• Nikhil Devshatwar's avatar
    [media] media: ti-vpe: vpdma: Fix race condition for firmware loading · c786595b
    Nikhil Devshatwar authored
    vpdma_create API is supposed to allocated the struct vpdma_data and
    return it to the driver. Also, it would call the callback function
    when the VPDMA firmware is loaded.
    
    Typically, VPE driver have following function call:
        dev->vpdma = vpdma_create(pdev, firmware_load_callback);
    And the callback implementation would continue the probe further.
    Also, the dev->vpdma is accessed from the callback implementation.
    
    This may lead to race condition between assignment of dev->vpdma
    and the callback function being triggered.
    This would lead to kernel crash because of NULL pointer access.
    
    Fix this by passing a driver wrapped &vpdma_data instead of allocating
    inside vpdma_create.
    Change the vpdma_create prototype accordingly and fix return paths.
    
    Also, update the VPE driver to use the updated API and
    initialize the dev->vpdma before hand so that the race condition
    is avoided.
    Signed-off-by: default avatarNikhil Devshatwar <nikhil.nd@ti.com>
    Signed-off-by: default avatarBenoit Parrot <bparrot@ti.com>
    Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
    c786595b
vpe.c 63.7 KB