summaryrefslogtreecommitdiff
path: root/include/media/soc_camera.h
diff options
context:
space:
mode:
authorTuukka Toivonen <tuukka.toivonen@intel.com>2017-01-27 13:32:56 +0300
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2017-02-03 19:51:56 +0300
commit47b037a0512d9f8675ec2693bed46c8ea6a884ab (patch)
tree2cc74ab5cd545ba1fb239031d935659994ddf51e /include/media/soc_camera.h
parent79a2eda80c6dab79790c308d9f50ecd2e5021ba3 (diff)
downloadlinux-47b037a0512d9f8675ec2693bed46c8ea6a884ab.tar.xz
[media] v4l2-async: failing functions shouldn't have side effects
v4l2-async had several functions doing some operations and then not undoing the operations in a failure situation. For example, v4l2_async_test_notify() moved a subdev into notifier's done list even if registering the subdev (v4l2_device_register_subdev) failed. If the subdev was allocated and v4l2_async_register_subdev() called from the driver's probe() function, as usually, the probe() function freed the allocated subdev and returned a failure. Nevertheless, the subdev was still left into the notifier's done list, causing an access to already freed memory when the notifier was later unregistered. A hand-edited call trace leaving freed subdevs into the notifier: v4l2_async_register_notifier(notifier, asd) cameradrv_probe sd = devm_kzalloc() v4l2_async_register_subdev(sd) v4l2_async_test_notify(notifier, sd, asd) list_move(sd, &notifier->done) v4l2_device_register_subdev(notifier->v4l2_dev, sd) cameradrv_registered(sd) -> fails ->v4l2_async_register_subdev returns failure ->cameradrv_probe returns failure ->devres frees the allocated sd ->sd was freed but it still remains in the notifier's list. This patch fixes this and several other cases where a failing function could leave nodes into a linked list while the caller might free the node due to a failure. Signed-off-by: Tuukka Toivonen <tuukka.toivonen@intel.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'include/media/soc_camera.h')
0 files changed, 0 insertions, 0 deletions