commit fa64f2332f034f202fa1f495c6dce7012bc2bb16
author Ankit Premrajka <ankitp@codeaurora.org> Thu Aug 04 09:32:34 2011 -0700
committer Bryan Huntsman <bryanh@codeaurora.org> Mon Oct 03 10:28:40 2011 -0700
tree 4b20ed9cea2aac64298fc831cd8797729a4bd867
parent caa090935e7394120834ebaf4d413155e3b743de

msm: camera: fix memory leaks in camera driver

Signed-off-by: Ankit Premrajka <ankitp@codeaurora.org>

drivers/media/video/msm/msm.c

diff --git a/drivers/media/video/msm/msm.c b/drivers/media/video/msm/msm.c
index 8d90eef..1f9f667 100644
--- a/drivers/media/video/msm/msm.c
+++ b/drivers/media/video/msm/msm.c
@@ -102,7 +102,7 @@
 		return -EINVAL;
 
 	qcmd = kzalloc(sizeof(struct msm_queue_cmd), GFP_KERNEL);
-	atomic_set(&qcmd->on_heap, 0);
+	atomic_set(&qcmd->on_heap, 1);
 	uptr = command->value;
 	qcmd->command = command;
 
@@ -112,10 +112,13 @@
 			pr_err("%s: user data %d is too big (max %d)\n",
 				__func__, command->length,
 				sizeof(g_server_dev.ctrl_data));
+			free_qcmd(qcmd);
 			return -EINVAL;
 		}
-		if (copy_from_user(command->value, uptr, command->length))
+		if (copy_from_user(command->value, uptr, command->length)) {
+			free_qcmd(qcmd);
 			return -EINVAL;
+		}
 	}
 
 	msm_enqueue(&g_server_dev.ctrl_q, &qcmd->list_control);
@@ -1902,10 +1905,11 @@
 	rc = v4l2_fh_init(eventHandle, pvdev);
 	if (rc < 0)
 		return rc;
-
-	rc = v4l2_event_init(eventHandle);
-	if (rc < 0)
-		return rc;
+	if (eventHandle->events == NULL) {
+		rc = v4l2_event_init(eventHandle);
+		if (rc < 0)
+			return rc;
+	}
 
 	/* queue of max size 30 */
 	rc = v4l2_event_alloc(eventHandle, 30);