[RFC PATCH] v4l: saa7134: fix multiple clients access (and oops)

[Marcin Slusarz]

While looking for a reason of multiple oopses in empress_querycap as reported
by kerneloops.org I noticed that only first open of device initializes
struct_file->private_data properly. (Closing the device was broken too).

So initialize private_date and free all resources on last close.
I think this change will fix oops in empress_querycap.

http://kerneloops.org/guilty.php?guilty=empress_querycap&version=2.6.25-release&start=1671168&end=1703935&class=oops

Signed-off-by: Marcin Slusarz <marcin.slusarz@xxxxxxxxx>
Cc: Mauro Carvalho Chehab <mchehab@xxxxxxxxxxxxx>
Cc: video4linux-list@xxxxxxxxxx
---

Compile tested only. Please test on real hardware.

---
 drivers/media/video/saa7134/saa7134-empress.c |   23 +++++++++++++----------
 1 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/media/video/saa7134/saa7134-empress.c b/drivers/media/video/saa7134/saa7134-empress.c
index 81431ee..e543074 100644
--- a/drivers/media/video/saa7134/saa7134-empress.c
+++ b/drivers/media/video/saa7134/saa7134-empress.c
@@ -96,11 +96,11 @@ static int ts_open(struct inode *inode, struct file *file)
 	saa_writeb(SAA7134_AUDIO_MUTE_CTRL,
 		saa_readb(SAA7134_AUDIO_MUTE_CTRL) & ~(1 << 6));
 
-	dev->empress_users++;
-	file->private_data = dev;
 	err = 0;
 
 done_up:
+	dev->empress_users++;
+	file->private_data = dev;
 	mutex_unlock(&dev->empress_tsq.vb_lock);
 done:
 	return err;
@@ -110,16 +110,19 @@ static int ts_release(struct inode *inode, struct file *file)
 {
 	struct saa7134_dev *dev = file->private_data;
 
-	videobuf_stop(&dev->empress_tsq);
-	videobuf_mmap_free(&dev->empress_tsq);
-	dev->empress_users--;
+	mutex_lock(&dev->empress_tsq.vb_lock);
+	if (--dev->empress_users == 0) {
+		videobuf_stop(&dev->empress_tsq);
+		videobuf_mmap_free(&dev->empress_tsq);
 
-	/* stop the encoder */
-	ts_reset_encoder(dev);
+		/* stop the encoder */
+		ts_reset_encoder(dev);
 
-	/* Mute audio */
-	saa_writeb(SAA7134_AUDIO_MUTE_CTRL,
-		saa_readb(SAA7134_AUDIO_MUTE_CTRL) | (1 << 6));
+		/* Mute audio */
+		saa_writeb(SAA7134_AUDIO_MUTE_CTRL,
+			saa_readb(SAA7134_AUDIO_MUTE_CTRL) | (1 << 6));
+	}
+	mutex_unlock(&dev->empress_tsq.vb_lock);
 
 	return 0;
 }
-- 
1.5.4.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/