diff options
| author | Brandon Philips <bphilips@suse.de> | 2008-04-13 14:57:01 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@infradead.org> | 2008-04-24 14:08:48 -0300 |
| commit | 0561297501842b5d7e0ca8805084f4d3f97c1078 (patch) | |
| tree | cd76584fec0e9307a18efac15069a3c11367a584 /drivers | |
| parent | 78bb3949a965e8a28e20988e28868429606b3639 (diff) | |
| download | talos-op-linux-0561297501842b5d7e0ca8805084f4d3f97c1078.tar.gz talos-op-linux-0561297501842b5d7e0ca8805084f4d3f97c1078.zip | |
V4L/DVB (7550): em28xx: Fix a possible memory leak
I did notice a possible memory leak since iolock is could possibly be
called before a buffer has been freed.
This ensure s_fmt isn't called while the queue is busy thereby avoiding
iolock on already allocated buffers.
Signed-off-by: Brandon Philips <bphilips@suse.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/video/em28xx/em28xx-video.c | 25 |
1 files changed, 14 insertions, 11 deletions
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c index 0a2ff4afe416..0aaf4e767e0d 100644 --- a/drivers/media/video/em28xx/em28xx-video.c +++ b/drivers/media/video/em28xx/em28xx-video.c @@ -630,16 +630,10 @@ buffer_prepare(struct videobuf_queue *vq, struct videobuf_buffer *vb, if (0 != buf->vb.baddr && buf->vb.bsize < buf->vb.size) return -EINVAL; - if (buf->fmt != fh->fmt || - buf->vb.width != dev->width || - buf->vb.height != dev->height || - buf->vb.field != field) { - buf->fmt = fh->fmt; - buf->vb.width = dev->width; - buf->vb.height = dev->height; - buf->vb.field = field; - buf->vb.state = VIDEOBUF_NEEDS_INIT; - } + buf->fmt = fh->fmt; + buf->vb.width = dev->width; + buf->vb.height = dev->height; + buf->vb.field = field; if (VIDEOBUF_NEEDS_INIT == buf->vb.state) { rc = videobuf_iolock(vq, &buf->vb, NULL); @@ -974,6 +968,12 @@ static int vidioc_s_fmt_cap(struct file *file, void *priv, mutex_lock(&dev->lock); + if (videobuf_queue_is_busy(&fh->vb_vidq)) { + em28xx_errdev("%s queue busy\n", __func__); + rc = -EBUSY; + goto out; + } + /* set new image size */ dev->width = f->fmt.pix.width; dev->height = f->fmt.pix.height; @@ -985,8 +985,11 @@ static int vidioc_s_fmt_cap(struct file *file, void *priv, em28xx_set_alternate(dev); em28xx_resolution_set(dev); + rc = 0; + +out: mutex_unlock(&dev->lock); - return 0; + return rc; } static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id *norm) |
