From 5bccd60852fc0a5ccc1980c10266896df99b8bda Mon Sep 17 00:00:00 2001 From: Mathias Krause Date: Sun, 30 Jan 2011 07:05:58 -0300 Subject: [media] V4L: omap1_camera: fix use after free Even though clk_put() is a no-op on most architectures it is not for some ARM implementations. To not fail on those, release the clock timer before freeing the surrounding structure. This bug was spotted by the semantic patch tool coccinelle using the script found at scripts/coccinelle/free/kfree.cocci. More information about semantic patching is available at http://coccinelle.lip6.fr/ Signed-off-by: Mathias Krause Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/omap1_camera.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/media/video/omap1_camera.c') diff --git a/drivers/media/video/omap1_camera.c b/drivers/media/video/omap1_camera.c index 0a2fb2bfdbfb..9ed1513122c1 100644 --- a/drivers/media/video/omap1_camera.c +++ b/drivers/media/video/omap1_camera.c @@ -1664,10 +1664,10 @@ static int __exit omap1_cam_remove(struct platform_device *pdev) res = pcdev->res; release_mem_region(res->start, resource_size(res)); - kfree(pcdev); - clk_put(pcdev->clk); + kfree(pcdev); + dev_info(&pdev->dev, "OMAP1 Camera Interface driver unloaded\n"); return 0; -- cgit v1.2.2 From 353c2129fdff2047237193932971e50734c64336 Mon Sep 17 00:00:00 2001 From: Guennadi Liakhovetski Date: Wed, 2 Feb 2011 17:38:22 -0300 Subject: [media] V4L: omap1_camera: join split format lines Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/omap1_camera.c | 62 +++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 31 deletions(-) (limited to 'drivers/media/video/omap1_camera.c') diff --git a/drivers/media/video/omap1_camera.c b/drivers/media/video/omap1_camera.c index 9ed1513122c1..eab31cbd68eb 100644 --- a/drivers/media/video/omap1_camera.c +++ b/drivers/media/video/omap1_camera.c @@ -811,8 +811,8 @@ static irqreturn_t cam_isr(int irq, void *data) spin_lock_irqsave(&pcdev->lock, flags); if (WARN_ON(!buf)) { - dev_warn(dev, "%s: unhandled camera interrupt, status == " - "%#x\n", __func__, it_status); + dev_warn(dev, "%s: unhandled camera interrupt, status == %#x\n", + __func__, it_status); suspend_capture(pcdev); disable_capture(pcdev); goto out; @@ -1088,15 +1088,15 @@ static int omap1_cam_get_formats(struct soc_camera_device *icd, xlate->host_fmt = &omap1_cam_formats[code]; xlate->code = code; xlate++; - dev_dbg(dev, "%s: providing format %s " - "as byte swapped code #%d\n", __func__, - omap1_cam_formats[code].name, code); + dev_dbg(dev, + "%s: providing format %s as byte swapped code #%d\n", + __func__, omap1_cam_formats[code].name, code); } default: if (xlate) - dev_dbg(dev, "%s: providing format %s " - "in pass-through mode\n", __func__, - fmt->name); + dev_dbg(dev, + "%s: providing format %s in pass-through mode\n", + __func__, fmt->name); } formats++; if (xlate) { @@ -1139,29 +1139,29 @@ static int dma_align(int *width, int *height, return 1; } -#define subdev_call_with_sense(pcdev, dev, icd, sd, function, args...) \ -({ \ - struct soc_camera_sense sense = { \ - .master_clock = pcdev->camexclk, \ - .pixel_clock_max = 0, \ - }; \ - int __ret; \ - \ - if (pcdev->pdata) \ - sense.pixel_clock_max = pcdev->pdata->lclk_khz_max * 1000; \ - icd->sense = &sense; \ - __ret = v4l2_subdev_call(sd, video, function, ##args); \ - icd->sense = NULL; \ - \ - if (sense.flags & SOCAM_SENSE_PCLK_CHANGED) { \ - if (sense.pixel_clock > sense.pixel_clock_max) { \ - dev_err(dev, "%s: pixel clock %lu " \ - "set by the camera too high!\n", \ - __func__, sense.pixel_clock); \ - __ret = -EINVAL; \ - } \ - } \ - __ret; \ +#define subdev_call_with_sense(pcdev, dev, icd, sd, function, args...) \ +({ \ + struct soc_camera_sense sense = { \ + .master_clock = pcdev->camexclk, \ + .pixel_clock_max = 0, \ + }; \ + int __ret; \ + \ + if (pcdev->pdata) \ + sense.pixel_clock_max = pcdev->pdata->lclk_khz_max * 1000; \ + icd->sense = &sense; \ + __ret = v4l2_subdev_call(sd, video, function, ##args); \ + icd->sense = NULL; \ + \ + if (sense.flags & SOCAM_SENSE_PCLK_CHANGED) { \ + if (sense.pixel_clock > sense.pixel_clock_max) { \ + dev_err(dev, \ + "%s: pixel clock %lu set by the camera too high!\n", \ + __func__, sense.pixel_clock); \ + __ret = -EINVAL; \ + } \ + } \ + __ret; \ }) static int set_mbus_format(struct omap1_cam_dev *pcdev, struct device *dev, -- cgit v1.2.2