From patchwork Thu Jan 10 10:04:55 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Oliver Neukum X-Patchwork-Id: 16201 Received: from mail.tu-berlin.de ([130.149.7.33]) by www.linuxtv.org with esmtp (Exim 4.72) (envelope-from ) id 1TtF0V-0002xk-Om; Thu, 10 Jan 2013 11:05:07 +0100 X-tubIT-Incoming-IP: 209.132.180.67 Received: from vger.kernel.org ([209.132.180.67]) by mail.tu-berlin.de (exim-4.75/mailfrontend-3) with esmtp id 1TtF0V-0006ha-Cy; Thu, 10 Jan 2013 11:05:07 +0100 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752777Ab3AJKFB (ORCPT + 1 other); Thu, 10 Jan 2013 05:05:01 -0500 Received: from smtp-out002.kontent.com ([81.88.40.216]:44675 "EHLO smtp-out002.kontent.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752130Ab3AJKFA (ORCPT ); Thu, 10 Jan 2013 05:05:00 -0500 Received: from linux-5eaq.site (p4FFB02F7.dip.t-dialin.net [79.251.2.247]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: neukum_org@smtp-out002.kontent.com) by smtp-out002.kontent.com (Postfix) with ESMTPSA id 9C3C210038211; Thu, 10 Jan 2013 11:04:58 +0100 (CET) From: Oliver Neukum To: linux-usb@vger.kernel.org, laurent.pinchart@ideasonboard.com, tom.leiming@gmail.com, linux-media@vger.kernel.org Cc: Oliver Neukum Subject: [PATCH] uvc: fix race of open and suspend in error case Date: Thu, 10 Jan 2013 11:04:55 +0100 Message-Id: <1357812295-21174-1-git-send-email-oliver@neukum.org> X-Mailer: git-send-email 1.7.10.4 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-PMX-Version: 5.6.1.2065439, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2013.1.10.95717 X-PMX-Spam: Gauge=IIIIIIII, Probability=8%, Report=' HTML_00_01 0.05, HTML_00_10 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1200_1299 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, URI_ENDS_IN_HTML 0, __ANY_URI 0, __CP_URI_IN_BODY 0, __HAS_FROM 0, __HAS_MSGID 0, __HAS_X_MAILER 0, __HAS_X_MAILING_LIST 0, __MIME_TEXT_ONLY 0, __SANE_MSGID 0, __SUBJ_ALPHA_END 0, __TO_MALFORMED_2 0, __TO_NO_NAME 0, __URI_NO_WWW 0, __URI_NS ' Ming Lei reported: IMO, there is a minor fault in the error handling path of uvc_status_start() inside uvc_v4l2_open(), and the 'users' count should have been decreased before usb_autopm_put_interface(). In theory, the warning can be triggered when the device is opened just between usb_autopm_put_interface() and atomic_dec(&stream->dev->users). The fix is trivial. Signed-off-by:Oliver Neukum Reported-by: Ming Lei Signed-off-by: Oliver Neukum Signed-off-by: Laurent Pinchart --- drivers/media/usb/uvc/uvc_v4l2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index f2ee8c6..74937b7 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -501,8 +501,8 @@ static int uvc_v4l2_open(struct file *file) if (atomic_inc_return(&stream->dev->users) == 1) { ret = uvc_status_start(stream->dev); if (ret < 0) { - usb_autopm_put_interface(stream->dev->intf); atomic_dec(&stream->dev->users); + usb_autopm_put_interface(stream->dev->intf); kfree(handle); return ret; }