[PATCH] media: tw686x: hold dev->lock during streamoff DMA disable

[Shuhao Fu <sfual@cse.ust.hk>]

tw686x_dma_delay() consumes and clears dev->pending_dma_en /
dev->pending_dma_cmd under dev->lock before replaying that deferred DMA
image to the hardware registers. tw686x_disable_channel() updates the
same fields. Most call sites serialize tw686x_disable_channel() with
dev->lock, but tw686x_stop_streaming() is the exception: it checks
dev->pci_dev under dev->lock, drops the lock, and then calls
tw686x_disable_channel().

If dma_delay_timer fires in that window, the timer path can race the
streamoff disable path and consume stale or partially updated pending
DMA state. This can leave deferred DMA programming out of sync with the
requested stream stop, so STREAMOFF may not immediately reflect the
intended channel-disable state.

Fix with holding dev->lock across the stop-side pci_dev check and
tw686x_disable_channel() call, so VIDIOC_STREAMOFF follows the same
locking contract as the other channel enable/disable paths.

Fixes: 704a84ccdbf1 ("[media] media: Support Intersil/Techwell TW686x-based video capture cards")
Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
---
 drivers/media/pci/tw686x/tw686x-video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/tw686x/tw686x-video.c b/drivers/media/pci/tw686x/tw686x-video.c
index 785dd797d921b5..19fb6196cf9c05 100644
--- a/drivers/media/pci/tw686x/tw686x-video.c
+++ b/drivers/media/pci/tw686x/tw686x-video.c
@@ -552,9 +552,9 @@ static void tw686x_stop_streaming(struct vb2_queue *vq)
 	/* Check device presence */
 	spin_lock_irqsave(&dev->lock, flags);
 	pci_dev = dev->pci_dev;
-	spin_unlock_irqrestore(&dev->lock, flags);
 	if (pci_dev)
 		tw686x_disable_channel(dev, vc->ch);
+	spin_unlock_irqrestore(&dev->lock, flags);
 
 	spin_lock_irqsave(&vc->qlock, flags);
 	tw686x_clear_queue(vc, VB2_BUF_STATE_ERROR);
-- 
2.43.0