Commit 61334819 authored by Katya Orlova's avatar Katya Orlova Committed by Hans Verkuil
Browse files

media: s3c-camif: Avoid inappropriate kfree() 



s3c_camif_register_video_node() works with video_device structure stored
as a field of camif_vp, so it should not be kfreed.
But there is video_device_release() on error path that do it.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: babde1c2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface")
Signed-off-by: default avatarKatya Orlova <e.orlova@ispras.ru>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
parent f301fedb

drivers/media/platform/samsung/s3c-camif/camif-capture.c

+2 −4
Original line number Diff line number Diff line
@@ -1133,12 +1133,12 @@ int s3c_camif_register_video_node(struct camif_dev *camif, int idx) 


	ret = vb2_queue_init(q);

	if (ret)

		goto err_vd_rel;

		return ret;



	vp->pad.flags = MEDIA_PAD_FL_SINK;

	ret = media_entity_pads_init(&vfd->entity, 1, &vp->pad);

	if (ret)

		goto err_vd_rel;

		return ret;



	video_set_drvdata(vfd, vp);
@@ -1171,8 +1171,6 @@ int s3c_camif_register_video_node(struct camif_dev *camif, int idx) 
	v4l2_ctrl_handler_free(&vp->ctrl_handler);

err_me_cleanup:

	media_entity_cleanup(&vfd->entity);

err_vd_rel:

	video_device_release(vfd);

	return ret;

}