Messages in this thread | | | Date | Sat, 2 Apr 2011 14:29:02 -0500 | From | Jonathan Nieder <> | Subject | Re: [PATCH 3/3] [media] cx88: use a mutex to protect cx8802_devlist |
| |
Hi Andreas,
(please turn off HTML mail.) Andreas Huber wrote:
> There is a reference count bug in the driver code. The driver's > active_ref count may become negative which leads to unpredictable > behavior. (mpeg video device inaccessible, etc ...)
Hmm, the patchset didn't touch active_ref handling.
active_ref was added by v2.6.25-rc3~132^2~7 (V4L/DVB (7194): cx88-mpeg: Allow concurrent access to cx88-mpeg devices, 2008-02-11) and relies on three assumptions:
* (successful) calls to cx8802_driver::request_acquire are balanced with calls to cx8802_driver::request_release;
* cx8802_driver::advise_acquire is non-null if and only if cx8802_driver::advise_release is (since both are NULL for blackbird, non-NULL for dvb);
* no data races.
I suppose it would be more idiomatic to use an atomic_t, but access to active_ref was previously protected by the BKL and now it is protected by core->lock. So it's not clear to me why this doesn't work.
Any hints? (e.g., a detailed reproduction recipe, or a log after adding a printk to find out when exactly active_ref becomes negative)
Thanks for reporting. Jonathan
| |