Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 826cee26 authored by Terence Hampson's avatar Terence Hampson Committed by Stephen Boyd
Browse files

mdss: ppp: Fix ppp parse error out sequence 



Put was called on fence twice, second time with a NULL pointer,
which was causing a crash.

Change-Id: I3f8f0f01a390ee6eeb66612e0b8448d9b9b79013
Signed-off-by: default avatarTerence Hampson <thampson@codeaurora.org>
parent 9767cf8b

drivers/video/msm/mdss/mdp3_ppp.c

+3 −7
Original line number Diff line number Diff line
@@ -1022,14 +1022,14 @@ int mdp3_ppp_parse_req(void __user *p, 
		if (req->cur_rel_fen_fd < 0) {

			pr_err("%s: get_unused_fd_flags failed\n", __func__);

			rc  = -ENOMEM;

			goto parse_err_2;

			goto parse_err_1;

		}

		sync_fence_install(req->cur_rel_fence, req->cur_rel_fen_fd);

		rc = copy_to_user(req_list_header->sync.rel_fen_fd,

			&req->cur_rel_fen_fd, sizeof(int));

		if (rc) {

			pr_err("%s:copy_to_user failed\n", __func__);

			goto parse_err_3;

			goto parse_err_2;

		}

	} else {

		fence = req->cur_rel_fence;
@@ -1050,12 +1050,8 @@ int mdp3_ppp_parse_req(void __user *p, 
	}

	return 0;



parse_err_3:

	put_unused_fd(req->cur_rel_fen_fd);

parse_err_2:

	sync_fence_put(req->cur_rel_fence);

	req->cur_rel_fence = NULL;

	req->cur_rel_fen_fd = 0;

	put_unused_fd(req->cur_rel_fen_fd);

parse_err_1:

	for (i--; i >= 0; i--) {

		mdp3_put_img(&req->src_data[i]);