V4L/DVB (8701): cx18: Add missing lock for when the irq handler manipulates the queues

cx18: Add missing lock for when the irq handler manipulates the queues.  This
was a potential source of stream queue corruption.  Also changed the name of
cx18_queue_find_buf() to cx18_queue_get_buf_irq().

Signed-off-by: Andy Walls <awalls@radix.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

3 files changed, 15 insertions, 12 deletions

diff --git a/drivers/media/video/cx18/cx18-irq.c b/drivers/media/video/cx18/cx18-irq.c
index 25114a5cbd57..ab218315c84b 100644
--- a/drivers/media/video/cx18/cx18-irq.c
+++ b/drivers/media/video/cx18/cx18-irq.c
@@ -61,7 +61,7 @@ static void epu_dma_done(struct cx18 *cx, struct cx18_mailbox *mb)
                 CX18_WARN("Ack struct = %d for %s\n",
                         mb->args[2], s->name);
         id = read_enc(off);
-        buf = cx18_queue_find_buf(s, id, read_enc(off + 4));
+        buf = cx18_queue_get_buf_irq(s, id, read_enc(off + 4));
         CX18_DEBUG_HI_DMA("DMA DONE for %s (buffer %d)\n", s->name, id);
         if (buf) {
                 cx18_buf_sync_for_cpu(s, buf);
diff --git a/drivers/media/video/cx18/cx18-queue.c b/drivers/media/video/cx18/cx18-queue.c
index 6990b77c6200..8a4dd821fd91 100644
--- a/drivers/media/video/cx18/cx18-queue.c
+++ b/drivers/media/video/cx18/cx18-queue.c
@@ -78,12 +78,13 @@ struct cx18_buffer *cx18_dequeue(struct cx18_stream *s, struct cx18_queue *q)
         return buf;
 }
 
-struct cx18_buffer *cx18_queue_find_buf(struct cx18_stream *s, u32 id,
+struct cx18_buffer *cx18_queue_get_buf_irq(struct cx18_stream *s, u32 id,
         u32 bytesused)
 {
         struct cx18 *cx = s->cx;
         struct list_head *p;
 
+        spin_lock(&s->qlock);
         list_for_each(p, &s->q_free.list) {
                 struct cx18_buffer *buf =
                         list_entry(p, struct cx18_buffer, list);
@@ -92,17 +93,19 @@ struct cx18_buffer *cx18_queue_find_buf(struct cx18_stream *s, u32 id,
                         continue;
                 buf->bytesused = bytesused;
                 /* the transport buffers are handled differently,
-                   so there is no need to move them to the full queue */
-                if (s->type == CX18_ENC_STREAM_TYPE_TS)
-                        return buf;
-                s->q_free.buffers--;
-                s->q_free.length -= s->buf_size;
-                s->q_full.buffers++;
-                s->q_full.length += s->buf_size;
-                s->q_full.bytesused += buf->bytesused;
-                list_move_tail(&buf->list, &s->q_full.list);
+                   they are not moved to the full queue */
+                if (s->type != CX18_ENC_STREAM_TYPE_TS) {
+                        s->q_free.buffers--;
+                        s->q_free.length -= s->buf_size;
+                        s->q_full.buffers++;
+                        s->q_full.length += s->buf_size;
+                        s->q_full.bytesused += buf->bytesused;
+                        list_move_tail(&buf->list, &s->q_full.list);
+                }
+                spin_unlock(&s->qlock);
                 return buf;
         }
+        spin_unlock(&s->qlock);
         CX18_ERR("Cannot find buffer %d for stream %s\n", id, s->name);
         return NULL;
 }
diff --git a/drivers/media/video/cx18/cx18-queue.h b/drivers/media/video/cx18/cx18-queue.h
index 91423b9863a4..7f93bb13c09f 100644
--- a/drivers/media/video/cx18/cx18-queue.h
+++ b/drivers/media/video/cx18/cx18-queue.h
@@ -46,7 +46,7 @@ void cx18_queue_init(struct cx18_queue *q);
 void cx18_enqueue(struct cx18_stream *s, struct cx18_buffer *buf,
         struct cx18_queue *q);
 struct cx18_buffer *cx18_dequeue(struct cx18_stream *s, struct cx18_queue *q);
-struct cx18_buffer *cx18_queue_find_buf(struct cx18_stream *s, u32 id,
+struct cx18_buffer *cx18_queue_get_buf_irq(struct cx18_stream *s, u32 id,
         u32 bytesused);
 void cx18_flush_queues(struct cx18_stream *s);