V4L/DVB (10254): em28xx: Fix audio URB transfer buffer race condition

em28xx: Fix audio URB transfer buffer memory leak and race
condition/corruption of capture pointer

Leak fix kindly contributed by Pádraig Brady.

Signed-off-by: Robert Krakora <rob.krakora@messagenetsystems.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

1 files changed, 8 insertions, 1 deletions

diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 94378ccb750..4df6d328842 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -65,6 +65,9 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
                 usb_unlink_urb(dev->adev.urb[i]);
                 usb_free_urb(dev->adev.urb[i]);
                 dev->adev.urb[i] = NULL;
+
+               kfree(dev->adev.transfer_buffer[i]);
+               dev->adev.transfer_buffer[i] = NULL;
         }
 
         return 0;
@@ -389,11 +392,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream,
 static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream
                                                     *substream)
 {
-        struct em28xx *dev;
+       unsigned long flags;
 
+        struct em28xx *dev;
         snd_pcm_uframes_t hwptr_done;
+
         dev = snd_pcm_substream_chip(substream);
+       spin_lock_irqsave(&dev->adev.slock, flags);
         hwptr_done = dev->adev.hwptr_done_capture;
+       spin_unlock_irqrestore(&dev->adev.slock, flags);
 
         return hwptr_done;
 }