Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9656c3d1 authored by Eugen Hristev's avatar Eugen Hristev Committed by Greg Kroah-Hartman
Browse files

media: atmel: atmel-isc: fix asd memory allocation 



commit 1e4e25c4959c10728fbfcc6a286f9503d32dfe02 upstream.

The subsystem will free the asd memory on notifier cleanup, if the asd is
added to the notifier.
However the memory is freed using kfree.
Thus, we cannot allocate the asd using devm_*
This can lead to crashes and problems.
To test this issue, just return an error at probe, but cleanup the
notifier beforehand.

Fixes: 10626744 ("[media] atmel-isc: add the Image Sensor Controller code")

Signed-off-by: default avatarEugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a030363e

drivers/media/platform/atmel/atmel-isc.c

+6 −2
Original line number Diff line number Diff line
@@ -2062,8 +2062,11 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc) 
			break;

		}



		subdev_entity->asd = devm_kzalloc(dev,

				     sizeof(*subdev_entity->asd), GFP_KERNEL);

		/* asd will be freed by the subsystem once it's added to the

		 * notifier list

		 */

		subdev_entity->asd = kzalloc(sizeof(*subdev_entity->asd),

					     GFP_KERNEL);

		if (!subdev_entity->asd) {

			of_node_put(rem);

			ret = -ENOMEM;
@@ -2209,6 +2212,7 @@ static int atmel_isc_probe(struct platform_device *pdev) 
						   &subdev_entity->notifier);

		if (ret) {

			dev_err(dev, "fail to register async notifier\n");

			kfree(subdev_entity->asd);

			goto cleanup_subdev;

		}