github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work

Browse Source 
If a UVC camera has an asynchronous control, uvc_status_stop may be
called from async_ctrl.work:

uvc_ctrl_status_event_work()
    uvc_ctrl_status_event()
        uvc_ctrl_clear_handle()
	    uvc_pm_put()
	        uvc_status_put()
		    uvc_status_stop()
		        cancel_work_sync()

This will cause a deadlock, since cancel_work_sync will wait for
uvc_ctrl_status_event_work to complete before returning.

Fix this by returning early from uvc_status_stop if we are currently in
the work function. flush_status now remains false until uvc_status_start
is called again, ensuring that uvc_ctrl_status_event_work won't resubmit
the URB.

Fixes: a32d9c41bd ("media: uvcvideo: Make power management granular")
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/all/6733bdfb-3e88-479f-8956-ab09c04c433e@linux.dev/
Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
Link: https://patch.msgid.link/20260316155823.1855434-1-sean.anderson@linux.dev
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Tested-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Sean Anderson 2026-03-16 11:58:22 -04:00 committed by Hans Verkuil
parent 940f161f73
commit 6d27f92c54
1 changed files with 19 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/media/usb/uvc/uvc_status.c
View File

@ -316,6 +316,16 @@ static int uvc_status_start(struct uvc_device *dev, gfp_t flags)
if (!dev->int_urb)
return 0;
/*
* If the previous uvc_status_stop() call was from the async work,
* the work may still be running. Wait for it to finish before we submit
* the urb.
*/
flush_work(&dev->async_ctrl.work);
/* Clear the flush status if we were previously stopped. */
smp_store_release(&dev->flush_status, false);
return usb_submit_urb(dev->int_urb, flags);
}
@ -336,6 +346,15 @@ static void uvc_status_stop(struct uvc_device *dev)
*/
smp_store_release(&dev->flush_status, true);
/*
* If we are called from the event work function, the URB is guaranteed
* to not be in flight as it has completed and has not been resubmitted.
* There's no need to cancel the work (which would deadlock), or to kill
* the URB.
*/
if (current_work() == &w->work)
return;
/*
* Cancel any pending asynchronous work. If any status event was queued,
* process it synchronously.
@ -354,15 +373,6 @@ static void uvc_status_stop(struct uvc_device *dev)
*/
if (cancel_work_sync(&w->work))
uvc_ctrl_status_event(w->chain, w->ctrl, w->data);
/*
* From this point, there are no events on the queue and the status URB
* is dead. No events will be queued until uvc_status_start() is called.
* The barrier is needed to make sure that flush_status is visible to
* uvc_ctrl_status_event_work() when uvc_status_start() will be called
* again.
*/
smp_store_release(&dev->flush_status, false);
}
int uvc_status_resume(struct uvc_device *dev)