Hi,

the recent discussion on procfs and driverfs caused me to look at the
existing uses with respect to races against disconnect.

I think I found something in stv680, the second driver I looked at.

from usb_stv680_remove_disconnected:

#if defined(CONFIG_PROC_FS) && defined(CONFIG_VIDEO_PROC_FS)
        destroy_proc_stv680_cam (stv680);
#endif
        /* Free the memory */
        kfree (stv680);

now destroy_proc_stv680_cam:
        sprintf (name, "video%d", stv680->vdev.minor);
        remove_proc_entry (name, stv680_proc_entry);
        stv680->proc_entry = NULL;

So this is safe if, and only if, remove_proc_entry waits
for current readers to finish before it returns.
As far as I can tell, this is not the case.

So reading from the proc file while the camera is disconnected is
potentially deadly. I see no easy fix.
Comments?

        Regards
                Oliver



-------------------------------------------------------
This sf.net email is sponsored by: Influence the future
of Java(TM) technology. Join the Java Community
Process(SM) (JCP(SM)) program now.
http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
_______________________________________________
[EMAIL PROTECTED]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

Reply via email to