V4L/DVB (10619): gspca - main: Destroy the URBs at disconnection time.

If a device using the gspca framework is unplugged while it is still streaming
then the call that is used to free the URBs that have been allocated occurs
after the pointer it uses becomes invalid at the end of gspca_disconnect.
Make another cleanup call in gspca_disconnect while the pointer is still
valid (multiple calls are OK as destroy_urbs checks for pointers already
being NULL.

Signed-off-by: Adam Baker <linux@baker-net.org.uk>
Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 2ed24527ecd61cea70287dd668725445799ee4fa..65e4901f4db70a713a4b1d60c0400c4ec9f9250a 100644 (file)
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -422,6 +422,7 @@ static void destroy_urbs(struct gspca_dev *gspca_dev)
                if (urb == NULL)
                        break;
 
+               BUG_ON(!gspca_dev->dev);
                gspca_dev->urb[i] = NULL;
                if (!gspca_dev->present)
                        usb_kill_urb(urb);
@@ -1950,8 +1951,12 @@ void gspca_disconnect(struct usb_interface *intf)
 {
        struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
 
+       mutex_lock(&gspca_dev->usb_lock);
        gspca_dev->present = 0;
+       mutex_unlock(&gspca_dev->usb_lock);
 
+       destroy_urbs(gspca_dev);
+       gspca_dev->dev = NULL;
        usb_set_intfdata(intf, NULL);
 
        /* release the device */