diff options
author | Sakari Ailus <sakari.ailus@linux.intel.com> | 2017-10-03 02:26:32 -0400 |
---|---|---|
committer | Rui Miguel Silva <rui.silva@linaro.org> | 2018-03-09 00:06:38 +0000 |
commit | 52ae2b0f44615f17bd211a89227fcf39e4fd9cc1 (patch) | |
tree | 5d6ffcde517237173b88c3e0c7462af19cedeb13 | |
parent | c2ab2b7d8c9450e7095f1f3330bd41ed8f739172 (diff) |
media: v4l: async: Correctly serialise async sub-device unregistrationmbl_v4.14.12-4
The check whether an async sub-device is bound to a notifier was performed
without list_lock held, making it possible for another process to
unbind the async sub-device before the sub-device unregistration function
proceeds to take the lock.
Fix this by first acquiring the lock and then proceeding with the check.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
-rw-r--r-- | drivers/media/v4l2-core/v4l2-async.c | 18 |
1 files changed, 7 insertions, 11 deletions
diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c index 4924481451ca..cde2cf2ab4b0 100644 --- a/drivers/media/v4l2-core/v4l2-async.c +++ b/drivers/media/v4l2-core/v4l2-async.c @@ -298,20 +298,16 @@ EXPORT_SYMBOL(v4l2_async_register_subdev); void v4l2_async_unregister_subdev(struct v4l2_subdev *sd) { - struct v4l2_async_notifier *notifier = sd->notifier; - - if (!sd->asd) { - if (!list_empty(&sd->async_list)) - v4l2_async_cleanup(sd); - return; - } - mutex_lock(&list_lock); - list_add(&sd->asd->list, ¬ifier->waiting); + if (sd->asd) { + struct v4l2_async_notifier *notifier = sd->notifier; - if (notifier->unbind) - notifier->unbind(notifier, sd, sd->asd); + list_add(&sd->asd->list, ¬ifier->waiting); + + if (notifier->unbind) + notifier->unbind(notifier, sd, sd->asd); + } v4l2_async_cleanup(sd); |