From 5063452ecb1c1c56b319d1b89b1b67c1abd849b9 Mon Sep 17 00:00:00 2001 From: Kosuke Tatsukawa Date: Thu, 8 Oct 2015 21:35:40 -0300 Subject: [PATCH] [media] media: fix waitqueue_active without memory barrier in cpia2 driver cpia2_usb_disconnect() seems to be missing a memory barrier which might cause the waker to not notice the waiter and miss sending a wake_up as in the following figure. cpia2_usb_disconnect sync ------------------------------------------------------------------------ mutex_unlock(&cam->v4l2_lock); if (waitqueue_active(&cam->wq_stream)) /* The CPU might reorder the test for the waitqueue up here, before prior writes complete */ /* wait_event_interruptible */ /* __wait_event_interruptible */ /* ___wait_event */ long __int = prepare_to_wait_event( &wq, &__wait, state); if (!cam->streaming || frame->status == FRAME_READY) cam->curbuff->status = FRAME_READY; cam->curbuff->length = 0; schedule() ------------------------------------------------------------------------ The attached patch removes the call to waitqueue_active() leaving just wake_up() behind. This fixes the problem because the call to spin_lock_irqsave() in wake_up() will be an ACQUIRE operation. I found this issue when I was looking through the linux source code for places calling waitqueue_active() before wake_up*(), but without preceding memory barriers, after sending a patch to fix a similar issue in drivers/tty/n_tty.c (Details about the original issue can be found here: https://lkml.org/lkml/2015/9/28/849). Signed-off-by: Kosuke Tatsukawa Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/cpia2/cpia2_usb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c index 351a78a84c3d..c1aa1ab2ece9 100644 --- a/drivers/media/usb/cpia2/cpia2_usb.c +++ b/drivers/media/usb/cpia2/cpia2_usb.c @@ -890,8 +890,7 @@ static void cpia2_usb_disconnect(struct usb_interface *intf) DBG("Wakeup waiting processes\n"); cam->curbuff->status = FRAME_READY; cam->curbuff->length = 0; - if (waitqueue_active(&cam->wq_stream)) - wake_up_interruptible(&cam->wq_stream); + wake_up_interruptible(&cam->wq_stream); } DBG("Releasing interface\n"); -- 2.30.2