Commit 8e17858a authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

staging: bcm2835-camera: fix error handling in init

The unwinding here isn't right.  We don't free gdev[0] and instead
free 1 step past what was allocated.  Also we can't allocate "dev" then
we should unwind instead of returning directly.

Fixes: 7b3ad5ab ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarwalter harms <wharms@bfs.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0743a78f
...@@ -1901,6 +1901,7 @@ static int __init bm2835_mmal_init(void) ...@@ -1901,6 +1901,7 @@ static int __init bm2835_mmal_init(void)
unsigned int num_cameras; unsigned int num_cameras;
struct vchiq_mmal_instance *instance; struct vchiq_mmal_instance *instance;
unsigned int resolutions[MAX_BCM2835_CAMERAS][2]; unsigned int resolutions[MAX_BCM2835_CAMERAS][2];
int i;
ret = vchiq_mmal_init(&instance); ret = vchiq_mmal_init(&instance);
if (ret < 0) if (ret < 0)
...@@ -1914,8 +1915,10 @@ static int __init bm2835_mmal_init(void) ...@@ -1914,8 +1915,10 @@ static int __init bm2835_mmal_init(void)
for (camera = 0; camera < num_cameras; camera++) { for (camera = 0; camera < num_cameras; camera++) {
dev = kzalloc(sizeof(struct bm2835_mmal_dev), GFP_KERNEL); dev = kzalloc(sizeof(struct bm2835_mmal_dev), GFP_KERNEL);
if (!dev) if (!dev) {
return -ENOMEM; ret = -ENOMEM;
goto cleanup_gdev;
}
dev->camera_num = camera; dev->camera_num = camera;
dev->max_width = resolutions[camera][0]; dev->max_width = resolutions[camera][0];
...@@ -1998,9 +2001,10 @@ static int __init bm2835_mmal_init(void) ...@@ -1998,9 +2001,10 @@ static int __init bm2835_mmal_init(void)
free_dev: free_dev:
kfree(dev); kfree(dev);
for ( ; camera > 0; camera--) { cleanup_gdev:
bcm2835_cleanup_instance(gdev[camera]); for (i = 0; i < camera; i++) {
gdev[camera] = NULL; bcm2835_cleanup_instance(gdev[i]);
gdev[i] = NULL;
} }
pr_info("%s: error %d while loading driver\n", pr_info("%s: error %d while loading driver\n",
BM2835_MMAL_MODULE_NAME, ret); BM2835_MMAL_MODULE_NAME, ret);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment