Merge "msm: cpp: Free pointer in error case" (9cbb4c71) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -1979,6 +1979,10 @@ static int msm_cpp_copy_from_ioctl_ptr(void *dst_ptr,
		struct msm_camera_v4l2_ioctl_t *ioctl_ptr)
		{
		int ret;
		if ((ioctl_ptr->ioctl_ptr == NULL) \|\| (ioctl_ptr->len == 0)) {
		pr_err("Wrong ioctl_ptr %p\n", ioctl_ptr);
		return -EINVAL;
		}

		/* For compat task, source ptr is in kernel space */
		if (is_compat_task()) {
		@@ -2062,6 +2066,7 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd,
		if (ioctl_ptr->ioctl_ptr == NULL) {
		pr_err("ioctl_ptr->ioctl_ptr=NULL\n");
		mutex_unlock(&cpp_dev->mutex);
		kfree(cpp_dev->fw_name_bin);
		return -EINVAL;
		}
		rc = (copy_from_user(cpp_dev->fw_name_bin,
		@@ -2281,6 +2286,9 @@ STREAM_BUFF_END:
		process_frame,
		sizeof(struct msm_cpp_frame_info_t))) {
		mutex_unlock(&cpp_dev->mutex);
		kfree(process_frame->cpp_cmd_msg);
		kfree(process_frame);
		kfree(event_qcmd);
		return -EINVAL;
		}

		@@ -2398,6 +2406,10 @@ STREAM_BUFF_END:
		case VIDIOC_MSM_CPP_POP_STREAM_BUFFER: {
		struct msm_buf_mngr_info buff_mgr_info;
		struct msm_cpp_frame_info_t frame_info;
		if (ioctl_ptr->ioctl_ptr == NULL) {
		rc = -EINVAL;
		break;
		}
		rc = (copy_from_user(&frame_info,
		(void __user *)ioctl_ptr->ioctl_ptr,
		sizeof(struct msm_cpp_frame_info_t)) ? -EFAULT : 0);