uvcvideo: Race on dev->state between uvc_disconnect() and uvc_v4l2_open()

[Eugene Shatokhin <eugene.shatokhin@rosalab.ru>]

Hi,

There is a race in uvcvideo module between uvc_disconnect() and 
uvc_v4l2_open() on dev->state. Checked and reproduced that with kernel 
4.1-rc1.

drivers/media/usb/uvc/uvc_driver.c, uvc_disconnect():

	dev->state |= UVC_DEV_DISCONNECTED;

drivers/media/usb/uvc/uvc_v4l2.c, uvc_v4l2_open():

	if (stream->dev->state & UVC_DEV_DISCONNECTED)
		return -ENODEV;

I checked that the race does happen by introducing a delay in 
uvc_disconnect() right before that assignment and armed a hardware 
breakpoint to detect the access to stream->dev->state from 
uvc_v4l2_open(). When I disconnected the webcam while Google Hangout was 
running, the hardware breakpoint triggered several times for that read 
in uvc_v4l2_open (uvc_v4l2.c:484). uvc_v4l2_open() was called in the 
context of GoogleTalkPlugin processes.

Not sure if the race is intentional but I guess, better to report it 
anyway. Nothing has crashed during my (brief) testing yet, but still.

Regards,

Eugene

-- 
Eugene Shatokhin, ROSA
www.rosalab.com