Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53d12e5a authored by Robert Krakora's avatar Robert Krakora Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (10254): em28xx: Fix audio URB transfer buffer race condition 



em28xx: Fix audio URB transfer buffer memory leak and race
condition/corruption of capture pointer

Leak fix kindly contributed by Pádraig Brady.

Signed-off-by: default avatarRobert Krakora <rob.krakora@messagenetsystems.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent ba390f00

drivers/media/video/em28xx/em28xx-audio.c

+8 −1
Original line number Diff line number Diff line
@@ -65,6 +65,9 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev) 
		usb_unlink_urb(dev->adev.urb[i]);

		usb_free_urb(dev->adev.urb[i]);

		dev->adev.urb[i] = NULL;



	       kfree(dev->adev.transfer_buffer[i]);

	       dev->adev.transfer_buffer[i] = NULL;

	}



	return 0;
@@ -389,11 +392,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream, 
static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream

						    *substream)

{

	struct em28xx *dev;

       unsigned long flags;



	struct em28xx *dev;

	snd_pcm_uframes_t hwptr_done;



	dev = snd_pcm_substream_chip(substream);

       spin_lock_irqsave(&dev->adev.slock, flags);

	hwptr_done = dev->adev.hwptr_done_capture;

       spin_unlock_irqrestore(&dev->adev.slock, flags);



	return hwptr_done;

}