From 100e88af833f5a3b6b8b30b6a22c1a3154a7ce41 Mon Sep 17 00:00:00 2001 From: armani Date: Tue, 6 Jan 2015 17:27:58 +0000 Subject: [PATCH] We do not support freeing memory using reqbufs with a zero size so return EINVAL in this case. Also change an easily triggerable panic by a printf and return EINVAL. Reminded by brad@, one typo spotted by sthen@ and ok mpi@ --- sys/dev/usb/uvideo.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sys/dev/usb/uvideo.c b/sys/dev/usb/uvideo.c index 4f3d33eeec8..4d90f5b6e41 100644 --- a/sys/dev/usb/uvideo.c +++ b/sys/dev/usb/uvideo.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uvideo.c,v 1.178 2014/11/18 23:55:01 krw Exp $ */ +/* $OpenBSD: uvideo.c,v 1.179 2015/01/06 17:27:58 armani Exp $ */ /* * Copyright (c) 2008 Robert Nagy @@ -3091,8 +3091,14 @@ uvideo_reqbufs(void *v, struct v4l2_requestbuffers *rb) DPRINTF(1, "%s: %s: count=%d\n", DEVNAME(sc), __func__, rb->count); - if (sc->sc_mmap_count > 0 || sc->sc_mmap_buffer != NULL) - panic("%s: mmap buffers already allocated", __func__); + /* We do not support freeing buffers via reqbufs(0) */ + if (rb->count == 0) + return (EINVAL); + + if (sc->sc_mmap_count > 0 || sc->sc_mmap_buffer != NULL) { + printf("%s: mmap buffers already allocated\n", __func__); + return (EINVAL); + } /* limit the buffers */ if (rb->count > UVIDEO_MAX_BUFFERS) -- 2.20.1