diff options
| author | Zhaowei Yuan <zhaowei.yuan@samsung.com> | 2014-04-02 15:58:36 +0800 |
|---|---|---|
| committer | Sylwester Nawrocki <s.nawrocki@samsung.com> | 2014-04-08 03:29:57 -0700 |
| commit | 5dcb74a7772ccc40001feaa23a3ce0fd3ea5e63a (patch) | |
| tree | 528cc7202f0bac8130bce49d7eba8906c3aeb4e3 | |
| parent | 613cd5a6c89ba153ade411385ec44176578d4d6a (diff) | |
| download | linux-3.10-5dcb74a7772ccc40001feaa23a3ce0fd3ea5e63a.tar.gz linux-3.10-5dcb74a7772ccc40001feaa23a3ce0fd3ea5e63a.tar.bz2 linux-3.10-5dcb74a7772ccc40001feaa23a3ce0fd3ea5e63a.zip | |
media: s5p_mfc: fix doublly free issue
When video_register_device() returns failure, vfd will be freed at once and
dev->vfl_dec will be freed after label "err_dec_reg", but the two pointers point
to the same area, so it was doublly freed here. Since video_device_release()
will be called by video_unregister_device() indirectly, we should remove the
two other calls after labels err_enc_reg and err_dec_reg.
Change-Id: I5ee8f83eeb47443e2f772914127514eab996c347
Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
| -rwxr-xr-x[-rw-r--r--] | drivers/media/platform/s5p-mfc/s5p_mfc.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c index ff87daf5c29..a293a3adc95 100644..100755 --- a/drivers/media/platform/s5p-mfc/s5p_mfc.c +++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c @@ -1127,7 +1127,7 @@ static int s5p_mfc_probe(struct platform_device *pdev) if (ret) { v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); video_device_release(vfd); - goto err_dec_reg; + goto err_dec_alloc; } v4l2_info(&dev->v4l2_dev, "decoder registered as /dev/video%d\n", vfd->num); @@ -1152,7 +1152,7 @@ static int s5p_mfc_probe(struct platform_device *pdev) if (ret) { v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); video_device_release(vfd); - goto err_enc_reg; + goto err_enc_alloc; } v4l2_info(&dev->v4l2_dev, "encoder registered as /dev/video%d\n", vfd->num); @@ -1175,12 +1175,8 @@ static int s5p_mfc_probe(struct platform_device *pdev) return 0; /* Deinit MFC if probe had failed */ -err_enc_reg: - video_device_release(dev->vfd_enc); err_enc_alloc: video_unregister_device(dev->vfd_dec); -err_dec_reg: - video_device_release(dev->vfd_dec); err_dec_alloc: v4l2_device_unregister(&dev->v4l2_dev); err_v4l2_dev_reg: |