diff options
| author | Mauro Carvalho Chehab <mchehab@redhat.com> | 2009-01-16 09:23:25 -0500 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2009-01-16 09:23:25 -0500 |
| commit | 2fd219108ef3cf22a79c49f56c53fc5a3ff5b06e (patch) | |
| tree | 91e3075c2ec11af8cf2e30b885f59cf9eda16bec /linux/drivers/media/video/em28xx/em28xx-audio.c | |
| parent | 5ab66038c4316acb1ed807b40a3a035dd481f4fa (diff) | |
| download | mediapointer-dvb-s2-2fd219108ef3cf22a79c49f56c53fc5a3ff5b06e.tar.gz mediapointer-dvb-s2-2fd219108ef3cf22a79c49f56c53fc5a3ff5b06e.tar.bz2 | |
em28xx: Fix audio URB transfer buffer race condition
From: Robert Krakora <rob.krakora@messagenetsystems.com>
em28xx: Fix audio URB transfer buffer memory leak and race
condition/corruption of capture pointer
Leak fix kindly contributed by Pádraig Brady.
Priority: normal
Signed-off-by: Robert Krakora <rob.krakora@messagenetsystems.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'linux/drivers/media/video/em28xx/em28xx-audio.c')
| -rw-r--r-- | linux/drivers/media/video/em28xx/em28xx-audio.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/linux/drivers/media/video/em28xx/em28xx-audio.c b/linux/drivers/media/video/em28xx/em28xx-audio.c index 34c494d68..0d6a3a9ec 100644 --- a/linux/drivers/media/video/em28xx/em28xx-audio.c +++ b/linux/drivers/media/video/em28xx/em28xx-audio.c @@ -66,6 +66,9 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev) usb_unlink_urb(dev->adev.urb[i]); usb_free_urb(dev->adev.urb[i]); dev->adev.urb[i] = NULL; + + kfree(dev->adev.transfer_buffer[i]); + dev->adev.transfer_buffer[i] = NULL; } return 0; @@ -458,11 +461,15 @@ static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream *substream) #endif { - struct em28xx *dev; + unsigned long flags; + struct em28xx *dev; snd_pcm_uframes_t hwptr_done; + dev = snd_pcm_substream_chip(substream); + spin_lock_irqsave(&dev->adev.slock, flags); hwptr_done = dev->adev.hwptr_done_capture; + spin_unlock_irqrestore(&dev->adev.slock, flags); return hwptr_done; } |