Messages in this thread | | | Date | Wed, 20 May 2015 17:48:41 +0300 | From | Eugene Shatokhin <> | Subject | uvcvideo: Race on dev->state between uvc_disconnect() and uvc_v4l2_open() |
| |
Hi,
There is a race in uvcvideo module between uvc_disconnect() and uvc_v4l2_open() on dev->state. Checked and reproduced that with kernel 4.1-rc1.
drivers/media/usb/uvc/uvc_driver.c, uvc_disconnect():
dev->state |= UVC_DEV_DISCONNECTED;
drivers/media/usb/uvc/uvc_v4l2.c, uvc_v4l2_open():
if (stream->dev->state & UVC_DEV_DISCONNECTED) return -ENODEV;
I checked that the race does happen by introducing a delay in uvc_disconnect() right before that assignment and armed a hardware breakpoint to detect the access to stream->dev->state from uvc_v4l2_open(). When I disconnected the webcam while Google Hangout was running, the hardware breakpoint triggered several times for that read in uvc_v4l2_open (uvc_v4l2.c:484). uvc_v4l2_open() was called in the context of GoogleTalkPlugin processes.
Not sure if the race is intentional but I guess, better to report it anyway. Nothing has crashed during my (brief) testing yet, but still.
Regards,
Eugene
-- Eugene Shatokhin, ROSA www.rosalab.com
| |