V4L/DVB (11231): hdpvr: locking fixes

unlock io_mutex in hdpvr_stop_streaming hdpvr_disconnect to allow the
streaming worker to stop before we flush the workqueue.
do not return to user space with mutex held in vidioc_encoder_cmd with
an unknown encoder command.

Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

2 files changed, 5 insertions, 1 deletions

diff --git a/drivers/media/video/hdpvr/hdpvr-core.c b/drivers/media/video/hdpvr/hdpvr-core.c
index 2c49862b6d32..547833eb6cec 100644
--- a/drivers/media/video/hdpvr/hdpvr-core.c
+++ b/drivers/media/video/hdpvr/hdpvr-core.c
@@ -390,8 +390,10 @@ static void hdpvr_disconnect(struct usb_interface *interface)
         video_unregister_device(dev->video_dev);
         wake_up_interruptible(&dev->wait_data);
         wake_up_interruptible(&dev->wait_buffer);
+        mutex_unlock(&dev->io_mutex);
         msleep(100);
         flush_workqueue(dev->workqueue);
+        mutex_lock(&dev->io_mutex);
         hdpvr_cancel_queue(dev);
         destroy_workqueue(dev->workqueue);
         mutex_unlock(&dev->io_mutex);
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index e9078cdedb28..2fe57303c0b5 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -300,12 +300,14 @@ static int hdpvr_stop_streaming(struct hdpvr_device *dev)
 
         dev->status = STATUS_SHUTTING_DOWN;
         hdpvr_config_call(dev, CTRL_STOP_STREAMING_VALUE, 0x00);
+        mutex_unlock(&dev->io_mutex);
 
         wake_up_interruptible(&dev->wait_buffer);
         msleep(50);
 
         flush_workqueue(dev->workqueue);
 
+        mutex_lock(&dev->io_mutex);
         /* kill the still outstanding urbs */
         hdpvr_cancel_queue(dev);
 
@@ -1130,7 +1132,7 @@ static int vidioc_encoder_cmd(struct file *filp, void *priv,
         default:
                 v4l2_dbg(MSG_INFO, hdpvr_debug, dev->video_dev,
                          "Unsupported encoder cmd %d\n", a->cmd);
-                return -EINVAL;
+                res = -EINVAL;
         }
         mutex_unlock(&dev->io_mutex);
         return res;