diff options
| author | Maxim Levitsky <maximlevitsky@gmail.com> | 2007-09-27 20:34:09 -0300 |
|---|---|---|
| committer | Maxim Levitsky <maximlevitsky@gmail.com> | 2007-09-27 20:34:09 -0300 |
| commit | 82d4b0451edeb07b125ed306abb92247c8967178 (patch) | |
| tree | e2f2beb4c4a1212ba741a591442f3934dd52517e /linux/drivers/media/video/videobuf-core.c | |
| parent | 91692c5db5bac6c5a8d01a2351fd428726c265bc (diff) | |
| download | mediapointer-dvb-s2-82d4b0451edeb07b125ed306abb92247c8967178.tar.gz mediapointer-dvb-s2-82d4b0451edeb07b125ed306abb92247c8967178.tar.bz2 | |
V4L: Fix a lock inversion in generic videobuf code
videobuf_qbuf takes q->lock, and then calls
q->ops->buf_prepare which by design in all drivers calls
videobuf_iolock which calls videobuf_dma_init_user and this
takes current->mm->mmap_sem
on the other hand if user calls mumap from other thread, sys_munmap
takes current->mm->mmap_sem and videobuf_vm_close takes q->lock
Since this can occur only for V4L2_MEMORY_MMAP buffers, take
current->mm->mmap_sem in qbuf, before q->lock, and don't take
current->mm->mmap_sem videobuf_dma_init_user for those buffers
Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
http://thread.gmane.org/gmane.comp.video.video4linux/34978/focus=34981
Reviewed-by: Ricardo Cerqueira <v4l@cerqueira.org>
Diffstat (limited to 'linux/drivers/media/video/videobuf-core.c')
| -rw-r--r-- | linux/drivers/media/video/videobuf-core.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/linux/drivers/media/video/videobuf-core.c b/linux/drivers/media/video/videobuf-core.c index 3c402060d..aacced01e 100644 --- a/linux/drivers/media/video/videobuf-core.c +++ b/linux/drivers/media/video/videobuf-core.c @@ -350,6 +350,9 @@ int videobuf_qbuf(struct videobuf_queue *q, MAGIC_CHECK(q->int_ops->magic,MAGIC_QTYPE_OPS); + if (b->memory == V4L2_MEMORY_MMAP) + down_read(¤t->mm->mmap_sem); + mutex_lock(&q->lock); retval = -EBUSY; if (q->reading) { @@ -435,6 +438,10 @@ int videobuf_qbuf(struct videobuf_queue *q, done: mutex_unlock(&q->lock); + + if (b->memory == V4L2_MEMORY_MMAP) + up_read(¤t->mm->mmap_sem); + return retval; } |