Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 50ab5edc authored by Nickolay's avatar Nickolay Committed by Linus Torvalds
Browse files

[PATCH] V4L: Fix read() bugs in bttv driver 



Fix read() bugs in bttv driver.

Signed-off-by: default avatarNickolay V. Shmyrev <nshmyrev@yandex.ru>
Signed-off-by: default avatarMichael H. Schimek <mschimek@gmx.at>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@brturbo.com.br>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 3b86b999

drivers/media/video/bttv-driver.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -2952,6 +2952,8 @@ static unsigned int bttv_poll(struct file *file, poll_table *wait) 
			fh->cap.read_buf->memory = V4L2_MEMORY_USERPTR;

			fh->cap.read_buf->memory = V4L2_MEMORY_USERPTR;

			field = videobuf_next_field(&fh->cap);

			field = videobuf_next_field(&fh->cap);

			if (0 != fh->cap.ops->buf_prepare(&fh->cap,fh->cap.read_buf,field)) {

			if (0 != fh->cap.ops->buf_prepare(&fh->cap,fh->cap.read_buf,field)) {

				kfree (fh->cap.read_buf);

				fh->cap.read_buf = NULL;

				up(&fh->cap.lock);

				up(&fh->cap.lock);

				return POLLERR;

				return POLLERR;

			}

			}

drivers/media/video/video-buf.c

+5 −3
Original line number Original line Diff line number Diff line
@@ -753,10 +753,9 @@ videobuf_read_zerocopy(struct videobuf_queue *q, char __user *data, 
	int retval;

	int retval;





	/* setup stuff */

	/* setup stuff */

	retval = -ENOMEM;

	q->read_buf = videobuf_alloc(q->msize);

	q->read_buf = videobuf_alloc(q->msize);

	if (NULL == q->read_buf)

	if (NULL == q->read_buf)

		goto done;

		return -ENOMEM;





	q->read_buf->memory = V4L2_MEMORY_USERPTR;

	q->read_buf->memory = V4L2_MEMORY_USERPTR;

	q->read_buf->baddr  = (unsigned long)data;

	q->read_buf->baddr  = (unsigned long)data;
@@ -819,8 +818,11 @@ ssize_t videobuf_read_one(struct videobuf_queue *q, 
		q->read_buf->memory = V4L2_MEMORY_USERPTR;

		q->read_buf->memory = V4L2_MEMORY_USERPTR;

		field = videobuf_next_field(q);

		field = videobuf_next_field(q);

		retval = q->ops->buf_prepare(q,q->read_buf,field);

		retval = q->ops->buf_prepare(q,q->read_buf,field);

		if (0 != retval)

		if (0 != retval) {

			kfree (q->read_buf);

			q->read_buf = NULL;

			goto done;

			goto done;

		}

		spin_lock_irqsave(q->irqlock,flags);

		spin_lock_irqsave(q->irqlock,flags);

		q->ops->buf_queue(q,q->read_buf);

		q->ops->buf_queue(q,q->read_buf);

		spin_unlock_irqrestore(q->irqlock,flags);

		spin_unlock_irqrestore(q->irqlock,flags);