linux-stable/include/media
Hans Verkuil a0d6e64b34 media: cec: fix a deadlock situation
commit a9e6107616 upstream.

The cec_devnode struct has a lock meant to serialize access
to the fields of this struct. This lock is taken during
device node (un)registration and when opening or releasing a
filehandle to the device node. When the last open filehandle
is closed the cec adapter might be disabled by calling the
adap_enable driver callback with the devnode.lock held.

However, if during that callback a message or event arrives
then the driver will call one of the cec_queue_event()
variants in cec-adap.c, and those will take the same devnode.lock
to walk the open filehandle list.

This obviously causes a deadlock.

This is quite easy to reproduce with the cec-gpio driver since that
uses the cec-pin framework which generated lots of events and uses
a kernel thread for the processing, so when adap_enable is called
the thread is still running and can generate events.

But I suspect that it might also happen with other drivers if an
interrupt arrives signaling e.g. a received message before adap_enable
had a chance to disable the interrupts.

This patch adds a new mutex to serialize access to the fhs list.
When adap_enable() is called the devnode.lock mutex is held, but
not devnode.lock_fhs. The event functions in cec-adap.c will now
use devnode.lock_fhs instead of devnode.lock, ensuring that it is
safe to call those functions from the adap_enable callback.

This specific issue only happens if the last open filehandle is closed
and the physical address is invalid. This is not something that
happens during normal operation, but it does happen when monitoring
CEC traffic (e.g. cec-ctl --monitor) with an unconfigured CEC adapter.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: <stable@vger.kernel.org>  # for v5.13 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-27 11:02:53 +01:00
..
davinci media: vpbe_osd.h/uvcvideo.h includes: fix trivial kernel-doc warnings 2021-03-22 10:24:07 +01:00
drv-intf ARM: s3c24xx: drop s3c-camif setup platform code 2020-08-19 20:57:32 +02:00
i2c media: media/i2c: fix kerneldoc issues for media i2c headers 2021-03-22 10:23:43 +01:00
tpg media: v4l2-tpg: Clamp hue in tpg_s_hue() 2020-08-26 18:51:34 +02:00
cec-notifier.h Update rmk's email address in various drivers 2020-04-21 17:50:09 +01:00
cec-pin.h media: cec-gpio: handle gpiod_get_value errors correctly 2020-04-29 12:04:38 +02:00
cec.h media: cec: fix a deadlock situation 2022-01-27 11:02:53 +01:00
demux.h
dmxdev.h
dvb-usb-ids.h media: dvbsky: add support for MyGica T230C2_LITE and T230A 2021-07-12 09:16:29 +02:00
dvb_ca_en50221.h
dvb_demux.h
dvb_frontend.h media: dvb_frontend.h: Fix shifting signed 32-bit value problem 2019-08-14 05:04:08 -03:00
dvb_math.h
dvb_net.h
dvb_ringbuffer.h
dvb_vb2.h
dvbdev.h media: dvbdev: Switch to new kerneldoc syntax for named variable macro argument 2021-03-11 11:59:45 +01:00
frame_vector.h media: videobuf2: Move frame_vector into media subsystem 2021-01-12 14:15:31 +01:00
hevc-ctrls.h media: hevc: Add segment address field 2021-07-12 09:16:32 +02:00
imx.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
media-dev-allocator.h media: Fix Media Controller API config checks 2021-06-24 14:26:00 +02:00
media-device.h media: media-device.h: drop duplicated word in comment 2020-07-19 14:00:07 +02:00
media-devnode.h media: media-devnode.h: drop duplicated word in comment 2020-07-19 14:00:12 +02:00
media-entity.h media: entity: Add lockdep check to media graph walk 2021-04-06 14:35:14 +02:00
media-request.h media: media requests: return EBADR instead of EACCES 2019-03-25 13:26:10 -04:00
rc-core.h media: rc: rename s_learning_mode() to s_wideband_receiver() 2021-07-22 08:21:53 +02:00
rc-map.h media: rc: add keymap for Toshiba CT-90405 remote 2021-06-08 15:56:58 +02:00
rcar-fcp.h
tuner-types.h
tuner.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tveeprom.h
v4l2-async.h media: Documentation: media: Fix v4l2-async kerneldoc syntax 2021-08-04 14:43:50 +02:00
v4l2-common.h media: v4l: common: Fix naming of v4l2_get_link_rate 2021-01-07 15:47:52 +01:00
v4l2-ctrls.h media: uapi: move MPEG-2 stateless controls out of staging 2021-05-23 19:21:31 +02:00
v4l2-dev.h media: fix kernel-doc markups 2020-11-16 10:31:16 +01:00
v4l2-device.h media: fix kernel-doc markups 2020-11-16 10:31:16 +01:00
v4l2-dv-timings.h media: fix kernel-doc markups 2020-11-16 10:31:16 +01:00
v4l2-event.h media: v4l2-dev/event: add v4l2_event_wake_all() 2021-01-04 13:14:25 +01:00
v4l2-fh.h media: v4l2-fh: define v4l2_fh struct regardless of condition 2020-04-21 13:40:06 +02:00
v4l2-flash-led-class.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
v4l2-fwnode.h media: v4l: fwnode: Rename and make static V4L2 async notifier helper 2021-04-06 14:35:59 +02:00
v4l2-h264.h media: core headers: fix kernel-doc warnings 2021-03-22 10:22:22 +01:00
v4l2-image-sizes.h media: v4l2-image-sizes: add HD and Full-HD definitions 2020-04-21 17:21:51 +02:00
v4l2-ioctl.h media: v4l2: prepare compat-ioctl rework 2020-11-16 10:31:05 +01:00
v4l2-jpeg.h media: Add parsing for APP14 data segment in jpeg helpers 2021-03-22 10:35:36 +01:00
v4l2-mc.h media: v4l2-mc: Add link flags to v4l2_create_fwnode_links_to_pad() 2021-03-11 11:59:52 +01:00
v4l2-mediabus.h media: fix kernel-doc markups 2020-11-16 10:31:16 +01:00
v4l2-mem2mem.h media: v4l2-mem2mem: add v4l2_m2m_suspend, v4l2_m2m_resume 2020-08-28 15:20:40 +02:00
v4l2-rect.h media: v4l2-rect.h: add enclosed rectangle helper 2020-07-04 12:29:38 +02:00
v4l2-subdev.h media: v4l: subdev: Add pre_streamon and post_streamoff callbacks 2021-08-04 14:43:51 +02:00
videobuf-core.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 237 2019-06-19 17:09:07 +02:00
videobuf-dma-contig.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 237 2019-06-19 17:09:07 +02:00
videobuf-dma-sg.h media: videobuf-dma-sg: number of pages should be unsigned long 2020-09-03 11:12:20 +02:00
videobuf-vmalloc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 237 2019-06-19 17:09:07 +02:00
videobuf2-core.h media: videobuf2: rework vb2_mem_ops API 2021-11-18 19:16:13 +01:00
videobuf2-dma-contig.h media: videobuf2-dma-contig: fix bad kfree in vb2_dma_contig_clear_max_seg_size 2020-06-11 19:20:55 +02:00
videobuf2-dma-sg.h media: Change Andrzej Pietrasiewicz's e-mail address 2019-01-16 11:21:07 -05:00
videobuf2-dvb.h
videobuf2-memops.h media: videobuf2-vmalloc: get_userptr: buffers are always writable 2019-05-29 08:05:58 -04:00
videobuf2-v4l2.h media: videobuf2-v4l2.c: add vb2_queue_change_type() helper 2021-06-08 12:04:08 +02:00
videobuf2-vmalloc.h
vsp1.h media: vsp1: drm: Implement writeback support 2019-03-18 17:24:14 +02:00