diff options
| author | Nickolay V. Shmyrev <nshmyrev@yandex.ru> | 2005-12-01 00:51:32 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-12-01 15:48:57 -0800 |
| commit | 50ab5edc973c979e8f620e09d20b96761d271894 (patch) | |
| tree | 7be7c4416bb650c1c1c0d5845c2f0369e9956b35 | |
| parent | 3b86b9999deb04bbfbb20e6b6fe1119a4bf0ff34 (diff) | |
| download | blackbird-op-linux-50ab5edc973c979e8f620e09d20b96761d271894.tar.gz blackbird-op-linux-50ab5edc973c979e8f620e09d20b96761d271894.zip | |
[PATCH] V4L: Fix read() bugs in bttv driver
Fix read() bugs in bttv driver.
Signed-off-by: Nickolay V. Shmyrev <nshmyrev@yandex.ru>
Signed-off-by: Michael H. Schimek <mschimek@gmx.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | drivers/media/video/bttv-driver.c | 2 | ||||
| -rw-r--r-- | drivers/media/video/video-buf.c | 8 |
2 files changed, 7 insertions, 3 deletions
diff --git a/drivers/media/video/bttv-driver.c b/drivers/media/video/bttv-driver.c index 5bc522259d36..f9d581cd31db 100644 --- a/drivers/media/video/bttv-driver.c +++ b/drivers/media/video/bttv-driver.c @@ -2952,6 +2952,8 @@ static unsigned int bttv_poll(struct file *file, poll_table *wait) fh->cap.read_buf->memory = V4L2_MEMORY_USERPTR; field = videobuf_next_field(&fh->cap); if (0 != fh->cap.ops->buf_prepare(&fh->cap,fh->cap.read_buf,field)) { + kfree (fh->cap.read_buf); + fh->cap.read_buf = NULL; up(&fh->cap.lock); return POLLERR; } diff --git a/drivers/media/video/video-buf.c b/drivers/media/video/video-buf.c index acfd3a103f35..bd34f81dbc69 100644 --- a/drivers/media/video/video-buf.c +++ b/drivers/media/video/video-buf.c @@ -753,10 +753,9 @@ videobuf_read_zerocopy(struct videobuf_queue *q, char __user *data, int retval; /* setup stuff */ - retval = -ENOMEM; q->read_buf = videobuf_alloc(q->msize); if (NULL == q->read_buf) - goto done; + return -ENOMEM; q->read_buf->memory = V4L2_MEMORY_USERPTR; q->read_buf->baddr = (unsigned long)data; @@ -819,8 +818,11 @@ ssize_t videobuf_read_one(struct videobuf_queue *q, q->read_buf->memory = V4L2_MEMORY_USERPTR; field = videobuf_next_field(q); retval = q->ops->buf_prepare(q,q->read_buf,field); - if (0 != retval) + if (0 != retval) { + kfree (q->read_buf); + q->read_buf = NULL; goto done; + } spin_lock_irqsave(q->irqlock,flags); q->ops->buf_queue(q,q->read_buf); spin_unlock_irqrestore(q->irqlock,flags); |
