From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm1-f47.google.com ([209.85.128.47]:37302 "EHLO mail-wm1-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726277AbeJWSTM (ORCPT ); Tue, 23 Oct 2018 14:19:12 -0400 Received: by mail-wm1-f47.google.com with SMTP id x19-v6so1086653wmc.2 for ; Tue, 23 Oct 2018 02:56:31 -0700 (PDT) Date: Tue, 23 Oct 2018 10:56:27 +0100 From: Sudip Mukherjee To: Greg Kroah-Hartman Cc: stable@vger.kernel.org, Philipp Zabel , Laurent Pinchart , Mauro Carvalho Chehab Subject: request for 4.14-stable: f9ffcb0a21e1 ("media: uvcvideo: Fix driver reference counting") Message-ID: <20181023095627.eehhvdgcwlpdtpkw@debian> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="5a6fz6ikid527kz2" Content-Disposition: inline Sender: stable-owner@vger.kernel.org List-ID: --5a6fz6ikid527kz2 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hi Greg, This was not marked for stable but seems it should be in stable. Please apply to your queue of 4.14-stable. -- Regards Sudip --5a6fz6ikid527kz2 Content-Type: text/x-diff; charset=us-ascii Content-Disposition: attachment; filename="0001-media-uvcvideo-Fix-driver-reference-counting.patch" >>From 58961baf4f29165ac293b11bd0e296e9d65e7c0b Mon Sep 17 00:00:00 2001 From: Philipp Zabel Date: Mon, 21 May 2018 06:24:58 -0400 Subject: [PATCH] media: uvcvideo: Fix driver reference counting commit f9ffcb0a21e1fa8e64d09ed613d884e054ae8191 upstream kref_init initializes the reference count to 1, not 0. This additional reference is never released since the conversion to reference counters. As a result, uvc_delete is not called anymore when UVC cameras are disconnected. Fix this by adding an additional kref_put in uvc_disconnect and in the probe error path. This also allows to remove the temporary additional reference in uvc_unregister_video. Fixes: 9d15cd958c17 ("media: uvcvideo: Convert from using an atomic variable to a reference count") Signed-off-by: Philipp Zabel Reviewed-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sudip Mukherjee --- drivers/media/usb/uvc/uvc_driver.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index 6d22b22cb35b..064d88299adc 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1865,13 +1865,6 @@ static void uvc_unregister_video(struct uvc_device *dev) { struct uvc_streaming *stream; - /* Unregistering all video devices might result in uvc_delete() being - * called from inside the loop if there's no open file handle. To avoid - * that, increment the refcount before iterating over the streams and - * decrement it when done. - */ - kref_get(&dev->ref); - list_for_each_entry(stream, &dev->streams, list) { if (!video_is_registered(&stream->vdev)) continue; @@ -1880,8 +1873,6 @@ static void uvc_unregister_video(struct uvc_device *dev) uvc_debugfs_cleanup_stream(stream); } - - kref_put(&dev->ref, uvc_delete); } static int uvc_register_video(struct uvc_device *dev, @@ -2129,6 +2120,7 @@ static int uvc_probe(struct usb_interface *intf, error: uvc_unregister_video(dev); + kref_put(&dev->ref, uvc_delete); return -ENODEV; } @@ -2146,6 +2138,7 @@ static void uvc_disconnect(struct usb_interface *intf) return; uvc_unregister_video(dev); + kref_put(&dev->ref, uvc_delete); } static int uvc_suspend(struct usb_interface *intf, pm_message_t message) -- 2.11.0 --5a6fz6ikid527kz2--