xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: zr364xx: propagate errors from zr364xx_start_readpipe()

Browse Source 
[ Upstream commit af0321a5be3e5647441eb6b79355beaa592df97a ]

zr364xx_start_readpipe() can fail but callers do not care about that.
This can result in various negative consequences. The patch adds missed
error handling.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Evgeny Novikov
2020-10-06 19:21:22 +02:00
committed by Sasha Levin
parent 779a0f4347
commit b5c7ec6d15
1 changed files with 24 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
drivers/media/usb/zr364xx/zr364xx.c
View File

@@ -1328,6 +1328,7 @@ static int zr364xx_board_init(struct zr364xx_camera *cam)
{ {
struct zr364xx_pipeinfo *pipe = cam->pipe; struct zr364xx_pipeinfo *pipe = cam->pipe;
unsigned long i; unsigned long i;
int err;
DBG("board init: %p\n", cam); DBG("board init: %p\n", cam);
memset(pipe, 0, sizeof(*pipe)); memset(pipe, 0, sizeof(*pipe));
@@ -1360,9 +1361,8 @@ static int zr364xx_board_init(struct zr364xx_camera *cam)
if (i == 0) { if (i == 0) {
printk(KERN_INFO KBUILD_MODNAME ": out of memory. Aborting\n"); printk(KERN_INFO KBUILD_MODNAME ": out of memory. Aborting\n");
kfree(cam->pipe->transfer_buffer); err = -ENOMEM;
cam->pipe->transfer_buffer = NULL; goto err_free;
return -ENOMEM;
} else } else
cam->buffer.dwFrames = i; cam->buffer.dwFrames = i;
@@ -1377,9 +1377,17 @@ static int zr364xx_board_init(struct zr364xx_camera *cam)
/*** end create system buffers ***/ /*** end create system buffers ***/
/* start read pipe */ /* start read pipe */
zr364xx_start_readpipe(cam); err = zr364xx_start_readpipe(cam);
if (err)
goto err_free;
DBG(": board initialized\n"); DBG(": board initialized\n");
return 0; return 0;
err_free:
kfree(cam->pipe->transfer_buffer);
cam->pipe->transfer_buffer = NULL;
return err;
} }
static int zr364xx_probe(struct usb_interface *intf, static int zr364xx_probe(struct usb_interface *intf,
@@ -1576,10 +1584,19 @@ static int zr364xx_resume(struct usb_interface *intf)
if (!cam->was_streaming) if (!cam->was_streaming)
return 0; return 0;
zr364xx_start_readpipe(cam); res = zr364xx_start_readpipe(cam);
if (res)
return res;
res = zr364xx_prepare(cam); res = zr364xx_prepare(cam);
if (!res) if (res)
goto err_prepare;
zr364xx_start_acquire(cam); zr364xx_start_acquire(cam);
return 0;
err_prepare:
zr364xx_stop_readpipe(cam);
return res; return res;
} }
#endif #endif