Commit ca6c1633 authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

media: v4l2-ctrls: use media_request_(un)lock_for_access



When getting control values from a completed request, we have
to protect the request against being re-inited when it is
being accessed by calling media_request_(un)lock_for_access.

Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: default avatarTomasz Figa <tfiga@chromium.org>
Acked-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent 6736f4e9
Loading
Loading
Loading
Loading
+15 −6
Original line number Diff line number Diff line
@@ -3289,11 +3289,10 @@ int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct media_device *mdev,
		     struct v4l2_ext_controls *cs)
{
	struct media_request_object *obj = NULL;
	struct media_request *req = NULL;
	int ret;

	if (cs->which == V4L2_CTRL_WHICH_REQUEST_VAL) {
		struct media_request *req;

		if (!mdev || cs->request_fd < 0)
			return -EINVAL;

@@ -3306,11 +3305,18 @@ int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct media_device *mdev,
			return -EACCES;
		}

		ret = media_request_lock_for_access(req);
		if (ret) {
			media_request_put(req);
			return ret;
		}

		obj = v4l2_ctrls_find_req_obj(hdl, req, false);
		/* Reference to the request held through obj */
		if (IS_ERR(obj)) {
			media_request_unlock_for_access(req);
			media_request_put(req);
		if (IS_ERR(obj))
			return PTR_ERR(obj);
		}

		hdl = container_of(obj, struct v4l2_ctrl_handler,
				   req_obj);
@@ -3318,8 +3324,11 @@ int v4l2_g_ext_ctrls(struct v4l2_ctrl_handler *hdl, struct media_device *mdev,

	ret = v4l2_g_ext_ctrls_common(hdl, cs);

	if (obj)
	if (obj) {
		media_request_unlock_for_access(req);
		media_request_object_put(obj);
		media_request_put(req);
	}
	return ret;
}
EXPORT_SYMBOL(v4l2_g_ext_ctrls);