summaryrefslogtreecommitdiffstats
path: root/drivers/media/platform/ti-vpe/vpdma.c
diff options
context:
space:
mode:
authorNikhil Devshatwar <nikhil.nd@ti.com>2016-11-19 00:20:35 +0100
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2016-11-22 11:07:28 +0100
commitc786595beb89d74ff709b2ee382f34a1e0040d88 (patch)
treec6fb4a1e79b33c750f9e3f78b4b714df06f7eb66 /drivers/media/platform/ti-vpe/vpdma.c
parent[media] media: ti-vpe: vpe: Fix vb2 buffer cleanup (diff)
downloadlinux-c786595beb89d74ff709b2ee382f34a1e0040d88.tar.xz
linux-c786595beb89d74ff709b2ee382f34a1e0040d88.zip
[media] media: ti-vpe: vpdma: Fix race condition for firmware loading
vpdma_create API is supposed to allocated the struct vpdma_data and return it to the driver. Also, it would call the callback function when the VPDMA firmware is loaded. Typically, VPE driver have following function call: dev->vpdma = vpdma_create(pdev, firmware_load_callback); And the callback implementation would continue the probe further. Also, the dev->vpdma is accessed from the callback implementation. This may lead to race condition between assignment of dev->vpdma and the callback function being triggered. This would lead to kernel crash because of NULL pointer access. Fix this by passing a driver wrapped &vpdma_data instead of allocating inside vpdma_create. Change the vpdma_create prototype accordingly and fix return paths. Also, update the VPE driver to use the updated API and initialize the dev->vpdma before hand so that the race condition is avoided. Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com> Signed-off-by: Benoit Parrot <bparrot@ti.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/platform/ti-vpe/vpdma.c')
-rw-r--r--drivers/media/platform/ti-vpe/vpdma.c17
1 files changed, 5 insertions, 12 deletions
diff --git a/drivers/media/platform/ti-vpe/vpdma.c b/drivers/media/platform/ti-vpe/vpdma.c
index 8f0d608c70f6..070937fe1af6 100644
--- a/drivers/media/platform/ti-vpe/vpdma.c
+++ b/drivers/media/platform/ti-vpe/vpdma.c
@@ -1130,21 +1130,14 @@ static int vpdma_load_firmware(struct vpdma_data *vpdma)
return 0;
}
-struct vpdma_data *vpdma_create(struct platform_device *pdev,
+int vpdma_create(struct platform_device *pdev, struct vpdma_data *vpdma,
void (*cb)(struct platform_device *pdev))
{
struct resource *res;
- struct vpdma_data *vpdma;
int r;
dev_dbg(&pdev->dev, "vpdma_create\n");
- vpdma = devm_kzalloc(&pdev->dev, sizeof(*vpdma), GFP_KERNEL);
- if (!vpdma) {
- dev_err(&pdev->dev, "couldn't alloc vpdma_dev\n");
- return ERR_PTR(-ENOMEM);
- }
-
vpdma->pdev = pdev;
vpdma->cb = cb;
spin_lock_init(&vpdma->lock);
@@ -1152,22 +1145,22 @@ struct vpdma_data *vpdma_create(struct platform_device *pdev,
res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "vpdma");
if (res == NULL) {
dev_err(&pdev->dev, "missing platform resources data\n");
- return ERR_PTR(-ENODEV);
+ return -ENODEV;
}
vpdma->base = devm_ioremap(&pdev->dev, res->start, resource_size(res));
if (!vpdma->base) {
dev_err(&pdev->dev, "failed to ioremap\n");
- return ERR_PTR(-ENOMEM);
+ return -ENOMEM;
}
r = vpdma_load_firmware(vpdma);
if (r) {
pr_err("failed to load firmware %s\n", VPDMA_FIRMWARE);
- return ERR_PTR(r);
+ return r;
}
- return vpdma;
+ return 0;
}
EXPORT_SYMBOL(vpdma_create);