iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[media] vmalloc_sg: off by one in error handling

Browse Source 
The "i--" needs to happen at the start of the loop or it will try to
release something bogus (probably it will crash) and it won't release
the first ->vaddr_page[].

Fixes: 7b4eeed174b7 ('[media] vmalloc_sg: make sure all pages in vmalloc area are really DMA-ready')

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This commit is contained in:
Dan Carpenter 2014-08-05 05:11:13 -03:00 committed by Mauro Carvalho Chehab
parent 5b6aa19919
commit 23d3090f8b
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/media/v4l2-core/videobuf-dma-sg.c
View File

@ -253,9 +253,11 @@ int videobuf_dma_init_kernel(struct videobuf_dmabuf *dma, int direction,
return 0;
out_free_pages:
while (i > 0) {
void *addr = page_address(dma->vaddr_pages[i]);
dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]);
void *addr;
i--;
addr = page_address(dma->vaddr_pages[i]);
dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]);
}
kfree(dma->dma_addr);
dma->dma_addr = NULL;