[PATCH] media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler

[Ginger Li]

fimc_lite_subdev_s_stream(on = 0) sets ST_FLITE_OFF outside of the
fimc->slock protected region and only then stops the capture in the hardware.
flite_irq_handler() runs under fimc->slock and clears ST_FLITE_OFF, so an
interrupt can be handled in between: the handler finds ST_FLITE_OFF already
set, clears it and wakes up fimc->irq_queue before the capture has actually
been stopped.  The wait_event_timeout() right after it then returns
immediately and the driver continues as if the capture had stopped.

Set ST_FLITE_OFF in the same critical section that stops the capture, as
fimc_lite_stop_capture() already does.

Fixes: 6319d6a ("[media] fimc-lite: Add ISP FIFO output support")
Signed-off-by: Ginger Li <ginger.jzllee at gmail.com>
---
 drivers/media/platform/samsung/exynos4-is/fimc-lite.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
--- a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
+++ b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c
@@ -1209,9 +1209,8 @@ static int fimc_lite_subdev_s_stream(struct v4l2_subde
 			spin_unlock_irqrestore(&fimc->slock, flags);
 		}
 	} else {
-		set_bit(ST_FLITE_OFF, &fimc->state);
-
 		spin_lock_irqsave(&fimc->slock, flags);
+		set_bit(ST_FLITE_OFF, &fimc->state);
 		flite_hw_capture_stop(fimc);
 		spin_unlock_irqrestore(&fimc->slock, flags);
 
-- 
2.43.0