lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[PATCH] V4L: Fix read() bugs in bttv driver

Browse Source 
Fix read() bugs in bttv driver.

Signed-off-by: Nickolay V. Shmyrev <nshmyrev@yandex.ru>
Signed-off-by: Michael H. Schimek <mschimek@gmx.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Nickolay V. Shmyrev
2005-12-01 00:51:32 -08:00
committed by Linus Torvalds
parent 3b86b9999d
commit 50ab5edc97
2 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/media/video/bttv-driver.c
View File

@@ -2952,6 +2952,8 @@ static unsigned int bttv_poll(struct file *file, poll_table *wait)
fh->cap.read_buf->memory = V4L2_MEMORY_USERPTR; fh->cap.read_buf->memory = V4L2_MEMORY_USERPTR;
field = videobuf_next_field(&fh->cap); field = videobuf_next_field(&fh->cap);
if (0 != fh->cap.ops->buf_prepare(&fh->cap,fh->cap.read_buf,field)) { if (0 != fh->cap.ops->buf_prepare(&fh->cap,fh->cap.read_buf,field)) {
kfree (fh->cap.read_buf);
fh->cap.read_buf = NULL;
up(&fh->cap.lock); up(&fh->cap.lock);
return POLLERR; return POLLERR;
} }

8
drivers/media/video/video-buf.c
View File

@@ -753,10 +753,9 @@ videobuf_read_zerocopy(struct videobuf_queue *q, char __user *data,
int retval; int retval;
/* setup stuff */ /* setup stuff */
retval = -ENOMEM;
q->read_buf = videobuf_alloc(q->msize); q->read_buf = videobuf_alloc(q->msize);
if (NULL == q->read_buf) if (NULL == q->read_buf)
goto done; return -ENOMEM;
q->read_buf->memory = V4L2_MEMORY_USERPTR; q->read_buf->memory = V4L2_MEMORY_USERPTR;
q->read_buf->baddr = (unsigned long)data; q->read_buf->baddr = (unsigned long)data;
@@ -819,8 +818,11 @@ ssize_t videobuf_read_one(struct videobuf_queue *q,
q->read_buf->memory = V4L2_MEMORY_USERPTR; q->read_buf->memory = V4L2_MEMORY_USERPTR;
field = videobuf_next_field(q); field = videobuf_next_field(q);
retval = q->ops->buf_prepare(q,q->read_buf,field); retval = q->ops->buf_prepare(q,q->read_buf,field);
if (0 != retval) if (0 != retval) {
kfree (q->read_buf);
q->read_buf = NULL;
goto done; goto done;
}
spin_lock_irqsave(q->irqlock,flags); spin_lock_irqsave(q->irqlock,flags);
q->ops->buf_queue(q,q->read_buf); q->ops->buf_queue(q,q->read_buf);
spin_unlock_irqrestore(q->irqlock,flags); spin_unlock_irqrestore(q->irqlock,flags);