Merge "msm: vidc: Fix use after free bug in set_output_buffers" (ee910d98) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/media/platform/msm/vidc/msm_vidc_common.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -3389,7 +3389,7 @@ static int set_output_buffers(struct msm_vidc_inst *inst,
		enum hal_buffer buffer_type)
		{
		int rc = 0;
		struct internal_buf *binfo;
		struct internal_buf *binfo = NULL;
		u32 smem_flags = 0, buffer_size;
		struct hal_buffer_requirements output_buf, extradata_buf;
		int i;
		@@ -3498,10 +3498,10 @@ static int set_output_buffers(struct msm_vidc_inst *inst,
		}
		return rc;
		fail_set_buffers:
		kfree(binfo);
		fail_kzalloc:
		msm_comm_smem_free(inst, &binfo->smem);
		err_no_mem:
		kfree(binfo);
		fail_kzalloc:
		return rc;
		}