m5602_start_transfer failed to set cam->isoc_in_buffer to NULL and
caused a double free in m5602_stop_transfer.
m5602_release_buffers, redid the error out logic.
When a usb_submit_urb fails it will now kill any succsfully submitted
URBs, previously it wouldn't kill any. I'm not sure if this is
required, but I assume it is.
The previous logic is more efficient by jumping to and only freeing
the required buffers, but it is an error condition and wasn't ever
being hit (or at least not without crashing in the second open, see
first patch) so it might as well have one simpler loop and iterator
over all buffers.
m5602.c, set cam->control_buffer to NULL when freed
m5602_v4l2.c, set cam->canvas, cam->isoc_in_buffer[i] to NULL when freed
Signed-off-by: David Fries <firstname.lastname@example.org>
Log in to post a comment.