Commit f696aed9 authored Aug 31, 2017 by Krishna Chaitanya Devarakonda Committed by Gerrit - the friendly Code Review server Sep 04, 2017

msm: sde: Avoid NULL pointer dereference in cancel request

There is a race condition possible when two threads are calling
the rotator cancel request. This might result in accessing a pointer
which was already assigned NULL. Fixing this by adding an extra check.

Change-Id: I9ce321a5f033d1fdc9d8b70a04098bfba3d7baaa
Signed-off-by: Krishna Chaitanya Devarakonda <kdevarak@codeaurora.org>

parent a2e923bd

drivers/media/platform/msm/sde/rotator/sde_rotator_core.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -2003,7 +2003,9 @@ static void sde_rotator_cancel_request(struct sde_rot_mgr *mgr,
		sde_rot_mgr_unlock(mgr);
		for (i = req->count - 1; i >= 0; i--) {
		entry = req->entries + i;
		if (entry->commitq)
		flush_kthread_worker(&entry->commitq->rot_kw);
		if (entry->doneq)
		flush_kthread_worker(&entry->doneq->rot_kw);
		}
		sde_rot_mgr_lock(mgr);