Hans Verkuil a896c674d5 media: cec: core: add adap_nb_transmit_canceled() callback ... commit da53c36ddd upstream. A potential deadlock was found by Zheng Zhang with a local syzkaller instance. The problem is that when a non-blocking CEC transmit is canceled by calling cec_data_cancel, that in turn can call the high-level received() driver callback, which can call cec_transmit_msg() to transmit a new message. The cec_data_cancel() function is called with the adap->lock mutex held, and cec_transmit_msg() tries to take that same lock. The root cause is that the received() callback can either be used to pass on a received message (and then adap->lock is not held), or to report a canceled transmit (and then adap->lock is held). This is confusing, so create a new low-level adap_nb_transmit_canceled callback that reports back that a non-blocking transmit was canceled. And the received() callback is only called when a message is received, as was the case before commit f9d0ecbf56 ("media: cec: correctly pass on reply results") complicated matters. Reported-by: Zheng Zhang <zheng.zhang@email.ucr.edu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Fixes: f9d0ecbf56 ("media: cec: correctly pass on reply results") Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-06-16 13:39:53 +02:00
..
core	media: cec: core: add adap_nb_transmit_canceled() callback	2024-06-16 13:39:53 +02:00
i2c	media: cec: i2c: ch7322: also select REGMAP	2023-07-23 13:47:27 +02:00
platform	media: cec: meson: always include meson sub-directory in Makefile	2023-11-28 16:56:21 +00:00
usb	media: pulse8-cec: handle possible ping error	2023-09-19 12:22:26 +02:00
Kconfig	…
Makefile	…