Commit 78c87e86 authored by Hans de Goede's avatar Hans de Goede Committed by Mauro Carvalho Chehab

[media] v4l2-event: Remove pending events from fh event queue when unsubscribing

The kev pointers inside the pending events queue (the available queue) of the
fh point to data inside the sev, unsubscribing frees the sev, thus making these
pointers point to freed memory!

This patch fixes these dangling pointers in the available queue by removing
all matching pending events on unsubscription.
Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
Acked-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent b36b5059
...@@ -285,6 +285,7 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, ...@@ -285,6 +285,7 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
{ {
struct v4l2_subscribed_event *sev; struct v4l2_subscribed_event *sev;
unsigned long flags; unsigned long flags;
int i;
if (sub->type == V4L2_EVENT_ALL) { if (sub->type == V4L2_EVENT_ALL) {
v4l2_event_unsubscribe_all(fh); v4l2_event_unsubscribe_all(fh);
...@@ -295,6 +296,11 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, ...@@ -295,6 +296,11 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
sev = v4l2_event_subscribed(fh, sub->type, sub->id); sev = v4l2_event_subscribed(fh, sub->type, sub->id);
if (sev != NULL) { if (sev != NULL) {
/* Remove any pending events for this subscription */
for (i = 0; i < sev->in_use; i++) {
list_del(&sev->events[sev_pos(sev, i)].list);
fh->navailable--;
}
list_del(&sev->list); list_del(&sev->list);
sev->fh = NULL; sev->fh = NULL;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment