Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit baff6cdd authored by Ricardo Cerqueira's avatar Ricardo Cerqueira Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (7201): cx88-mpeg: Fix race condition in variable access 



There was a possible race condition in the increment/decrement of
the active device references counter.
Thanks to Trent Piepho (xyzzy@speakeasy.org) for bringing it up.

Signed-off-by: default avatarRicardo Cerqueira <v4l@cerqueira.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@infradead.org>
parent 40ae91a7

drivers/media/video/cx88/cx88-mpeg.c

+3 −3
Original line number Diff line number Diff line
@@ -615,8 +615,8 @@ static int cx8802_request_acquire(struct cx8802_driver *drv) 


	if (drv->advise_acquire)

	{

		core->active_ref++;

		mutex_lock(&drv->core->lock);

		core->active_ref++;

		if (core->active_type_id == CX88_BOARD_NONE) {

			core->active_type_id = drv->type_id;

			drv->advise_acquire(drv);
@@ -634,14 +634,14 @@ static int cx8802_request_release(struct cx8802_driver *drv) 
{

	struct cx88_core *core = drv->core;



	mutex_lock(&drv->core->lock);

	if (drv->advise_release && --core->active_ref == 0)

	{

		mutex_lock(&drv->core->lock);

		drv->advise_release(drv);

		core->active_type_id = CX88_BOARD_NONE;

		mutex_unlock(&drv->core->lock);

		mpeg_dbg(1,"%s() Post release GPIO=%x\n", __FUNCTION__, cx_read(MO_GP0_IO));

	}

	mutex_unlock(&drv->core->lock);



	return 0;

}