Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a82bc60 authored by Hans de Goede's avatar Hans de Goede Committed by Mauro Carvalho Chehab
Browse files

[media] gspca_main: Update buffer flags even when user_copy fails 



Before this patch dqbuf errors out on a failing user_copy (with user pointers)
before updating the buffer flags, causing a successsfully dequeued buffer
to still have the DONE flag, which means that it could no longer be
re-queueud (assuming the app somehow survives the segfault).

Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
Acked-by: default avatarJean-Francois Moine <moinejf@free.fr>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 27074efa

drivers/media/video/gspca/gspca.c

+5 −5
Original line number Diff line number Diff line
@@ -1912,6 +1912,11 @@ static int vidioc_dqbuf(struct file *file, void *priv, 
		mutex_unlock(&gspca_dev->usb_lock);

	}



	frame->v4l2_buf.flags &= ~V4L2_BUF_FLAG_DONE;

	memcpy(v4l2_buf, &frame->v4l2_buf, sizeof *v4l2_buf);

	PDEBUG(D_FRAM, "dqbuf %d", j);

	ret = 0;



	if (gspca_dev->memory == V4L2_MEMORY_USERPTR) {

		if (copy_to_user((__u8 __user *) frame->v4l2_buf.m.userptr,

				 frame->data,
@@ -1919,13 +1924,8 @@ static int vidioc_dqbuf(struct file *file, void *priv, 
			PDEBUG(D_ERR|D_STREAM,

				"dqbuf cp to user failed");

			ret = -EFAULT;

			goto out;

		}

	}

	frame->v4l2_buf.flags &= ~V4L2_BUF_FLAG_DONE;

	memcpy(v4l2_buf, &frame->v4l2_buf, sizeof *v4l2_buf);

	PDEBUG(D_FRAM, "dqbuf %d", j);

	ret = 0;

out:

	mutex_unlock(&gspca_dev->queue_lock);

	return ret;