Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 55e266e3 authored by Azam Sadiq Pasha Kapatrala Syed's avatar Azam Sadiq Pasha Kapatrala Syed
Browse files

msm: camera: Fix improper ion free in error case 



In case of ion import failure, error value is being passed as an
handle to ion_free which causes invalid address access. This patch
fixes improper api calls in error case.

Change-Id: Ic7a70b63cf0ee8f439d859cc941cf6450bce7254
Signed-off-by: default avatarAzam Sadiq Pasha Kapatrala Syed <akapatra@codeaurora.org>
parent 60c431a5

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+1 −3
Original line number Diff line number Diff line
@@ -268,10 +268,8 @@ static unsigned long msm_cpp_queue_buffer_info(struct cpp_device *cpp_dev, 
	return buff->map_info.phy_addr;



QUEUE_BUFF_ERROR2:

	ion_unmap_iommu(cpp_dev->client, buff->map_info.ion_handle,

		cpp_dev->domain_num, 0);

QUEUE_BUFF_ERROR1:

	ion_free(cpp_dev->client, buff->map_info.ion_handle);

QUEUE_BUFF_ERROR1:

	buff->map_info.ion_handle = NULL;

	kzfree(buff);