[media] s5p-fimc: Prevent race conditions during subdevs registration

Make sure when fimc and fimc-lite capture video node is registered
it has valid pipeline_ops assigned to it. Otherwise when a video
node is opened right after is was registered there, might be an
attempt to use ops that are just being assigned, after function
v4l2_device_register_subdev() returns.

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/platform/s5p-fimc/fimc-capture.c b/drivers/media/platform/s5p-fimc/fimc-capture.c
index 3d39d97abaa5ab3a35a4c89f20338848efc174b9..3fc896b8eeae76002875e98475f448d88efd7dd0 100644 (file)
--- a/drivers/media/platform/s5p-fimc/fimc-capture.c
+++ b/drivers/media/platform/s5p-fimc/fimc-capture.c
@@ -1774,9 +1774,13 @@ static int fimc_capture_subdev_registered(struct v4l2_subdev *sd)
        if (ret)
                return ret;
 
+       fimc->pipeline_ops = v4l2_get_subdev_hostdata(sd);
+
        ret = fimc_register_capture_device(fimc, sd->v4l2_dev);
-       if (ret)
+       if (ret) {
                fimc_unregister_m2m_device(fimc);
+               fimc->pipeline_ops = NULL;
+       }
 
        return ret;
 }
@@ -1793,6 +1797,7 @@ static void fimc_capture_subdev_unregistered(struct v4l2_subdev *sd)
        if (video_is_registered(&fimc->vid_cap.vfd)) {
                video_unregister_device(&fimc->vid_cap.vfd);
                media_entity_cleanup(&fimc->vid_cap.vfd.entity);
+               fimc->pipeline_ops = NULL;
        }
        kfree(fimc->vid_cap.ctx);
        fimc->vid_cap.ctx = NULL;

diff --git a/drivers/media/platform/s5p-fimc/fimc-lite.c b/drivers/media/platform/s5p-fimc/fimc-lite.c
index 9db246bed841abc4622433d82f668e801e0cf3d7..23f203e8a7d3b5b4b929c01f92b44712bdb3ec04 100644 (file)
--- a/drivers/media/platform/s5p-fimc/fimc-lite.c
+++ b/drivers/media/platform/s5p-fimc/fimc-lite.c
@@ -1263,10 +1263,12 @@ static int fimc_lite_subdev_registered(struct v4l2_subdev *sd)
                return ret;
 
        video_set_drvdata(vfd, fimc);
+       fimc->pipeline_ops = v4l2_get_subdev_hostdata(sd);
 
        ret = video_register_device(vfd, VFL_TYPE_GRABBER, -1);
        if (ret < 0) {
                media_entity_cleanup(&vfd->entity);
+               fimc->pipeline_ops = NULL;
                return ret;
        }
 
@@ -1285,6 +1287,7 @@ static void fimc_lite_subdev_unregistered(struct v4l2_subdev *sd)
        if (video_is_registered(&fimc->vfd)) {
                video_unregister_device(&fimc->vfd);
                media_entity_cleanup(&fimc->vfd.entity);
+               fimc->pipeline_ops = NULL;
        }
 }
 

diff --git a/drivers/media/platform/s5p-fimc/fimc-mdevice.c b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
index 38ea4d143a496cee415af614d0cf6f259560182a..0531ab70a94c42e512165d4bd3cfb5f117973d19 100644 (file)
--- a/drivers/media/platform/s5p-fimc/fimc-mdevice.c
+++ b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
@@ -352,6 +352,7 @@ static int fimc_register_callback(struct device *dev, void *p)
 
        sd = &fimc->vid_cap.subdev;
        sd->grp_id = FIMC_GROUP_ID;
+       v4l2_set_subdev_hostdata(sd, (void *)&fimc_pipeline_ops);
 
        ret = v4l2_device_register_subdev(&fmd->v4l2_dev, sd);
        if (ret) {
@@ -360,7 +361,6 @@ static int fimc_register_callback(struct device *dev, void *p)
                return ret;
        }
 
-       fimc->pipeline_ops = &fimc_pipeline_ops;
        fmd->fimc[fimc->id] = fimc;
        return 0;
 }
@@ -375,6 +375,7 @@ static int fimc_lite_register_callback(struct device *dev, void *p)
                return 0;
 
        fimc->subdev.grp_id = FLITE_GROUP_ID;
+       v4l2_set_subdev_hostdata(&fimc->subdev, (void *)&fimc_pipeline_ops);
 
        ret = v4l2_device_register_subdev(&fmd->v4l2_dev, &fimc->subdev);
        if (ret) {
@@ -384,7 +385,6 @@ static int fimc_lite_register_callback(struct device *dev, void *p)
                return ret;
        }
 
-       fimc->pipeline_ops = &fimc_pipeline_ops;
        fmd->fimc_lite[fimc->index] = fimc;
        return 0;
 }