Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 868d5cca authored by Rupesh Tatiya's avatar Rupesh Tatiya Committed by Gerrit - the friendly Code Review server
Browse files

radio-iris: Perform smd close operation only once. 



iris_fops_release function can be called in parallel and this may result
in accessing freed memory in close_smd operation. Serialize the access to
close_smd and call it only if it is valid.

Change-Id: I9dd00625866c2f0da12ae0d35896f0683bd1453f
Signed-off-by: default avatarRupesh Tatiya <rtatiya@codeaurora.org>
parent 0940fb6a

drivers/media/radio/radio-iris.c

+5 −4
Original line number Diff line number Diff line
@@ -633,6 +633,7 @@ int radio_hci_unregister_dev(struct radio_hci_dev *hdev) 
	skb_queue_purge(&hdev->cmd_q);

	skb_queue_purge(&hdev->raw_q);



	radio->fm_hdev = NULL;

	return 0;

}

EXPORT_SYMBOL(radio_hci_unregister_dev);
@@ -5209,11 +5210,11 @@ static int iris_fops_release(struct file *file) 
		return retval;

	}

END:

	if (radio->fm_hdev != NULL) {

	mutex_lock(&fm_smd_enable);

	if (radio->fm_hdev != NULL)

		radio->fm_hdev->close_smd();

	mutex_unlock(&fm_smd_enable);

	}



	if (retval < 0)

		FMDERR("Err on disable FM %d\n", retval);