Re: BUG: unable to handle kernel paging request at 6b6b6bcb (v4l2_device_disconnect+0x11/0x30)

[Dave Young]

On Tue, Sep 6, 2011 at 6:31 AM, Sitsofe Wheeler <sitsofe@xxxxxxxxx> wrote:
> On Mon, Sep 05, 2011 at 12:16:42PM +0200, Hans Verkuil wrote:
>> On Monday, September 05, 2011 12:13:26 Hans Verkuil wrote:
>> >
>> > The original order is correct, but what I missed is that for drivers
>> > that release (free) everything in the videodev release callback the
>> > v4l2_device struct is also freed and v4l2_device_put will fail.
>> >
>> > To fix this, add this code just before the vdev->release call:
>> >
>> > Â Â /* Do not call v4l2_device_put if there is no release callback set. */
>> > Â Â if (v4l2_dev->release == NULL)
>> > Â Â Â Â Â Â v4l2_dev = NULL;
>> >
>> > If there is no release callback, then the refcounting is pointless
>> > anyway.
>> >
>> > This should work.
>>
>> Note that in the long run using the v4l2_device release callback
>> instead of the videodev release is better. But it's a lot of work to
>> convert everything so that's long term. I'm quite surprised BTW that
>> this bug wasn't found much earlier.
>
> This inline patch fixes the second "poison overwritten" problem so:
> Tested-by: Sitsofe Wheeler <sitsofe@xxxxxxxxx>

Confirmed

>
> However, it does not prevent the original oops that was reported in the
> original message. Yang Ruirui's patch in
> https://lkml.org/lkml/2011/9/1/74 seems to be required to resolve
> that initial problem - can it be ACK'd? Yang's patch is reproduced
> inline below:

Thanks, If it's ok, I can resend it as inline.

>
> For uvc device, dev->vdev.dev is the &intf->dev,
> uvc_delete code is as below:
> Â Â Â Âusb_put_intf(dev->intf);
> Â Â Â Âusb_put_dev(dev->udev);
>
> Â Â Â Âuvc_status_cleanup(dev);
> Â Â Â Âuvc_ctrl_cleanup_device(dev);
>
> ## the intf dev is released above, so below code will oops.
>
> Â Â Â Âif (dev->vdev.dev)
> Â Â Â Â Â Â Â Âv4l2_device_unregister(&dev->vdev);
> Fix it by get_device in v4l2_device_register and put_device in v4l2_device_disconnect
> ---
> Âdrivers/media/video/v4l2-device.c | Â Â2 ++
> Â1 file changed, 2 insertions(+)
> diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c
> index c72856c..e6a2c3b 100644
> --- a/drivers/media/video/v4l2-device.c
> +++ b/drivers/media/video/v4l2-device.c
> @@ -38,6 +38,7 @@ int v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev)
> Â Â Â Âmutex_init(&v4l2_dev->ioctl_lock);
> Â Â Â Âv4l2_prio_init(&v4l2_dev->prio);
> Â Â Â Âkref_init(&v4l2_dev->ref);
> + Â Â Â get_device(dev);
> Â Â Â Âv4l2_dev->dev = dev;
> Â Â Â Âif (dev == NULL) {
> Â Â Â Â Â Â Â Â/* If dev == NULL, then name must be filled in by the caller */
> @@ -93,6 +94,7 @@ void v4l2_device_disconnect(struct v4l2_device *v4l2_dev)
>
> Â Â Â Âif (dev_get_drvdata(v4l2_dev->dev) == v4l2_dev)
> Â Â Â Â Â Â Â Âdev_set_drvdata(v4l2_dev->dev, NULL);
> + Â Â Â put_device(v4l2_dev->dev);
> Â Â Â Âv4l2_dev->dev = NULL;
> Â}
> ÂEXPORT_SYMBOL_GPL(v4l2_device_disconnect);
>
> --
> Sitsofe | http://sucs.org/~sits/
>



-- 
Regards
Yang RuiRui
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/