V4L/DVB (13831): uvcvideo: Fix oops caused by a race condition in buffer dequeuing
authorLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Thu, 17 Dec 2009 00:20:45 +0000 (21:20 -0300)
committerMauro Carvalho Chehab <mchehab@redhat.com>
Sun, 17 Jan 2010 13:31:35 +0000 (11:31 -0200)
commitd7c0d43997cf716617d724554d19b3b8dd465833
tree00ef45adee02318f35775cc9ecce4ae18372a624
parent2c4d9de8ab1434336248bbc01ee8e64d7e6b8a4f
V4L/DVB (13831): uvcvideo: Fix oops caused by a race condition in buffer dequeuing

Buffers were marked as done before being removed from the IRQ queue. If
a userspace application dequeued and requeued the buffer fast enough
during that time window, the buffer could end up being deleted twice,
generating an oops in interrupt context.

Add a new state, UVC_BUF_STATE_READY, to mark buffers as ready for reuse
but not yet removed from the queue, and transition to UVC_BUF_STATE_DONE
only when the buffer is removed from the queue.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/video/uvc/uvc_queue.c
drivers/media/video/uvc/uvc_video.c
drivers/media/video/uvc/uvcvideo.h