From: Laurent Pinchart Date: Sat, 1 Nov 2014 13:32:28 +0000 (-0300) Subject: [media] v4l: vb2: Fix race condition in _vb2_fop_release X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=69c0e9c547817fef14871bc5c4645fad683f242e;p=linux-beck.git [media] v4l: vb2: Fix race condition in _vb2_fop_release The function releases the queue if the file being released is the queue owner. The check reads the queue->owner field without taking the queue lock, creating a race condition with functions that set the queue owner, such as vb2_ioctl_reqbufs() for instance. Fix this by moving the queue->owner check within the mutex protected section. Signed-off-by: Laurent Pinchart Acked-by: Hans Verkuil Acked-by: Sylwester Nawrocki Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index 2685670b20ec..d09a8916e940 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -3389,14 +3389,14 @@ int _vb2_fop_release(struct file *file, struct mutex *lock) { struct video_device *vdev = video_devdata(file); + if (lock) + mutex_lock(lock); if (file->private_data == vdev->queue->owner) { - if (lock) - mutex_lock(lock); vb2_queue_release(vdev->queue); vdev->queue->owner = NULL; - if (lock) - mutex_unlock(lock); } + if (lock) + mutex_unlock(lock); return v4l2_fh_release(file); } EXPORT_SYMBOL_GPL(_vb2_fop_release);