diff options
| author | Frank Chen <frankc@nvidia.com> | 2016-12-14 11:36:41 -0800 |
|---|---|---|
| committer | Winnie Hsu <whsu@nvidia.com> | 2017-05-16 12:38:28 -0700 |
| commit | e163dc1d86b26357fdc05757457ef58fc567f990 (patch) | |
| tree | b64a32b06f4a2ef531f19315492e842b6c78bd18 | |
| parent | 44a90765971303f210e2f3017f723b59ab66e67a (diff) | |
tegra: camera: Fix UAF security issue
Fix UAF (use-after-free) security issue in
camera.pcl driver
Bug 1832830
Change-Id: Ie0f8a58a7bb9d1b4949e0f68d25d6da108f06e76
Signed-off-by: Frank Chen <frankc@nvidia.com>
Reviewed-on: http://git-master/r/1271371
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Jihoon Bang <jbang@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
| -rw-r--r-- | drivers/media/platform/tegra/camera.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/platform/tegra/camera.c b/drivers/media/platform/tegra/camera.c index 041c830501ef..9017e7fcd2cc 100644 --- a/drivers/media/platform/tegra/camera.c +++ b/drivers/media/platform/tegra/camera.c @@ -526,13 +526,13 @@ static int camera_new_device(struct camera_info *cam, unsigned long arg) next_dev->client->addr == dev_info.addr) { dev_dbg(cam_desc.dev, "%s: device already exists.\n", __func__); - camera_remove_device(new_dev, false); if (atomic_xchg(&next_dev->in_use, 1)) { dev_err(cam_desc.dev, "%s device %s BUSY\n", __func__, next_dev->name); err = -EBUSY; goto new_device_err; - } + } else + camera_remove_device(new_dev, false); new_dev = next_dev; goto new_device_done; } |