Commit 1d6213ab authored by Jonathan Nieder's avatar Jonathan Nieder Committed by Mauro Carvalho Chehab

[media] cx88: hold device lock during sub-driver initialization

cx8802_blackbird_probe makes a device node for the mpeg sub-device
before it has been added to dev->drvlist.  If the device is opened
during that time, the open succeeds but request_acquire cannot be
called, so the reference count remains zero.  Later, when the device
is closed, the reference count becomes negative --- uh oh.

Close the race by holding core->lock during probe and not releasing
until the device is in drvlist and initialization finished.
Previously the BKL prevented this race.
Reported-by: default avatarAndreas Huber <hobrom@gmx.at>
Tested-by: default avatarAndi Huber <hobrom@gmx.at>
Tested-by: default avatarMarlon de Boer <marlon@hyves.nl>
Cc: stable@kernel.org
Signed-off-by: default avatarJonathan Nieder <jrnieder@gmail.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 1fe70e96
......@@ -1335,11 +1335,9 @@ static int cx8802_blackbird_probe(struct cx8802_driver *drv)
blackbird_register_video(dev);
/* initial device configuration: needed ? */
mutex_lock(&dev->core->lock);
// init_controls(core);
cx88_set_tvnorm(core,core->tvnorm);
cx88_video_mux(core,0);
mutex_unlock(&dev->core->lock);
return 0;
......
......@@ -709,18 +709,17 @@ int cx8802_register_driver(struct cx8802_driver *drv)
drv->request_release = cx8802_request_release;
memcpy(driver, drv, sizeof(*driver));
mutex_lock(&drv->core->lock);
err = drv->probe(driver);
if (err == 0) {
i++;
mutex_lock(&drv->core->lock);
list_add_tail(&driver->drvlist, &dev->drvlist);
mutex_unlock(&drv->core->lock);
} else {
printk(KERN_ERR
"%s/2: cx8802 probe failed, err = %d\n",
dev->core->name, err);
}
mutex_unlock(&drv->core->lock);
}
return i ? 0 : -ENODEV;
......
......@@ -505,13 +505,10 @@ struct cx8802_driver {
int (*suspend)(struct pci_dev *pci_dev, pm_message_t state);
int (*resume)(struct pci_dev *pci_dev);
/* MPEG 8802 -> mini driver - Driver probe and configuration */
/* Caller must _not_ hold core->lock */
int (*probe)(struct cx8802_driver *drv);
/* Callers to the following functions must hold core->lock */
/* MPEG 8802 -> mini driver - Driver probe and configuration */
int (*probe)(struct cx8802_driver *drv);
int (*remove)(struct cx8802_driver *drv);
/* MPEG 8802 -> mini driver - Access for hardware control */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment