On Tue Sep 29 19:01:38 2026 -0700, Christopher Snowhill wrote:
> Commit de626073dfcb ("media: em28xx: drop 'users' field") replaced the
> vb2_fop_release() call in em28xx_v4l2_close() with
> _vb2_fop_release(filp, NULL) under dev->lock. vb2_fop_release() took
> the vb2 queue lock, but the new call takes no lock at all.
>
> The video and VBI queues have their own locks (vb_queue_lock and
> vb_vbi_queue_lock), and v4l2_ioctl_get_lock() serializes the queue
> ioctls with those rather than dev->lock. The queue can therefore be
> released on close while another file handle is in the middle of
> VIDIOC_REQBUFS. __vb2_queue_alloc() adds each buffer to the queue before
> allocating its planes, so the release can find an MMAP buffer whose
> mem_priv is still NULL and hand it to vb2_vmalloc_put():
>
> BUG: kernel NULL pointer dereference, address: 0000000000000020
> RIP: 0010:vb2_vmalloc_put+0xe/0x50 [videobuf2_vmalloc]
> Call Trace:
> __vb2_queue_free+0x14e/0x350 [videobuf2_common]
> vb2_core_queue_release+0x3b/0x80 [videobuf2_common]
> _vb2_fop_release+0x44/0x70 [videobuf2_v4l2]
> em28xx_v4l2_close+0x60/0x140 [em28xx_v4l]
> v4l2_release+0x9d/0xf0 [videodev]
> __fput+0xfd/0x280
>
> This was hit with OBS on a MyGica iGrabber (card=105).
>
> Pass the queue lock to _vb2_fop_release(). Taking it while holding
> dev->lock matches the existing order in em28xx_v4l2_fini(), where
> vb2_video_unregister_device() takes the queue lock under dev->lock.
>
> Fixes: de626073dfcb ("media: em28xx: drop 'users' field")
> Assisted-by: LLM
> Signed-off-by: Christopher Snowhill <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/usb/em28xx/em28xx-video.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
---
diff --git a/drivers/media/usb/em28xx/em28xx-video.c
b/drivers/media/usb/em28xx/em28xx-video.c
index a21ec2332dfb..9b5f7f74cccf 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2500,6 +2500,7 @@ static int em28xx_v4l2_resume(struct em28xx *dev)
*/
static int em28xx_v4l2_close(struct file *filp)
{
+ struct video_device *vdev = video_devdata(filp);
struct em28xx *dev = video_drvdata(filp);
struct em28xx_v4l2 *v4l2 = dev->v4l2;
struct usb_device *udev = interface_to_usbdev(dev->intf);
@@ -2508,7 +2509,7 @@ static int em28xx_v4l2_close(struct file *filp)
mutex_lock(&dev->lock);
last_user = v4l2_fh_is_singular_file(filp);
- _vb2_fop_release(filp, NULL);
+ _vb2_fop_release(filp, vdev->queue->lock);
if (last_user) {
/* No sense to try to write to the device */
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
