From: Sasha Levin Date: Wed, 31 Oct 2018 14:44:42 +0000 (-0400) Subject: queue media-uvcvideo-fix-driver-reference-counting.patch for 4.14 X-Git-Tag: v4.19.1~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=be8b84a0402dea49b8d52fb6a2423fbe1776a981;p=thirdparty%2Fkernel%2Fstable-queue.git queue media-uvcvideo-fix-driver-reference-counting.patch for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/media-uvcvideo-fix-driver-reference-counting.patch b/queue-4.14/media-uvcvideo-fix-driver-reference-counting.patch new file mode 100644 index 00000000000..053c51b1869 --- /dev/null +++ b/queue-4.14/media-uvcvideo-fix-driver-reference-counting.patch @@ -0,0 +1,72 @@ +From 2ffd23148e767bd3c9d9b2f218faba8c74deffb3 Mon Sep 17 00:00:00 2001 +From: Philipp Zabel +Date: Mon, 21 May 2018 06:24:58 -0400 +Subject: media: uvcvideo: Fix driver reference counting + +commit f9ffcb0a21e1fa8e64d09ed613d884e054ae8191 upstream + +kref_init initializes the reference count to 1, not 0. This additional +reference is never released since the conversion to reference counters. +As a result, uvc_delete is not called anymore when UVC cameras are +disconnected. +Fix this by adding an additional kref_put in uvc_disconnect and in the +probe error path. This also allows to remove the temporary additional +reference in uvc_unregister_video. + +Fixes: 9d15cd958c17 ("media: uvcvideo: Convert from using an atomic variable to a reference count") + +Signed-off-by: Philipp Zabel +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sudip Mukherjee +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 6d22b22cb35b..064d88299adc 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -1865,13 +1865,6 @@ static void uvc_unregister_video(struct uvc_device *dev) + { + struct uvc_streaming *stream; + +- /* Unregistering all video devices might result in uvc_delete() being +- * called from inside the loop if there's no open file handle. To avoid +- * that, increment the refcount before iterating over the streams and +- * decrement it when done. +- */ +- kref_get(&dev->ref); +- + list_for_each_entry(stream, &dev->streams, list) { + if (!video_is_registered(&stream->vdev)) + continue; +@@ -1880,8 +1873,6 @@ static void uvc_unregister_video(struct uvc_device *dev) + + uvc_debugfs_cleanup_stream(stream); + } +- +- kref_put(&dev->ref, uvc_delete); + } + + static int uvc_register_video(struct uvc_device *dev, +@@ -2129,6 +2120,7 @@ static int uvc_probe(struct usb_interface *intf, + + error: + uvc_unregister_video(dev); ++ kref_put(&dev->ref, uvc_delete); + return -ENODEV; + } + +@@ -2146,6 +2138,7 @@ static void uvc_disconnect(struct usb_interface *intf) + return; + + uvc_unregister_video(dev); ++ kref_put(&dev->ref, uvc_delete); + } + + static int uvc_suspend(struct usb_interface *intf, pm_message_t message) +-- +2.17.1 + diff --git a/queue-4.14/series b/queue-4.14/series index 7b71a66835a..915bab1c0ce 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -107,3 +107,4 @@ sch_netem-restore-skb-dev-after-dequeuing-from-the-r.patch mtd-spi-nor-add-support-for-is25wp-series-chips.patch kvm-x86-fix-warn-due-to-uninitialized-guest-fpu-stat.patch arm-dts-r8a7790-correct-critical-cpu-temperature.patch +media-uvcvideo-fix-driver-reference-counting.patch