diff options
| author | Ziyi Guo <n7l8m4@u.northwestern.edu> | 2026-01-30 05:31:54 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2026-03-11 03:05:38 +0300 |
| commit | c3109ecc3bb76aab9ef65f2e795a97a764a0b4a3 (patch) | |
| tree | 6e47caa35e6d8123712bf82679c032293a46becc | |
| parent | 46c2891cf12c767de031a248cbb1f96d203bd3f6 (diff) | |
| download | linux-c3109ecc3bb76aab9ef65f2e795a97a764a0b4a3.tar.xz | |
media: i2c: imx258: add missing mutex protection for format code access
imx258_open(), imx258_enum_mbus_code(), and imx258_enum_frame_size()
call imx258_get_format_code() without holding imx258->mutex. However,
imx258_get_format_code() has lockdep_assert_held(&imx258->mutex)
indicating that callers must hold this lock.
All other callers of imx258_get_format_code() properly acquire the mutex:
- imx258_set_pad_format() acquires mutex at imx258.c:918
- imx258_get_pad_format() acquires mutex at imx258.c:896
The mutex is needed to protect access to imx258->vflip->val and
imx258->hflip->val which are used to calculate the bayer format code.
Add mutex_lock()/mutex_unlock() around the imx258_get_format_code()
calls in the affected functions to fix the missing lock protection.
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
| -rw-r--r-- | drivers/media/i2c/imx258.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/drivers/media/i2c/imx258.c b/drivers/media/i2c/imx258.c index e50dcfd830f5..bc9ee449a87c 100644 --- a/drivers/media/i2c/imx258.c +++ b/drivers/media/i2c/imx258.c @@ -709,12 +709,16 @@ static int imx258_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) v4l2_subdev_state_get_format(fh->state, 0); struct v4l2_rect *try_crop; + mutex_lock(&imx258->mutex); + /* Initialize try_fmt */ try_fmt->width = supported_modes[0].width; try_fmt->height = supported_modes[0].height; try_fmt->code = imx258_get_format_code(imx258); try_fmt->field = V4L2_FIELD_NONE; + mutex_unlock(&imx258->mutex); + /* Initialize try_crop */ try_crop = v4l2_subdev_state_get_crop(fh->state, 0); try_crop->left = IMX258_PIXEL_ARRAY_LEFT; @@ -839,7 +843,9 @@ static int imx258_enum_mbus_code(struct v4l2_subdev *sd, if (code->index > 0) return -EINVAL; + mutex_lock(&imx258->mutex); code->code = imx258_get_format_code(imx258); + mutex_unlock(&imx258->mutex); return 0; } @@ -849,10 +855,16 @@ static int imx258_enum_frame_size(struct v4l2_subdev *sd, struct v4l2_subdev_frame_size_enum *fse) { struct imx258 *imx258 = to_imx258(sd); + u32 code; + if (fse->index >= ARRAY_SIZE(supported_modes)) return -EINVAL; - if (fse->code != imx258_get_format_code(imx258)) + mutex_lock(&imx258->mutex); + code = imx258_get_format_code(imx258); + mutex_unlock(&imx258->mutex); + + if (fse->code != code) return -EINVAL; fse->min_width = supported_modes[fse->index].width; |