Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 23d3090f authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

[media] vmalloc_sg: off by one in error handling 



The "i--" needs to happen at the start of the loop or it will try to
release something bogus (probably it will crash) and it won't release
the first ->vaddr_page[].

Fixes: 7b4eeed1 ('[media] vmalloc_sg: make sure all pages in vmalloc area are really DMA-ready')

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <m.chehab@samsung.com>
parent 5b6aa199

drivers/media/v4l2-core/videobuf-dma-sg.c

+4 −2
Original line number Diff line number Diff line
@@ -253,9 +253,11 @@ int videobuf_dma_init_kernel(struct videobuf_dmabuf *dma, int direction, 
	return 0;

out_free_pages:

	while (i > 0) {

		void *addr = page_address(dma->vaddr_pages[i]);

		dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]);

		void *addr;



		i--;

		addr = page_address(dma->vaddr_pages[i]);

		dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]);

	}

	kfree(dma->dma_addr);

	dma->dma_addr = NULL;