aboutsummaryrefslogtreecommitdiff
path: root/drivers/media/video/cx88/cx88-mpeg.c
diff options
context:
space:
mode:
authorJonathan Nieder <jrnieder@gmail.com>2011-05-01 06:29:56 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2011-05-20 09:29:37 -0300
commit1d6213ab995c61f7d1d81cf6cf876acf15d6e714 (patch)
tree72ebdfa1d65066a6cd5361ee605a48e2dfcda4b2 /drivers/media/video/cx88/cx88-mpeg.c
parent1fe70e963028f34ba5e32488a7870ff4b410b19b (diff)
[media] cx88: hold device lock during sub-driver initialization
cx8802_blackbird_probe makes a device node for the mpeg sub-device before it has been added to dev->drvlist. If the device is opened during that time, the open succeeds but request_acquire cannot be called, so the reference count remains zero. Later, when the device is closed, the reference count becomes negative --- uh oh. Close the race by holding core->lock during probe and not releasing until the device is in drvlist and initialization finished. Previously the BKL prevented this race. Reported-by: Andreas Huber <hobrom@gmx.at> Tested-by: Andi Huber <hobrom@gmx.at> Tested-by: Marlon de Boer <marlon@hyves.nl> Cc: stable@kernel.org Signed-off-by: Jonathan Nieder <jrnieder@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video/cx88/cx88-mpeg.c')
-rw-r--r--drivers/media/video/cx88/cx88-mpeg.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
index 91d3d179c3c..455290011d4 100644
--- a/drivers/media/video/cx88/cx88-mpeg.c
+++ b/drivers/media/video/cx88/cx88-mpeg.c
@@ -709,18 +709,17 @@ int cx8802_register_driver(struct cx8802_driver *drv)
drv->request_release = cx8802_request_release;
memcpy(driver, drv, sizeof(*driver));
+ mutex_lock(&drv->core->lock);
err = drv->probe(driver);
if (err == 0) {
i++;
- mutex_lock(&drv->core->lock);
list_add_tail(&driver->drvlist, &dev->drvlist);
- mutex_unlock(&drv->core->lock);
} else {
printk(KERN_ERR
"%s/2: cx8802 probe failed, err = %d\n",
dev->core->name, err);
}
-
+ mutex_unlock(&drv->core->lock);
}
return i ? 0 : -ENODEV;