diff options
| author | Laurent Pinchart <laurent.pinchart@ideasonboard.com> | 2009-12-16 21:20:45 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-01-17 11:31:35 -0200 |
| commit | d7c0d43997cf716617d724554d19b3b8dd465833 (patch) | |
| tree | 00ef45adee02318f35775cc9ecce4ae18372a624 /drivers/media/video/uvc/uvcvideo.h | |
| parent | 2c4d9de8ab1434336248bbc01ee8e64d7e6b8a4f (diff) | |
| download | linux-stable-d7c0d43997cf716617d724554d19b3b8dd465833.tar.gz linux-stable-d7c0d43997cf716617d724554d19b3b8dd465833.tar.bz2 linux-stable-d7c0d43997cf716617d724554d19b3b8dd465833.zip | |
V4L/DVB (13831): uvcvideo: Fix oops caused by a race condition in buffer dequeuing
Buffers were marked as done before being removed from the IRQ queue. If
a userspace application dequeued and requeued the buffer fast enough
during that time window, the buffer could end up being deleted twice,
generating an oops in interrupt context.
Add a new state, UVC_BUF_STATE_READY, to mark buffers as ready for reuse
but not yet removed from the queue, and transition to UVC_BUF_STATE_DONE
only when the buffer is removed from the queue.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video/uvc/uvcvideo.h')
| -rw-r--r-- | drivers/media/video/uvc/uvcvideo.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h index 7ec9a04ced50..2337585001ea 100644 --- a/drivers/media/video/uvc/uvcvideo.h +++ b/drivers/media/video/uvc/uvcvideo.h @@ -365,8 +365,9 @@ enum uvc_buffer_state { UVC_BUF_STATE_IDLE = 0, UVC_BUF_STATE_QUEUED = 1, UVC_BUF_STATE_ACTIVE = 2, - UVC_BUF_STATE_DONE = 3, - UVC_BUF_STATE_ERROR = 4, + UVC_BUF_STATE_READY = 3, + UVC_BUF_STATE_DONE = 4, + UVC_BUF_STATE_ERROR = 5, }; struct uvc_buffer { |