On Tue, 05 Jun 2018 10:20:16 -0400, Hugo Lefeuvre said:
Thanks. I think I'll have to read the source code to fully understand what happens. Do you know what piece of code handles this reference duplication ?
It's not duplication, it's increment/decrement of a counter. Look for functions with 'get' and 'put' in their names.
As a conclusion we can assume that ioctl and release never run concurrently, and as such the lock introduced in my patch is useless.
Well, they *shouldn't* do so. What the code actually does, however....
Concerning the TODO at line 876, I think I've misunderstood it. I'll think a bit more about it and come back with an updated patch later.
I haven't looked at the code - there's an outside chance that the driver isn't doing reference counting correctly.