| Message ID | 20201228122131.138454-2-ezequiel@collabora.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/3] media: imx: Unregister csc/scaler only if registered | expand |
On Mon, 2020-12-28 at 09:21 -0300, Ezequiel Garcia wrote: > The csc/scaler device private struct is released by > ipu_csc_scaler_video_device_release(), which can be called > by video_unregister_device() if there are no users > of the underlying struct video device. > > Therefore, the mutex can't be held when calling > video_unregister_device() as its memory may be freed > by it, leading to a kernel oops. > > Fortunately, the fix is quite simple as no locking > is needed when calling video_unregister_device(): v4l2-core > already has its own internal locking, and the structures > are also properly refcounted. > > Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device") > Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> > --- > drivers/staging/media/imx/imx-media-csc-scaler.c | 4 ---- > 1 file changed, 4 deletions(-) > > diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c > index fab1155a5958..63a0204502a8 100644 > --- a/drivers/staging/media/imx/imx-media-csc-scaler.c > +++ b/drivers/staging/media/imx/imx-media-csc-scaler.c > @@ -869,11 +869,7 @@ void imx_media_csc_scaler_device_unregister(struct imx_media_video_dev *vdev) > struct ipu_csc_scaler_priv *priv = vdev_to_priv(vdev); > struct video_device *vfd = priv->vdev.vfd; > > - mutex_lock(&priv->mutex); > - > video_unregister_device(vfd); > - > - mutex_unlock(&priv->mutex); > } > > struct imx_media_video_dev * Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> regards Philipp
diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c index fab1155a5958..63a0204502a8 100644 --- a/drivers/staging/media/imx/imx-media-csc-scaler.c +++ b/drivers/staging/media/imx/imx-media-csc-scaler.c @@ -869,11 +869,7 @@ void imx_media_csc_scaler_device_unregister(struct imx_media_video_dev *vdev) struct ipu_csc_scaler_priv *priv = vdev_to_priv(vdev); struct video_device *vfd = priv->vdev.vfd; - mutex_lock(&priv->mutex); - video_unregister_device(vfd); - - mutex_unlock(&priv->mutex); } struct imx_media_video_dev *
The csc/scaler device private struct is released by ipu_csc_scaler_video_device_release(), which can be called by video_unregister_device() if there are no users of the underlying struct video device. Therefore, the mutex can't be held when calling video_unregister_device() as its memory may be freed by it, leading to a kernel oops. Fortunately, the fix is quite simple as no locking is needed when calling video_unregister_device(): v4l2-core already has its own internal locking, and the structures are also properly refcounted. Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device") Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> --- drivers/staging/media/imx/imx-media-csc-scaler.c | 4 ---- 1 file changed, 4 deletions(-)