lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

V4L/DVB (10254): em28xx: Fix audio URB transfer buffer race condition

Browse Source 
em28xx: Fix audio URB transfer buffer memory leak and race
condition/corruption of capture pointer

Leak fix kindly contributed by Pádraig Brady.

Signed-off-by: Robert Krakora <rob.krakora@messagenetsystems.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Robert Krakora
2009-01-16 11:23:25 -03:00
committed by Mauro Carvalho Chehab
parent ba390f0055
commit 53d12e5a56
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/media/video/em28xx/em28xx-audio.c
View File

@@ -65,6 +65,9 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
usb_unlink_urb(dev->adev.urb[i]); usb_unlink_urb(dev->adev.urb[i]);
usb_free_urb(dev->adev.urb[i]); usb_free_urb(dev->adev.urb[i]);
dev->adev.urb[i] = NULL; dev->adev.urb[i] = NULL;
kfree(dev->adev.transfer_buffer[i]);
dev->adev.transfer_buffer[i] = NULL;
} }
return 0; return 0;
@@ -389,11 +392,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream,
static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream
*substream) *substream)
{ {
struct em28xx *dev; unsigned long flags;
struct em28xx *dev;
snd_pcm_uframes_t hwptr_done; snd_pcm_uframes_t hwptr_done;
dev = snd_pcm_substream_chip(substream); dev = snd_pcm_substream_chip(substream);
spin_lock_irqsave(&dev->adev.slock, flags);
hwptr_done = dev->adev.hwptr_done_capture; hwptr_done = dev->adev.hwptr_done_capture;
spin_unlock_irqrestore(&dev->adev.slock, flags);
return hwptr_done; return hwptr_done;
} }