Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1162075Ab1FAIRT (ORCPT ); Wed, 1 Jun 2011 04:17:19 -0400 Received: from cantor2.suse.de ([195.135.220.15]:43493 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1162065Ab1FAIRN (ORCPT ); Wed, 1 Jun 2011 04:17:13 -0400 X-Mailbox-Line: From linux@blue.kroah.org Wed Jun 1 17:04:37 2011 Message-Id: <20110601080435.499760659@blue.kroah.org> User-Agent: quilt/0.48-16.4 Date: Wed, 01 Jun 2011 17:00:57 +0900 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Jonathan Nieder , Mauro Carvalho Chehab , Greg Kroah-Hartman Subject: [121/146] [media] cx88: hold device lock during sub-driver In-Reply-To: <20110601080606.GA522@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3200 Lines: 94 2.6.38-stable review patch. If anyone has any objections, please let us know. ------------------ initialization From: Jonathan Nieder commit 1d6213ab995c61f7d1d81cf6cf876acf15d6e714 upstream. cx8802_blackbird_probe makes a device node for the mpeg sub-device before it has been added to dev->drvlist. If the device is opened during that time, the open succeeds but request_acquire cannot be called, so the reference count remains zero. Later, when the device is closed, the reference count becomes negative --- uh oh. Close the race by holding core->lock during probe and not releasing until the device is in drvlist and initialization finished. Previously the BKL prevented this race. Reported-by: Andreas Huber Tested-by: Andi Huber Tested-by: Marlon de Boer Signed-off-by: Jonathan Nieder Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/video/cx88/cx88-blackbird.c | 2 -- drivers/media/video/cx88/cx88-mpeg.c | 5 ++--- drivers/media/video/cx88/cx88.h | 7 ++----- 3 files changed, 4 insertions(+), 10 deletions(-) --- a/drivers/media/video/cx88/cx88-blackbird.c +++ b/drivers/media/video/cx88/cx88-blackbird.c @@ -1335,11 +1335,9 @@ static int cx8802_blackbird_probe(struct blackbird_register_video(dev); /* initial device configuration: needed ? */ - mutex_lock(&dev->core->lock); // init_controls(core); cx88_set_tvnorm(core,core->tvnorm); cx88_video_mux(core,0); - mutex_unlock(&dev->core->lock); return 0; --- a/drivers/media/video/cx88/cx88-mpeg.c +++ b/drivers/media/video/cx88/cx88-mpeg.c @@ -709,18 +709,17 @@ int cx8802_register_driver(struct cx8802 drv->request_release = cx8802_request_release; memcpy(driver, drv, sizeof(*driver)); + mutex_lock(&drv->core->lock); err = drv->probe(driver); if (err == 0) { i++; - mutex_lock(&drv->core->lock); list_add_tail(&driver->drvlist, &dev->drvlist); - mutex_unlock(&drv->core->lock); } else { printk(KERN_ERR "%s/2: cx8802 probe failed, err = %d\n", dev->core->name, err); } - + mutex_unlock(&drv->core->lock); } return i ? 0 : -ENODEV; --- a/drivers/media/video/cx88/cx88.h +++ b/drivers/media/video/cx88/cx88.h @@ -495,13 +495,10 @@ struct cx8802_driver { int (*suspend)(struct pci_dev *pci_dev, pm_message_t state); int (*resume)(struct pci_dev *pci_dev); - /* MPEG 8802 -> mini driver - Driver probe and configuration */ - - /* Caller must _not_ hold core->lock */ - int (*probe)(struct cx8802_driver *drv); - /* Callers to the following functions must hold core->lock */ + /* MPEG 8802 -> mini driver - Driver probe and configuration */ + int (*probe)(struct cx8802_driver *drv); int (*remove)(struct cx8802_driver *drv); /* MPEG 8802 -> mini driver - Access for hardware control */ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/