Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

V4L/DVB (7201): cx88-mpeg: Fix race condition in variable access

There was a possible race condition in the increment/decrement of
the active device references counter.
Thanks to Trent Piepho (xyzzy@speakeasy.org) for bringing it up.

Signed-off-by: Ricardo Cerqueira <v4l@cerqueira.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

authored by

Ricardo Cerqueira and committed by
Mauro Carvalho Chehab
baff6cdd 40ae91a7

+3 -3
+3 -3
drivers/media/video/cx88/cx88-mpeg.c
··· 615 615 616 616 if (drv->advise_acquire) 617 617 { 618 - core->active_ref++; 619 618 mutex_lock(&drv->core->lock); 619 + core->active_ref++; 620 620 if (core->active_type_id == CX88_BOARD_NONE) { 621 621 core->active_type_id = drv->type_id; 622 622 drv->advise_acquire(drv); ··· 634 634 { 635 635 struct cx88_core *core = drv->core; 636 636 637 + mutex_lock(&drv->core->lock); 637 638 if (drv->advise_release && --core->active_ref == 0) 638 639 { 639 - mutex_lock(&drv->core->lock); 640 640 drv->advise_release(drv); 641 641 core->active_type_id = CX88_BOARD_NONE; 642 - mutex_unlock(&drv->core->lock); 643 642 mpeg_dbg(1,"%s() Post release GPIO=%x\n", __FUNCTION__, cx_read(MO_GP0_IO)); 644 643 } 644 + mutex_unlock(&drv->core->lock); 645 645 646 646 return 0; 647 647 }