2011-03-12 18:08:17

by Vasily Kulikov

[permalink] [raw]
Subject: [bug] radio: wl128x: sleep inside of spinlock

Hi,

There is a copy_to_user() call inside of spin_lock_irqsave()/spin_unlock_irqrestore():

drivers/media/radio/wl128x/fmdrv_common.c:

/* Copies RDS data from internal buffer to user buffer */
u32 fmc_transfer_rds_from_internal_buff(struct fmdev *fmdev, struct file *file,
u8 __user *buf, size_t count)
{
...
spin_lock_irqsave(&fmdev->rds_buff_lock, flags);
...
if (copy_to_user(buf, &fmdev->rx.rds.buff[fmdev->rx.rds.rd_idx],
...
spin_unlock_irqrestore(&fmdev->rds_buff_lock, flags);
return ret;
}

--
Vasiliy