[PATCH] dvb: dst: protect the read/write commands with a mutex

We need to protect the read/write commands with a mutex.

Bug reported by Henrik Sjoberg <henke@epact.se>

Signed-off-by: Manu Abraham <manu@linuxtv.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Cc: Johannes Stezenbach <js@linuxtv.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

3 files changed, 35 insertions, 19 deletions

diff --git a/drivers/media/dvb/bt8xx/dst.c b/drivers/media/dvb/bt8xx/dst.c
index bc833a55438f..0c718dca09ca 100644
--- a/drivers/media/dvb/bt8xx/dst.c
+++ b/drivers/media/dvb/bt8xx/dst.c
@@ -910,6 +910,7 @@ static int dst_get_device_id(struct dst_state *state)
 
 static int dst_probe(struct dst_state *state)
 {
+        sema_init(&state->dst_mutex, 1);
         if ((rdc_8820_reset(state)) < 0) {
                 dprintk(verbose, DST_ERROR, 1, "RDC 8820 RESET Failed.");
                 return -1;
@@ -960,21 +961,23 @@ static int dst_probe(struct dst_state *state)
 int dst_command(struct dst_state *state, u8 *data, u8 len)
 {
         u8 reply;
+
+        down(&state->dst_mutex);
         if ((dst_comm_init(state)) < 0) {
                 dprintk(verbose, DST_NOTICE, 1, "DST Communication Initialization Failed.");
-                return -1;
+                goto error;
         }
         if (write_dst(state, data, len)) {
                 dprintk(verbose, DST_INFO, 1, "Tring to recover.. ");
                 if ((dst_error_recovery(state)) < 0) {
                         dprintk(verbose, DST_ERROR, 1, "Recovery Failed.");
-                        return -1;
+                        goto error;
                 }
-                return -1;
+                goto error;
         }
         if ((dst_pio_disable(state)) < 0) {
                 dprintk(verbose, DST_ERROR, 1, "PIO Disable Failed.");
-                return -1;
+                goto error;
         }
         if (state->type_flags & DST_TYPE_HAS_FW_1)
                 udelay(3000);
@@ -982,36 +985,41 @@ int dst_command(struct dst_state *state, u8 *data, u8 len)
                 dprintk(verbose, DST_DEBUG, 1, "Trying to recover.. ");
                 if ((dst_error_recovery(state)) < 0) {
                         dprintk(verbose, DST_INFO, 1, "Recovery Failed.");
-                        return -1;
+                        goto error;
                 }
-                return -1;
+                goto error;
         }
         if (reply != ACK) {
                 dprintk(verbose, DST_INFO, 1, "write not acknowledged 0x%02x ", reply);
-                return -1;
+                goto error;
         }
         if (len >= 2 && data[0] == 0 && (data[1] == 1 || data[1] == 3))
-                return 0;
+                goto error;
         if (state->type_flags & DST_TYPE_HAS_FW_1)
                 udelay(3000);
         else
                 udelay(2000);
         if (!dst_wait_dst_ready(state, NO_DELAY))
-                return -1;
+                goto error;
         if (read_dst(state, state->rxbuffer, FIXED_COMM)) {
                 dprintk(verbose, DST_DEBUG, 1, "Trying to recover.. ");
                 if ((dst_error_recovery(state)) < 0) {
                         dprintk(verbose, DST_INFO, 1, "Recovery failed.");
-                        return -1;
+                        goto error;
                 }
-                return -1;
+                goto error;
         }
         if (state->rxbuffer[7] != dst_check_sum(state->rxbuffer, 7)) {
                 dprintk(verbose, DST_INFO, 1, "checksum failure");
-                return -1;
+                goto error;
         }
-
+        up(&state->dst_mutex);
         return 0;
+
+error:
+        up(&state->dst_mutex);
+        return -EIO;
+
 }
 EXPORT_SYMBOL(dst_command);
 
diff --git a/drivers/media/dvb/bt8xx/dst_ca.c b/drivers/media/dvb/bt8xx/dst_ca.c
index 38c728945bf1..e6541aff3996 100644
--- a/drivers/media/dvb/bt8xx/dst_ca.c
+++ b/drivers/media/dvb/bt8xx/dst_ca.c
@@ -81,36 +81,41 @@ static int dst_ci_command(struct dst_state* state, u8 * data, u8 *ca_string, u8
 {
         u8 reply;
 
+        down(&state->dst_mutex);
         dst_comm_init(state);
         msleep(65);
 
         if (write_dst(state, data, len)) {
                 dprintk(verbose, DST_CA_INFO, 1, " Write not successful, trying to recover");
                 dst_error_recovery(state);
-                return -1;
+                goto error;
         }
         if ((dst_pio_disable(state)) < 0) {
                 dprintk(verbose, DST_CA_ERROR, 1, " DST PIO disable failed.");
-                return -1;
+                goto error;
         }
         if (read_dst(state, &reply, GET_ACK) < 0) {
                 dprintk(verbose, DST_CA_INFO, 1, " Read not successful, trying to recover");
                 dst_error_recovery(state);
-                return -1;
+                goto error;
         }
         if (read) {
                 if (! dst_wait_dst_ready(state, LONG_DELAY)) {
                         dprintk(verbose, DST_CA_NOTICE, 1, " 8820 not ready");
-                        return -1;
+                        goto error;
                 }
                 if (read_dst(state, ca_string, 128) < 0) {      /*      Try to make this dynamic        */
                         dprintk(verbose, DST_CA_INFO, 1, " Read not successful, trying to recover");
                         dst_error_recovery(state);
-                        return -1;
+                        goto error;
                 }
         }
-
+        up(&state->dst_mutex);
         return 0;
+
+error:
+        up(&state->dst_mutex);
+        return -EIO;
 }
 
 
diff --git a/drivers/media/dvb/bt8xx/dst_common.h b/drivers/media/dvb/bt8xx/dst_common.h
index 29b5430dbe4f..81557f38fe38 100644
--- a/drivers/media/dvb/bt8xx/dst_common.h
+++ b/drivers/media/dvb/bt8xx/dst_common.h
@@ -22,6 +22,7 @@
 #ifndef DST_COMMON_H
 #define DST_COMMON_H
 
+#include <linux/smp_lock.h>
 #include <linux/dvb/frontend.h>
 #include <linux/device.h>
 #include "bt878.h"
@@ -119,6 +120,8 @@ struct dst_state {
         u8 card_info[8];
         u8 vendor[8];
         u8 board_info[8];
+
+        struct semaphore dst_mutex;
 };
 
 struct dst_types {