diff options
| author | Zhaowei Yuan <zhaowei.yuan@samsung.com> | 2014-04-02 15:58:36 +0800 |
|---|---|---|
| committer | Chanho Park <chanho61.park@samsung.com> | 2014-11-18 11:47:26 +0900 |
| commit | 8525f4e678f85d38cdc533046c9ceb7f28123976 (patch) | |
| tree | 82c4440bbfd067ac3bccc3aa07fdae1cc5ba0e51 /drivers | |
| parent | d96c1054b3c043d066cb50e024cf18b4624d8ffc (diff) | |
| download | linux-3.10-8525f4e678f85d38cdc533046c9ceb7f28123976.tar.gz linux-3.10-8525f4e678f85d38cdc533046c9ceb7f28123976.tar.bz2 linux-3.10-8525f4e678f85d38cdc533046c9ceb7f28123976.zip | |
media: s5p_mfc: fix doublly free issue
When video_register_device() returns failure, vfd will be freed at once and
dev->vfl_dec will be freed after label "err_dec_reg", but the two pointers point
to the same area, so it was doublly freed here. Since video_device_release()
will be called by video_unregister_device() indirectly, we should remove the
two other calls after labels err_enc_reg and err_dec_reg.
Change-Id: I5ee8f83eeb47443e2f772914127514eab996c347
Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
Diffstat (limited to 'drivers')
| -rwxr-xr-x[-rw-r--r--] | drivers/media/platform/s5p-mfc/s5p_mfc.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c index ff87daf5c29..a293a3adc95 100644..100755 --- a/drivers/media/platform/s5p-mfc/s5p_mfc.c +++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c @@ -1127,7 +1127,7 @@ static int s5p_mfc_probe(struct platform_device *pdev) if (ret) { v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); video_device_release(vfd); - goto err_dec_reg; + goto err_dec_alloc; } v4l2_info(&dev->v4l2_dev, "decoder registered as /dev/video%d\n", vfd->num); @@ -1152,7 +1152,7 @@ static int s5p_mfc_probe(struct platform_device *pdev) if (ret) { v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); video_device_release(vfd); - goto err_enc_reg; + goto err_enc_alloc; } v4l2_info(&dev->v4l2_dev, "encoder registered as /dev/video%d\n", vfd->num); @@ -1175,12 +1175,8 @@ static int s5p_mfc_probe(struct platform_device *pdev) return 0; /* Deinit MFC if probe had failed */ -err_enc_reg: - video_device_release(dev->vfd_enc); err_enc_alloc: video_unregister_device(dev->vfd_dec); -err_dec_reg: - video_device_release(dev->vfd_dec); err_dec_alloc: v4l2_device_unregister(&dev->v4l2_dev); err_v4l2_dev_reg: |