commit 2db2546a0b5c0bc1f5053cc3b6353de432abb456
author Kieran Bingham <kieran.bingham@ideasonboard.com> Thu Nov 30 14:25:05 2017 +0000
committer Kieran Bingham <kieran.bingham@ideasonboard.com> Thu Nov 30 17:18:55 2017 +0000
tree 8a6f3991b936d703fa557e1850053b423fcc7989
parent dcef290aff6d72824d48811173077d8eda19185a

v4l: async: Protect against double notifier regstrations

It can be easy to attempt to register the same notifier twice
in mis-handled error cases such as working with -EPROBE_DEFER.

This results in odd kernel crashes where the notifier_list becomes
corrupted due to adding the same entry twice.

Protect against this so that a developer has some sense of the pending
failure.

Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>

drivers/media/v4l2-core/v4l2-async.c

diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index 1281aac..d95f201 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -399,6 +399,7 @@ static int __v4l2_async_notifier_register(struct v4l2_async_notifier *notifier)
 	struct device *dev =
 		notifier->v4l2_dev ? notifier->v4l2_dev->dev : NULL;
 	struct v4l2_async_subdev *asd;
+	struct v4l2_async_notifier *n;
 	int ret;
 	int i;
 
@@ -410,6 +411,19 @@ static int __v4l2_async_notifier_register(struct v4l2_async_notifier *notifier)
 
 	mutex_lock(&list_lock);
 
+	/*
+	 * Registering the same notifier can occur if a driver incorrectly
+	 * handles a -EPROBE_DEFER for example, and will break in a
+	 * confusing fashion with linked-list corruption.
+	 */
+	list_for_each_entry(n, &notifier_list, list) {
+		if (n == notifier) {
+			dev_err(dev, "Notifier has already been registered\n");
+			ret = -EEXIST;
+			goto err_unlock;
+		}
+	}
+
 	for (i = 0; i < notifier->num_subdevs; i++) {
 		asd = notifier->subdevs[i];