcvideo.h [media] UVC: Add support for R200 depth camera 2016-03-03 06:49:20 -03:00