Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e1b5239d authored by Yiduo Wang's avatar Yiduo Wang
Browse files

msm: camera: Fix improper memory free in failure case 



Remove improper drv_priv free in failure case and
add NULL pointer check to avoid kernel panic

Change-Id: If074eba245e93bf8fead505993a2611582e4398d
Signed-off-by: default avatarYiduo Wang <yiduow@codeaurora.org>
parent 792ce78d

drivers/media/platform/msm/camera_v2/camera/camera.c

+3 −6
Original line number Diff line number Diff line
@@ -346,20 +346,17 @@ static int camera_v4l2_s_fmt_vid_cap_mplane(struct file *filep, void *fh, 


		rc = msm_post_event(&event, MSM_POST_EVT_TIMEOUT);

		if (rc < 0)

			goto set_fmt_fail;

			return rc;



		rc = camera_check_event_status(&event);

		if (rc < 0)

			goto set_fmt_fail;

			return rc;



		sp->is_vb2_valid = 1;

	}



	return rc;



set_fmt_fail:

	kzfree(sp->vb2_q.drv_priv);

	sp->vb2_q.drv_priv = NULL;

	return rc;

}



static int camera_v4l2_try_fmt_vid_cap_mplane(struct file *filep, void *fh,

drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c

+4 −0
Original line number Diff line number Diff line
@@ -20,6 +20,10 @@ static int msm_vb2_queue_setup(struct vb2_queue *q, 
	int i;

	struct msm_v4l2_format_data *data = q->drv_priv;



	if (!data) {

		pr_err("%s: drv_priv NULL\n", __func__);

		return -EINVAL;

	}

	if (data->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {

		if (WARN_ON(data->num_planes > VIDEO_MAX_PLANES))

			return -EINVAL;