[media] radio-mr800: fix locking order

Don't hold the lock before unregistering the device, since when the
device is unregistered the datastruct containing the lock may be freed
(if the refcount went to 0).

Also fixed the framework documentation that erroneously suggested the
wrong locking order as well.

Reported-by: David Ellingsworth <david@identd.dyndns.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Acked-by: David Ellingsworth <david@identd.dyndns.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/Documentation/video4linux/v4l2-framework.txt b/Documentation/video4linux/v4l2-framework.txt
index a128e012a45cbe2e14569907b6c8712d98adf92a..f22f35c271f38d34fda0c19d8942b536e2fc95d9 100644 (file)
--- a/Documentation/video4linux/v4l2-framework.txt
+++ b/Documentation/video4linux/v4l2-framework.txt
@@ -488,7 +488,7 @@ also waits in the code, then you should do the same to allow other processes
 to access the device node while the first process is waiting for something.
 
 The implementation of a hotplug disconnect should also take the lock before
-calling v4l2_device_disconnect and video_unregister_device.
+calling v4l2_device_disconnect.
 
 video_device registration
 -------------------------

diff --git a/drivers/media/radio/radio-mr800.c b/drivers/media/radio/radio-mr800.c
index 97967ad3cd1229164718d545bdb2f91b141e5b51..2f56b26cece9bbaf24110efad437ae31d296130d 100644 (file)
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -285,8 +285,8 @@ static void usb_amradio_disconnect(struct usb_interface *intf)
 
        mutex_lock(&radio->lock);
        v4l2_device_disconnect(&radio->v4l2_dev);
-       video_unregister_device(&radio->videodev);
        mutex_unlock(&radio->lock);
+       video_unregister_device(&radio->videodev);
 }
 
 /* vidioc_querycap - query device capabilities */