V4L/DVB (10254): em28xx: Fix audio URB transfer buffer race condition

em28xx: Fix audio URB transfer buffer memory leak and race
condition/corruption of capture pointer

Leak fix kindly contributed by Pádraig Brady.

Signed-off-by: Robert Krakora <rob.krakora@messagenetsystems.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 94378ccb7505845d157920e4f81d9154eee6f35f..4df6d32884248a95c88029aea03c60349eb0c18f 100644 (file)
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -65,6 +65,9 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
                usb_unlink_urb(dev->adev.urb[i]);
                usb_free_urb(dev->adev.urb[i]);
                dev->adev.urb[i] = NULL;
+
+              kfree(dev->adev.transfer_buffer[i]);
+              dev->adev.transfer_buffer[i] = NULL;
        }
 
        return 0;
@@ -389,11 +392,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream,
 static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream
                                                    *substream)
 {
-       struct em28xx *dev;
+       unsigned long flags;
 
+       struct em28xx *dev;
        snd_pcm_uframes_t hwptr_done;
+
        dev = snd_pcm_substream_chip(substream);
+       spin_lock_irqsave(&dev->adev.slock, flags);
        hwptr_done = dev->adev.hwptr_done_capture;
+       spin_unlock_irqrestore(&dev->adev.slock, flags);
 
        return hwptr_done;
 }