Commit cb74cf53 authored Jul 04, 2011 by Guennadi Liakhovetski Committed by Mauro Carvalho Chehab Jul 27, 2011

[media] V4L: sh_mobile_ceu_camera: fix Oops when USERPTR mapping fails



If vb2_dma_contig_get_userptr() fails on a videobuffer, driver's
.buf_init() method will not be called and the list will not be
initialised. Trying to remove an uninitialised element from a list leads
to a NULL-dereference.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Tested-by: Bastian Hecht <hechtb@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

parent 7dfff953

drivers/media/video/sh_mobile_ceu_camera.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -422,7 +422,11 @@ static void sh_mobile_ceu_videobuf_release(struct vb2_buffer *vb)
		pcdev->active = NULL;
		}

		/* Doesn't hurt also if the list is empty */
		/*
		* Doesn't hurt also if the list is empty, but it hurts, if queuing the
		* buffer failed, and .buf_init() hasn't been called
		*/
		if (buf->queue.next)
		list_del_init(&buf->queue);

		spin_unlock_irq(&pcdev->lock);