torvalds/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 00:29:35 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

media: i2c: imx258: add missing mutex protection for format code access

Browse Source 
imx258_open(), imx258_enum_mbus_code(), and imx258_enum_frame_size()
call imx258_get_format_code() without holding imx258->mutex. However,
imx258_get_format_code() has lockdep_assert_held(&imx258->mutex)
indicating that callers must hold this lock.

All other callers of imx258_get_format_code() properly acquire the mutex:
- imx258_set_pad_format() acquires mutex at imx258.c:918
- imx258_get_pad_format() acquires mutex at imx258.c:896

The mutex is needed to protect access to imx258->vflip->val and
imx258->hflip->val which are used to calculate the bayer format code.

Add mutex_lock()/mutex_unlock() around the imx258_get_format_code()
calls in the affected functions to fix the missing lock protection.

Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
This commit is contained in:
Ziyi Guo
2026-01-30 02:31:54 +00:00
committed by Mauro Carvalho Chehab
parent 46c2891cf1
commit c3109ecc3b
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/media/i2c/imx258.c
View File

@@ -709,12 +709,16 @@ static int imx258_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
v4l2_subdev_state_get_format(fh->state, 0);
struct v4l2_rect *try_crop;
mutex_lock(&imx258->mutex);
/* Initialize try_fmt */
try_fmt->width = supported_modes[0].width;
try_fmt->height = supported_modes[0].height;
try_fmt->code = imx258_get_format_code(imx258);
try_fmt->field = V4L2_FIELD_NONE;
mutex_unlock(&imx258->mutex);
/* Initialize try_crop */
try_crop = v4l2_subdev_state_get_crop(fh->state, 0);
try_crop->left = IMX258_PIXEL_ARRAY_LEFT;
@@ -839,7 +843,9 @@ static int imx258_enum_mbus_code(struct v4l2_subdev *sd,
if (code->index > 0)
return -EINVAL;
mutex_lock(&imx258->mutex);
code->code = imx258_get_format_code(imx258);
mutex_unlock(&imx258->mutex);
return 0;
}
@@ -849,10 +855,16 @@ static int imx258_enum_frame_size(struct v4l2_subdev *sd,
struct v4l2_subdev_frame_size_enum *fse)
{
struct imx258 *imx258 = to_imx258(sd);
u32 code;
if (fse->index >= ARRAY_SIZE(supported_modes))
return -EINVAL;
if (fse->code != imx258_get_format_code(imx258))
mutex_lock(&imx258->mutex);
code = imx258_get_format_code(imx258);
mutex_unlock(&imx258->mutex);
if (fse->code != code)
return -EINVAL;
fse->min_width = supported_modes[fse->index].width;