media: platform: video-mux: Fix mutex locking

The current order of locking between the driver mutex and the v4l2 subdev state lock causes a circuluar locking dependency when trying to set up a link. Fix this. Signed-off-by: Paul Elder <[email protected]> Reviewed-by: Laurent Pinchart <[email protected]> Signed-off-by: Kieran Bingham <[email protected]>
6by9 · Oct 10, 2024 · 39684b3 · 39684b3
1 parent c545426
commit 39684b3
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/drivers/media/platform/video-mux.c b/drivers/media/platform/video-mux.c
@@ -70,6 +70,7 @@ static int video_mux_link_setup(struct media_entity *entity,
 {
 	struct v4l2_subdev *sd = media_entity_to_v4l2_subdev(entity);
 	struct v4l2_subdev *source_sd;
+	struct v4l2_subdev_state *sd_state;
 	struct video_mux *vmux = v4l2_subdev_to_video_mux(sd);
 	u16 source_pad = entity->num_pads - 1;
 	int ret = 0;
@@ -85,10 +86,10 @@ static int video_mux_link_setup(struct media_entity *entity,
 		remote->entity->name, remote->index, local->entity->name,
 		local->index, flags & MEDIA_LNK_FL_ENABLED);
 
+	sd_state = v4l2_subdev_lock_and_get_active_state(sd);
 	mutex_lock(&vmux->lock);
 
 	if (flags & MEDIA_LNK_FL_ENABLED) {
-		struct v4l2_subdev_state *sd_state;
 		struct v4l2_mbus_framefmt *source_mbusformat;
 
 		if (vmux->active == local->index)
@@ -106,12 +107,10 @@ static int video_mux_link_setup(struct media_entity *entity,
 		vmux->active = local->index;
 
 		/* Propagate the active format to the source */
-		sd_state = v4l2_subdev_lock_and_get_active_state(sd);
 		source_mbusformat = v4l2_subdev_get_pad_format(sd, sd_state,
 							       source_pad);
 		*source_mbusformat = *v4l2_subdev_get_pad_format(sd, sd_state,
 								 vmux->active);
-		v4l2_subdev_unlock_state(sd_state);
 
 		source_sd = media_entity_to_v4l2_subdev(remote->entity);
 		vmux->subdev.ctrl_handler = source_sd->ctrl_handler;
@@ -129,6 +128,7 @@ static int video_mux_link_setup(struct media_entity *entity,
 
 out:
 	mutex_unlock(&vmux->lock);
+	v4l2_subdev_unlock_state(sd_state);
 	return ret;
 }