| From 23d3090f8b44ab42162e99e8584445bc25b8922f Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Tue, 5 Aug 2014 05:11:13 -0300 |
| Subject: media: vmalloc_sg: off by one in error handling |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| commit 23d3090f8b44ab42162e99e8584445bc25b8922f upstream. |
| |
| The "i--" needs to happen at the start of the loop or it will try to |
| release something bogus (probably it will crash) and it won't release |
| the first ->vaddr_page[]. |
| |
| Fixes: 7b4eeed174b7 ('[media] vmalloc_sg: make sure all pages in vmalloc area are really DMA-ready') |
| |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> |
| Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/media/v4l2-core/videobuf-dma-sg.c | 6 ++++-- |
| 1 file changed, 4 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/media/v4l2-core/videobuf-dma-sg.c |
| +++ b/drivers/media/v4l2-core/videobuf-dma-sg.c |
| @@ -253,9 +253,11 @@ int videobuf_dma_init_kernel(struct vide |
| return 0; |
| out_free_pages: |
| while (i > 0) { |
| - void *addr = page_address(dma->vaddr_pages[i]); |
| - dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]); |
| + void *addr; |
| + |
| i--; |
| + addr = page_address(dma->vaddr_pages[i]); |
| + dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]); |
| } |
| kfree(dma->dma_addr); |
| dma->dma_addr = NULL; |
