From: Robert Krakora Date: Fri, 16 Jan 2009 14:23:25 +0000 (-0300) Subject: V4L/DVB (10254): em28xx: Fix audio URB transfer buffer race condition X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=53d12e5a56934c31ca59f3b6f127e5a68e645fd2;p=deliverable%2Flinux.git V4L/DVB (10254): em28xx: Fix audio URB transfer buffer race condition em28xx: Fix audio URB transfer buffer memory leak and race condition/corruption of capture pointer Leak fix kindly contributed by Pádraig Brady. Signed-off-by: Robert Krakora Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c index 94378ccb7505..4df6d3288424 100644 --- a/drivers/media/video/em28xx/em28xx-audio.c +++ b/drivers/media/video/em28xx/em28xx-audio.c @@ -65,6 +65,9 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev) usb_unlink_urb(dev->adev.urb[i]); usb_free_urb(dev->adev.urb[i]); dev->adev.urb[i] = NULL; + + kfree(dev->adev.transfer_buffer[i]); + dev->adev.transfer_buffer[i] = NULL; } return 0; @@ -389,11 +392,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream, static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream *substream) { - struct em28xx *dev; + unsigned long flags; + struct em28xx *dev; snd_pcm_uframes_t hwptr_done; + dev = snd_pcm_substream_chip(substream); + spin_lock_irqsave(&dev->adev.slock, flags); hwptr_done = dev->adev.hwptr_done_capture; + spin_unlock_irqrestore(&dev->adev.slock, flags); return hwptr_done; }