---

yaml
---
r: 242163
b: refs/heads/master
c: d6dbd93
h: refs/heads/master
i:
  242161: a759253
  242159: b280c6e
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5bd6b0464b68d429bc8a3fe6595d19c39dfc4d95
+refs/heads/master: d6dbd939b97d271766a58a66d69b27023bc90993

trunk/drivers/staging/lirc/lirc_zilog.c

@@ -70,7 +70,7 @@ struct IR_rx {
 	struct IR *ir;
 
 	/* RX device */
-	/* FIXME mutex lock access to this pointer */
+	struct mutex client_lock;
 	struct i2c_client *c;
 
 	/* RX polling thread data */
@@ -86,7 +86,7 @@ struct IR_tx {
 	struct IR *ir;
 
 	/* TX device */
-	/* FIXME mutex lock access to this pointer */
+	struct mutex client_lock;
 	struct i2c_client *c;
 
 	/* TX additional actions needed */
@@ -341,6 +341,14 @@ static int add_to_buf(struct IR *ir)
 	if (rx == NULL)
 		return -ENXIO;
 
+	/* Ensure our rx->c i2c_client remains valid for the duration */
+	mutex_lock(&rx->client_lock);
+	if (rx->c == NULL) {
+		mutex_unlock(&rx->client_lock);
+		put_ir_rx(rx, false);
+		return -ENXIO;
+	}
+
 	tx = get_ir_tx(ir);
 
 	/*
@@ -442,6 +450,7 @@ static int add_to_buf(struct IR *ir)
 		ret = 0;
 	} while (!lirc_buffer_full(rbuf));
 
+	mutex_unlock(&rx->client_lock);
 	if (tx != NULL)
 		put_ir_tx(tx, false);
 	put_ir_rx(rx, false);
@@ -1089,6 +1098,14 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
 	if (tx == NULL)
 		return -ENXIO;
 
+	/* Ensure our tx->c i2c_client remains valid for the duration */
+	mutex_lock(&tx->client_lock);
+	if (tx->c == NULL) {
+		mutex_unlock(&tx->client_lock);
+		put_ir_tx(tx, false);
+		return -ENXIO;
+	}
+
 	/* Lock i2c bus for the duration */
 	mutex_lock(&ir->ir_lock);
 
@@ -1099,6 +1116,7 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
 
 		if (copy_from_user(&command, buf + i, sizeof(command))) {
 			mutex_unlock(&ir->ir_lock);
+			mutex_unlock(&tx->client_lock);
 			put_ir_tx(tx, false);
 			return -EFAULT;
 		}
@@ -1109,6 +1127,7 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
 			ret = fw_load(tx);
 			if (ret != 0) {
 				mutex_unlock(&ir->ir_lock);
+				mutex_unlock(&tx->client_lock);
 				put_ir_tx(tx, false);
 				if (ret != -ENOMEM)
 					ret = -EIO;
@@ -1126,6 +1145,7 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
 					    (unsigned)command & 0xFFFF);
 			if (ret == -EPROTO) {
 				mutex_unlock(&ir->ir_lock);
+				mutex_unlock(&tx->client_lock);
 				put_ir_tx(tx, false);
 				return ret;
 			}
@@ -1144,6 +1164,7 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
 				zilog_error("unable to send to the IR chip "
 					    "after 3 resets, giving up\n");
 				mutex_unlock(&ir->ir_lock);
+				mutex_unlock(&tx->client_lock);
 				put_ir_tx(tx, false);
 				return ret;
 			}
@@ -1158,6 +1179,8 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
 	/* Release i2c bus */
 	mutex_unlock(&ir->ir_lock);
 
+	mutex_unlock(&tx->client_lock);
+
 	/* Give back our struct IR_tx reference */
 	put_ir_tx(tx, false);
 
@@ -1365,12 +1388,20 @@ static int ir_remove(struct i2c_client *client)
 {
 	if (strncmp("ir_tx_z8", client->name, 8) == 0) {
 		struct IR_tx *tx = i2c_get_clientdata(client);
-		if (tx != NULL)
+		if (tx != NULL) {
+			mutex_lock(&tx->client_lock);
+			tx->c = NULL;
+			mutex_unlock(&tx->client_lock);
 			put_ir_tx(tx, false);
+		}
 	} else if (strncmp("ir_rx_z8", client->name, 8) == 0) {
 		struct IR_rx *rx = i2c_get_clientdata(client);
-		if (rx != NULL)
+		if (rx != NULL) {
+			mutex_lock(&rx->client_lock);
+			rx->c = NULL;
+			mutex_unlock(&rx->client_lock);
 			put_ir_rx(rx, false);
+		}
 	}
 	return 0;
 }
@@ -1472,6 +1503,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 		ir->tx = tx;
 
 		ir->l.features |= LIRC_CAN_SEND_PULSE;
+		mutex_init(&tx->client_lock);
 		tx->c = client;
 		tx->need_boot = 1;
 		tx->post_tx_ready_poll =
@@ -1514,6 +1546,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 		ir->rx = rx;
 
 		ir->l.features |= LIRC_CAN_REC_LIRCCODE;
+		mutex_init(&rx->client_lock);
 		rx->c = client;
 		rx->hdpvr_data_fmt =
 			       (id->driver_data & ID_FLAG_HDPVR) ? true : false;