From: Dave Jones Another large on-stack allocation. (This time around 2KB). --- drivers/media/video/w9966.c | 23 ++++++++++++++++------- 1 files changed, 16 insertions(+), 7 deletions(-) diff -puN drivers/media/video/w9966.c~w9966-stack-usage-fix drivers/media/video/w9966.c --- 25/drivers/media/video/w9966.c~w9966-stack-usage-fix 2004-01-21 12:21:31.000000000 -0800 +++ 25-akpm/drivers/media/video/w9966.c 2004-01-21 12:21:31.000000000 -0800 @@ -875,6 +875,7 @@ static ssize_t w9966_v4l_read(struct fil unsigned char addr = 0xa0; // ECP, read, CCD-transfer, 00000 unsigned char* dest = (unsigned char*)buf; unsigned long dleft = count; + unsigned char *tbuf; // Why would anyone want more than this?? if (count > cam->width * cam->height * 2) @@ -894,25 +895,33 @@ static ssize_t w9966_v4l_read(struct fil w9966_pdev_release(cam); return -EFAULT; } - + + tbuf = kmalloc(W9966_RBUFFER, GFP_KERNEL); + if (tbuf == NULL) { + count = -ENOMEM; + goto out; + } + while(dleft > 0) { unsigned long tsize = (dleft > W9966_RBUFFER) ? W9966_RBUFFER : dleft; - unsigned char tbuf[W9966_RBUFFER]; if (parport_read(cam->pport, tbuf, tsize) < tsize) { - w9966_pdev_release(cam); - return -EFAULT; + count = -EFAULT; + goto out; } if (copy_to_user(dest, tbuf, tsize) != 0) { - w9966_pdev_release(cam); - return -EFAULT; + count = -EFAULT; + goto out; } dest += tsize; dleft -= tsize; } - + w9966_wReg(cam, 0x01, 0x18); // Disable capture + +out: + kfree(tbuf); w9966_pdev_release(cam); return count; _