V4L/DVB (9691): gspca: Move the video device to a separate area.

The video device was part of the gspca device. On device disconnection
while streaming, the device structure is freed at close time.
In this case, the remaining close job on the video device run out of
allocated memory.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

authored by Jean-Francois Moine and committed by Mauro Carvalho Chehab e07a1d8a 5c4fa002

+14 -16
+13 -15
drivers/media/video/gspca/gspca.c
··· 862 862 int ret; 863 863 864 864 PDEBUG(D_STREAM, "%s open", current->comm); 865 - gspca_dev = (struct gspca_dev *) video_devdata(file); 865 + gspca_dev = video_drvdata(file); 866 866 if (mutex_lock_interruptible(&gspca_dev->queue_lock)) 867 867 return -ERESTARTSYS; 868 868 if (!gspca_dev->present) { ··· 890 890 #ifdef GSPCA_DEBUG 891 891 /* activate the v4l2 debug */ 892 892 if (gspca_debug & D_V4L2) 893 - gspca_dev->vdev.debug |= V4L2_DEBUG_IOCTL 893 + gspca_dev->vdev->debug |= V4L2_DEBUG_IOCTL 894 894 | V4L2_DEBUG_IOCTL_ARG; 895 895 else 896 - gspca_dev->vdev.debug &= ~(V4L2_DEBUG_IOCTL 896 + gspca_dev->vdev->debug &= ~(V4L2_DEBUG_IOCTL 897 897 | V4L2_DEBUG_IOCTL_ARG); 898 898 #endif 899 899 ret = 0; ··· 1755 1755 return ret; 1756 1756 } 1757 1757 1758 - static void dev_release(struct video_device *vfd) 1759 - { 1760 - /* nothing */ 1761 - } 1762 - 1763 1758 static struct file_operations dev_fops = { 1764 1759 .owner = THIS_MODULE, 1765 1760 .open = dev_open, ··· 1802 1807 .name = "gspca main driver", 1803 1808 .fops = &dev_fops, 1804 1809 .ioctl_ops = &dev_ioctl_ops, 1805 - .release = dev_release, /* mandatory */ 1810 + .release = video_device_release, 1806 1811 .minor = -1, 1807 1812 }; 1808 1813 ··· 1871 1876 init_waitqueue_head(&gspca_dev->wq); 1872 1877 1873 1878 /* init video stuff */ 1874 - memcpy(&gspca_dev->vdev, &gspca_template, sizeof gspca_template); 1875 - gspca_dev->vdev.parent = &dev->dev; 1876 - gspca_dev->vdev.fops = &dev_fops; 1879 + gspca_dev->vdev = video_device_alloc(); 1880 + memcpy(gspca_dev->vdev, &gspca_template, sizeof gspca_template); 1881 + gspca_dev->vdev->parent = &dev->dev; 1877 1882 gspca_dev->module = module; 1878 1883 gspca_dev->present = 1; 1879 - ret = video_register_device(&gspca_dev->vdev, 1884 + video_set_drvdata(gspca_dev->vdev, gspca_dev); 1885 + ret = video_register_device(gspca_dev->vdev, 1880 1886 VFL_TYPE_GRABBER, 1881 1887 video_nr); 1882 1888 if (ret < 0) { 1883 1889 err("video_register_device err %d", ret); 1890 + video_device_release(gspca_dev->vdev); 1884 1891 goto out; 1885 1892 } 1886 1893 ··· 1890 1893 PDEBUG(D_PROBE, "probe ok"); 1891 1894 return 0; 1892 1895 out: 1893 - kref_put(&gspca_dev->kref, gspca_delete); 1896 + kfree(gspca_dev->usb_buf); 1897 + kfree(gspca_dev); 1894 1898 return ret; 1895 1899 } 1896 1900 EXPORT_SYMBOL(gspca_dev_probe); ··· 1909 1911 usb_set_intfdata(intf, NULL); 1910 1912 1911 1913 /* We don't want people trying to open up the device */ 1912 - video_unregister_device(&gspca_dev->vdev); 1914 + video_unregister_device(gspca_dev->vdev); 1913 1915 1914 1916 gspca_dev->present = 0; 1915 1917 gspca_dev->streaming = 0;
+1 -1
drivers/media/video/gspca/gspca.h
··· 120 120 }; 121 121 122 122 struct gspca_dev { 123 - struct video_device vdev; /* !! must be the first item */ 123 + struct video_device *vdev; 124 124 struct module *module; /* subdriver handling the device */ 125 125 struct usb_device *dev; 126 126 struct kref kref;