[PATCH] media: dvb-core: remove active network interfaces on release

[Shuangpeng Bai <shuangpeng.kernel@gmail.com>]

dvb_net_release() marks the DVB net instance as exiting and then calls
dvb_net_remove_if() for each network interface.  The latter rejects an
interface while it is in use, but the release path cannot propagate the
result and leaves the netdev registered and its feed active.  Callers may
then proceed to tear down the demux and driver resources on which that feed
depends.

In ttusb-budget, a concurrent netdev open can be starting an isochronous
feed while disconnect passes the failed interface removal and frees the
driver's URBs.  If URB submission fails, the feed-start error path can then
call usb_kill_urb() on an URB freed by disconnect.

Keep returning -EBUSY when userspace explicitly requests removal of an
active interface, but use the exit state to let the final release proceed.
Unregister the netdev first so the networking core blocks new opens,
synchronizes with an open already in progress, and invokes ndo_stop for an
active interface.  Wait for the feed-management work to finish before
freeing the netdev.  Since set_multicast_list_wq can restart a feed after
ndo_stop(), stop any feed left by a completed work item.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/media/dvb-core/dvb_net.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index a2159b2bc176..a5726a006bc1 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -1404,18 +1404,26 @@ static int dvb_net_remove_if(struct dvb_net *dvbnet, unsigned long num)
 {
 	struct net_device *net = dvbnet->device[num];
 	struct dvb_net_priv *priv;
+	bool exiting;
 
 	if (!dvbnet->state[num])
 		return -EINVAL;
 	priv = netdev_priv(net);
-	if (priv->in_use)
+	mutex_lock(&dvbnet->remove_mutex);
+	exiting = dvbnet->exit;
+	mutex_unlock(&dvbnet->remove_mutex);
+	if (priv->in_use && !exiting)
 		return -EBUSY;
 
-	dvb_net_stop(net);
-	flush_work(&priv->set_multicast_list_wq);
-	flush_work(&priv->restart_net_feed_wq);
 	pr_info("removed network interface %s\n", net->name);
 	unregister_netdev(net);
+	flush_work(&priv->set_multicast_list_wq);
+	flush_work(&priv->restart_net_feed_wq);
+	/*
+	 * set_multicast_list_wq may have restarted a feed after ndo_stop().
+	 */
+	if (priv->secfeed || priv->tsfeed)
+		dvb_net_feed_stop(net);
 	dvbnet->state[num]=0;
 	dvbnet->device[num] = NULL;
 	free_netdev(net);
-- 
2.43.0