Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2dd54a54 authored by Guennadi Liakhovetski's avatar Guennadi Liakhovetski Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (12424): soc-camera: fix recursive locking in .buf_queue() 



The .buf_queue() V4L2 driver method is called under
spinlock_irqsave(q->irqlock,...), don't take the lock again inside the
function.

Reported-by: default avatarAntonio Ospite <ospite@studenti.unina.it>
Signed-off-by: default avatarGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 7d2e2e35

drivers/media/video/mx1_camera.c

+1 −5
Original line number Diff line number Diff line
@@ -234,6 +234,7 @@ static int mx1_camera_setup_dma(struct mx1_camera_dev *pcdev) 
	return ret;

}



/* Called under spinlock_irqsave(&pcdev->lock, ...) */

static void mx1_videobuf_queue(struct videobuf_queue *vq,

						struct videobuf_buffer *vb)

{
@@ -241,13 +242,10 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq, 
	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);

	struct mx1_camera_dev *pcdev = ici->priv;

	struct mx1_buffer *buf = container_of(vb, struct mx1_buffer, vb);

	unsigned long flags;



	dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,

		vb, vb->baddr, vb->bsize);



	spin_lock_irqsave(&pcdev->lock, flags);



	list_add_tail(&vb->queue, &pcdev->capture);



	vb->state = VIDEOBUF_ACTIVE;
@@ -264,8 +262,6 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq, 
			__raw_writel(temp, pcdev->base + CSICR1);

		}

	}



	spin_unlock_irqrestore(&pcdev->lock, flags);

}



static void mx1_videobuf_release(struct videobuf_queue *vq,

drivers/media/video/mx3_camera.c

+10 −9
Original line number Diff line number Diff line
@@ -332,7 +332,10 @@ static enum pixel_fmt fourcc_to_ipu_pix(__u32 fourcc) 
	}

}



/* Called with .vb_lock held */

/*

 * Called with .vb_lock mutex held and

 * under spinlock_irqsave(&mx3_cam->lock, ...)

 */

static void mx3_videobuf_queue(struct videobuf_queue *vq,

			       struct videobuf_buffer *vb)

{
@@ -346,7 +349,8 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq, 
	struct idmac_video_param *video = &ichan->params.video;

	const struct soc_camera_data_format *data_fmt = icd->current_fmt;

	dma_cookie_t cookie;

	unsigned long flags;



	BUG_ON(!irqs_disabled());



	/* This is the configuration of one sg-element */

	video->out_pixel_fmt	= fourcc_to_ipu_pix(data_fmt->fourcc);
@@ -359,8 +363,6 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq, 
	memset((void *)vb->baddr, 0xaa, vb->bsize);

#endif



	spin_lock_irqsave(&mx3_cam->lock, flags);



	list_add_tail(&vb->queue, &mx3_cam->capture);



	if (!mx3_cam->active) {
@@ -370,24 +372,23 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq, 
		vb->state = VIDEOBUF_QUEUED;

	}



	spin_unlock_irqrestore(&mx3_cam->lock, flags);

	spin_unlock_irq(&mx3_cam->lock);



	cookie = txd->tx_submit(txd);

	dev_dbg(&icd->dev, "Submitted cookie %d DMA 0x%08x\n", cookie, sg_dma_address(&buf->sg));



	spin_lock_irq(&mx3_cam->lock);



	if (cookie >= 0)

		return;



	/* Submit error */

	vb->state = VIDEOBUF_PREPARED;



	spin_lock_irqsave(&mx3_cam->lock, flags);



	list_del_init(&vb->queue);



	if (mx3_cam->active == buf)

		mx3_cam->active = NULL;



	spin_unlock_irqrestore(&mx3_cam->lock, flags);

}



/* Called with .vb_lock held */

drivers/media/video/pxa_camera.c

+1 −5
Original line number Diff line number Diff line
@@ -612,6 +612,7 @@ static void pxa_camera_stop_capture(struct pxa_camera_dev *pcdev) 
	dev_dbg(pcdev->soc_host.dev, "%s\n", __func__);

}



/* Called under spinlock_irqsave(&pcdev->lock, ...) */

static void pxa_videobuf_queue(struct videobuf_queue *vq,

			       struct videobuf_buffer *vb)

{
@@ -619,13 +620,10 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq, 
	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);

	struct pxa_camera_dev *pcdev = ici->priv;

	struct pxa_buffer *buf = container_of(vb, struct pxa_buffer, vb);

	unsigned long flags;



	dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d active=%p\n", __func__,

		vb, vb->baddr, vb->bsize, pcdev->active);



	spin_lock_irqsave(&pcdev->lock, flags);



	list_add_tail(&vb->queue, &pcdev->capture);



	vb->state = VIDEOBUF_ACTIVE;
@@ -633,8 +631,6 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq, 


	if (!pcdev->active)

		pxa_camera_start_capture(pcdev);



	spin_unlock_irqrestore(&pcdev->lock, flags);

}



static void pxa_videobuf_release(struct videobuf_queue *vq,

drivers/media/video/sh_mobile_ceu_camera.c

+1 −4
Original line number Diff line number Diff line
@@ -282,27 +282,24 @@ static int sh_mobile_ceu_videobuf_prepare(struct videobuf_queue *vq, 
	return ret;

}



/* Called under spinlock_irqsave(&pcdev->lock, ...) */

static void sh_mobile_ceu_videobuf_queue(struct videobuf_queue *vq,

					 struct videobuf_buffer *vb)

{

	struct soc_camera_device *icd = vq->priv_data;

	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);

	struct sh_mobile_ceu_dev *pcdev = ici->priv;

	unsigned long flags;



	dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %zd\n", __func__,

		vb, vb->baddr, vb->bsize);



	vb->state = VIDEOBUF_QUEUED;

	spin_lock_irqsave(&pcdev->lock, flags);

	list_add_tail(&vb->queue, &pcdev->capture);



	if (!pcdev->active) {

		pcdev->active = vb;

		sh_mobile_ceu_capture(pcdev);

	}



	spin_unlock_irqrestore(&pcdev->lock, flags);

}



static void sh_mobile_ceu_videobuf_release(struct videobuf_queue *vq,