diff options
| author | Jonathan Nieder <jrnieder@gmail.com> | 2011-05-01 06:29:56 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2011-05-20 09:29:37 -0300 |
| commit | 1d6213ab995c61f7d1d81cf6cf876acf15d6e714 (patch) | |
| tree | 72ebdfa1d65066a6cd5361ee605a48e2dfcda4b2 /drivers/media/video | |
| parent | 1fe70e963028f34ba5e32488a7870ff4b410b19b (diff) | |
[media] cx88: hold device lock during sub-driver initialization
cx8802_blackbird_probe makes a device node for the mpeg sub-device
before it has been added to dev->drvlist. If the device is opened
during that time, the open succeeds but request_acquire cannot be
called, so the reference count remains zero. Later, when the device
is closed, the reference count becomes negative --- uh oh.
Close the race by holding core->lock during probe and not releasing
until the device is in drvlist and initialization finished.
Previously the BKL prevented this race.
Reported-by: Andreas Huber <hobrom@gmx.at>
Tested-by: Andi Huber <hobrom@gmx.at>
Tested-by: Marlon de Boer <marlon@hyves.nl>
Cc: stable@kernel.org
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video')
| -rw-r--r-- | drivers/media/video/cx88/cx88-blackbird.c | 2 | ||||
| -rw-r--r-- | drivers/media/video/cx88/cx88-mpeg.c | 5 | ||||
| -rw-r--r-- | drivers/media/video/cx88/cx88.h | 7 |
3 files changed, 4 insertions, 10 deletions
diff --git a/drivers/media/video/cx88/cx88-blackbird.c b/drivers/media/video/cx88/cx88-blackbird.c index a6f7d53a451..f637d34d506 100644 --- a/drivers/media/video/cx88/cx88-blackbird.c +++ b/drivers/media/video/cx88/cx88-blackbird.c @@ -1335,11 +1335,9 @@ static int cx8802_blackbird_probe(struct cx8802_driver *drv) blackbird_register_video(dev); /* initial device configuration: needed ? */ - mutex_lock(&dev->core->lock); // init_controls(core); cx88_set_tvnorm(core,core->tvnorm); cx88_video_mux(core,0); - mutex_unlock(&dev->core->lock); return 0; diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c index 91d3d179c3c..455290011d4 100644 --- a/drivers/media/video/cx88/cx88-mpeg.c +++ b/drivers/media/video/cx88/cx88-mpeg.c @@ -709,18 +709,17 @@ int cx8802_register_driver(struct cx8802_driver *drv) drv->request_release = cx8802_request_release; memcpy(driver, drv, sizeof(*driver)); + mutex_lock(&drv->core->lock); err = drv->probe(driver); if (err == 0) { i++; - mutex_lock(&drv->core->lock); list_add_tail(&driver->drvlist, &dev->drvlist); - mutex_unlock(&drv->core->lock); } else { printk(KERN_ERR "%s/2: cx8802 probe failed, err = %d\n", dev->core->name, err); } - + mutex_unlock(&drv->core->lock); } return i ? 0 : -ENODEV; diff --git a/drivers/media/video/cx88/cx88.h b/drivers/media/video/cx88/cx88.h index 9731daa92a0..3d32f4afac9 100644 --- a/drivers/media/video/cx88/cx88.h +++ b/drivers/media/video/cx88/cx88.h @@ -505,13 +505,10 @@ struct cx8802_driver { int (*suspend)(struct pci_dev *pci_dev, pm_message_t state); int (*resume)(struct pci_dev *pci_dev); - /* MPEG 8802 -> mini driver - Driver probe and configuration */ - - /* Caller must _not_ hold core->lock */ - int (*probe)(struct cx8802_driver *drv); - /* Callers to the following functions must hold core->lock */ + /* MPEG 8802 -> mini driver - Driver probe and configuration */ + int (*probe)(struct cx8802_driver *drv); int (*remove)(struct cx8802_driver *drv); /* MPEG 8802 -> mini driver - Access for hardware control */ |