Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 127926e6 authored by Shilpa Mamidi's avatar Shilpa Mamidi Committed by Gerrit - the friendly Code Review server
Browse files

msm: cpp: Free pointer in error case 



Free pointers in error case and also add
check condition before using any parameters.

Change-Id: I1c2fa6d8712b95673b30fe0fab517b54da736792
Signed-off-by: default avatarShilpa Mamidi <shilpam@codeaurora.org>
parent 3f466670

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+12 −0
Original line number Diff line number Diff line
@@ -1979,6 +1979,10 @@ static int msm_cpp_copy_from_ioctl_ptr(void *dst_ptr, 
	struct msm_camera_v4l2_ioctl_t *ioctl_ptr)

{

	int ret;

	if ((ioctl_ptr->ioctl_ptr == NULL) || (ioctl_ptr->len == 0)) {

		pr_err("Wrong ioctl_ptr %p\n", ioctl_ptr);

		return -EINVAL;

	}



	/* For compat task, source ptr is in kernel space */

	if (is_compat_task()) {
@@ -2062,6 +2066,7 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, 
			if (ioctl_ptr->ioctl_ptr == NULL) {

				pr_err("ioctl_ptr->ioctl_ptr=NULL\n");

				mutex_unlock(&cpp_dev->mutex);

				kfree(cpp_dev->fw_name_bin);

				return -EINVAL;

			}

			rc = (copy_from_user(cpp_dev->fw_name_bin,
@@ -2281,6 +2286,9 @@ STREAM_BUFF_END: 
				process_frame,

				sizeof(struct msm_cpp_frame_info_t))) {

					mutex_unlock(&cpp_dev->mutex);

					kfree(process_frame->cpp_cmd_msg);

					kfree(process_frame);

					kfree(event_qcmd);

					return -EINVAL;

		}
@@ -2398,6 +2406,10 @@ STREAM_BUFF_END: 
	case VIDIOC_MSM_CPP_POP_STREAM_BUFFER: {

		struct msm_buf_mngr_info buff_mgr_info;

		struct msm_cpp_frame_info_t frame_info;

		if (ioctl_ptr->ioctl_ptr == NULL) {

			rc = -EINVAL;

			break;

		}

		rc = (copy_from_user(&frame_info,

			(void __user *)ioctl_ptr->ioctl_ptr,

			sizeof(struct msm_cpp_frame_info_t)) ? -EFAULT : 0);