mirror of
https://github.com/torvalds/linux.git
synced 2026-04-18 06:44:00 -04:00
dccc0c3ddf
Some rc device drivers have a race condition between rc_unregister_device() and irq or urb callbacks. This is because rc_unregister_device() does two things, it marks the device as unregistered so no new commands can be issued and then it calls rc_free_device(). This means the driver has no chance to cancel any pending urb callbacks or interrupts after the device has been marked as unregistered. Those callbacks may access struct rc_dev or its members (e.g. struct ir_raw_event_ctrl), which have been freed by rc_free_device(). This change removes the implicit call to rc_free_device() from rc_unregister_device(). This means that device drivers can call rc_unregister_device() in their remove or disconnect function, then cancel all the urbs and interrupts before explicitly calling rc_free_device(). Note this is an alternative fix for an issue found by Haotian Zhang, see the Closes: tags. Reported-by: Haotian Zhang <vulab@iscas.ac.cn> Closes: https://lore.kernel.org/linux-media/20251114101432.2566-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101418.2548-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101346.2530-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114090605.2413-1-vulab@iscas.ac.cn/ Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
78 lines
1.8 KiB
C
78 lines
1.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
Mantis PCI bridge driver
|
|
|
|
Copyright (C) Manu Abraham (abraham.manu@gmail.com)
|
|
|
|
*/
|
|
|
|
#include <media/rc-core.h>
|
|
#include <linux/pci.h>
|
|
|
|
#include <media/dmxdev.h>
|
|
#include <media/dvbdev.h>
|
|
#include <media/dvb_demux.h>
|
|
#include <media/dvb_frontend.h>
|
|
#include <media/dvb_net.h>
|
|
|
|
#include "mantis_common.h"
|
|
#include "mantis_input.h"
|
|
|
|
#define MODULE_NAME "mantis_core"
|
|
|
|
void mantis_input_process(struct mantis_pci *mantis, int scancode)
|
|
{
|
|
if (mantis->rc)
|
|
rc_keydown(mantis->rc, RC_PROTO_UNKNOWN, scancode, 0);
|
|
}
|
|
|
|
int mantis_input_init(struct mantis_pci *mantis)
|
|
{
|
|
struct rc_dev *dev;
|
|
int err;
|
|
|
|
dev = rc_allocate_device(RC_DRIVER_SCANCODE);
|
|
if (!dev) {
|
|
dprintk(MANTIS_ERROR, 1, "Remote device allocation failed");
|
|
err = -ENOMEM;
|
|
goto out;
|
|
}
|
|
|
|
snprintf(mantis->device_name, sizeof(mantis->device_name),
|
|
"Mantis %s IR receiver", mantis->hwconfig->model_name);
|
|
snprintf(mantis->input_phys, sizeof(mantis->input_phys),
|
|
"pci-%s/ir0", pci_name(mantis->pdev));
|
|
|
|
dev->device_name = mantis->device_name;
|
|
dev->input_phys = mantis->input_phys;
|
|
dev->input_id.bustype = BUS_PCI;
|
|
dev->input_id.vendor = mantis->vendor_id;
|
|
dev->input_id.product = mantis->device_id;
|
|
dev->input_id.version = 1;
|
|
dev->driver_name = MODULE_NAME;
|
|
dev->map_name = mantis->rc_map_name ? : RC_MAP_EMPTY;
|
|
dev->dev.parent = &mantis->pdev->dev;
|
|
|
|
err = rc_register_device(dev);
|
|
if (err) {
|
|
dprintk(MANTIS_ERROR, 1, "IR device registration failed, ret = %d", err);
|
|
goto out_dev;
|
|
}
|
|
|
|
mantis->rc = dev;
|
|
return 0;
|
|
|
|
out_dev:
|
|
rc_free_device(dev);
|
|
out:
|
|
return err;
|
|
}
|
|
EXPORT_SYMBOL_GPL(mantis_input_init);
|
|
|
|
void mantis_input_exit(struct mantis_pci *mantis)
|
|
{
|
|
rc_unregister_device(mantis->rc);
|
|
rc_free_device(mantis->rc);
|
|
}
|
|
EXPORT_SYMBOL_GPL(mantis_input_exit);
|