@@ -548,6 +548,10 @@ static int uvc_v4l2_open(struct file *file)
}
mutex_lock(&stream->dev->lock);
+ if (!video_is_registered(&stream->vdev)) {
+ mutex_unlock(&stream->dev->lock);
+ return -ENODEV;
+ }
if (stream->dev->users == 0) {
ret = uvc_status_start(stream->dev, GFP_KERNEL);
if (ret < 0) {
@@ -590,7 +594,7 @@ static int uvc_v4l2_release(struct file *file)
file->private_data = NULL;
mutex_lock(&stream->dev->lock);
- if (--stream->dev->users == 0)
+ if (--stream->dev->users == 0 && video_is_registered(&stream->vdev))
uvc_status_stop(stream->dev);
mutex_unlock(&stream->dev->lock);
uvc_v4l2_open() acquires the uvc device mutex. After doing so, it does not check if the video device is still registered. This may result in race conditions and can result in an attempt to submit an urb to a disconnected USB interface (from uvc_status_start). The problem was observed after adding a call to msleep() just before acquiring the mutex and disconnecting the camera during the sleep. Check if the video device is still registered after acquiring the mutex to avoid the problem. In the release function, only call uvc_status_stop() if the video device is still registered. If the video device has been unregistered, the urb associated with uvc status has already been killed in uvc_status_unregister(). Trying to kill it again won't do any good and might have unexpected side effects. Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Alan Stern <stern@rowland.harvard.edu> Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Guenter Roeck <linux@roeck-us.net> --- v2: Fix typo in description. The USB message is sent from uvc_status_start() in the open function, not from uvc_v4l2_open(). drivers/media/usb/uvc/uvc_v4l2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)