diff options
author | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2019-08-23 08:12:59 -0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-10-05 13:13:48 +0200 |
commit | 730e14891202a3858bc7e94df5607165caa6ac6f (patch) | |
tree | fba36f5af7533c16efff8cec9e3712910a4ae844 /drivers/media | |
parent | b74f2a4c0af2ab5486db694909809bf2398337a3 (diff) | |
download | linux-stable-730e14891202a3858bc7e94df5607165caa6ac6f.tar.gz linux-stable-730e14891202a3858bc7e94df5607165caa6ac6f.tar.bz2 linux-stable-730e14891202a3858bc7e94df5607165caa6ac6f.zip |
media: cec-notifier: clear cec_adap in cec_notifier_unregister
[ Upstream commit 14d5511691e5290103bc480998bc322e68f139d4 ]
If cec_notifier_cec_adap_unregister() is called before
cec_unregister_adapter() then everything is OK (and this is the
case today). But if it is the other way around, then
cec_notifier_unregister() is called first, and that doesn't
set n->cec_adap to NULL.
So if e.g. cec_notifier_set_phys_addr() is called after
cec_notifier_unregister() but before cec_unregister_adapter()
then n->cec_adap points to an unregistered and likely deleted
cec adapter. So just set n->cec_adap->notifier and n->cec_adap
to NULL for rubustness.
Eventually cec_notifier_unregister will disappear and this will
be simplified substantially.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media')
-rw-r--r-- | drivers/media/cec/cec-notifier.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/cec/cec-notifier.c b/drivers/media/cec/cec-notifier.c index 9598c7778871..c4aa27e0c430 100644 --- a/drivers/media/cec/cec-notifier.c +++ b/drivers/media/cec/cec-notifier.c @@ -124,6 +124,8 @@ void cec_notifier_unregister(struct cec_notifier *n) { mutex_lock(&n->lock); n->callback = NULL; + n->cec_adap->notifier = NULL; + n->cec_adap = NULL; mutex_unlock(&n->lock); cec_notifier_put(n); } |