V4L/DVB: ivtv: Fix race condition for queued udma transfers

There are several DMA related interrupts which wake up the dma_waitq. The udma
routines use this queue while they wait for their transfer to complete. When
woken, the udma routine will check the IVTV_F_I_UDMA_PENDING & IVTV_F_I_UDMA
flags to see if the transfer is still queued or has finished. However, a small
window exists between the IVTV_F_I_UDMA_PENDING flag being cleared and the
IVTV_F_I_UDMA flag being set. Given that the completion of an unrelated DMA
transfer may wake up the udma routine, it's possible for this check to fail
and the udma routine will start unmapping pages when the transfer has only
just started. The result of this is unpredictable.

This fix simply delays the clearing of the IVTV_F_I_UDMA_PENDING flag until
after IVTV_F_I_UDMA has been set.
Signed-off-by: Ian Armstrong <ian@iarmst.demon.co.uk>
Signed-off-by: Andy Walls <awalls@radix.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

drivers/media/video/ivtv/ivtv-irq.c

@@ -940,9 +940,10 @@ irqreturn_t ivtv_irq_handler(int irq, void *dev_id)
 				ivtv_dma_enc_start(s);
 			break;
 		}
-		if (i == IVTV_MAX_STREAMS && test_and_clear_bit(IVTV_F_I_UDMA_PENDING, &itv->i_flags)) {
+
+		if (i == IVTV_MAX_STREAMS &&
+		    test_bit(IVTV_F_I_UDMA_PENDING, &itv->i_flags))
 			ivtv_udma_start(itv);
-		}
 	}
 
 	if ((combo & IVTV_IRQ_DMA) && !test_bit(IVTV_F_I_PIO, &itv->i_flags)) {

drivers/media/video/ivtv/ivtv-udma.c

@@ -213,6 +213,7 @@ void ivtv_udma_start(struct ivtv *itv)
 	write_reg_sync(read_reg(IVTV_REG_DMAXFER) | 0x01, IVTV_REG_DMAXFER);
 	set_bit(IVTV_F_I_DMA, &itv->i_flags);
 	set_bit(IVTV_F_I_UDMA, &itv->i_flags);
+	clear_bit(IVTV_F_I_UDMA_PENDING, &itv->i_flags);
 }
 
 void ivtv_udma_prepare(struct ivtv *itv)