From: Brandon Philips <bphilips@suse.de>
Date: Sun, 13 Apr 2008 17:57:01 +0000 (-0300)
Subject: V4L/DVB (7550): em28xx: Fix a possible memory leak
X-Git-Tag: v2.6.26-rc1~1084^2~164
X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=0561297501842b5d7e0ca8805084f4d3f97c1078;p=linux-2.6-omap-h63xx.git

V4L/DVB (7550): em28xx: Fix a possible memory leak

I did notice a possible memory leak since iolock is could possibly be
called before a buffer has been freed.

This ensure s_fmt isn't called while the queue is busy thereby avoiding
iolock on already allocated buffers.

Signed-off-by: Brandon Philips <bphilips@suse.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
---

diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 0a2ff4afe41..0aaf4e767e0 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -630,16 +630,10 @@ buffer_prepare(struct videobuf_queue *vq, struct videobuf_buffer *vb,
 	if (0 != buf->vb.baddr  &&  buf->vb.bsize < buf->vb.size)
 		return -EINVAL;
 
-	if (buf->fmt       != fh->fmt    ||
-	    buf->vb.width  != dev->width  ||
-	    buf->vb.height != dev->height ||
-	    buf->vb.field  != field) {
-		buf->fmt       = fh->fmt;
-		buf->vb.width  = dev->width;
-		buf->vb.height = dev->height;
-		buf->vb.field  = field;
-		buf->vb.state = VIDEOBUF_NEEDS_INIT;
-	}
+	buf->fmt       = fh->fmt;
+	buf->vb.width  = dev->width;
+	buf->vb.height = dev->height;
+	buf->vb.field  = field;
 
 	if (VIDEOBUF_NEEDS_INIT == buf->vb.state) {
 		rc = videobuf_iolock(vq, &buf->vb, NULL);
@@ -974,6 +968,12 @@ static int vidioc_s_fmt_cap(struct file *file, void *priv,
 
 	mutex_lock(&dev->lock);
 
+	if (videobuf_queue_is_busy(&fh->vb_vidq)) {
+		em28xx_errdev("%s queue busy\n", __func__);
+		rc = -EBUSY;
+		goto out;
+	}
+
 	/* set new image size */
 	dev->width = f->fmt.pix.width;
 	dev->height = f->fmt.pix.height;
@@ -985,8 +985,11 @@ static int vidioc_s_fmt_cap(struct file *file, void *priv,
 	em28xx_set_alternate(dev);
 	em28xx_resolution_set(dev);
 
+	rc = 0;
+
+out:
 	mutex_unlock(&dev->lock);
-	return 0;
+	return rc;
 }
 
 static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id *norm)