mmap(),poll()报错，请大家帮帮忙。。。。

我用mini2440弄了个摄像头驱动，应用程序调用的时候提示Oops错误，指针指到memcpy()；
但是用read()方式可以正常输出图像。
mmap(),poll()和中断处理中的关键代码如下：
static int camif_mmap(struct file* filp, struct vm_area_struct *vma)
{
    if (!(vma->vm_flags & (VM_WRITE | VM_READ))) {
        return -EACCES;
    }

    if (cam->io != IO_MMAP ||
        size != PAGE_ALIGN(cam->frame[0].buf.length)) {
        return -EINVAL;
    }


    for (i = 0; i < cam->nbuffers; i++) {
        if ((cam->frame.buf.m.offset>>PAGE_SHIFT) == vma->vm_pgoff)
            break;
    }
    if (i == cam->nbuffers) {
        return -EINVAL;
    }
    vma->vm_flags |= VM_IO;
    vma->vm_flags |= VM_RESERVED;

    pos = cam->frame.bufmem;

    while (size > 0) { /* size is page-aligned */
        if (vm_insert_page(vma, start, vmalloc_to_page(pos))) {
            mutex_unlock(&cam->fileop_mutex);
            return -EAGAIN;
        }
        start += PAGE_SIZE;
        pos += PAGE_SIZE;
        size -= PAGE_SIZE;
    }
    vma->vm_ops = &s3c2440_vm_ops;
    vma->vm_private_data = &cam->frame;
    s3c2440_vm_open(vma);
    
    return 0;
}

static unsigned int  camif_poll(struct file *filp, poll_table *wait){
    .......................
    if (!s3c2440_request_buffers(cam, cam->nreadbuffers, IO_READ)) {
            printk(KERN_ALERT"poll() failed, not enough memory");
            goto error;
        }
        cam->io = IO_READ;
        cam->stream = STREAM_ON;
    .....................

    poll_wait(filp, &cam->wait_frame, wait);

    if (!list_empty(&cam->outqueue))
        mask |= POLLIN | POLLRDNORM;
    mutex_unlock(&cam->fileop_mutex);
    return mask;

}


static irqreturn_t on_camif_irq_p(int irq, void * dev){
.....
    memcpy((*f)->bufmem, (void *)img_buff[nframe].virt_base, imagesize);
................
}

很不幸，真正关键的部分被你省略号掉了...

不好意思，是我编码有问题：在reqbufs()中把img_buff[]给释放了，造成调用memcpy()时，img_buff[nframe].virt_base为0，所以报错。

已经搞定，谢谢总斑竹。

另外，略掉的部分都是加锁和解锁操作。