aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJean-François Moine <moinejf@free.fr>2010-07-06 03:32:27 -0400
committerMauro Carvalho Chehab <mchehab@redhat.com>2010-08-02 15:42:48 -0400
commitf7059eaa285c0460569ffd26c43ae07e3f03cd6c (patch)
tree4f31450a63b1460fcdf3b79e8f47d8b824683a60
parent02bbcb9d863df10b5a4b91ba5b4c76eaf1340883 (diff)
V4L/DVB: gspca - main: Don't use the frame buffer flags
This patch fixes possible race conditions in queue management with SMP: when a frame was completed, the irq function tried to use the next frame buffer. At this time, it was possible that the application on an other processor updated the frame pointer, making the image to point to a bad buffer. The patch contains two main changes: - the image transfer uses the queue indexes which are protected against simultaneous memory access, - the image pointer which is used for image concatenation is only set at interrupt level. Some subdrivers which used the image pointer have been updated. Reported-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Jean-François Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
-rw-r--r--drivers/media/video/gspca/cpia1.c10
-rw-r--r--drivers/media/video/gspca/gspca.c112
-rw-r--r--drivers/media/video/gspca/gspca.h8
-rw-r--r--drivers/media/video/gspca/m5602/m5602_core.c5
-rw-r--r--drivers/media/video/gspca/ov534.c2
-rw-r--r--drivers/media/video/gspca/pac7302.c10
-rw-r--r--drivers/media/video/gspca/pac7311.c9
-rw-r--r--drivers/media/video/gspca/sonixb.c4
-rw-r--r--drivers/media/video/gspca/vc032x.c4
9 files changed, 58 insertions, 106 deletions
diff --git a/drivers/media/video/gspca/cpia1.c b/drivers/media/video/gspca/cpia1.c
index 4b3ea3b4bbba..3747a1dcff54 100644
--- a/drivers/media/video/gspca/cpia1.c
+++ b/drivers/media/video/gspca/cpia1.c
@@ -1765,14 +1765,10 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
1765 atomic_set(&sd->cam_exposure, data[39] * 2); 1765 atomic_set(&sd->cam_exposure, data[39] * 2);
1766 atomic_set(&sd->fps, data[41]); 1766 atomic_set(&sd->fps, data[41]);
1767 1767
1768 image = gspca_dev->image;
1769 if (image == NULL) {
1770 gspca_dev->last_packet_type = DISCARD_PACKET;
1771 return;
1772 }
1773
1774 /* Check for proper EOF for last frame */ 1768 /* Check for proper EOF for last frame */
1775 if (gspca_dev->image_len > 4 && 1769 image = gspca_dev->image;
1770 if (image != NULL &&
1771 gspca_dev->image_len > 4 &&
1776 image[gspca_dev->image_len - 4] == 0xff && 1772 image[gspca_dev->image_len - 4] == 0xff &&
1777 image[gspca_dev->image_len - 3] == 0xff && 1773 image[gspca_dev->image_len - 3] == 0xff &&
1778 image[gspca_dev->image_len - 2] == 0xff && 1774 image[gspca_dev->image_len - 2] == 0xff &&
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 2dc7270722f3..11b0e3557c1b 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -315,8 +315,6 @@ static void fill_frame(struct gspca_dev *gspca_dev,
315 urb->status = 0; 315 urb->status = 0;
316 goto resubmit; 316 goto resubmit;
317 } 317 }
318 if (gspca_dev->image == NULL)
319 gspca_dev->last_packet_type = DISCARD_PACKET;
320 pkt_scan = gspca_dev->sd_desc->pkt_scan; 318 pkt_scan = gspca_dev->sd_desc->pkt_scan;
321 for (i = 0; i < urb->number_of_packets; i++) { 319 for (i = 0; i < urb->number_of_packets; i++) {
322 320
@@ -428,16 +426,19 @@ void gspca_frame_add(struct gspca_dev *gspca_dev,
428 426
429 PDEBUG(D_PACK, "add t:%d l:%d", packet_type, len); 427 PDEBUG(D_PACK, "add t:%d l:%d", packet_type, len);
430 428
431 /* check the availability of the frame buffer */
432 if (gspca_dev->image == NULL)
433 return;
434
435 if (packet_type == FIRST_PACKET) { 429 if (packet_type == FIRST_PACKET) {
436 i = gspca_dev->fr_i; 430 i = atomic_read(&gspca_dev->fr_i);
431
432 /* if there are no queued buffer, discard the whole frame */
433 if (i == atomic_read(&gspca_dev->fr_q)) {
434 gspca_dev->last_packet_type = DISCARD_PACKET;
435 return;
436 }
437 j = gspca_dev->fr_queue[i]; 437 j = gspca_dev->fr_queue[i];
438 frame = &gspca_dev->frame[j]; 438 frame = &gspca_dev->frame[j];
439 frame->v4l2_buf.timestamp = ktime_to_timeval(ktime_get()); 439 frame->v4l2_buf.timestamp = ktime_to_timeval(ktime_get());
440 frame->v4l2_buf.sequence = ++gspca_dev->sequence; 440 frame->v4l2_buf.sequence = ++gspca_dev->sequence;
441 gspca_dev->image = frame->data;
441 gspca_dev->image_len = 0; 442 gspca_dev->image_len = 0;
442 } else if (gspca_dev->last_packet_type == DISCARD_PACKET) { 443 } else if (gspca_dev->last_packet_type == DISCARD_PACKET) {
443 if (packet_type == LAST_PACKET) 444 if (packet_type == LAST_PACKET)
@@ -460,31 +461,24 @@ void gspca_frame_add(struct gspca_dev *gspca_dev,
460 } 461 }
461 gspca_dev->last_packet_type = packet_type; 462 gspca_dev->last_packet_type = packet_type;
462 463
463 /* if last packet, wake up the application and advance in the queue */ 464 /* if last packet, invalidate packet concatenation until
465 * next first packet, wake up the application and advance
466 * in the queue */
464 if (packet_type == LAST_PACKET) { 467 if (packet_type == LAST_PACKET) {
465 i = gspca_dev->fr_i; 468 i = atomic_read(&gspca_dev->fr_i);
466 j = gspca_dev->fr_queue[i]; 469 j = gspca_dev->fr_queue[i];
467 frame = &gspca_dev->frame[j]; 470 frame = &gspca_dev->frame[j];
468 frame->v4l2_buf.bytesused = gspca_dev->image_len; 471 frame->v4l2_buf.bytesused = gspca_dev->image_len;
469 frame->v4l2_buf.flags = (frame->v4l2_buf.flags 472 frame->v4l2_buf.flags = (frame->v4l2_buf.flags
470 | V4L2_BUF_FLAG_DONE) 473 | V4L2_BUF_FLAG_DONE)
471 & ~V4L2_BUF_FLAG_QUEUED; 474 & ~V4L2_BUF_FLAG_QUEUED;
475 i = (i + 1) % GSPCA_MAX_FRAMES;
476 atomic_set(&gspca_dev->fr_i, i);
472 wake_up_interruptible(&gspca_dev->wq); /* event = new frame */ 477 wake_up_interruptible(&gspca_dev->wq); /* event = new frame */
473 i = (i + 1) % gspca_dev->nframes; 478 PDEBUG(D_FRAM, "frame complete len:%d",
474 gspca_dev->fr_i = i; 479 frame->v4l2_buf.bytesused);
475 PDEBUG(D_FRAM, "frame complete len:%d q:%d i:%d o:%d", 480 gspca_dev->image = NULL;
476 frame->v4l2_buf.bytesused, 481 gspca_dev->image_len = 0;
477 gspca_dev->fr_q,
478 i,
479 gspca_dev->fr_o);
480 j = gspca_dev->fr_queue[i];
481 frame = &gspca_dev->frame[j];
482 if ((frame->v4l2_buf.flags & BUF_ALL_FLAGS)
483 == V4L2_BUF_FLAG_QUEUED) {
484 gspca_dev->image = frame->data;
485 } else {
486 gspca_dev->image = NULL;
487 }
488 } 482 }
489} 483}
490EXPORT_SYMBOL(gspca_frame_add); 484EXPORT_SYMBOL(gspca_frame_add);
@@ -514,8 +508,8 @@ static int frame_alloc(struct gspca_dev *gspca_dev,
514 PDEBUG(D_STREAM, "frame alloc frsz: %d", frsz); 508 PDEBUG(D_STREAM, "frame alloc frsz: %d", frsz);
515 frsz = PAGE_ALIGN(frsz); 509 frsz = PAGE_ALIGN(frsz);
516 gspca_dev->frsz = frsz; 510 gspca_dev->frsz = frsz;
517 if (count > GSPCA_MAX_FRAMES) 511 if (count >= GSPCA_MAX_FRAMES)
518 count = GSPCA_MAX_FRAMES; 512 count = GSPCA_MAX_FRAMES - 1;
519 gspca_dev->frbuf = vmalloc_32(frsz * count); 513 gspca_dev->frbuf = vmalloc_32(frsz * count);
520 if (!gspca_dev->frbuf) { 514 if (!gspca_dev->frbuf) {
521 err("frame alloc failed"); 515 err("frame alloc failed");
@@ -534,11 +528,9 @@ static int frame_alloc(struct gspca_dev *gspca_dev,
534 frame->data = gspca_dev->frbuf + i * frsz; 528 frame->data = gspca_dev->frbuf + i * frsz;
535 frame->v4l2_buf.m.offset = i * frsz; 529 frame->v4l2_buf.m.offset = i * frsz;
536 } 530 }
537 gspca_dev->fr_i = gspca_dev->fr_o = gspca_dev->fr_q = 0; 531 atomic_set(&gspca_dev->fr_q, 0);
538 gspca_dev->image = NULL; 532 atomic_set(&gspca_dev->fr_i, 0);
539 gspca_dev->image_len = 0; 533 gspca_dev->fr_o = 0;
540 gspca_dev->last_packet_type = DISCARD_PACKET;
541 gspca_dev->sequence = 0;
542 return 0; 534 return 0;
543} 535}
544 536
@@ -776,6 +768,12 @@ static int gspca_init_transfer(struct gspca_dev *gspca_dev)
776 goto out; 768 goto out;
777 } 769 }
778 770
771 /* reset the streaming variables */
772 gspca_dev->image = NULL;
773 gspca_dev->image_len = 0;
774 gspca_dev->last_packet_type = DISCARD_PACKET;
775 gspca_dev->sequence = 0;
776
779 gspca_dev->usb_err = 0; 777 gspca_dev->usb_err = 0;
780 778
781 /* set the higher alternate setting and 779 /* set the higher alternate setting and
@@ -1591,7 +1589,7 @@ static int vidioc_streamoff(struct file *file, void *priv,
1591 enum v4l2_buf_type buf_type) 1589 enum v4l2_buf_type buf_type)
1592{ 1590{
1593 struct gspca_dev *gspca_dev = priv; 1591 struct gspca_dev *gspca_dev = priv;
1594 int i, ret; 1592 int ret;
1595 1593
1596 if (buf_type != V4L2_BUF_TYPE_VIDEO_CAPTURE) 1594 if (buf_type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
1597 return -EINVAL; 1595 return -EINVAL;
@@ -1615,12 +1613,10 @@ static int vidioc_streamoff(struct file *file, void *priv,
1615 gspca_stream_off(gspca_dev); 1613 gspca_stream_off(gspca_dev);
1616 mutex_unlock(&gspca_dev->usb_lock); 1614 mutex_unlock(&gspca_dev->usb_lock);
1617 1615
1618 /* empty the application queues */ 1616 /* empty the transfer queues */
1619 for (i = 0; i < gspca_dev->nframes; i++) 1617 atomic_set(&gspca_dev->fr_q, 0);
1620 gspca_dev->frame[i].v4l2_buf.flags &= ~BUF_ALL_FLAGS; 1618 atomic_set(&gspca_dev->fr_i, 0);
1621 gspca_dev->fr_i = gspca_dev->fr_o = gspca_dev->fr_q = 0; 1619 gspca_dev->fr_o = 0;
1622 gspca_dev->last_packet_type = DISCARD_PACKET;
1623 gspca_dev->sequence = 0;
1624 ret = 0; 1620 ret = 0;
1625out: 1621out:
1626 mutex_unlock(&gspca_dev->queue_lock); 1622 mutex_unlock(&gspca_dev->queue_lock);
@@ -1697,7 +1693,7 @@ static int vidioc_s_parm(struct file *filp, void *priv,
1697 int n; 1693 int n;
1698 1694
1699 n = parm->parm.capture.readbuffers; 1695 n = parm->parm.capture.readbuffers;
1700 if (n == 0 || n > GSPCA_MAX_FRAMES) 1696 if (n == 0 || n >= GSPCA_MAX_FRAMES)
1701 parm->parm.capture.readbuffers = gspca_dev->nbufread; 1697 parm->parm.capture.readbuffers = gspca_dev->nbufread;
1702 else 1698 else
1703 gspca_dev->nbufread = n; 1699 gspca_dev->nbufread = n;
@@ -1800,21 +1796,17 @@ out:
1800static int frame_wait(struct gspca_dev *gspca_dev, 1796static int frame_wait(struct gspca_dev *gspca_dev,
1801 int nonblock_ing) 1797 int nonblock_ing)
1802{ 1798{
1803 struct gspca_frame *frame; 1799 int i, ret;
1804 int i, j, ret;
1805 1800
1806 /* check if a frame is ready */ 1801 /* check if a frame is ready */
1807 i = gspca_dev->fr_o; 1802 i = gspca_dev->fr_o;
1808 j = gspca_dev->fr_queue[i]; 1803 if (i == atomic_read(&gspca_dev->fr_i)) {
1809 frame = &gspca_dev->frame[j];
1810
1811 if (!(frame->v4l2_buf.flags & V4L2_BUF_FLAG_DONE)) {
1812 if (nonblock_ing) 1804 if (nonblock_ing)
1813 return -EAGAIN; 1805 return -EAGAIN;
1814 1806
1815 /* wait till a frame is ready */ 1807 /* wait till a frame is ready */
1816 ret = wait_event_interruptible_timeout(gspca_dev->wq, 1808 ret = wait_event_interruptible_timeout(gspca_dev->wq,
1817 (frame->v4l2_buf.flags & V4L2_BUF_FLAG_DONE) || 1809 i != atomic_read(&gspca_dev->fr_i) ||
1818 !gspca_dev->streaming || !gspca_dev->present, 1810 !gspca_dev->streaming || !gspca_dev->present,
1819 msecs_to_jiffies(3000)); 1811 msecs_to_jiffies(3000));
1820 if (ret < 0) 1812 if (ret < 0)
@@ -1823,11 +1815,7 @@ static int frame_wait(struct gspca_dev *gspca_dev,
1823 return -EIO; 1815 return -EIO;
1824 } 1816 }
1825 1817
1826 gspca_dev->fr_o = (i + 1) % gspca_dev->nframes; 1818 gspca_dev->fr_o = (i + 1) % GSPCA_MAX_FRAMES;
1827 PDEBUG(D_FRAM, "frame wait q:%d i:%d o:%d",
1828 gspca_dev->fr_q,
1829 gspca_dev->fr_i,
1830 gspca_dev->fr_o);
1831 1819
1832 if (gspca_dev->sd_desc->dq_callback) { 1820 if (gspca_dev->sd_desc->dq_callback) {
1833 mutex_lock(&gspca_dev->usb_lock); 1821 mutex_lock(&gspca_dev->usb_lock);
@@ -1836,7 +1824,7 @@ static int frame_wait(struct gspca_dev *gspca_dev,
1836 gspca_dev->sd_desc->dq_callback(gspca_dev); 1824 gspca_dev->sd_desc->dq_callback(gspca_dev);
1837 mutex_unlock(&gspca_dev->usb_lock); 1825 mutex_unlock(&gspca_dev->usb_lock);
1838 } 1826 }
1839 return j; 1827 return gspca_dev->fr_queue[i];
1840} 1828}
1841 1829
1842/* 1830/*
@@ -1941,15 +1929,9 @@ static int vidioc_qbuf(struct file *file, void *priv,
1941 } 1929 }
1942 1930
1943 /* put the buffer in the 'queued' queue */ 1931 /* put the buffer in the 'queued' queue */
1944 i = gspca_dev->fr_q; 1932 i = atomic_read(&gspca_dev->fr_q);
1945 gspca_dev->fr_queue[i] = index; 1933 gspca_dev->fr_queue[i] = index;
1946 if (gspca_dev->fr_i == i) 1934 atomic_set(&gspca_dev->fr_q, (i + 1) % GSPCA_MAX_FRAMES);
1947 gspca_dev->image = frame->data;
1948 gspca_dev->fr_q = (i + 1) % gspca_dev->nframes;
1949 PDEBUG(D_FRAM, "qbuf q:%d i:%d o:%d",
1950 gspca_dev->fr_q,
1951 gspca_dev->fr_i,
1952 gspca_dev->fr_o);
1953 1935
1954 v4l2_buf->flags |= V4L2_BUF_FLAG_QUEUED; 1936 v4l2_buf->flags |= V4L2_BUF_FLAG_QUEUED;
1955 v4l2_buf->flags &= ~V4L2_BUF_FLAG_DONE; 1937 v4l2_buf->flags &= ~V4L2_BUF_FLAG_DONE;
@@ -2005,7 +1987,7 @@ static int read_alloc(struct gspca_dev *gspca_dev,
2005static unsigned int dev_poll(struct file *file, poll_table *wait) 1987static unsigned int dev_poll(struct file *file, poll_table *wait)
2006{ 1988{
2007 struct gspca_dev *gspca_dev = file->private_data; 1989 struct gspca_dev *gspca_dev = file->private_data;
2008 int i, ret; 1990 int ret;
2009 1991
2010 PDEBUG(D_FRAM, "poll"); 1992 PDEBUG(D_FRAM, "poll");
2011 1993
@@ -2023,11 +2005,9 @@ static unsigned int dev_poll(struct file *file, poll_table *wait)
2023 if (mutex_lock_interruptible(&gspca_dev->queue_lock) != 0) 2005 if (mutex_lock_interruptible(&gspca_dev->queue_lock) != 0)
2024 return POLLERR; 2006 return POLLERR;
2025 2007
2026 /* check the next incoming buffer */ 2008 /* check if an image has been received */
2027 i = gspca_dev->fr_o; 2009 if (gspca_dev->fr_o != atomic_read(&gspca_dev->fr_i))
2028 i = gspca_dev->fr_queue[i]; 2010 ret = POLLIN | POLLRDNORM; /* yes */
2029 if (gspca_dev->frame[i].v4l2_buf.flags & V4L2_BUF_FLAG_DONE)
2030 ret = POLLIN | POLLRDNORM; /* something to read */
2031 else 2011 else
2032 ret = 0; 2012 ret = 0;
2033 mutex_unlock(&gspca_dev->queue_lock); 2013 mutex_unlock(&gspca_dev->queue_lock);
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index 453e43d66a83..17e55580631e 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -178,11 +178,11 @@ struct gspca_dev {
178 u8 *image; /* image beeing filled */ 178 u8 *image; /* image beeing filled */
179 __u32 frsz; /* frame size */ 179 __u32 frsz; /* frame size */
180 u32 image_len; /* current length of image */ 180 u32 image_len; /* current length of image */
181 char nframes; /* number of frames */ 181 atomic_t fr_q; /* next frame to queue */
182 char fr_i; /* frame being filled */ 182 atomic_t fr_i; /* frame being filled */
183 char fr_q; /* next frame to queue */
184 char fr_o; /* next frame to dequeue */
185 signed char fr_queue[GSPCA_MAX_FRAMES]; /* frame queue */ 183 signed char fr_queue[GSPCA_MAX_FRAMES]; /* frame queue */
184 char nframes; /* number of frames */
185 u8 fr_o; /* next frame to dequeue */
186 __u8 last_packet_type; 186 __u8 last_packet_type;
187 __s8 empty_packet; /* if (-1) don't check empty packets */ 187 __s8 empty_packet; /* if (-1) don't check empty packets */
188 __u8 streaming; 188 __u8 streaming;
diff --git a/drivers/media/video/gspca/m5602/m5602_core.c b/drivers/media/video/gspca/m5602/m5602_core.c
index 0c4ad5a5642a..b073d66acd04 100644
--- a/drivers/media/video/gspca/m5602/m5602_core.c
+++ b/drivers/media/video/gspca/m5602/m5602_core.c
@@ -307,11 +307,6 @@ static void m5602_urb_complete(struct gspca_dev *gspca_dev,
307 } else { 307 } else {
308 int cur_frame_len; 308 int cur_frame_len;
309 309
310 if (gspca_dev->image == NULL) {
311 gspca_dev->last_packet_type = DISCARD_PACKET;
312 return;
313 }
314
315 cur_frame_len = gspca_dev->image_len; 310 cur_frame_len = gspca_dev->image_len;
316 /* Remove urb header */ 311 /* Remove urb header */
317 data += 4; 312 data += 4;
diff --git a/drivers/media/video/gspca/ov534.c b/drivers/media/video/gspca/ov534.c
index 84c9b8dbded6..96cb3a976581 100644
--- a/drivers/media/video/gspca/ov534.c
+++ b/drivers/media/video/gspca/ov534.c
@@ -988,8 +988,6 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
988 /* If this packet is marked as EOF, end the frame */ 988 /* If this packet is marked as EOF, end the frame */
989 } else if (data[1] & UVC_STREAM_EOF) { 989 } else if (data[1] & UVC_STREAM_EOF) {
990 sd->last_pts = 0; 990 sd->last_pts = 0;
991 if (gspca_dev->image == NULL)
992 goto discard;
993 if (gspca_dev->image_len + len - 12 != 991 if (gspca_dev->image_len + len - 12 !=
994 gspca_dev->width * gspca_dev->height * 2) { 992 gspca_dev->width * gspca_dev->height * 2) {
995 PDEBUG(D_PACK, "wrong sized frame"); 993 PDEBUG(D_PACK, "wrong sized frame");
diff --git a/drivers/media/video/gspca/pac7302.c b/drivers/media/video/gspca/pac7302.c
index 88cc03bb3f94..a66df07d7625 100644
--- a/drivers/media/video/gspca/pac7302.c
+++ b/drivers/media/video/gspca/pac7302.c
@@ -835,12 +835,6 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
835 if (sof) { 835 if (sof) {
836 int n, lum_offset, footer_length; 836 int n, lum_offset, footer_length;
837 837
838 image = gspca_dev->image;
839 if (image == NULL) {
840 gspca_dev->last_packet_type = DISCARD_PACKET;
841 return;
842 }
843
844 /* 6 bytes after the FF D9 EOF marker a number of lumination 838 /* 6 bytes after the FF D9 EOF marker a number of lumination
845 bytes are send corresponding to different parts of the 839 bytes are send corresponding to different parts of the
846 image, the 14th and 15th byte after the EOF seem to 840 image, the 14th and 15th byte after the EOF seem to
@@ -856,7 +850,9 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
856 } else { 850 } else {
857 gspca_frame_add(gspca_dev, INTER_PACKET, data, n); 851 gspca_frame_add(gspca_dev, INTER_PACKET, data, n);
858 } 852 }
859 if (gspca_dev->last_packet_type != DISCARD_PACKET 853
854 image = gspca_dev->image;
855 if (image != NULL
860 && image[gspca_dev->image_len - 2] == 0xff 856 && image[gspca_dev->image_len - 2] == 0xff
861 && image[gspca_dev->image_len - 1] == 0xd9) 857 && image[gspca_dev->image_len - 1] == 0xd9)
862 gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0); 858 gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
index 5568c41a296c..1cb7e99e92bd 100644
--- a/drivers/media/video/gspca/pac7311.c
+++ b/drivers/media/video/gspca/pac7311.c
@@ -630,12 +630,6 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
630 if (sof) { 630 if (sof) {
631 int n, lum_offset, footer_length; 631 int n, lum_offset, footer_length;
632 632
633 image = gspca_dev->image;
634 if (image == NULL) {
635 gspca_dev->last_packet_type = DISCARD_PACKET;
636 return;
637 }
638
639 /* 6 bytes after the FF D9 EOF marker a number of lumination 633 /* 6 bytes after the FF D9 EOF marker a number of lumination
640 bytes are send corresponding to different parts of the 634 bytes are send corresponding to different parts of the
641 image, the 14th and 15th byte after the EOF seem to 635 image, the 14th and 15th byte after the EOF seem to
@@ -651,7 +645,8 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
651 } else { 645 } else {
652 gspca_frame_add(gspca_dev, INTER_PACKET, data, n); 646 gspca_frame_add(gspca_dev, INTER_PACKET, data, n);
653 } 647 }
654 if (gspca_dev->last_packet_type != DISCARD_PACKET 648 image = gspca_dev->image;
649 if (image != NULL
655 && image[gspca_dev->image_len - 2] == 0xff 650 && image[gspca_dev->image_len - 2] == 0xff
656 && image[gspca_dev->image_len - 1] == 0xd9) 651 && image[gspca_dev->image_len - 1] == 0xd9)
657 gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0); 652 gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
diff --git a/drivers/media/video/gspca/sonixb.c b/drivers/media/video/gspca/sonixb.c
index 4989a2c779e5..204bb3af4559 100644
--- a/drivers/media/video/gspca/sonixb.c
+++ b/drivers/media/video/gspca/sonixb.c
@@ -1254,10 +1254,6 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
1254 int used; 1254 int used;
1255 int size = cam->cam_mode[gspca_dev->curr_mode].sizeimage; 1255 int size = cam->cam_mode[gspca_dev->curr_mode].sizeimage;
1256 1256
1257 if (gspca_dev->image == NULL) {
1258 gspca_dev->last_packet_type = DISCARD_PACKET;
1259 return;
1260 }
1261 used = gspca_dev->image_len; 1257 used = gspca_dev->image_len;
1262 if (used + len > size) 1258 if (used + len > size)
1263 len = size - used; 1259 len = size - used;
diff --git a/drivers/media/video/gspca/vc032x.c b/drivers/media/video/gspca/vc032x.c
index 0a7d1e0866d2..82be16938458 100644
--- a/drivers/media/video/gspca/vc032x.c
+++ b/drivers/media/video/gspca/vc032x.c
@@ -3728,10 +3728,6 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
3728 if (sd->bridge == BRIDGE_VC0321) { 3728 if (sd->bridge == BRIDGE_VC0321) {
3729 int size, l; 3729 int size, l;
3730 3730
3731 if (gspca_dev->image == NULL) {
3732 gspca_dev->last_packet_type = DISCARD_PACKET;
3733 return;
3734 }
3735 l = gspca_dev->image_len; 3731 l = gspca_dev->image_len;
3736 size = gspca_dev->frsz; 3732 size = gspca_dev->frsz;
3737 if (len > size - l) 3733 if (len > size - l)