Commit 8e17858a authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: bcm2835-camera: fix error handling in init 



The unwinding here isn't right.  We don't free gdev[0] and instead
free 1 step past what was allocated.  Also we can't allocate "dev" then
we should unwind instead of returning directly.

Fixes: 7b3ad5ab ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarwalter harms <wharms@bfs.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0743a78f

drivers/staging/media/platform/bcm2835/bcm2835-camera.c

+9 −5
Original line number Diff line number Diff line
@@ -1901,6 +1901,7 @@ static int __init bm2835_mmal_init(void) 
	unsigned int num_cameras;

	struct vchiq_mmal_instance *instance;

	unsigned int resolutions[MAX_BCM2835_CAMERAS][2];

	int i;



	ret = vchiq_mmal_init(&instance);

	if (ret < 0)
@@ -1914,8 +1915,10 @@ static int __init bm2835_mmal_init(void) 


	for (camera = 0; camera < num_cameras; camera++) {

		dev = kzalloc(sizeof(struct bm2835_mmal_dev), GFP_KERNEL);

		if (!dev)

			return -ENOMEM;

		if (!dev) {

			ret = -ENOMEM;

			goto cleanup_gdev;

		}



		dev->camera_num = camera;

		dev->max_width = resolutions[camera][0];
@@ -1998,9 +2001,10 @@ static int __init bm2835_mmal_init(void) 
free_dev:

	kfree(dev);



	for ( ; camera > 0; camera--) {

		bcm2835_cleanup_instance(gdev[camera]);

		gdev[camera] = NULL;

cleanup_gdev:

	for (i = 0; i < camera; i++) {

		bcm2835_cleanup_instance(gdev[i]);

		gdev[i] = NULL;

	}

	pr_info("%s: error %d while loading driver\n",

		BM2835_MMAL_MODULE_NAME, ret);