From 50ab5edc973c979e8f620e09d20b96761d271894 Mon Sep 17 00:00:00 2001 From: "Nickolay V. Shmyrev" Date: Thu, 1 Dec 2005 00:51:32 -0800 Subject: [PATCH] [PATCH] V4L: Fix read() bugs in bttv driver Fix read() bugs in bttv driver. Signed-off-by: Nickolay V. Shmyrev Signed-off-by: Michael H. Schimek Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/media/video/bttv-driver.c | 2 ++ drivers/media/video/video-buf.c | 8 +++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/media/video/bttv-driver.c b/drivers/media/video/bttv-driver.c index 5bc522259d3..f9d581cd31d 100644 --- a/drivers/media/video/bttv-driver.c +++ b/drivers/media/video/bttv-driver.c @@ -2952,6 +2952,8 @@ static unsigned int bttv_poll(struct file *file, poll_table *wait) fh->cap.read_buf->memory = V4L2_MEMORY_USERPTR; field = videobuf_next_field(&fh->cap); if (0 != fh->cap.ops->buf_prepare(&fh->cap,fh->cap.read_buf,field)) { + kfree (fh->cap.read_buf); + fh->cap.read_buf = NULL; up(&fh->cap.lock); return POLLERR; } diff --git a/drivers/media/video/video-buf.c b/drivers/media/video/video-buf.c index acfd3a103f3..bd34f81dbc6 100644 --- a/drivers/media/video/video-buf.c +++ b/drivers/media/video/video-buf.c @@ -753,10 +753,9 @@ videobuf_read_zerocopy(struct videobuf_queue *q, char __user *data, int retval; /* setup stuff */ - retval = -ENOMEM; q->read_buf = videobuf_alloc(q->msize); if (NULL == q->read_buf) - goto done; + return -ENOMEM; q->read_buf->memory = V4L2_MEMORY_USERPTR; q->read_buf->baddr = (unsigned long)data; @@ -819,8 +818,11 @@ ssize_t videobuf_read_one(struct videobuf_queue *q, q->read_buf->memory = V4L2_MEMORY_USERPTR; field = videobuf_next_field(q); retval = q->ops->buf_prepare(q,q->read_buf,field); - if (0 != retval) + if (0 != retval) { + kfree (q->read_buf); + q->read_buf = NULL; goto done; + } spin_lock_irqsave(q->irqlock,flags); q->ops->buf_queue(q,q->read_buf); spin_unlock_irqrestore(q->irqlock,flags); -- 2.20.1