)]}'
{
  "commit": "4a2c9b037a08b8496f04a76987332ca6f19bd794",
  "tree": "f2b56f37daa502c20fde0424fcc8910c8c5b4349",
  "parents": [
    "2e3fa167100b2ebefa75c3b74d2336f0d5c05166"
  ],
  "author": {
    "name": "Alexander Popov",
    "email": "alex.popov@linux.com",
    "time": "Sun Nov 03 23:17:19 2019 +0100"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Sun Dec 01 09:14:24 2019 +0100"
  },
  "message": "media: vivid: Fix wrong locking that causes race conditions on streaming stop\n\ncommit 6dcd5d7a7a29c1e4b8016a06aed78cd650cd8c27 upstream.\n\nThere is the same incorrect approach to locking implemented in\nvivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out() and\nsdr_cap_stop_streaming().\n\nThese functions are called during streaming stopping with vivid_dev.mutex\nlocked. And they all do the same mistake while stopping their kthreads,\nwhich need to lock this mutex as well. See the example from\nvivid_stop_generating_vid_cap():\n  /* shutdown control thread */\n  vivid_grab_controls(dev, false);\n  mutex_unlock(\u0026dev-\u003emutex);\n  kthread_stop(dev-\u003ekthread_vid_cap);\n  dev-\u003ekthread_vid_cap \u003d NULL;\n  mutex_lock(\u0026dev-\u003emutex);\n\nBut when this mutex is unlocked, another vb2_fop_read() can lock it\ninstead of vivid_thread_vid_cap() and manipulate the buffer queue.\nThat causes a use-after-free access later.\n\nTo fix those issues let\u0027s:\n  1. avoid unlocking the mutex in vivid_stop_generating_vid_cap(),\nvivid_stop_generating_vid_out() and sdr_cap_stop_streaming();\n  2. use mutex_trylock() with schedule_timeout_uninterruptible() in\nthe loops of the vivid kthread handlers.\n\nSigned-off-by: Alexander Popov \u003calex.popov@linux.com\u003e\nAcked-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nTested-by: Hans Verkuil \u003chverkuil-cisco@xs4all.nl\u003e\nSigned-off-by: Hans Verkuil \u003chverkuil-cisco@xs4all.nl\u003e\nCc: \u003cstable@vger.kernel.org\u003e      # for v3.18 and up\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d300e5e7eadc87f90d62de93cf46d1420be26b40",
      "old_mode": 33188,
      "old_path": "drivers/media/platform/vivid/vivid-kthread-cap.c",
      "new_id": "2ca9c928ed2f201095e7fd2e7fd00ac3d95af0c1",
      "new_mode": 33188,
      "new_path": "drivers/media/platform/vivid/vivid-kthread-cap.c"
    },
    {
      "type": "modify",
      "old_id": "7c8d758528161d82013c60cffa0fa98c92b6cb07",
      "old_mode": 33188,
      "old_path": "drivers/media/platform/vivid/vivid-kthread-out.c",
      "new_id": "ed5d8fb854b46459630554bbc88237cfb5a313bd",
      "new_mode": 33188,
      "new_path": "drivers/media/platform/vivid/vivid-kthread-out.c"
    },
    {
      "type": "modify",
      "old_id": "ebd7b9c4dd830ec3c78a88f90abbb5a84ce55926",
      "old_mode": 33188,
      "old_path": "drivers/media/platform/vivid/vivid-sdr-cap.c",
      "new_id": "4f49c9a47d49e6f2ab3aebcb7a50ce787eadeaf4",
      "new_mode": 33188,
      "new_path": "drivers/media/platform/vivid/vivid-sdr-cap.c"
    }
  ]
}