From patchwork Mon Aug 5 17:53:23 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Laurent Pinchart X-Patchwork-Id: 2838884 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id D61009F498 for ; Mon, 5 Aug 2013 17:53:24 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id BD6D720363 for ; Mon, 5 Aug 2013 17:53:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D46A220354 for ; Mon, 5 Aug 2013 17:53:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754428Ab3HERww (ORCPT ); Mon, 5 Aug 2013 13:52:52 -0400 Received: from perceval.ideasonboard.com ([95.142.166.194]:53135 "EHLO perceval.ideasonboard.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754240Ab3HERwi (ORCPT ); Mon, 5 Aug 2013 13:52:38 -0400 Received: from avalon.ideasonboard.com (cpc8-cmbg15-2-0-cust169.5-4.cable.virginmedia.com [86.30.140.170]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id 5501F35A6B; Mon, 5 Aug 2013 19:52:18 +0200 (CEST) From: Laurent Pinchart To: linux-media@vger.kernel.org Cc: linux-sh@vger.kernel.org, Hans Verkuil , Sakari Ailus , Katsuya MATSUBARA , Sylwester Nawrocki Subject: [PATCH v6 04/10] media: vb2: Take queue or device lock in vb2_fop_mmap() Date: Mon, 5 Aug 2013 19:53:23 +0200 Message-Id: <1375725209-2674-5-git-send-email-laurent.pinchart+renesas@ideasonboard.com> X-Mailer: git-send-email 1.8.1.5 In-Reply-To: <1375725209-2674-1-git-send-email-laurent.pinchart+renesas@ideasonboard.com> References: <1375725209-2674-1-git-send-email-laurent.pinchart+renesas@ideasonboard.com> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The vb2_fop_mmap() function is a plug-in implementation of the mmap() file operation that calls vb2_mmap() on the queue associated with the video device. Neither the vb2_fop_mmap() function nor the v4l2_mmap() mmap handler in the V4L2 core take any lock, leading to race conditions between mmap() and other buffer-related ioctls such as VIDIOC_REQBUFS. Fix it by taking the queue or device lock around the vb2_mmap() call. Signed-off-by: Laurent Pinchart --- drivers/media/v4l2-core/videobuf2-core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index 9fc4bab..bd4bade 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -2578,8 +2578,15 @@ EXPORT_SYMBOL_GPL(vb2_ioctl_expbuf); int vb2_fop_mmap(struct file *file, struct vm_area_struct *vma) { struct video_device *vdev = video_devdata(file); + struct mutex *lock = vdev->queue->lock ? vdev->queue->lock : vdev->lock; + int err; - return vb2_mmap(vdev->queue, vma); + if (lock && mutex_lock_interruptible(lock)) + return -ERESTARTSYS; + err = vb2_mmap(vdev->queue, vma); + if (lock) + mutex_unlock(lock); + return err; } EXPORT_SYMBOL_GPL(vb2_fop_mmap);