diff options
| author |   Philipp Zabel <p.zabel@pengutronix.de> | 2018-11-06 05:40:54 -0500 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2018-11-23 05:19:39 -0500 |
| commit | 649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f (patch) | |
| tree | 8065841baf7a7126c64a6bb5e0e9f13f9b3f11c9 /drivers/media/platform/coda/coda.h | |
| parent | media: ov2680: fix null dereference at power on (diff) | |
| download | linux-dev-649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f.tar.xz linux-dev-649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f.zip | |
media: coda: fix memory corruption in case more than 32 instances are opened
The ffz() return value is undefined if the instance mask does not
contain any zeros. If it returned 32, the following set_bit would
corrupt the debugfs_root pointer.
Switch to IDA for context index allocation. This also removes the
artificial 32 instance limit for all except CodaDx6.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Diffstat (limited to 'drivers/media/platform/coda/coda.h')
| -rw-r--r-- | drivers/media/platform/coda/coda.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h index 19ac0b9dc6eb..680c7035c9d4 100644 --- a/drivers/media/platform/coda/coda.h +++ b/drivers/media/platform/coda/coda.h @@ -16,6 +16,7 @@ #define __CODA_H__ #include <linux/debugfs.h> +#include <linux/idr.h> #include <linux/irqreturn.h> #include <linux/mutex.h> #include <linux/kfifo.h> @@ -95,7 +96,7 @@ struct coda_dev { struct workqueue_struct *workqueue; struct v4l2_m2m_dev *m2m_dev; struct list_head instances; - unsigned long instance_mask; + struct ida ida; struct dentry *debugfs_root; }; |