Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2140234e authored by Mahesh Voorugonda's avatar Mahesh Voorugonda
Browse files

msm: vidc_3x: Fix in handing SYS_ERROR 



When there is a SYS_ERROR the instance object is getting
freed even before notifying the client causing the kernel
NULL pointer dereferece. (When the max number of instances
reached latest instance will be freed)

Change-Id: I5c93401d650228755516e362ceb8c16a356f2653
Signed-off-by: default avatarMahesh Voorugonda <mvooru@codeaurora.org>
parent e4c9b6f1

drivers/media/platform/msm/vidc_3x/msm_vidc.c

+3 −4
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1278,13 +1278,12 @@ void *msm_vidc_open(int core_id, int session_type) 


	return inst;

fail_init:

	mutex_lock(&core->lock);

	v4l2_fh_del(&inst->event_handler);

	v4l2_fh_exit(&inst->event_handler);

	vb2_queue_release(&inst->bufq[OUTPUT_PORT].vb2_bufq);



	mutex_lock(&core->lock);

	list_del(&inst->list);

	mutex_unlock(&core->lock);

	vb2_queue_release(&inst->bufq[OUTPUT_PORT].vb2_bufq);



fail_bufq_output:

	vb2_queue_release(&inst->bufq[CAPTURE_PORT].vb2_bufq);