summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorFrank Chen <frankc@nvidia.com>2016-12-14 11:36:41 -0800
committerWinnie Hsu <whsu@nvidia.com>2017-05-16 12:38:28 -0700
commite163dc1d86b26357fdc05757457ef58fc567f990 (patch)
treeb64a32b06f4a2ef531f19315492e842b6c78bd18 /drivers
parent44a90765971303f210e2f3017f723b59ab66e67a (diff)
tegra: camera: Fix UAF security issue
Fix UAF (use-after-free) security issue in camera.pcl driver Bug 1832830 Change-Id: Ie0f8a58a7bb9d1b4949e0f68d25d6da108f06e76 Signed-off-by: Frank Chen <frankc@nvidia.com> Reviewed-on: http://git-master/r/1271371 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Jihoon Bang <jbang@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/media/platform/tegra/camera.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/platform/tegra/camera.c b/drivers/media/platform/tegra/camera.c
index 041c830501ef..9017e7fcd2cc 100644
--- a/drivers/media/platform/tegra/camera.c
+++ b/drivers/media/platform/tegra/camera.c
@@ -526,13 +526,13 @@ static int camera_new_device(struct camera_info *cam, unsigned long arg)
next_dev->client->addr == dev_info.addr) {
dev_dbg(cam_desc.dev,
"%s: device already exists.\n", __func__);
- camera_remove_device(new_dev, false);
if (atomic_xchg(&next_dev->in_use, 1)) {
dev_err(cam_desc.dev, "%s device %s BUSY\n",
__func__, next_dev->name);
err = -EBUSY;
goto new_device_err;
- }
+ } else
+ camera_remove_device(new_dev, false);
new_dev = next_dev;
goto new_device_done;
}