From roel.kluin@gmail.com Tue Aug 25 22:15:06 2009 From: Roel Kluin Date: Sat, 22 Aug 2009 19:32:44 +0200 Subject: Staging: rspiusb: Check usb_buffer_map_sg() retval To: Jiri Slaby Cc: Greg Kroah-Hartman , devel@linuxdriverproject.org, Andrew Morton Message-ID: <4A902BBC.8090005@gmail.com> usb_buffer_map_sg() may return -1, check this directly. Signed-off-by: Roel Kluin Reviewed-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rspiusb/rspiusb.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) --- a/drivers/staging/rspiusb/rspiusb.c +++ b/drivers/staging/rspiusb/rspiusb.c @@ -611,6 +611,7 @@ static int MapUserBuffer(struct ioctl_st int i = 0; int k = 0; int err = 0; + int ret; struct page **maplist_p; int numPagesRequired; @@ -687,9 +688,16 @@ static int MapUserBuffer(struct ioctl_st } else { pdx->sgl[frameInfo][0].length = count; } - pdx->sgEntries[frameInfo] = - usb_buffer_map_sg(pdx->udev, epAddr, pdx->sgl[frameInfo], - pdx->maplist_numPagesMapped[frameInfo]); + ret = usb_buffer_map_sg(pdx->udev, epAddr, pdx->sgl[frameInfo], + pdx->maplist_numPagesMapped[frameInfo]); + if (ret < 0) { + vfree(maplist_p); + dbg("usb_buffer_map_sg() failed"); + return -EINVAL; + } + + pdx->sgEntries[frameInfo] = ret; + dbg("number of sgEntries = %d", pdx->sgEntries[frameInfo]); pdx->userBufMapped = 1; vfree(maplist_p); @@ -716,8 +724,6 @@ static int MapUserBuffer(struct ioctl_st pdx->PixelUrb[frameInfo][i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP | URB_NO_INTERRUPT; } - if (i == 0) - return -EINVAL; /* only interrupt when last URB completes */ pdx->PixelUrb[frameInfo][--i]->transfer_flags &= ~URB_NO_INTERRUPT; pdx->pendedPixelUrbs[frameInfo] =