Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

media: s3c-camif: Avoid inappropriate kfree()

Browse source 
[ Upstream commit 61334819aca018c3416ee6c330a08a49c1524fc3 ]

s3c_camif_register_video_node() works with video_device structure stored
as a field of camif_vp, so it should not be kfreed.
But there is video_device_release() on error path that do it.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface")
Signed-off-by: Katya Orlova <e.orlova@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Katya Orlova 2023-09-22 14:55:06 +03:00 • committed by Ksawlii
parent 6f35f1059c
commit 18e4afcfa8
1 changed files with 2 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/media/platform/s3c-camif/camif-capture.c
View file

@ -1132,12 +1132,12 @@ int s3c_camif_register_video_node(struct camif_dev *camif, int idx)
ret = vb2_queue_init(q); ret = vb2_queue_init(q);
if (ret) if (ret)
goto err_vd_rel; return ret;
vp->pad.flags = MEDIA_PAD_FL_SINK; vp->pad.flags = MEDIA_PAD_FL_SINK;
ret = media_entity_pads_init(&vfd->entity, 1, &vp->pad); ret = media_entity_pads_init(&vfd->entity, 1, &vp->pad);
if (ret) if (ret)
goto err_vd_rel; return ret;
video_set_drvdata(vfd, vp); video_set_drvdata(vfd, vp);
@ -1170,8 +1170,6 @@ err_ctrlh_free:
v4l2_ctrl_handler_free(&vp->ctrl_handler); v4l2_ctrl_handler_free(&vp->ctrl_handler);
err_me_cleanup: err_me_cleanup:
media_entity_cleanup(&vfd->entity); media_entity_cleanup(&vfd->entity);
err_vd_rel:
video_device_release(vfd);
return ret; return ret;
} }