diff options
author | Guennadi Liakhovetski <g.liakhovetski@gmx.de> | 2009-08-05 19:06:31 -0400 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2009-08-13 19:39:11 -0400 |
commit | 2dd54a54c19d0e5b50f4e1c591653772ead9d4a1 (patch) | |
tree | 3ab873ae09a4cc3f56906dbb4712e1331a078519 /drivers | |
parent | 7d2e2e35fb50f381c9398e481aac1e1729765ae3 (diff) |
V4L/DVB (12424): soc-camera: fix recursive locking in .buf_queue()
The .buf_queue() V4L2 driver method is called under
spinlock_irqsave(q->irqlock,...), don't take the lock again inside the
function.
Reported-by: Antonio Ospite <ospite@studenti.unina.it>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/media/video/mx1_camera.c | 6 | ||||
-rw-r--r-- | drivers/media/video/mx3_camera.c | 19 | ||||
-rw-r--r-- | drivers/media/video/pxa_camera.c | 6 | ||||
-rw-r--r-- | drivers/media/video/sh_mobile_ceu_camera.c | 5 |
4 files changed, 13 insertions, 23 deletions
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c index 2d075205bdfe..736c31d23194 100644 --- a/drivers/media/video/mx1_camera.c +++ b/drivers/media/video/mx1_camera.c | |||
@@ -234,6 +234,7 @@ static int mx1_camera_setup_dma(struct mx1_camera_dev *pcdev) | |||
234 | return ret; | 234 | return ret; |
235 | } | 235 | } |
236 | 236 | ||
237 | /* Called under spinlock_irqsave(&pcdev->lock, ...) */ | ||
237 | static void mx1_videobuf_queue(struct videobuf_queue *vq, | 238 | static void mx1_videobuf_queue(struct videobuf_queue *vq, |
238 | struct videobuf_buffer *vb) | 239 | struct videobuf_buffer *vb) |
239 | { | 240 | { |
@@ -241,13 +242,10 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq, | |||
241 | struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent); | 242 | struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent); |
242 | struct mx1_camera_dev *pcdev = ici->priv; | 243 | struct mx1_camera_dev *pcdev = ici->priv; |
243 | struct mx1_buffer *buf = container_of(vb, struct mx1_buffer, vb); | 244 | struct mx1_buffer *buf = container_of(vb, struct mx1_buffer, vb); |
244 | unsigned long flags; | ||
245 | 245 | ||
246 | dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__, | 246 | dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__, |
247 | vb, vb->baddr, vb->bsize); | 247 | vb, vb->baddr, vb->bsize); |
248 | 248 | ||
249 | spin_lock_irqsave(&pcdev->lock, flags); | ||
250 | |||
251 | list_add_tail(&vb->queue, &pcdev->capture); | 249 | list_add_tail(&vb->queue, &pcdev->capture); |
252 | 250 | ||
253 | vb->state = VIDEOBUF_ACTIVE; | 251 | vb->state = VIDEOBUF_ACTIVE; |
@@ -264,8 +262,6 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq, | |||
264 | __raw_writel(temp, pcdev->base + CSICR1); | 262 | __raw_writel(temp, pcdev->base + CSICR1); |
265 | } | 263 | } |
266 | } | 264 | } |
267 | |||
268 | spin_unlock_irqrestore(&pcdev->lock, flags); | ||
269 | } | 265 | } |
270 | 266 | ||
271 | static void mx1_videobuf_release(struct videobuf_queue *vq, | 267 | static void mx1_videobuf_release(struct videobuf_queue *vq, |
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c index e605c076ed89..9770cb7932ca 100644 --- a/drivers/media/video/mx3_camera.c +++ b/drivers/media/video/mx3_camera.c | |||
@@ -332,7 +332,10 @@ static enum pixel_fmt fourcc_to_ipu_pix(__u32 fourcc) | |||
332 | } | 332 | } |
333 | } | 333 | } |
334 | 334 | ||
335 | /* Called with .vb_lock held */ | 335 | /* |
336 | * Called with .vb_lock mutex held and | ||
337 | * under spinlock_irqsave(&mx3_cam->lock, ...) | ||
338 | */ | ||
336 | static void mx3_videobuf_queue(struct videobuf_queue *vq, | 339 | static void mx3_videobuf_queue(struct videobuf_queue *vq, |
337 | struct videobuf_buffer *vb) | 340 | struct videobuf_buffer *vb) |
338 | { | 341 | { |
@@ -346,7 +349,8 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq, | |||
346 | struct idmac_video_param *video = &ichan->params.video; | 349 | struct idmac_video_param *video = &ichan->params.video; |
347 | const struct soc_camera_data_format *data_fmt = icd->current_fmt; | 350 | const struct soc_camera_data_format *data_fmt = icd->current_fmt; |
348 | dma_cookie_t cookie; | 351 | dma_cookie_t cookie; |
349 | unsigned long flags; | 352 | |
353 | BUG_ON(!irqs_disabled()); | ||
350 | 354 | ||
351 | /* This is the configuration of one sg-element */ | 355 | /* This is the configuration of one sg-element */ |
352 | video->out_pixel_fmt = fourcc_to_ipu_pix(data_fmt->fourcc); | 356 | video->out_pixel_fmt = fourcc_to_ipu_pix(data_fmt->fourcc); |
@@ -359,8 +363,6 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq, | |||
359 | memset((void *)vb->baddr, 0xaa, vb->bsize); | 363 | memset((void *)vb->baddr, 0xaa, vb->bsize); |
360 | #endif | 364 | #endif |
361 | 365 | ||
362 | spin_lock_irqsave(&mx3_cam->lock, flags); | ||
363 | |||
364 | list_add_tail(&vb->queue, &mx3_cam->capture); | 366 | list_add_tail(&vb->queue, &mx3_cam->capture); |
365 | 367 | ||
366 | if (!mx3_cam->active) { | 368 | if (!mx3_cam->active) { |
@@ -370,24 +372,23 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq, | |||
370 | vb->state = VIDEOBUF_QUEUED; | 372 | vb->state = VIDEOBUF_QUEUED; |
371 | } | 373 | } |
372 | 374 | ||
373 | spin_unlock_irqrestore(&mx3_cam->lock, flags); | 375 | spin_unlock_irq(&mx3_cam->lock); |
374 | 376 | ||
375 | cookie = txd->tx_submit(txd); | 377 | cookie = txd->tx_submit(txd); |
376 | dev_dbg(&icd->dev, "Submitted cookie %d DMA 0x%08x\n", cookie, sg_dma_address(&buf->sg)); | 378 | dev_dbg(&icd->dev, "Submitted cookie %d DMA 0x%08x\n", cookie, sg_dma_address(&buf->sg)); |
379 | |||
380 | spin_lock_irq(&mx3_cam->lock); | ||
381 | |||
377 | if (cookie >= 0) | 382 | if (cookie >= 0) |
378 | return; | 383 | return; |
379 | 384 | ||
380 | /* Submit error */ | 385 | /* Submit error */ |
381 | vb->state = VIDEOBUF_PREPARED; | 386 | vb->state = VIDEOBUF_PREPARED; |
382 | 387 | ||
383 | spin_lock_irqsave(&mx3_cam->lock, flags); | ||
384 | |||
385 | list_del_init(&vb->queue); | 388 | list_del_init(&vb->queue); |
386 | 389 | ||
387 | if (mx3_cam->active == buf) | 390 | if (mx3_cam->active == buf) |
388 | mx3_cam->active = NULL; | 391 | mx3_cam->active = NULL; |
389 | |||
390 | spin_unlock_irqrestore(&mx3_cam->lock, flags); | ||
391 | } | 392 | } |
392 | 393 | ||
393 | /* Called with .vb_lock held */ | 394 | /* Called with .vb_lock held */ |
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c index e048d25798cc..016bb45ba0c3 100644 --- a/drivers/media/video/pxa_camera.c +++ b/drivers/media/video/pxa_camera.c | |||
@@ -612,6 +612,7 @@ static void pxa_camera_stop_capture(struct pxa_camera_dev *pcdev) | |||
612 | dev_dbg(pcdev->soc_host.dev, "%s\n", __func__); | 612 | dev_dbg(pcdev->soc_host.dev, "%s\n", __func__); |
613 | } | 613 | } |
614 | 614 | ||
615 | /* Called under spinlock_irqsave(&pcdev->lock, ...) */ | ||
615 | static void pxa_videobuf_queue(struct videobuf_queue *vq, | 616 | static void pxa_videobuf_queue(struct videobuf_queue *vq, |
616 | struct videobuf_buffer *vb) | 617 | struct videobuf_buffer *vb) |
617 | { | 618 | { |
@@ -619,13 +620,10 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq, | |||
619 | struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent); | 620 | struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent); |
620 | struct pxa_camera_dev *pcdev = ici->priv; | 621 | struct pxa_camera_dev *pcdev = ici->priv; |
621 | struct pxa_buffer *buf = container_of(vb, struct pxa_buffer, vb); | 622 | struct pxa_buffer *buf = container_of(vb, struct pxa_buffer, vb); |
622 | unsigned long flags; | ||
623 | 623 | ||
624 | dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d active=%p\n", __func__, | 624 | dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d active=%p\n", __func__, |
625 | vb, vb->baddr, vb->bsize, pcdev->active); | 625 | vb, vb->baddr, vb->bsize, pcdev->active); |
626 | 626 | ||
627 | spin_lock_irqsave(&pcdev->lock, flags); | ||
628 | |||
629 | list_add_tail(&vb->queue, &pcdev->capture); | 627 | list_add_tail(&vb->queue, &pcdev->capture); |
630 | 628 | ||
631 | vb->state = VIDEOBUF_ACTIVE; | 629 | vb->state = VIDEOBUF_ACTIVE; |
@@ -633,8 +631,6 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq, | |||
633 | 631 | ||
634 | if (!pcdev->active) | 632 | if (!pcdev->active) |
635 | pxa_camera_start_capture(pcdev); | 633 | pxa_camera_start_capture(pcdev); |
636 | |||
637 | spin_unlock_irqrestore(&pcdev->lock, flags); | ||
638 | } | 634 | } |
639 | 635 | ||
640 | static void pxa_videobuf_release(struct videobuf_queue *vq, | 636 | static void pxa_videobuf_release(struct videobuf_queue *vq, |
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c index 0db88a53d92c..e86878deea71 100644 --- a/drivers/media/video/sh_mobile_ceu_camera.c +++ b/drivers/media/video/sh_mobile_ceu_camera.c | |||
@@ -282,27 +282,24 @@ out: | |||
282 | return ret; | 282 | return ret; |
283 | } | 283 | } |
284 | 284 | ||
285 | /* Called under spinlock_irqsave(&pcdev->lock, ...) */ | ||
285 | static void sh_mobile_ceu_videobuf_queue(struct videobuf_queue *vq, | 286 | static void sh_mobile_ceu_videobuf_queue(struct videobuf_queue *vq, |
286 | struct videobuf_buffer *vb) | 287 | struct videobuf_buffer *vb) |
287 | { | 288 | { |
288 | struct soc_camera_device *icd = vq->priv_data; | 289 | struct soc_camera_device *icd = vq->priv_data; |
289 | struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent); | 290 | struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent); |
290 | struct sh_mobile_ceu_dev *pcdev = ici->priv; | 291 | struct sh_mobile_ceu_dev *pcdev = ici->priv; |
291 | unsigned long flags; | ||
292 | 292 | ||
293 | dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %zd\n", __func__, | 293 | dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %zd\n", __func__, |
294 | vb, vb->baddr, vb->bsize); | 294 | vb, vb->baddr, vb->bsize); |
295 | 295 | ||
296 | vb->state = VIDEOBUF_QUEUED; | 296 | vb->state = VIDEOBUF_QUEUED; |
297 | spin_lock_irqsave(&pcdev->lock, flags); | ||
298 | list_add_tail(&vb->queue, &pcdev->capture); | 297 | list_add_tail(&vb->queue, &pcdev->capture); |
299 | 298 | ||
300 | if (!pcdev->active) { | 299 | if (!pcdev->active) { |
301 | pcdev->active = vb; | 300 | pcdev->active = vb; |
302 | sh_mobile_ceu_capture(pcdev); | 301 | sh_mobile_ceu_capture(pcdev); |
303 | } | 302 | } |
304 | |||
305 | spin_unlock_irqrestore(&pcdev->lock, flags); | ||
306 | } | 303 | } |
307 | 304 | ||
308 | static void sh_mobile_ceu_videobuf_release(struct videobuf_queue *vq, | 305 | static void sh_mobile_ceu_videobuf_release(struct videobuf_queue *vq, |