Commit df794cfb authored May 17, 2017 by Archit Taneja Committed by Greg Kroah-Hartman May 18, 2017

staging: android: ion: Avoid calling free_duped_table() twice



Currently, the duplicated sg table is freed in the detach() and
the error path of map_dma_buf() ion's dma_buf_ops.

If a call to dma_buf_map_attachment() fails, the importer is
expected to call dma_buf_detach() to remove the attachment. This
will result in us trying to free the duped sg table twice.

Don't call free_duped_table() in ion_map_dma_buf() to avoid this.

Signed-off-by: Archit Taneja <architt@codeaurora.org>
Acked-by: Laura Abbott <labbott@redhat.com>
Reviewed-by: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 83d952ee

drivers/staging/android/ion/ion.c

+3 −9

Original line number	Diff line number	Diff line
		@@ -267,20 +267,14 @@ static struct sg_table ion_map_dma_buf(struct dma_buf_attachment attachment,
		{
		struct ion_dma_buf_attachment *a = attachment->priv;
		struct sg_table *table;
		int ret;

		table = a->table;

		if (!dma_map_sg(attachment->dev, table->sgl, table->nents,
		direction)){
		ret = -ENOMEM;
		goto err;
		}
		return table;
		direction))
		return ERR_PTR(-ENOMEM);

		err:
		free_duped_table(table);
		return ERR_PTR(ret);
		return table;
		}

		static void ion_unmap_dma_buf(struct dma_buf_attachment *attachment,