[PATCH] media input infrastructure:tw686x: Fix of possible inconsistent memory deallocation and/or race condition by implementation of custom video_device_release function in tw686x driver

[Mark Balantzyan]

Possible inconsistent memory deallocation and/or race conditions were 
detected specifically with respect to remaining open handles to the video 
device handled by the tw686x driver. This patch addresses this by 
implementing a revised independent instance of the video_device_release 
function to free the remaining resources and memory where the last open 
handle(s) is/were closed.

Signed-off-by: Mark Balantzyan <mbala...@gmail.com>
---
 drivers/media/pci/tw686x/tw686x-video.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/media/pci/tw686x/tw686x-video.c 
b/drivers/media/pci/tw686x/tw686x-video.c
index 3a06c000..741e15ac 100644
--- a/drivers/media/pci/tw686x/tw686x-video.c
+++ b/drivers/media/pci/tw686x/tw686x-video.c
@@ -1151,6 +1151,13 @@ void tw686x_video_irq(struct tw686x_dev *dev, 
unsigned long requests,
        }
 }

+void video_device_release(tw686x_dev *dev) {
+       for (int pb = 0; pb < 2; pb++) {
+               dev->dma_ops->free(dev->video_channels,pb);
+       }
+       kfree(dev);
+}
+
 void tw686x_video_free(struct tw686x_dev *dev)
 {
        unsigned int ch, pb;
@@ -1160,9 +1167,9 @@ void tw686x_video_free(struct tw686x_dev *dev)

                video_unregister_device(vc->device);

-               if (dev->dma_ops->free)
-                       for (pb = 0; pb < 2; pb++)
-                               dev->dma_ops->free(vc, pb);
+               if (dev->dma_ops->free) {
+                       video_device_release(dev);
+               }
        }
 }

--
2.17.1