aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/media/video/gspca/pac7311.c
diff options
context:
space:
mode:
authorJean-François Moine <moinejf@free.fr>2010-07-06 03:32:27 -0400
committerMauro Carvalho Chehab <mchehab@redhat.com>2010-08-02 15:42:48 -0400
commitf7059eaa285c0460569ffd26c43ae07e3f03cd6c (patch)
tree4f31450a63b1460fcdf3b79e8f47d8b824683a60 /drivers/media/video/gspca/pac7311.c
parent02bbcb9d863df10b5a4b91ba5b4c76eaf1340883 (diff)
V4L/DVB: gspca - main: Don't use the frame buffer flags
This patch fixes possible race conditions in queue management with SMP: when a frame was completed, the irq function tried to use the next frame buffer. At this time, it was possible that the application on an other processor updated the frame pointer, making the image to point to a bad buffer. The patch contains two main changes: - the image transfer uses the queue indexes which are protected against simultaneous memory access, - the image pointer which is used for image concatenation is only set at interrupt level. Some subdrivers which used the image pointer have been updated. Reported-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Jean-François Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video/gspca/pac7311.c')
-rw-r--r--drivers/media/video/gspca/pac7311.c9
1 files changed, 2 insertions, 7 deletions
diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
index 5568c41a296c..1cb7e99e92bd 100644
--- a/drivers/media/video/gspca/pac7311.c
+++ b/drivers/media/video/gspca/pac7311.c
@@ -630,12 +630,6 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
630 if (sof) { 630 if (sof) {
631 int n, lum_offset, footer_length; 631 int n, lum_offset, footer_length;
632 632
633 image = gspca_dev->image;
634 if (image == NULL) {
635 gspca_dev->last_packet_type = DISCARD_PACKET;
636 return;
637 }
638
639 /* 6 bytes after the FF D9 EOF marker a number of lumination 633 /* 6 bytes after the FF D9 EOF marker a number of lumination
640 bytes are send corresponding to different parts of the 634 bytes are send corresponding to different parts of the
641 image, the 14th and 15th byte after the EOF seem to 635 image, the 14th and 15th byte after the EOF seem to
@@ -651,7 +645,8 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
651 } else { 645 } else {
652 gspca_frame_add(gspca_dev, INTER_PACKET, data, n); 646 gspca_frame_add(gspca_dev, INTER_PACKET, data, n);
653 } 647 }
654 if (gspca_dev->last_packet_type != DISCARD_PACKET 648 image = gspca_dev->image;
649 if (image != NULL
655 && image[gspca_dev->image_len - 2] == 0xff 650 && image[gspca_dev->image_len - 2] == 0xff
656 && image[gspca_dev->image_len - 1] == 0xd9) 651 && image[gspca_dev->image_len - 1] == 0xd9)
657 gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0); 652 gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);