events: Safeguard against event deletion in event callbacks

Events callback can call events_unwatch_fd(), resulting in the event
being deleted from the events list. Use list_for_each_entry_safe() to
walk the list properly, and make sure the event isn't accessed after
it's callback function returns.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

1 files changed, 6 insertions, 5 deletions

diff --git a/events.c b/events.c
index 15d9535..4fb395c 100644
--- a/events.c
+++ b/events.c
@@ -115,16 +115,17 @@ static void events_dispatch(struct events *events, const fd_set *rfds,
 			    const fd_set *wfds, const fd_set *efds)
 {
 	struct event_fd *event;
+	struct event_fd *next;
 
-	list_for_each_entry(event, &events->events, list) {
+	list_for_each_entry_safe(event, next, &events->events, list) {
 		if (event->type == OMAP3_ISP_EVENT_READ &&
 		    FD_ISSET(event->fd, rfds))
 			event->callback(event->priv);
-		if (event->type == OMAP3_ISP_EVENT_WRITE &&
-		    FD_ISSET(event->fd, wfds))
+		else if (event->type == OMAP3_ISP_EVENT_WRITE &&
+			 FD_ISSET(event->fd, wfds))
 			event->callback(event->priv);
-		if (event->type == OMAP3_ISP_EVENT_EXCEPTION &&
-		    FD_ISSET(event->fd, efds))
+		else if (event->type == OMAP3_ISP_EVENT_EXCEPTION &&
+			 FD_ISSET(event->fd, efds))
 			event->callback(event->priv);
 
 		/* If the callback stopped events processing, we're done. */