Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

[media] media: dmxdev: remove dvb_ringbuffer_flush() on writer side

In dvb_ringbuffer lock-less synchronizationof reader and writer threads is done
with separateread and write pointers. Sincedvb_ringbuffer_flush() modifies the
read pointer, this function must not be called from the writer thread.
This patch removes the dvb_ringbuffer_flush() calls in the dmxdev ringbuffer
write functions, this fixes Oopses "Unable to handle kernel paging request"
I could observe for the call chaindvb_demux_read ->dvb_dmxdev_buffer_read ->
dvb_ringbuffer_read_user -> __copy_to_user (the reader side of the ringbuffer).
The flush calls at the write side are not necessary anyway since ringbuffer_flush
is also called in dvb_dmxdev_buffer_read() when an error condition is set in the
ringbuffer.
This patch should also be applied to stable kernels.

Signed-off-by: Soeren Moch <smoch@web.de>
CC: <stable@vger.kernel.org>
Reviewed-by: Sakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

authored by

Soeren Moch and committed by
Mauro Carvalho Chehab
414abbd2 6914d70e

+2 -6
+2 -6
drivers/media/dvb-core/dmxdev.c
··· 377 377 ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer, buffer2, 378 378 buffer2_len); 379 379 } 380 - if (ret < 0) { 381 - dvb_ringbuffer_flush(&dmxdevfilter->buffer); 380 + if (ret < 0) 382 381 dmxdevfilter->buffer.error = ret; 383 - } 384 382 if (dmxdevfilter->params.sec.flags & DMX_ONESHOT) 385 383 dmxdevfilter->state = DMXDEV_STATE_DONE; 386 384 spin_unlock(&dmxdevfilter->dev->lock); ··· 414 416 ret = dvb_dmxdev_buffer_write(buffer, buffer1, buffer1_len); 415 417 if (ret == buffer1_len) 416 418 ret = dvb_dmxdev_buffer_write(buffer, buffer2, buffer2_len); 417 - if (ret < 0) { 418 - dvb_ringbuffer_flush(buffer); 419 + if (ret < 0) 419 420 buffer->error = ret; 420 - } 421 421 spin_unlock(&dmxdevfilter->dev->lock); 422 422 wake_up(&buffer->queue); 423 423 return 0;