On 09/20/2013 07:15 PM, Simon Farnsworth wrote:
> pm_qos_remove_request was not called on video_release, resulting in the PM
> core's list of requests being corrupted when the file handle was freed.
>
> This has no immediate symptoms, but later in operation, the kernel will
> panic as the PM core dereferences a dangling pointer.
>
> Signed-off-by: Simon Farnsworth <simon.farnsworth@xxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
Acked-by: Hans Verkuil <hans.verkuil@xxxxxxxxx>
Regards,
Hans
> ---
>
> I didn't notice this when I first implemented the pm_qos_request as the
> userspace I was using always called streamoff before closing the
> device. I've since changed userspace components, and hit the kernel panic.
>
> drivers/media/pci/saa7134/saa7134-video.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
> index e12bbd8..fb60da8 100644
> --- a/drivers/media/pci/saa7134/saa7134-video.c
> +++ b/drivers/media/pci/saa7134/saa7134-video.c
> @@ -1455,6 +1455,7 @@ static int video_release(struct file *file)
>
> /* stop video capture */
> if (res_check(fh, RESOURCE_VIDEO)) {
> + pm_qos_remove_request(&dev->qos_request);
> videobuf_streamoff(&fh->cap);
> res_free(dev,fh,RESOURCE_VIDEO);
> }
>
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html