media: hdpvr: Hold io_mutex when restarting streaming after a timeout

From: Praneeth Balasubramanian <[email protected]>

hdpvr_start_streaming() expects dev->io_mutex to be held by the caller, as its comment says. Every caller takes it except the restart in the read timeout path of hdpvr_read(). Commit 6bc5a4a19275 ("media: hdpvr:
fix locking and a missing msleep") added the lock around the hdpvr_stop_streaming() call there, but not around the restart.

The restart checks dev->status before its USB control transfers, which can take seconds, and sets STATUS_STREAMING afterwards. In that time another thread can start and then stop streaming with VIDIOC_ENCODER_CMD. hdpvr_stop_streaming() sets STATUS_SHUTTING_DOWN, drops io_mutex and waits in flush_work() for the worker to exit. The restart then sets STATUS_STREAMING and schedules the worker again. The worker does not exit, so flush_work() can wait forever.

Take io_mutex around the restart, like the other callers. A restart that races with a stop then sees STATUS_SHUTTING_DOWN and returns -EAGAIN.

The missing lock was found with an LLM-based tool that checks callers against the locking rules stated in kernel comments.

---

Notes:
Changes in v2:
- Add Cc: stable, as the media CI requires.
- Resent so that the author matches the Signed-off-by. Gmail rewrote the From: header of v1. No code change.

This was found by an LLM-based static analysis (GPT-5.6) that checks kernel code against the rules stated in its comments, as part of research at UCSB SecLab. The patch and changelog were drafted with Claude Opus 5.5. I reviewed the patch and take responsibility for it.

Testing: builds without new warnings with W=1 (x86_64). Not runtime-tested, since I do not have an HD-PVR. The hang is from reading the code, not from a reproduction.

The patch applies to mainline 9ba46df34488 and to next-20261109.

 drivers/media/usb/hdpvr/hdpvr-video.c | 2 ++
 1 file changed, 2 insertions(+)

index 4290b2367fa3..b7afcebe80e6 100644
@@ -475,7 +475,9 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,
 				 * streaming.
 				 */
 				msleep(4000);
+				mutex_lock(&dev->io_mutex);
 				err = hdpvr_start_streaming(dev);
+				mutex_unlock(&dev->io_mutex);
 				if (err) {
 					ret = err;
 					goto err;

2.25.1