LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Takashi Iwai <tiwai@suse.de>,
	Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
	Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Subject: [PATCH 3.14 51/98] [media] uvcvideo: Fix destruction order in uvc_delete()
Date: Sun, 25 Jan 2015 10:07:09 -0800	[thread overview]
Message-ID: <20150125180715.074141503@linuxfoundation.org> (raw)
In-Reply-To: <20150125180712.859646324@linuxfoundation.org>

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 2228d80dd05a4fc5a410fde847677b8fb3eb23d7 upstream.

We've got a bug report at disconnecting a Webcam, where the kernel
spews warnings like below:
  WARNING: CPU: 0 PID: 8385 at ../fs/sysfs/group.c:219 sysfs_remove_group+0x87/0x90()
  sysfs group c0b2350c not found for kobject 'event3'
  CPU: 0 PID: 8385 Comm: queue2:src Not tainted 3.16.2-1.gdcee397-default #1
  Hardware name: ASUSTeK Computer INC. A7N8X-E/A7N8X-E, BIOS ASUS A7N8X-E Deluxe ACPI BIOS Rev 1013  11/12/2004
    c08d0705 ddc75cbc c0718c5b ddc75ccc c024b654 c08c6d44 ddc75ce8 000020c1
    c08d0705 000000db c03d1ec7 c03d1ec7 00000009 00000000 c0b2350c d62c9064
    ddc75cd4 c024b6a3 00000009 ddc75ccc c08c6d44 ddc75ce8 ddc75cfc c03d1ec7
  Call Trace:
    [<c0205ba6>] try_stack_unwind+0x156/0x170
    [<c02046f3>] dump_trace+0x53/0x180
    [<c0205c06>] show_trace_log_lvl+0x46/0x50
    [<c0204871>] show_stack_log_lvl+0x51/0xe0
    [<c0205c67>] show_stack+0x27/0x50
    [<c0718c5b>] dump_stack+0x3e/0x4e
    [<c024b654>] warn_slowpath_common+0x84/0xa0
    [<c024b6a3>] warn_slowpath_fmt+0x33/0x40
    [<c03d1ec7>] sysfs_remove_group+0x87/0x90
    [<c05a2c54>] device_del+0x34/0x180
    [<c05e3989>] evdev_disconnect+0x19/0x50
    [<c05e06fa>] __input_unregister_device+0x9a/0x140
    [<c05e0845>] input_unregister_device+0x45/0x80
    [<f854b1d6>] uvc_delete+0x26/0x110 [uvcvideo]
    [<f84d66f8>] v4l2_device_release+0x98/0xc0 [videodev]
    [<c05a25bb>] device_release+0x2b/0x90
    [<c04ad8bf>] kobject_cleanup+0x6f/0x1a0
    [<f84d5453>] v4l2_release+0x43/0x70 [videodev]
    [<c0372f31>] __fput+0xb1/0x1b0
    [<c02650c1>] task_work_run+0x91/0xb0
    [<c024d845>] do_exit+0x265/0x910
    [<c024df64>] do_group_exit+0x34/0xa0
    [<c025a76f>] get_signal_to_deliver+0x17f/0x590
    [<c0201b6a>] do_signal+0x3a/0x960
    [<c02024f7>] do_notify_resume+0x67/0x90
    [<c071ebb5>] work_notifysig+0x30/0x3b
    [<b7739e60>] 0xb7739e5f
   ---[ end trace b1e56095a485b631 ]---

The cause is that uvc_status_cleanup() is called after usb_put_*() in
uvc_delete().  usb_put_*() removes the sysfs parent and eventually
removes the children recursively, so the later device_del() can't find
its sysfs.  The fix is simply rearrange the call orders in
uvc_delete() so that the child is removed before the parent.

Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=897736
Reported-and-tested-by: Martin Pluskal <mpluskal@suse.com>

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/uvc/uvc_driver.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -1603,12 +1603,12 @@ static void uvc_delete(struct uvc_device
 {
 	struct list_head *p, *n;
 
-	usb_put_intf(dev->intf);
-	usb_put_dev(dev->udev);
-
 	uvc_status_cleanup(dev);
 	uvc_ctrl_cleanup_device(dev);
 
+	usb_put_intf(dev->intf);
+	usb_put_dev(dev->udev);
+
 	if (dev->vdev.dev)
 		v4l2_device_unregister(&dev->vdev);
 #ifdef CONFIG_MEDIA_CONTROLLER



  parent reply	other threads:[~2015-01-25 19:17 UTC|newest]

Thread overview: 96+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-01-25 18:06 [PATCH 3.14 00/98] 3.14.30-stable review Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 02/98] netlink: Always copy on mmap TX Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 03/98] netlink: Dont reorder loads/stores before marking mmap netlink frame as available Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 04/98] in6: fix conflict with glibc Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 05/98] tg3: tg3_disable_ints using uninitialized mailbox value to disable interrupts Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 07/98] batman-adv: Unify fragment size calculation Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 08/98] batman-adv: avoid NULL dereferences and fix if check Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 09/98] net: Fix stacked vlan offload features computation Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 10/98] net: Reset secmark when scrubbing packet Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 11/98] tcp: Do not apply TSO segment limit to non-TSO packets Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 12/98] alx: fix alx_poll() Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 13/98] team: avoid possible underflow of count_pending value for notify_peers and mcast_rejoin Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 14/98] enic: fix rx skb checksum Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 15/98] net/core: Handle csum for CHECKSUM_COMPLETE VXLAN forwarding Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 16/98] drm/vmwgfx: Fix fence event code Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 17/98] drm/ttm: Avoid memory allocation from shrinker functions Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 18/98] drm/radeon: fix typo in CI dpm disable Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 19/98] drm/radeon: work around a hw bug in MGCG on CIK Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 21/98] drm/radeon: properly filter DP1.2 4k modes on non-DP1.2 hw Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 22/98] drm/i915: Dont complain about stolen conflicts on gen3 Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 23/98] drm/i915: Only warn the first time we attempt to mmio whilst suspended Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 24/98] drm/nv4c/mc: disable msi Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 27/98] ARC: [nsimosci] move peripherals to match model to FPGA Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 28/98] ARC: switch to generic ENTRY/END assembler annotations Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 29/98] cfg80211: dont WARN about two consecutive Country IE hint Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 30/98] cfg80211: avoid mem leak on driver hint set Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 31/98] cfg80211: Fix 160 MHz channels with 80+80 and 160 MHz drivers Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 32/98] hp_accel: Add support for HP ZBook 15 Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 33/98] tick/powerclamp: Remove tick_nohz_idle abuse Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 34/98] genirq: Prevent proc race against freeing of irq descriptors Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 35/98] iscsi-target: Fail connection on short sendmsg writes Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 36/98] Revert "[SCSI] mpt2sas: Remove phys on topology change." Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 37/98] Revert "[SCSI] mpt3sas: Remove phys on topology change" Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 38/98] scsi: blacklist RSOC for Microsoft iSCSI target devices Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 39/98] clk: samsung: Fix double add of syscore ops after driver rebind Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 40/98] clk: Really fix deadlock with mmap_sem Greg Kroah-Hartman
2015-01-26 12:46   ` Luis Henriques
2015-01-26 22:20     ` Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.14 41/98] clk: Dont try to use a struct clk* after it could have been freed Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 42/98] parisc: fix out-of-register compiler error in ldcw inline assembler function Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 43/98] storvsc: ring buffer failures may result in I/O freeze Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 44/98] net: ethernet: cpsw: fix hangs with interrupts Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 45/98] video/logo: prevent use of logos after they have been freed Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 46/98] [media] smiapp-pll: Correct clock debug prints Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 48/98] [media] smiapp: Take mutex during PLL update in sensor initialisation Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 49/98] [media] sound: simplify au0828 quirk table Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 50/98] [media] sound: Update au0828 quirks table Greg Kroah-Hartman
2015-01-25 18:07 ` Greg Kroah-Hartman [this message]
2015-01-25 18:07 ` [PATCH 3.14 52/98] vfio-pci: Fix the check on pci device type in vfio_pci_probe() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 53/98] drivers: net: cpsw: fix multicast flush in dual emac mode Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 54/98] ftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 55/98] NFSv4.1: Fix client id trunking on Linux Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 56/98] gpiolib: of: Correct error handling in of_get_named_gpiod_flags Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 57/98] gpio: fix memory and reference leaks in gpiochip_add error path Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 58/98] OHCI: add a quirk for ULi M5237 blocking on reset Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 59/98] usb: dwc3: gadget: Fix TRB preparation during SG Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 60/98] usb: dwc3: gadget: Stop TRB preparation after limit is reached Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 61/98] USB: cp210x: fix ID for production CEL MeshConnect USB Stick Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 62/98] USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 63/98] USB: keyspan: fix null-deref at probe Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 64/98] USB: console: fix uninitialised ldisc semaphore Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 65/98] USB: console: fix potential use after free Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 66/98] USB: EHCI: fix initialization bug in iso_stream_schedule() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 67/98] usb: musb: stuff leak of struct usb_hcd Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 68/98] can: kvaser_usb: Dont free packets when tight on URBs Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 69/98] can: kvaser_usb: Reset all URB tx contexts upon channel close Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 70/98] can: kvaser_usb: Dont send a RESET_CHIP for non-existing channels Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 72/98] Input: I8042 - add Acer Aspire 7738 to the nomux list Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 73/98] ARM: dts: imx25: Fix the SPI1 clocks Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 74/98] ARM: imx6q: drop unnecessary semicolon Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 75/98] ARM: clk-imx6q: fix video divider for rev T0 1.0 Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 76/98] ARM: omap5/dra7xx: Fix frequency typos Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 77/98] ARM: shmobile: sh73a0 legacy: Set .control_parent for all irqpin instances Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 78/98] decompress_bunzip2: off by one in get_next_block() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 79/98] um: Skip futex_atomic_cmpxchg_inatomic() test Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 80/98] x86, um: actually mark system call tables readonly Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 81/98] LOCKD: Fix a race when initialising nlmsvc_timeout Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 82/98] tcm_loop: Fixup tag handling Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 83/98] tcm_loop: Fix wrong I_T nexus association Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 84/98] vhost-scsi: Add missing virtio-scsi -> TCM attribute conversion Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 85/98] iscsi,iser-target: Initiate termination only once Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 86/98] iser-target: Fix flush + disconnect completion handling Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 87/98] iser-target: Parallelize CM connection establishment Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 88/98] iser-target: Fix connected_handler + teardown flow race Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 89/98] iser-target: Handle ADDR_CHANGE event for listener cm_id Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 90/98] iser-target: Fix implicit termination of connections Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 91/98] bcache: Make sure to pass GFP_WAIT to mempool_alloc() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 92/98] KVM: nVMX: Disable unrestricted mode if ept=0 Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 93/98] netfilter: ipset: small potential read beyond the end of buffer Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 94/98] net: prevent of emerging cross-namespace symlinks Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 95/98] net: fix creation adjacent device symlinks Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 96/98] fsnotify: next_i is freed during fsnotify_unmount_inodes Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 97/98] s390/3215: fix hanging console issue Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.14 98/98] s390/3215: fix tty output containing tabs Greg Kroah-Hartman
2015-01-25 21:37 ` [PATCH 3.14 00/98] 3.14.30-stable review Guenter Roeck
2015-01-26 17:43 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150125180715.074141503@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=laurent.pinchart@ideasonboard.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mchehab@osg.samsung.com \
    --cc=stable@vger.kernel.org \
    --cc=tiwai@suse.de \
    --subject='Re: [PATCH 3.14 51/98] [media] uvcvideo: Fix destruction order in uvc_delete()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).