From 495e488de4078579da14b32520fb766177ccf8cf Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Sun, 22 Jun 2008 17:03:02 +0000 Subject: Fix open/close race in saa7134 From: Arjan van de Ven The saa7134 driver uses a (non-atomic) variable in an attempt to only allow one opener of the device (how it deals with sending the fd over unix sockets I don't know). Unfortunately, the release function first decrements this variable, and THEN goes on to disable more of the device. This allows for a race where another opener of the device comes in after the decrement of the variable, configures the hardware just to then see the hardware be disabled by the rest of the release function. This patch makes the release function use the same lock as the open function to protect the hardware as well as the variable (which now at least has some locking to protect it). Signed-off-by: Arjan van de Ven Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/video/saa7134/saa7134-empress.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'linux/drivers') diff --git a/linux/drivers/media/video/saa7134/saa7134-empress.c b/linux/drivers/media/video/saa7134/saa7134-empress.c index 9ad75423a..987a60fb4 100644 --- a/linux/drivers/media/video/saa7134/saa7134-empress.c +++ b/linux/drivers/media/video/saa7134/saa7134-empress.c @@ -119,6 +119,8 @@ static int ts_release(struct inode *inode, struct file *file) { struct saa7134_dev *dev = file->private_data; + mutex_lock(&dev->empress_tsq.vb_lock); + videobuf_stop(&dev->empress_tsq); videobuf_mmap_free(&dev->empress_tsq); @@ -131,6 +133,8 @@ static int ts_release(struct inode *inode, struct file *file) dev->empress_users--; + mutex_unlock(&dev->empress_tsq.vb_lock); + return 0; } -- cgit v1.2.3