From patchwork Wed Oct 4 21:50:24 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sakari Ailus X-Patchwork-Id: 9985743 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 35D21602B8 for ; Wed, 4 Oct 2017 21:51:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 27DF2285A5 for ; Wed, 4 Oct 2017 21:51:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1CF9728C2E; Wed, 4 Oct 2017 21:51:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BB70C285A5 for ; Wed, 4 Oct 2017 21:51:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751336AbdJDVvx (ORCPT ); Wed, 4 Oct 2017 17:51:53 -0400 Received: from nblzone-211-213.nblnetworks.fi ([83.145.211.213]:40292 "EHLO hillosipuli.retiisi.org.uk" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751327AbdJDVu4 (ORCPT ); Wed, 4 Oct 2017 17:50:56 -0400 Received: from lanttu.localdomain (lanttu-e.localdomain [192.168.1.64]) by hillosipuli.retiisi.org.uk (Postfix) with ESMTP id 043D2600E2; Thu, 5 Oct 2017 00:50:53 +0300 (EEST) From: Sakari Ailus To: linux-media@vger.kernel.org Cc: niklas.soderlund@ragnatech.se, maxime.ripard@free-electrons.com, hverkuil@xs4all.nl, laurent.pinchart@ideasonboard.com, pavel@ucw.cz, sre@kernel.org Subject: [PATCH v15 05/32] v4l: async: Correctly serialise async sub-device unregistration Date: Thu, 5 Oct 2017 00:50:24 +0300 Message-Id: <20171004215051.13385-6-sakari.ailus@linux.intel.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20171004215051.13385-1-sakari.ailus@linux.intel.com> References: <20171004215051.13385-1-sakari.ailus@linux.intel.com> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The check whether an async sub-device is bound to a notifier was performed without list_lock held, making it possible for another process to unbind the async sub-device before the sub-device unregistration function proceeds to take the lock. Fix this by first acquiring the lock and then proceeding with the check. Signed-off-by: Sakari Ailus Reviewed-by: Sebastian Reichel Acked-by: Hans Verkuil --- drivers/media/v4l2-core/v4l2-async.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c index 4924481451ca..cde2cf2ab4b0 100644 --- a/drivers/media/v4l2-core/v4l2-async.c +++ b/drivers/media/v4l2-core/v4l2-async.c @@ -298,20 +298,16 @@ EXPORT_SYMBOL(v4l2_async_register_subdev); void v4l2_async_unregister_subdev(struct v4l2_subdev *sd) { - struct v4l2_async_notifier *notifier = sd->notifier; - - if (!sd->asd) { - if (!list_empty(&sd->async_list)) - v4l2_async_cleanup(sd); - return; - } - mutex_lock(&list_lock); - list_add(&sd->asd->list, ¬ifier->waiting); + if (sd->asd) { + struct v4l2_async_notifier *notifier = sd->notifier; - if (notifier->unbind) - notifier->unbind(notifier, sd, sd->asd); + list_add(&sd->asd->list, ¬ifier->waiting); + + if (notifier->unbind) + notifier->unbind(notifier, sd, sd->asd); + } v4l2_async_cleanup(sd);