Commit baff6cdd authored by Ricardo Cerqueira's avatar Ricardo Cerqueira Committed by Mauro Carvalho Chehab

V4L/DVB (7201): cx88-mpeg: Fix race condition in variable access

There was a possible race condition in the increment/decrement of
the active device references counter.
Thanks to Trent Piepho (xyzzy@speakeasy.org) for bringing it up.
Signed-off-by: default avatarRicardo Cerqueira <v4l@cerqueira.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@infradead.org>
parent 40ae91a7
...@@ -615,8 +615,8 @@ static int cx8802_request_acquire(struct cx8802_driver *drv) ...@@ -615,8 +615,8 @@ static int cx8802_request_acquire(struct cx8802_driver *drv)
if (drv->advise_acquire) if (drv->advise_acquire)
{ {
core->active_ref++;
mutex_lock(&drv->core->lock); mutex_lock(&drv->core->lock);
core->active_ref++;
if (core->active_type_id == CX88_BOARD_NONE) { if (core->active_type_id == CX88_BOARD_NONE) {
core->active_type_id = drv->type_id; core->active_type_id = drv->type_id;
drv->advise_acquire(drv); drv->advise_acquire(drv);
...@@ -634,14 +634,14 @@ static int cx8802_request_release(struct cx8802_driver *drv) ...@@ -634,14 +634,14 @@ static int cx8802_request_release(struct cx8802_driver *drv)
{ {
struct cx88_core *core = drv->core; struct cx88_core *core = drv->core;
mutex_lock(&drv->core->lock);
if (drv->advise_release && --core->active_ref == 0) if (drv->advise_release && --core->active_ref == 0)
{ {
mutex_lock(&drv->core->lock);
drv->advise_release(drv); drv->advise_release(drv);
core->active_type_id = CX88_BOARD_NONE; core->active_type_id = CX88_BOARD_NONE;
mutex_unlock(&drv->core->lock);
mpeg_dbg(1,"%s() Post release GPIO=%x\n", __FUNCTION__, cx_read(MO_GP0_IO)); mpeg_dbg(1,"%s() Post release GPIO=%x\n", __FUNCTION__, cx_read(MO_GP0_IO));
} }
mutex_unlock(&drv->core->lock);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment