summaryrefslogtreecommitdiff
path: root/drivers/media
diff options
context:
space:
mode:
authorRobert Krakora <rob.krakora@messagenetsystems.com>2009-01-16 11:23:25 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2009-01-29 08:38:43 -0200
commit53d12e5a56934c31ca59f3b6f127e5a68e645fd2 (patch)
tree00d0cbf7ac06e3a986b9478dbac72a86b8f88b80 /drivers/media
parentba390f005573bdf6ab7fd78bb05119036c2ed539 (diff)
V4L/DVB (10254): em28xx: Fix audio URB transfer buffer race condition
em28xx: Fix audio URB transfer buffer memory leak and race condition/corruption of capture pointer Leak fix kindly contributed by Pádraig Brady. Signed-off-by: Robert Krakora <rob.krakora@messagenetsystems.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/video/em28xx/em28xx-audio.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 94378ccb7505..4df6d3288424 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -65,6 +65,9 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
usb_unlink_urb(dev->adev.urb[i]);
usb_free_urb(dev->adev.urb[i]);
dev->adev.urb[i] = NULL;
+
+ kfree(dev->adev.transfer_buffer[i]);
+ dev->adev.transfer_buffer[i] = NULL;
}
return 0;
@@ -389,11 +392,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream,
static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream
*substream)
{
- struct em28xx *dev;
+ unsigned long flags;
+ struct em28xx *dev;
snd_pcm_uframes_t hwptr_done;
+
dev = snd_pcm_substream_chip(substream);
+ spin_lock_irqsave(&dev->adev.slock, flags);
hwptr_done = dev->adev.hwptr_done_capture;
+ spin_unlock_irqrestore(&dev->adev.slock, flags);
return hwptr_done;
}