tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

V4L/DVB (9647): em28xx: void having two concurrent control URB's

Now that we have a polling task for IR, there's a race condition, since
IR can be polling while other operations are being doing. Also, we are
now sharing the same urb_buf for both read and write control urb
operations. So, we need a mutex.

Thanks to Davin Heitmueller <devin.heitmueller@gmail.com> for warning me.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Mauro Carvalho Chehab f2a2e491 c4a98793

+12 -2
unified split
+10 -2
drivers/media/video/em28xx/em28xx-core.c
··· 76 77 em28xx_regdbg("req=%02x, reg=%02x ", req, reg); 78 79 ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req, 80 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 81 0x0000, reg, dev->urb_buf, len, HZ); 82 if (ret < 0) { 83 if (reg_debug) 84 printk(" failed!\n"); 85 return ret; 86 } 87 88 if (len) 89 memcpy(buf, dev->urb_buf, len); 90 91 if (reg_debug) { 92 printk("%02x values: ", ret); ··· 116 117 em28xx_regdbg("req=%02x, reg=%02x:", req, reg); 118 119 ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req, 120 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 121 0x0000, reg, dev->urb_buf, 1, HZ); 122 if (ret < 0) { 123 printk(" failed!\n"); 124 return ret; 125 } 126 - 127 - val = dev->urb_buf[0]; 128 129 if (reg_debug) 130 printk("%02x\n", (unsigned char) val); ··· 162 printk("\n"); 163 } 164 165 memcpy(dev->urb_buf, buf, len); 166 ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), req, 167 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 168 0x0000, reg, dev->urb_buf, len, HZ); 169 170 if (dev->wait_after_write) 171 msleep(dev->wait_after_write);
··· 76 77 em28xx_regdbg("req=%02x, reg=%02x ", req, reg); 78 79 + mutex_lock(&dev->ctrl_urb_lock); 80 ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req, 81 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 82 0x0000, reg, dev->urb_buf, len, HZ); 83 if (ret < 0) { 84 if (reg_debug) 85 printk(" failed!\n"); 86 + mutex_unlock(&dev->ctrl_urb_lock); 87 return ret; 88 } 89 90 if (len) 91 memcpy(buf, dev->urb_buf, len); 92 + 93 + mutex_unlock(&dev->ctrl_urb_lock); 94 95 if (reg_debug) { 96 printk("%02x values: ", ret); ··· 112 113 em28xx_regdbg("req=%02x, reg=%02x:", req, reg); 114 115 + mutex_lock(&dev->ctrl_urb_lock); 116 ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req, 117 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 118 0x0000, reg, dev->urb_buf, 1, HZ); 119 + val = dev->urb_buf[0]; 120 + mutex_unlock(&dev->ctrl_urb_lock); 121 + 122 if (ret < 0) { 123 printk(" failed!\n"); 124 return ret; 125 } 126 127 if (reg_debug) 128 printk("%02x\n", (unsigned char) val); ··· 156 printk("\n"); 157 } 158 159 + mutex_lock(&dev->ctrl_urb_lock); 160 memcpy(dev->urb_buf, buf, len); 161 ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), req, 162 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 163 0x0000, reg, dev->urb_buf, len, HZ); 164 + mutex_unlock(&dev->ctrl_urb_lock); 165 166 if (dev->wait_after_write) 167 msleep(dev->wait_after_write);
+1
drivers/media/video/em28xx/em28xx-video.c
··· 1936 1937 dev->udev = udev; 1938 mutex_init(&dev->lock); 1939 spin_lock_init(&dev->slock); 1940 init_waitqueue_head(&dev->open); 1941 init_waitqueue_head(&dev->wait_frame);
··· 1936 1937 dev->udev = udev; 1938 mutex_init(&dev->lock); 1939 + mutex_init(&dev->ctrl_urb_lock); 1940 spin_lock_init(&dev->slock); 1941 init_waitqueue_head(&dev->open); 1942 init_waitqueue_head(&dev->wait_frame);
+1
drivers/media/video/em28xx/em28xx.h
··· 433 434 /* locks */ 435 struct mutex lock; 436 /* spinlock_t queue_lock; */ 437 struct list_head inqueue, outqueue; 438 wait_queue_head_t open, wait_frame, wait_stream;
··· 433 434 /* locks */ 435 struct mutex lock; 436 + struct mutex ctrl_urb_lock; /* protects urb_buf */ 437 /* spinlock_t queue_lock; */ 438 struct list_head inqueue, outqueue; 439 wait_queue_head_t open, wait_frame, wait_stream;