summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeetesh Burman <jburman@nvidia.com>2018-02-15 14:07:39 +0530
committerWinnie Hsu <whsu@nvidia.com>2018-04-03 10:44:53 -0700
commit68bd404adda3b13e3a5a465696ec85647f08dbdf (patch)
treeea8fa64b8b07cb9c4fe6f2e31205135266d33a9d
parent5fea92e18248d450c16c897f95d295e8ecdea000 (diff)
v4l2: prevent speculative load
bug 2039126 Change-Id: Id1908c3058c9ecc0dfb4f2d85440a8d36db45db5 Signed-off-by: David Gilhooley <dgilhooley@nvidia.com> Signed-off-by: James Huang <jamehuang@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1650029 Signed-off-by: Jeetesh Burman <jburman@nvidia.com> (cherry picked from commit 7a0213eca150614fe88d197a09d461fff6168652) Reviewed-on: https://git-master.nvidia.com/r/1660781 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
-rw-r--r--drivers/media/v4l2-core/v4l2-ioctl.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 7658586fe5f4..80bef0e66683 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -28,6 +28,7 @@
#include <media/v4l2-device.h>
#include <media/v4l2-chip-ident.h>
#include <media/videobuf2-core.h>
+#include <asm/barrier.h>
/* Zero out the end of the struct pointed to by p. Everything after, but
* not including, the specified field is cleared. */
@@ -2119,6 +2120,7 @@ bool v4l2_is_known_ioctl(unsigned int cmd)
{
if (_IOC_NR(cmd) >= V4L2_IOCTLS)
return false;
+ speculation_barrier();
return v4l2_ioctls[_IOC_NR(cmd)].ioctl == cmd;
}
@@ -2128,6 +2130,7 @@ struct mutex *v4l2_ioctl_get_lock(struct video_device *vdev, unsigned cmd)
return vdev->lock;
if (test_bit(_IOC_NR(cmd), vdev->disable_locking))
return NULL;
+ speculation_barrier();
if (vdev->queue && vdev->queue->lock &&
(v4l2_ioctls[_IOC_NR(cmd)].flags & INFO_FL_QUEUE))
return vdev->queue->lock;