Hans Verkuil a896c674d5 media: cec: core: add adap_nb_transmit_canceled() callback ... commit da53c36ddd upstream. A potential deadlock was found by Zheng Zhang with a local syzkaller instance. The problem is that when a non-blocking CEC transmit is canceled by calling cec_data_cancel, that in turn can call the high-level received() driver callback, which can call cec_transmit_msg() to transmit a new message. The cec_data_cancel() function is called with the adap->lock mutex held, and cec_transmit_msg() tries to take that same lock. The root cause is that the received() callback can either be used to pass on a received message (and then adap->lock is not held), or to report a canceled transmit (and then adap->lock is held). This is confusing, so create a new low-level adap_nb_transmit_canceled callback that reports back that a non-blocking transmit was canceled. And the received() callback is only called when a message is received, as was the case before commit f9d0ecbf56 ("media: cec: correctly pass on reply results") complicated matters. Reported-by: Zheng Zhang <zheng.zhang@email.ucr.edu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Fixes: f9d0ecbf56 ("media: cec: correctly pass on reply results") Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-06-16 13:39:53 +02:00
..
acpi	…
asm-generic	arch: Introduce CONFIG_FUNCTION_ALIGNMENT	2024-04-10 16:18:49 +02:00
clocksource	…
crypto	crypto: af_alg - Disallow multiple in-flight AIO requests	2024-01-25 14:52:34 -08:00
drm	drm/mipi-dsi: use correct return type for the DSC functions	2024-06-16 13:39:30 +02:00
dt-bindings	dt-bindings: clocks: imx8mp: Add ID for usb suspend clock	2024-03-01 13:21:53 +01:00
keys	KEYS: trusted: allow use of kernel RNG for key material	2023-10-19 23:05:33 +02:00
kunit	…
kvm	…
linux	fpga: region: add owner module and take its refcount	2024-06-16 13:39:38 +02:00
math-emu	…
media	media: cec: core: add adap_nb_transmit_canceled() callback	2024-06-16 13:39:53 +02:00
memory	…
misc	…
net	netfilter: nft_payload: move struct nft_payload_set definition where it belongs	2024-06-16 13:39:50 +02:00
pcmcia	…
ras	…
rdma	RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz	2023-12-13 18:36:40 +01:00
scsi	scsi: core: Rename scsi_mq_done() into scsi_done() and export it	2023-10-19 23:05:32 +02:00
soc	soc: fsl: qbman: Add CGR update function	2024-04-10 16:18:42 +02:00
sound	ASoC: soc-card: Add storage for PCI SSID	2023-11-28 16:56:17 +00:00
target	…
trace	ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value	2024-06-16 13:39:29 +02:00
uapi	bpf: Pack struct bpf_fib_lookup	2024-06-16 13:39:18 +02:00
vdso	…
video	…
xen	…