[PATCH] media: raspberrypi: rp1-cfe: acquire state_lock in cfe_start_streaming()

[PATCH] media: raspberrypi: rp1-cfe: acquire state_lock in cfe_start_streaming()

[Tharit Tangkijwanichakul]

cfe_start_streaming() modifies shared device state without holding
state_lock. The driver exposes multiple video nodes backed by
a single cfe_device. While one node runs cfe_start_streaming(),
another node's cfe_buffer_queue() may read the node state via
test_all_nodes() under state_lock to decide whether to schedule a job.
Another case is when node->fs_count is read by the interrupt handler
in cfe_sof_isr().  Modifying this state without state_lock races
against those readers.

The counterpart cfe_stop_streaming() already takes state_lock around its
state modification. Fix cfe_start_streaming() to do the same.

Found by code inspection.

Fixes: 6edb685abb2a ("media: raspberrypi: Add support for RP1-CFE")
Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
---
 drivers/media/platform/raspberrypi/rp1-cfe/cfe.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c b/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c
index 8375ed3e9..d8ea71830 100644
--- a/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c
+++ b/drivers/media/platform/raspberrypi/rp1-cfe/cfe.c
@@ -1151,6 +1151,7 @@ static int cfe_start_streaming(struct vb2_queue *vq, unsigned int count)
 	struct v4l2_subdev_state *state;
 	struct v4l2_subdev_route *route;
 	s64 link_freq;
+	unsigned long flags;
 	int ret;
 
 	cfe_dbg(cfe, "%s: [%s]\n", __func__, node_desc[node->id].name);
@@ -1184,9 +1185,11 @@ static int cfe_start_streaming(struct vb2_queue *vq, unsigned int count)
 
 	state = v4l2_subdev_lock_and_get_active_state(&cfe->csi2.sd);
 
+	spin_lock_irqsave(&cfe->state_lock, flags);
 	clear_state(cfe, FS_INT | FE_INT, node->id);
 	set_state(cfe, NODE_STREAMING, node->id);
 	node->fs_count = 0;
+	spin_unlock_irqrestore(&cfe->state_lock, flags);
 
 	ret = cfe_start_channel(node);
 	if (ret)

base-commit: 06cb687a5132fcffe624c0070576ab852ac6b568
prerequisite-patch-id: 4c010e20cdeb611d14546bc729b513f959e25afd
-- 
2.53.0