V4L/DVB (8842): vivi_release(): fix use-after-free

[safe/jmp/linux-2.6] / drivers / media / video / cpia.c

diff --git a/drivers/media/video/cpia.c b/drivers/media/video/cpia.c
index 7e8d5ef..a661800 100644 (file)
--- a/drivers/media/video/cpia.c
+++ b/drivers/media/video/cpia.c
@@ -28,7 +28,6 @@
 
 
 #include <linux/module.h>
-#include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/vmalloc.h>
@@ -66,10 +65,6 @@ MODULE_PARM_DESC(colorspace_conv,
 
 #define ABOUT "V4L-Driver for Vision CPiA based cameras"
 
-#ifndef VID_HARDWARE_CPIA
-#define VID_HARDWARE_CPIA 24    /* FIXME -> from linux/videodev.h */
-#endif
-
 #define CPIA_MODULE_CPIA                       (0<<5)
 #define CPIA_MODULE_SYSTEM                     (1<<5)
 #define CPIA_MODULE_VP_CTRL                    (5<<5)
@@ -1350,13 +1345,13 @@ out:
 
 static void create_proc_cpia_cam(struct cam_data *cam)
 {
-       char name[7];
+       char name[5 + 1 + 10 + 1];
        struct proc_dir_entry *ent;
 
        if (!cpia_proc_root || !cam)
                return;
 
-       sprintf(name, "video%d", cam->vdev.minor);
+       snprintf(name, sizeof(name), "video%d", cam->vdev.minor);
 
        ent = create_proc_entry(name, S_IFREG|S_IRUGO|S_IWUSR, cpia_proc_root);
        if (!ent)
@@ -1376,12 +1371,12 @@ static void create_proc_cpia_cam(struct cam_data *cam)
 
 static void destroy_proc_cpia_cam(struct cam_data *cam)
 {
-       char name[7];
+       char name[5 + 1 + 10 + 1];
 
        if (!cam || !cam->proc_entry)
                return;
 
-       sprintf(name, "video%d", cam->vdev.minor);
+       snprintf(name, sizeof(name), "video%d", cam->vdev.minor);
        remove_proc_entry(name, cpia_proc_root);
        cam->proc_entry = NULL;
 }
@@ -3153,8 +3148,7 @@ static int reset_camera(struct cam_data *cam)
 
 static void put_cam(struct cpia_camera_ops* ops)
 {
-       if (ops->owner)
-               module_put(ops->owner);
+       module_put(ops->owner);
 }
 
 /* ------------------------- V4L interface --------------------- */
@@ -3798,15 +3792,14 @@ static const struct file_operations cpia_fops = {
        .read           = cpia_read,
        .mmap           = cpia_mmap,
        .ioctl          = cpia_ioctl,
+#ifdef CONFIG_COMPAT
        .compat_ioctl   = v4l_compat_ioctl32,
+#endif
        .llseek         = no_llseek,
 };
 
 static struct video_device cpia_template = {
-       .owner          = THIS_MODULE,
        .name           = "CPiA Camera",
-       .type           = VID_TYPE_CAPTURE,
-       .hardware       = VID_HARDWARE_CPIA,
        .fops           = &cpia_fops,
 };
 
@@ -3962,7 +3955,7 @@ struct cam_data *cpia_register_camera(struct cpia_camera_ops *ops, void *lowleve
        camera->lowlevel_data = lowlevel;
 
        /* register v4l device */
-       if (video_register_device(&camera->vdev, VFL_TYPE_GRABBER, video_nr) == -1) {
+       if (video_register_device(&camera->vdev, VFL_TYPE_GRABBER, video_nr) < 0) {
                kfree(camera);
                printk(KERN_DEBUG "video_register_device failed\n");
                return NULL;