[media] pwc: better usb disconnect handling

Unplugging a pwc cam while an app has the /dev/video# node open leads
to an oops in pwc_video_close when the app closes the node, because
the disconnect handler has free-ed the pdev struct pwc_video_close
tries to use. Instead of adding some sort of bandaid for this.
fix it properly using the v4l2 core's new(ish) behavior of keeping the
v4l2_dev structure around until both unregister has been called, and
all file handles referring  to it have been closed:

Embed the v4l2_dev structure in the pdev structure and define a v4l2 dev
release callback releasing the pdev structure (and thus also the embedded
v4l2 dev structure.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

3 files changed, 50 insertions, 108 deletions

diff --git a/drivers/media/video/pwc/pwc-ctrl.c b/drivers/media/video/pwc/pwc-ctrl.c
index 1593f8deb810..760b4de13adf 100644
--- a/drivers/media/video/pwc/pwc-ctrl.c
+++ b/drivers/media/video/pwc/pwc-ctrl.c
@@ -1414,7 +1414,7 @@ long pwc_ioctl(struct pwc_device *pdev, unsigned int cmd, void *arg)
         {
                 ARG_DEF(struct pwc_probe, probe)
 
-                strcpy(ARGR(probe).name, pdev->vdev->name);
+                strcpy(ARGR(probe).name, pdev->vdev.name);
                 ARGR(probe).type = pdev->type;
                 ARG_OUT(probe)
                 break;
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index 356cd42b593b..b0bde5a87c8a 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -40,7 +40,7 @@
    Oh yes, convention: to disctinguish between all the various pointers to
    device-structures, I use these names for the pointer variables:
    udev: struct usb_device *
-   vdev: struct video_device *
+   vdev: struct video_device (member of pwc_dev)
    pdev: struct pwc_devive *
 */
 
@@ -152,6 +152,7 @@ static ssize_t pwc_video_read(struct file *file, char __user *buf,
                           size_t count, loff_t *ppos);
 static unsigned int pwc_video_poll(struct file *file, poll_table *wait);
 static int  pwc_video_mmap(struct file *file, struct vm_area_struct *vma);
+static void pwc_video_release(struct video_device *vfd);
 
 static const struct v4l2_file_operations pwc_fops = {
         .owner =        THIS_MODULE,
@@ -164,42 +165,12 @@ static const struct v4l2_file_operations pwc_fops = {
 };
 static struct video_device pwc_template = {
         .name =         "Philips Webcam",       /* Filled in later */
-        .release =      video_device_release,
+        .release =      pwc_video_release,
         .fops =         &pwc_fops,
+        .ioctl_ops =    &pwc_ioctl_ops,
 };
 
 /***************************************************************************/
-
-/* Okay, this is some magic that I worked out and the reasoning behind it...
-
-   The biggest problem with any USB device is of course: "what to do
-   when the user unplugs the device while it is in use by an application?"
-   We have several options:
-   1) Curse them with the 7 plagues when they do (requires divine intervention)
-   2) Tell them not to (won't work: they'll do it anyway)
-   3) Oops the kernel (this will have a negative effect on a user's uptime)
-   4) Do something sensible.
-
-   Of course, we go for option 4.
-
-   It happens that this device will be linked to two times, once from
-   usb_device and once from the video_device in their respective 'private'
-   pointers. This is done when the device is probed() and all initialization
-   succeeded. The pwc_device struct links back to both structures.
-
-   When a device is unplugged while in use it will be removed from the
-   list of known USB devices; I also de-register it as a V4L device, but
-   unfortunately I can't free the memory since the struct is still in use
-   by the file descriptor. This free-ing is then deferend until the first
-   opportunity. Crude, but it works.
-
-   A small 'advantage' is that if a user unplugs the cam and plugs it back
-   in, it should get assigned the same video device minor, but unfortunately
-   it's non-trivial to re-link the cam back to the video device... (that
-   would surely be magic! :))
-*/
-
-/***************************************************************************/
 /* Private functions */
 
 /* Here we want the physical address of the memory.
@@ -1016,16 +987,15 @@ static ssize_t show_snapshot_button_status(struct device *class_dev,
 static DEVICE_ATTR(button, S_IRUGO | S_IWUSR, show_snapshot_button_status,
                    NULL);
 
-static int pwc_create_sysfs_files(struct video_device *vdev)
+static int pwc_create_sysfs_files(struct pwc_device *pdev)
 {
-        struct pwc_device *pdev = video_get_drvdata(vdev);
         int rc;
 
-        rc = device_create_file(&vdev->dev, &dev_attr_button);
+        rc = device_create_file(&pdev->vdev.dev, &dev_attr_button);
         if (rc)
                 goto err;
         if (pdev->features & FEATURE_MOTOR_PANTILT) {
-                rc = device_create_file(&vdev->dev, &dev_attr_pan_tilt);
+                rc = device_create_file(&pdev->vdev.dev, &dev_attr_pan_tilt);
                 if (rc)
                         goto err_button;
         }
@@ -1033,19 +1003,17 @@ static int pwc_create_sysfs_files(struct video_device *vdev)
         return 0;
 
 err_button:
-        device_remove_file(&vdev->dev, &dev_attr_button);
+        device_remove_file(&pdev->vdev.dev, &dev_attr_button);
 err:
         PWC_ERROR("Could not create sysfs files.\n");
         return rc;
 }
 
-static void pwc_remove_sysfs_files(struct video_device *vdev)
+static void pwc_remove_sysfs_files(struct pwc_device *pdev)
 {
-        struct pwc_device *pdev = video_get_drvdata(vdev);
-
         if (pdev->features & FEATURE_MOTOR_PANTILT)
-                device_remove_file(&vdev->dev, &dev_attr_pan_tilt);
-        device_remove_file(&vdev->dev, &dev_attr_button);
+                device_remove_file(&pdev->vdev.dev, &dev_attr_pan_tilt);
+        device_remove_file(&pdev->vdev.dev, &dev_attr_button);
 }
 
 #ifdef CONFIG_USB_PWC_DEBUG
@@ -1106,7 +1074,7 @@ static int pwc_video_open(struct file *file)
                 if (ret >= 0)
                 {
                         PWC_DEBUG_OPEN("This %s camera is equipped with a %s (%d).\n",
-                                        pdev->vdev->name,
+                                        pdev->vdev.name,
                                         pwc_sensor_type_to_string(i), i);
                 }
         }
@@ -1180,16 +1148,15 @@ static int pwc_video_open(struct file *file)
         return 0;
 }
 
-
-static void pwc_cleanup(struct pwc_device *pdev)
+static void pwc_video_release(struct video_device *vfd)
 {
-        pwc_remove_sysfs_files(pdev->vdev);
-        video_unregister_device(pdev->vdev);
+        struct pwc_device *pdev = container_of(vfd, struct pwc_device, vdev);
+        int hint;
 
-#ifdef CONFIG_USB_PWC_INPUT_EVDEV
-        if (pdev->button_dev)
-                input_unregister_device(pdev->button_dev);
-#endif
+        /* search device_hint[] table if we occupy a slot, by any chance */
+        for (hint = 0; hint < MAX_DEV_HINTS; hint++)
+                if (device_hint[hint].pdev == pdev)
+                        device_hint[hint].pdev = NULL;
 
         kfree(pdev);