linux/drivers/media/usb
Shuah Khan ed940cd274 [media] au0828: fix au0828_v4l2_close() dev_state race condition
au0828_v4l2_close() check for dev_state == DEV_DISCONNECTED will fail to
detect the device disconnected state correctly, if au0828_v4l2_open() runs
to set the DEV_INITIALIZED bit. A loop test of bind/unbind found this bug
by increasing the likelihood of au0828_v4l2_open() occurring while unbind
is in progress. When au0828_v4l2_close() fails to detect that the device
is in disconnect state, it attempts to power down the device and fails with
the following general protection fault:

[  260.992962] Call Trace:
[  260.993008]  [<ffffffffa0f80f0f>] ? xc5000_sleep+0x8f/0xd0 [xc5000]
[  260.993095]  [<ffffffffa0f6803c>] ? fe_standby+0x3c/0x50 [tuner]
[  260.993186]  [<ffffffffa0ef541c>] au0828_v4l2_close+0x53c/0x620 [au0828]
[  260.993298]  [<ffffffffa0d08ec0>] v4l2_release+0xf0/0x210 [videodev]
[  260.993382]  [<ffffffff81570f9c>] __fput+0x1fc/0x6c0
[  260.993449]  [<ffffffff815714ce>] ____fput+0xe/0x10
[  260.993519]  [<ffffffff8116eb83>] task_work_run+0x133/0x1f0
[  260.993602]  [<ffffffff810035d0>] exit_to_usermode_loop+0x140/0x170
[  260.993681]  [<ffffffff810061ca>] syscall_return_slowpath+0x16a/0x1a0
[  260.993754]  [<ffffffff82835fb3>] entry_SYSCALL_64_fastpath+0xa6/0xa8

Cc: stable@vger.kernel.org
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-03-31 15:01:08 -03:00
..
airspy [media] airspy: fix bit set/clean mess on s->flags 2016-03-01 10:48:17 -03:00
as102 [media] drivers/media/usb/as102: constify as102_priv_ops_t structure 2016-02-01 07:31:48 -02:00
au0828 [media] au0828: fix au0828_v4l2_close() dev_state race condition 2016-03-31 15:01:08 -03:00
b2c2 [media] media: change email address 2016-01-25 12:01:08 -02:00
cpia2 [media] usb/cpia2_core: clean up a min_t() cast 2016-02-19 08:10:32 -02:00
cx231xx [media] media_device: move allocation out of media_device_*_init 2016-02-23 07:19:39 -03:00
dvb-usb [media] dw2102: add support for TeVii S662 2016-03-03 14:36:36 -03:00
dvb-usb-v2 [media] rtl2832: improve slave TS control 2016-03-03 09:26:49 -03:00
em28xx [media] em28xx: fix Terratec Grabby AC97 codec detection 2016-03-05 09:04:10 -03:00
go7007 [media] go7007: constify go7007_hpi_ops structures 2016-02-01 07:34:07 -02:00
gspca [media] touptek: cast char types on %x printk 2016-03-10 13:37:45 -03:00
hackrf Merge branch 'patchwork' into v4l_for_linus 2016-01-11 11:13:27 -02:00
hdpvr [media] hdpvr: hide unused variable 2016-02-01 13:14:27 -02:00
msi2500 [media] msi2500: Delete an unnecessary check in msi2500_set_usb_adc() 2016-01-25 15:15:39 -02:00
pvrusb2 [media] pvrusb2: don't go past buf array 2016-02-23 07:20:47 -03:00
pwc [media] pwc: Add USB id for Philips Spc880nc webcam 2016-02-01 10:21:10 -02:00
s2255 [media] media: videobuf2: Move timestamp to vb2_buffer 2015-12-18 13:53:31 -02:00
siano [media] media_device: move allocation out of media_device_*_init 2016-02-23 07:19:39 -03:00
stk1160 [media] stk1160: Remove redundant vb2_buf payload set 2016-02-01 07:37:20 -02:00
stkwebcam [media] stk-webcam: Delete an unnecessary check before the function call "vfree" 2015-03-02 14:53:27 -03:00
tm6000 [media] include/media: split I2C headers from V4L2 core 2015-11-17 06:57:11 -02:00
ttusb-budget [media] dvb: Get rid of typedev usage for enums 2015-06-09 17:47:35 -03:00
ttusb-dec [media] ttusb-dec: constify ttusbdecfe_config structure 2015-11-19 11:22:15 -02:00
usbtv [media] usbtv: correctly handling failed allocation 2016-02-01 07:42:00 -02:00
usbvision [media] usbvision: fix locking error 2016-02-02 14:28:56 -02:00
uvc [media] UVC: Add support for R200 depth camera 2016-03-03 06:49:20 -03:00
zr364xx [media] usb drivers: use BUG_ON() instead of if () BUG 2015-06-09 18:30:09 -03:00
Kconfig [media] tlg2300: move to staging in preparation for removal 2014-12-16 23:21:43 -02:00
Makefile [media] tlg2300: move to staging in preparation for removal 2014-12-16 23:21:43 -02:00