mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-01-19 00:40:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

usb: gadget: uvc: Remove nested locking

Browse Source 
When handling error status from uvcg_video_usb_req_queue,
uvc_video_complete currently calls uvcg_queue_cancel with
video->req_lock held. uvcg_queue_cancel internally locks
queue->irqlock, which nests queue->irqlock inside
video->req_lock. This isn't a functional bug at the
moment, but does open up possibilities for ABBA
deadlocks in the future.

This patch fixes the accidental nesting by dropping
video->req_lock before calling uvcg_queue_cancel.

Fixes: 6acba0345b ("usb:gadget:uvc Do not use worker thread to pump isoc usb requests")
Signed-off-by: Avichal Rakesh <arakesh@google.com>
Link: https://lore.kernel.org/r/20240104215009.2252452-2-arakesh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Avichal Rakesh
2024-01-04 13:50:09 -08:00
committed by Greg Kroah-Hartman
parent fe814b5b0f
commit 9866dc4314
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/usb/gadget/function/uvc_video.c
View File

@@ -469,13 +469,15 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
* Put request back in req_free for it to be cleaned
* up later.
*/
uvcg_queue_cancel(queue, 0);
list_add_tail(&to_queue->list, &video->req_free);
}
} else {
uvc_video_free_request(ureq, ep);
ret = 0;
}
spin_unlock_irqrestore(&video->req_lock, flags);
if (ret < 0)
uvcg_queue_cancel(queue, 0);
}
static int