aboutsummaryrefslogtreecommitdiff
path: root/drivers/media/video
diff options
context:
space:
mode:
authorNickolay V. Shmyrev <nshmyrev@yandex.ru>2005-12-01 00:51:32 -0800
committerLinus Torvalds <torvalds@g5.osdl.org>2005-12-01 15:48:57 -0800
commit50ab5edc973c979e8f620e09d20b96761d271894 (patch)
tree7be7c4416bb650c1c1c0d5845c2f0369e9956b35 /drivers/media/video
parent3b86b9999deb04bbfbb20e6b6fe1119a4bf0ff34 (diff)
[PATCH] V4L: Fix read() bugs in bttv driver
Fix read() bugs in bttv driver. Signed-off-by: Nickolay V. Shmyrev <nshmyrev@yandex.ru> Signed-off-by: Michael H. Schimek <mschimek@gmx.at> Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/media/video')
-rw-r--r--drivers/media/video/bttv-driver.c2
-rw-r--r--drivers/media/video/video-buf.c8
2 files changed, 7 insertions, 3 deletions
diff --git a/drivers/media/video/bttv-driver.c b/drivers/media/video/bttv-driver.c
index 5bc522259d3..f9d581cd31d 100644
--- a/drivers/media/video/bttv-driver.c
+++ b/drivers/media/video/bttv-driver.c
@@ -2952,6 +2952,8 @@ static unsigned int bttv_poll(struct file *file, poll_table *wait)
fh->cap.read_buf->memory = V4L2_MEMORY_USERPTR;
field = videobuf_next_field(&fh->cap);
if (0 != fh->cap.ops->buf_prepare(&fh->cap,fh->cap.read_buf,field)) {
+ kfree (fh->cap.read_buf);
+ fh->cap.read_buf = NULL;
up(&fh->cap.lock);
return POLLERR;
}
diff --git a/drivers/media/video/video-buf.c b/drivers/media/video/video-buf.c
index acfd3a103f3..bd34f81dbc6 100644
--- a/drivers/media/video/video-buf.c
+++ b/drivers/media/video/video-buf.c
@@ -753,10 +753,9 @@ videobuf_read_zerocopy(struct videobuf_queue *q, char __user *data,
int retval;
/* setup stuff */
- retval = -ENOMEM;
q->read_buf = videobuf_alloc(q->msize);
if (NULL == q->read_buf)
- goto done;
+ return -ENOMEM;
q->read_buf->memory = V4L2_MEMORY_USERPTR;
q->read_buf->baddr = (unsigned long)data;
@@ -819,8 +818,11 @@ ssize_t videobuf_read_one(struct videobuf_queue *q,
q->read_buf->memory = V4L2_MEMORY_USERPTR;
field = videobuf_next_field(q);
retval = q->ops->buf_prepare(q,q->read_buf,field);
- if (0 != retval)
+ if (0 != retval) {
+ kfree (q->read_buf);
+ q->read_buf = NULL;
goto done;
+ }
spin_lock_irqsave(q->irqlock,flags);
q->ops->buf_queue(q,q->read_buf);
spin_unlock_irqrestore(q->irqlock,flags);