From 5dcb74a7772ccc40001feaa23a3ce0fd3ea5e63a Mon Sep 17 00:00:00 2001 From: Zhaowei Yuan Date: Wed, 2 Apr 2014 15:58:36 +0800 Subject: media: s5p_mfc: fix doublly free issue When video_register_device() returns failure, vfd will be freed at once and dev->vfl_dec will be freed after label "err_dec_reg", but the two pointers point to the same area, so it was doublly freed here. Since video_device_release() will be called by video_unregister_device() indirectly, we should remove the two other calls after labels err_enc_reg and err_dec_reg. Change-Id: I5ee8f83eeb47443e2f772914127514eab996c347 Signed-off-by: Zhaowei Yuan --- drivers/media/platform/s5p-mfc/s5p_mfc.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) mode change 100644 => 100755 drivers/media/platform/s5p-mfc/s5p_mfc.c diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c old mode 100644 new mode 100755 index ff87daf5c29..a293a3adc95 --- a/drivers/media/platform/s5p-mfc/s5p_mfc.c +++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c @@ -1127,7 +1127,7 @@ static int s5p_mfc_probe(struct platform_device *pdev) if (ret) { v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); video_device_release(vfd); - goto err_dec_reg; + goto err_dec_alloc; } v4l2_info(&dev->v4l2_dev, "decoder registered as /dev/video%d\n", vfd->num); @@ -1152,7 +1152,7 @@ static int s5p_mfc_probe(struct platform_device *pdev) if (ret) { v4l2_err(&dev->v4l2_dev, "Failed to register video device\n"); video_device_release(vfd); - goto err_enc_reg; + goto err_enc_alloc; } v4l2_info(&dev->v4l2_dev, "encoder registered as /dev/video%d\n", vfd->num); @@ -1175,12 +1175,8 @@ static int s5p_mfc_probe(struct platform_device *pdev) return 0; /* Deinit MFC if probe had failed */ -err_enc_reg: - video_device_release(dev->vfd_enc); err_enc_alloc: video_unregister_device(dev->vfd_dec); -err_dec_reg: - video_device_release(dev->vfd_dec); err_dec_alloc: v4l2_device_unregister(&dev->v4l2_dev); err_v4l2_dev_reg: -- cgit v1.2.3