[media] V4L: soc-camera: protect hosts during probing from overzealous user-space

If multiple clients are registered on a single camera host interface,
the user-space hot-plug software can try to access the one, that probed
first, before probing of the second one has completed. This can be
handled by individual host drivers, but it is even better to hold back
the user-space until all the probing on this host has completed. This
fixes a race on ecovec with two clients registered on the CEU1 host, which
otherwise triggers a BUG() in sh_mobile_ceu_remove_device().

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index eb25756a07af3fdbc26b9993f153716cea0edc85..aedb970d13f6a8c962f274484bb52e64f876fc0d 100644 (file)
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -530,7 +530,10 @@ static int soc_camera_open(struct file *file)
                if (icl->reset)
                        icl->reset(icd->pdev);
 
+               /* Don't mess with the host during probe */
+               mutex_lock(&ici->host_lock);
                ret = ici->ops->add(icd);
+               mutex_unlock(&ici->host_lock);
                if (ret < 0) {
                        dev_err(icd->pdev, "Couldn't activate the camera: %d\n", ret);
                        goto eiciadd;
@@ -956,7 +959,7 @@ static void scan_add_host(struct soc_camera_host *ici)
 {
        struct soc_camera_device *icd;
 
-       mutex_lock(&list_lock);
+       mutex_lock(&ici->host_lock);
 
        list_for_each_entry(icd, &devices, list) {
                if (icd->iface == ici->nr) {
@@ -967,7 +970,7 @@ static void scan_add_host(struct soc_camera_host *ici)
                }
        }
 
-       mutex_unlock(&list_lock);
+       mutex_unlock(&ici->host_lock);
 }
 
 #ifdef CONFIG_I2C_BOARDINFO
@@ -1313,6 +1316,7 @@ int soc_camera_host_register(struct soc_camera_host *ici)
        list_add_tail(&ici->list, &hosts);
        mutex_unlock(&list_lock);
 
+       mutex_init(&ici->host_lock);
        scan_add_host(ici);
 
        return 0;

diff --git a/include/media/soc_camera.h b/include/media/soc_camera.h
index b5c2b6cb0d81078f23fb3a6c1c779e90e31b88ce..cad374bdcf4be14d9e1866748108149acb4115f8 100644 (file)
--- a/include/media/soc_camera.h
+++ b/include/media/soc_camera.h
@@ -59,7 +59,8 @@ struct soc_camera_device {
 struct soc_camera_host {
        struct v4l2_device v4l2_dev;
        struct list_head list;
-       unsigned char nr;                               /* Host number */
+       struct mutex host_lock;         /* Protect during probing */
+       unsigned char nr;               /* Host number */
        void *priv;
        const char *drv_name;
        struct soc_camera_host_ops *ops;