Hans Verkuil a896c674d5 media: cec: core: add adap_nb_transmit_canceled() callback ... commit da53c36ddd upstream. A potential deadlock was found by Zheng Zhang with a local syzkaller instance. The problem is that when a non-blocking CEC transmit is canceled by calling cec_data_cancel, that in turn can call the high-level received() driver callback, which can call cec_transmit_msg() to transmit a new message. The cec_data_cancel() function is called with the adap->lock mutex held, and cec_transmit_msg() tries to take that same lock. The root cause is that the received() callback can either be used to pass on a received message (and then adap->lock is not held), or to report a canceled transmit (and then adap->lock is held). This is confusing, so create a new low-level adap_nb_transmit_canceled callback that reports back that a non-blocking transmit was canceled. And the received() callback is only called when a message is received, as was the case before commit f9d0ecbf56 ("media: cec: correctly pass on reply results") complicated matters. Reported-by: Zheng Zhang <zheng.zhang@email.ucr.edu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Fixes: f9d0ecbf56 ("media: cec: correctly pass on reply results") Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-06-16 13:39:53 +02:00
..
davinci	…
drv-intf	…
i2c	…
tpg	…
cec-notifier.h	…
cec-pin.h	…
cec.h	media: cec: core: add adap_nb_transmit_canceled() callback	2024-06-16 13:39:53 +02:00
demux.h	…
dmxdev.h	…
dvb-usb-ids.h	media: dvbsky: add support for MyGica T230C2_LITE and T230A	2021-07-12 09:16:29 +02:00
dvb_ca_en50221.h	…
dvb_demux.h	…
dvb_frontend.h	…
dvb_math.h	…
dvb_net.h	media: dvb-core: Fix use-after-free due on race condition at dvb_net	2023-06-09 10:32:24 +02:00
dvb_ringbuffer.h	…
dvb_vb2.h	…
dvbdev.h	media: dvb-core: Fix use-after-free due to race at dvb_register_device()	2023-06-09 10:32:24 +02:00
frame_vector.h	…
hevc-ctrls.h	media: hevc: Add segment address field	2021-07-12 09:16:32 +02:00
imx.h	…
media-dev-allocator.h	media: Fix Media Controller API config checks	2021-06-24 14:26:00 +02:00
media-device.h	…
media-devnode.h	…
media-entity.h	…
media-request.h	…
rc-core.h	media: rc: rename s_learning_mode() to s_wideband_receiver()	2021-07-22 08:21:53 +02:00
rc-map.h	media: rc: add keymap for Toshiba CT-90405 remote	2021-06-08 15:56:58 +02:00
rcar-fcp.h	…
tuner-types.h	…
tuner.h	…
tveeprom.h	…
v4l2-async.h	media: Documentation: media: Fix v4l2-async kerneldoc syntax	2021-08-04 14:43:50 +02:00
v4l2-common.h	media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation	2022-11-03 23:59:14 +09:00
v4l2-ctrls.h	media: uapi: move MPEG-2 stateless controls out of staging	2021-05-23 19:21:31 +02:00
v4l2-dev.h	…
v4l2-device.h	…
v4l2-dv-timings.h	…
v4l2-event.h	…
v4l2-fh.h	…
v4l2-flash-led-class.h	…
v4l2-fwnode.h	…
v4l2-h264.h	…
v4l2-image-sizes.h	…
v4l2-ioctl.h	…
v4l2-jpeg.h	…
v4l2-mc.h	…
v4l2-mediabus.h	…
v4l2-mem2mem.h	media: v4l2-mem2mem: add lock to protect parameter num_rdy	2023-08-26 14:23:23 +02:00
v4l2-rect.h	…
v4l2-subdev.h	media: v4l: subdev: Fail graciously when getting try data for NULL state	2022-11-10 18:15:34 +01:00
videobuf-core.h	…
videobuf-dma-contig.h	…
videobuf-dma-sg.h	…
videobuf-vmalloc.h	…
videobuf2-core.h	media: videobuf2: rework vb2_mem_ops API	2021-11-18 19:16:13 +01:00
videobuf2-dma-contig.h	…
videobuf2-dma-sg.h	…
videobuf2-dvb.h	…
videobuf2-memops.h	…
videobuf2-v4l2.h	media: videobuf2-v4l2.c: add vb2_queue_change_type() helper	2021-06-08 12:04:08 +02:00
videobuf2-vmalloc.h	…
vsp1.h	…