[media] v4l: vb2: Fix race condition in _vb2_fop_release
authorLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Sat, 1 Nov 2014 13:32:28 +0000 (10:32 -0300)
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>
Thu, 4 Dec 2014 14:41:51 +0000 (12:41 -0200)
The function releases the queue if the file being released is the queue
owner. The check reads the queue->owner field without taking the queue
lock, creating a race condition with functions that set the queue owner,
such as vb2_ioctl_reqbufs() for instance.

Fix this by moving the queue->owner check within the mutex protected
section.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/v4l2-core/videobuf2-core.c

index 2685670b20ecc5c5ea0bacdb2cca1eeb42d8feed..d09a8916e94005180f0f6beaf0ff53d7b2e932a4 100644 (file)
@@ -3389,14 +3389,14 @@ int _vb2_fop_release(struct file *file, struct mutex *lock)
 {
        struct video_device *vdev = video_devdata(file);
 
+       if (lock)
+               mutex_lock(lock);
        if (file->private_data == vdev->queue->owner) {
-               if (lock)
-                       mutex_lock(lock);
                vb2_queue_release(vdev->queue);
                vdev->queue->owner = NULL;
-               if (lock)
-                       mutex_unlock(lock);
        }
+       if (lock)
+               mutex_unlock(lock);
        return v4l2_fh_release(file);
 }
 EXPORT_SYMBOL_GPL(_vb2_fop_release);