Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aec96832 authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

[media] vpif_capture: protect dma_queue by a spin_lock 



The dma_queue list is accessed by both the interrupt handler and by normal
code. It needs to be protected by a lock to prevent possible list corruption.

Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Acked-by: default avatarLad, Prabhakar <prabhakar.lad@ti.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 94b76a88

drivers/media/platform/davinci/vpif_capture.c

+23 −3
Original line number Diff line number Diff line
@@ -201,13 +201,16 @@ static void vpif_buffer_queue(struct vb2_buffer *vb) 
	struct vpif_cap_buffer *buf = container_of(vb,

				struct vpif_cap_buffer, vb);

	struct common_obj *common;

	unsigned long flags;



	common = &ch->common[VPIF_VIDEO_INDEX];



	vpif_dbg(2, debug, "vpif_buffer_queue\n");



	spin_lock_irqsave(&common->irqlock, flags);

	/* add the buffer to the DMA queue */

	list_add_tail(&buf->list, &common->dma_queue);

	spin_unlock_irqrestore(&common->irqlock, flags);

}



/**
@@ -278,10 +281,13 @@ static int vpif_start_streaming(struct vb2_queue *vq, unsigned int count) 
	struct common_obj *common = &ch->common[VPIF_VIDEO_INDEX];

	struct vpif_params *vpif = &ch->vpifparams;

	unsigned long addr = 0;

	unsigned long flags;

	int ret;



	/* If buffer queue is empty, return error */

	spin_lock_irqsave(&common->irqlock, flags);

	if (list_empty(&common->dma_queue)) {

		spin_unlock_irqrestore(&common->irqlock, flags);

		vpif_dbg(1, debug, "buffer queue is empty\n");

		return -EIO;

	}
@@ -291,6 +297,7 @@ static int vpif_start_streaming(struct vb2_queue *vq, unsigned int count) 
				    struct vpif_cap_buffer, list);

	/* Remove buffer from the buffer queue */

	list_del(&common->cur_frm->list);

	spin_unlock_irqrestore(&common->irqlock, flags);

	/* Mark state of the current frame to active */

	common->cur_frm->vb.state = VB2_BUF_STATE_ACTIVE;

	/* Initialize field_id and started member */
@@ -362,6 +369,7 @@ static int vpif_stop_streaming(struct vb2_queue *vq) 
	struct vpif_fh *fh = vb2_get_drv_priv(vq);

	struct channel_obj *ch = fh->channel;

	struct common_obj *common;

	unsigned long flags;



	if (!vb2_is_streaming(vq))

		return 0;
@@ -369,12 +377,14 @@ static int vpif_stop_streaming(struct vb2_queue *vq) 
	common = &ch->common[VPIF_VIDEO_INDEX];



	/* release all active buffers */

	spin_lock_irqsave(&common->irqlock, flags);

	while (!list_empty(&common->dma_queue)) {

		common->next_frm = list_entry(common->dma_queue.next,

						struct vpif_cap_buffer, list);

		list_del(&common->next_frm->list);

		vb2_buffer_done(&common->next_frm->vb, VB2_BUF_STATE_ERROR);

	}

	spin_unlock_irqrestore(&common->irqlock, flags);



	return 0;

}
@@ -420,10 +430,12 @@ static void vpif_schedule_next_buffer(struct common_obj *common) 
{

	unsigned long addr = 0;



	spin_lock(&common->irqlock);

	common->next_frm = list_entry(common->dma_queue.next,

				     struct vpif_cap_buffer, list);

	/* Remove that buffer from the buffer queue */

	list_del(&common->next_frm->list);

	spin_unlock(&common->irqlock);

	common->next_frm->vb.state = VB2_BUF_STATE_ACTIVE;

	addr = vb2_dma_contig_plane_dma_addr(&common->next_frm->vb, 0);
@@ -468,8 +480,12 @@ static irqreturn_t vpif_channel_isr(int irq, void *dev_id) 
		/* Check the field format */

		if (1 == ch->vpifparams.std_info.frm_fmt) {

			/* Progressive mode */

			if (list_empty(&common->dma_queue))

			spin_lock(&common->irqlock);

			if (list_empty(&common->dma_queue)) {

				spin_unlock(&common->irqlock);

				continue;

			}

			spin_unlock(&common->irqlock);



			if (!channel_first_int[i][channel_id])

				vpif_process_buffer_complete(common);
@@ -513,9 +529,13 @@ static irqreturn_t vpif_channel_isr(int irq, void *dev_id) 
				vpif_process_buffer_complete(common);

			} else if (1 == fid) {

				/* odd field */

				spin_lock(&common->irqlock);

				if (list_empty(&common->dma_queue) ||

				    (common->cur_frm != common->next_frm))

				    (common->cur_frm != common->next_frm)) {

					spin_unlock(&common->irqlock);

					continue;

				}

				spin_unlock(&common->irqlock);



				vpif_schedule_next_buffer(common);

			}