From f7059eaa285c0460569ffd26c43ae07e3f03cd6c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Moine?= Date: Tue, 6 Jul 2010 04:32:27 -0300 Subject: V4L/DVB: gspca - main: Don't use the frame buffer flags MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This patch fixes possible race conditions in queue management with SMP: when a frame was completed, the irq function tried to use the next frame buffer. At this time, it was possible that the application on an other processor updated the frame pointer, making the image to point to a bad buffer. The patch contains two main changes: - the image transfer uses the queue indexes which are protected against simultaneous memory access, - the image pointer which is used for image concatenation is only set at interrupt level. Some subdrivers which used the image pointer have been updated. Reported-by: Hans de Goede Signed-off-by: Jean-François Moine Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/gspca/gspca.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'drivers/media/video/gspca/gspca.h') diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h index 453e43d66a8..17e55580631 100644 --- a/drivers/media/video/gspca/gspca.h +++ b/drivers/media/video/gspca/gspca.h @@ -178,11 +178,11 @@ struct gspca_dev { u8 *image; /* image beeing filled */ __u32 frsz; /* frame size */ u32 image_len; /* current length of image */ - char nframes; /* number of frames */ - char fr_i; /* frame being filled */ - char fr_q; /* next frame to queue */ - char fr_o; /* next frame to dequeue */ + atomic_t fr_q; /* next frame to queue */ + atomic_t fr_i; /* frame being filled */ signed char fr_queue[GSPCA_MAX_FRAMES]; /* frame queue */ + char nframes; /* number of frames */ + u8 fr_o; /* next frame to dequeue */ __u8 last_packet_type; __s8 empty_packet; /* if (-1) don't check empty packets */ __u8 streaming; -- cgit v1.2.2