summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZhaowei Yuan <zhaowei.yuan@samsung.com>2014-04-02 07:58:36 (GMT)
committerSylwester Nawrocki <s.nawrocki@samsung.com>2014-04-08 10:29:57 (GMT)
commit5dcb74a7772ccc40001feaa23a3ce0fd3ea5e63a (patch)
tree528cc7202f0bac8130bce49d7eba8906c3aeb4e3
parent613cd5a6c89ba153ade411385ec44176578d4d6a (diff)
downloadlinux-3.10-5dcb74a7772ccc40001feaa23a3ce0fd3ea5e63a.zip
linux-3.10-5dcb74a7772ccc40001feaa23a3ce0fd3ea5e63a.tar.gz
linux-3.10-5dcb74a7772ccc40001feaa23a3ce0fd3ea5e63a.tar.bz2
media: s5p_mfc: fix doublly free issuerefs/changes/66/18866/3
When video_register_device() returns failure, vfd will be freed at once and dev->vfl_dec will be freed after label "err_dec_reg", but the two pointers point to the same area, so it was doublly freed here. Since video_device_release() will be called by video_unregister_device() indirectly, we should remove the two other calls after labels err_enc_reg and err_dec_reg. Change-Id: I5ee8f83eeb47443e2f772914127514eab996c347 Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
-rwxr-xr-x[-rw-r--r--]drivers/media/platform/s5p-mfc/s5p_mfc.c8
1 files changed, 2 insertions, 6 deletions
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index ff87daf..a293a3a 100644..100755
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -1127,7 +1127,7 @@ static int s5p_mfc_probe(struct platform_device *pdev)
if (ret) {
v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
video_device_release(vfd);
- goto err_dec_reg;
+ goto err_dec_alloc;
}
v4l2_info(&dev->v4l2_dev,
"decoder registered as /dev/video%d\n", vfd->num);
@@ -1152,7 +1152,7 @@ static int s5p_mfc_probe(struct platform_device *pdev)
if (ret) {
v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
video_device_release(vfd);
- goto err_enc_reg;
+ goto err_enc_alloc;
}
v4l2_info(&dev->v4l2_dev,
"encoder registered as /dev/video%d\n", vfd->num);
@@ -1175,12 +1175,8 @@ static int s5p_mfc_probe(struct platform_device *pdev)
return 0;
/* Deinit MFC if probe had failed */
-err_enc_reg:
- video_device_release(dev->vfd_enc);
err_enc_alloc:
video_unregister_device(dev->vfd_dec);
-err_dec_reg:
- video_device_release(dev->vfd_dec);
err_dec_alloc:
v4l2_device_unregister(&dev->v4l2_dev);
err_v4l2_dev_reg: