From patchwork Sat Aug 20 11:42:28 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Rankin X-Patchwork-Id: 1082592 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter2.kernel.org (8.14.4/8.14.4) with ESMTP id p7KBgfYJ032016 for ; Sat, 20 Aug 2011 11:42:41 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753475Ab1HTLmf (ORCPT ); Sat, 20 Aug 2011 07:42:35 -0400 Received: from nm2.bt.bullet.mail.ird.yahoo.com ([212.82.108.233]:27569 "HELO nm2.bt.bullet.mail.ird.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1753394Ab1HTLme (ORCPT ); Sat, 20 Aug 2011 07:42:34 -0400 Received: from [212.82.108.229] by nm2.bt.bullet.mail.ird.yahoo.com with NNFMP; 20 Aug 2011 11:42:33 -0000 Received: from [212.82.108.226] by tm2.bt.bullet.mail.ird.yahoo.com with NNFMP; 20 Aug 2011 11:42:32 -0000 Received: from [127.0.0.1] by omp1003.bt.mail.ird.yahoo.com with NNFMP; 20 Aug 2011 11:42:32 -0000 X-Yahoo-Newman-Id: 946908.83517.bm@omp1003.bt.mail.ird.yahoo.com Received: (qmail 78011 invoked from network); 20 Aug 2011 11:42:32 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=DKIM-Signature:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Received:Message-ID:Date:From:User-Agent:MIME-Version:To:CC:Subject:References:In-Reply-To:Content-Type; b=G/biIA2CQixe5+VrsN5QLaL7a4NUZdIiFMAcCweNmBE3ZpJNIgp/h/5ydDVQAjwGW/ZshcDJ76+XHr5z9P4P2tPtgmkTo5G5vmgZnTA4Hpq7/+Fv9YI+1zmstzbnQwT+sopzFNwcXXSCHzJ/ml3Z6DPh1WB9L//qC7CBdRhyrzc= ; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1313840552; bh=U6xmMRUd3Z33fXFPY3ILwaKhwQ3GRLpZ+eJvWJc8kkc=; h=X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:Received:Received:Message-ID:Date:From:User-Agent:MIME-Version:To:CC:Subject:References:In-Reply-To:Content-Type; b=FYw21LdufZZ6ipizOQ6EdWuLBzb8vGXBqTs5/6/F1Jq8pUmOX4xiQOI3x8OxYl6gvxlNAwa+7LIy9/vLawGBvfiJzTELilj3OneBoN3zP39qKKXiDWnMRnFE423dscgyW7ak8bFRgVpzdembyROBYPOY056pFvAIPrkJHPDYVHg= X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: liUADHAVM1mEsLAVy8bzYJBn8PeVlwlqnaAJhd0e_9DfqPV k4qEF_uLJQ31hdkm_vcqJuxW9tdJL.6Vz2nTuts1N4dba_VXfO8abw_XQNkD 4sM9LK306_BDmNJZu7MbeZ7vamryrHTzaFxDJQfCqmLbHNJSFWQNBbahWpIb I7vlq8YD2kUGjUp3JMizSUdYrOftpcNFr_BTUznY0mpR4RO1vJQ_thGJyXbp mgf09EZa7tjAa2iJC60hD2v1zYpTPLP5wt8qvMJOtnQ4273YCB6kwjcC0QJ8 OVgxN7eeQ7rDR9NuQf9buF1Ttq3x.XjAD2jvXctSXhUkMiB0RD1mb9YIv3I4 Uc.xAFYiRVUtK4xqIsZLh.0j9uRJrshU9iL3wk83gIhUwODjXouxD5Tv9HPK w_Q-- X-Yahoo-SMTP: dMK34oyswBBlfKesWTI5ovDjFOUFE6shtILt.ZXnUEjQHhWq Received: from wellhouse.underworld (rankincj@86.182.26.38 with login) by smtp821.mail.ukl.yahoo.com with SMTP; 20 Aug 2011 11:42:31 +0000 GMT Received: from volcano.underworld (volcano.underworld [192.168.0.3]) by wellhouse.underworld (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id p7KBgSlU011500 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Sat, 20 Aug 2011 12:42:30 +0100 Message-ID: <4E4F9DA4.90701@yahoo.com> Date: Sat, 20 Aug 2011 12:42:28 +0100 From: Chris Rankin User-Agent: Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20110707 Thunderbird/5.0 MIME-Version: 1.0 To: Mauro Carvalho Chehab CC: Devin Heitmueller , linux-media@vger.kernel.org, Antti Palosaari Subject: [PATCH 1/2] EM28xx - fix race on disconnect References: <4E4D5157.2080406@yahoo.com> <4E4D8DFD.5060800@yahoo.com> <4E4DFA65.4090508@redhat.com> In-Reply-To: <4E4DFA65.4090508@redhat.com> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Sat, 20 Aug 2011 11:42:41 +0000 (UTC) *Sigh* I overlooked two patches in the original numbering... This patch closes the race on the device and extension lists at USB disconnect time. Previously, the device was removed from the device list during em28xx_release_resources(), and then passed to the em28xx_close_extension() function so that all extensions could run their fini() operations. However, this left a (brief, theoretical, highly unlikely ;-)) window between these two calls during which a new module could call em28xx_register_extension(). The result would have been that the em28xx_usb_disconnect() function would also have passed the device to the new extension's fini() function, despite never having called the extension's init() function. This patch also restores em28xx_close_extension()'s symmetry with em28xx_init_extension(), and establishes the property that every device in the device list must have been initialised for every extension in the extension list. Signed-of-by: Chris Rankin --- linux-3.0/drivers/media/video/em28xx/em28xx-cards.c.orig 2011-08-19 00:23:17.000000000 +0100 +++ linux-3.0/drivers/media/video/em28xx/em28xx-cards.c 2011-08-19 00:32:40.000000000 +0100 @@ -2738,9 +2738,9 @@ #endif /* CONFIG_MODULES */ /* - * em28xx_realease_resources() + * em28xx_release_resources() * unregisters the v4l2,i2c and usb devices - * called when the device gets disconected or at module unload + * called when the device gets disconnected or at module unload */ void em28xx_release_resources(struct em28xx *dev) { @@ -2754,8 +2754,6 @@ em28xx_release_analog_resources(dev); - em28xx_remove_from_devlist(dev); - em28xx_i2c_unregister(dev); v4l2_device_unregister(&dev->v4l2_dev); @@ -3152,7 +3150,7 @@ /* * em28xx_usb_disconnect() - * called when the device gets diconencted + * called when the device gets disconnected * video device will be unregistered on v4l2_close in case it is still open */ static void em28xx_usb_disconnect(struct usb_interface *interface) --- linux-3.0/drivers/media/video/em28xx/em28xx-core.c.orig 2011-08-18 23:07:51.000000000 +0100 +++ linux-3.0/drivers/media/video/em28xx/em28xx-core.c 2011-08-19 00:27:00.000000000 +0100 @@ -1160,18 +1160,6 @@ static DEFINE_MUTEX(em28xx_devlist_mutex); /* - * em28xx_realease_resources() - * unregisters the v4l2,i2c and usb devices - * called when the device gets disconected or at module unload -*/ -void em28xx_remove_from_devlist(struct em28xx *dev) -{ - mutex_lock(&em28xx_devlist_mutex); - list_del(&dev->devlist); - mutex_unlock(&em28xx_devlist_mutex); -}; - -/* * Extension interface */ @@ -1221,14 +1209,13 @@ void em28xx_close_extension(struct em28xx *dev) { - struct em28xx_ops *ops = NULL; + const struct em28xx_ops *ops = NULL; mutex_lock(&em28xx_devlist_mutex); - if (!list_empty(&em28xx_extension_devlist)) { - list_for_each_entry(ops, &em28xx_extension_devlist, next) { - if (ops->fini) - ops->fini(dev); - } + list_for_each_entry(ops, &em28xx_extension_devlist, next) { + if (ops->fini) + ops->fini(dev); } + list_del(&dev->devlist); mutex_unlock(&em28xx_devlist_mutex); }