Memory allocation might always fail, add error handling
after kmalloc() calls.
--- em28xx-new/em28xx-video.c.orig 2009-01-11 09:45:52.000000000 +0100
+++ em28xx-new/em28xx-video.c 2009-01-11 09:46:52.000000000 +0100
@@ -3375,6 +3375,10 @@ static int em28xx_generic_probe(int *mod
case EM2870_BOARD_TERRATEC_XS:
{
sendbuf = kmalloc(1, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, "\x00", 1);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x02,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3447,6 +3451,10 @@ static int em28xx_generic_probe(int *mod
};
for (i = 0, rv = 0; i < ARRAY_SIZE(yakumo); i++) {
sendbuf = kmalloc(yakumo[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, yakumo[i].buffer, yakumo[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), yakumo[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3537,6 +3545,10 @@ static int em28xx_generic_probe(int *mod
for (i = 0, rv = 0; i < ARRAY_SIZE(videology); i++) {
/* usb_control_msg() expects kmalloced memory, otherwise the host controller will die */
sendbuf = kmalloc(videology[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, videology[i].buffer, videology[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), videology[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3560,6 +3572,10 @@ static int em28xx_generic_probe(int *mod
for (i = 0, rv = 0; i < ARRAY_SIZE(msi_vox); i++) {
sendbuf = kmalloc(msi_vox[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, msi_vox[i].buffer, msi_vox[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), msi_vox[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3582,6 +3598,10 @@ static int em28xx_generic_probe(int *mod
for (i = 0, rv = 0; i < ARRAY_SIZE(hercules_stv); i++) {
sendbuf = kmalloc(hercules_stv[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, hercules_stv[i].buffer, hercules_stv[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), hercules_stv[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3604,6 +3624,10 @@ static int em28xx_generic_probe(int *mod
for (i = 0, rv = 0; i < ARRAY_SIZE(gadmei_utv_310); i++) {
sendbuf = kmalloc(gadmei_utv_310[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, gadmei_utv_310[i].buffer, gadmei_utv_310[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), gadmei_utv_310[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3625,6 +3649,10 @@ static int em28xx_generic_probe(int *mod
}
for (i = 0, rv = 0; i < ARRAY_SIZE(msi_vox_ntsc); i++) {
sendbuf = kmalloc(msi_vox_ntsc[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, msi_vox_ntsc[i].buffer, msi_vox_ntsc[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), msi_vox_ntsc[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3681,6 +3709,10 @@ static int em28xx_generic_probe(int *mod
for (i = 0, rv = 0; i < ARRAY_SIZE(gadmei_utv_330);
i++) {
sendbuf = kmalloc(gadmei_utv_330[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, gadmei_utv_330[i].buffer, gadmei_utv_330[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), gadmei_utv_330[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3702,6 +3734,10 @@ static int em28xx_generic_probe(int *mod
}
for (i = 0, rv = 0; i < ARRAY_SIZE(netgmbh_cam); i++) {
sendbuf = kmalloc(netgmbh_cam[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, netgmbh_cam[i].buffer, netgmbh_cam[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), netgmbh_cam[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3725,6 +3761,10 @@ static int em28xx_generic_probe(int *mod
for (i = 0, rv = 0; i < ARRAY_SIZE(typhoon_dvdmaker); i++) {
sendbuf = kmalloc(typhoon_dvdmaker[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, typhoon_dvdmaker[i].buffer, typhoon_dvdmaker[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), typhoon_dvdmaker[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3776,6 +3816,10 @@ static int em28xx_generic_probe(int *mod
for (i = 0, rv = 0; i < ARRAY_SIZE(usbgear); i++) {
sendbuf = kmalloc(usbgear[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, usbgear[i].buffer, usbgear[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), usbgear[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3798,6 +3842,10 @@ static int em28xx_generic_probe(int *mod
for (i = 0, rv = 0; i < ARRAY_SIZE(siig_prolink); i++) {
sendbuf = kmalloc(siig_prolink[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, siig_prolink[i].buffer, siig_prolink[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), siig_prolink[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3819,6 +3867,10 @@ static int em28xx_generic_probe(int *mod
}
for (i = 0, rv = 0; i < ARRAY_SIZE(supercomp); i++) {
sendbuf = kmalloc(supercomp[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, supercomp[i].buffer, supercomp[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), supercomp[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -3850,6 +3902,10 @@ static int em28xx_generic_probe(int *mod
for (i = 0, rv = 0; i < ARRAY_SIZE(pinnacle_pctv);
i++) {
sendbuf = kmalloc(pinnacle_pctv[i].blen, GFP_KERNEL);
+ if (!sendbuf) {
+ em28xx_err("%s:%u:%s(): out of memory\n", __FILE__, __LINE__, __func__);
+ return -ENOMEM;
+ }
memcpy(sendbuf, pinnacle_pctv[i].buffer, pinnacle_pctv[i].blen);
ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), pinnacle_pctv[i].brequest,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
_______________________________________________
Em28xx mailing list
Em28xx@mcentral.de
http://mcentral.de/mailman/listinfo/em28xx
