diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-08-05 05:11:13 -0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-11-14 10:10:28 -0800 |
| commit | 768147da5b9a688fe3357cdadcbb17aca2a7216d (patch) | |
| tree | 6bef4303a02bf28f9b4e2eed1399d4fc58c3974d /drivers/media | |
| parent | 534d3b6e0b33844e1ce8693f6ca65d1f9fc65d39 (diff) | |
| download | lwn-768147da5b9a688fe3357cdadcbb17aca2a7216d.tar.gz lwn-768147da5b9a688fe3357cdadcbb17aca2a7216d.zip | |
media: vmalloc_sg: off by one in error handling
commit 23d3090f8b44ab42162e99e8584445bc25b8922f upstream.
The "i--" needs to happen at the start of the loop or it will try to
release something bogus (probably it will crash) and it won't release
the first ->vaddr_page[].
Fixes: 7b4eeed174b7 ('[media] vmalloc_sg: make sure all pages in vmalloc area are really DMA-ready')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/v4l2-core/videobuf-dma-sg.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c index 3c8cc023a5a5..3ff15f1c9d70 100644 --- a/drivers/media/v4l2-core/videobuf-dma-sg.c +++ b/drivers/media/v4l2-core/videobuf-dma-sg.c @@ -253,9 +253,11 @@ int videobuf_dma_init_kernel(struct videobuf_dmabuf *dma, int direction, return 0; out_free_pages: while (i > 0) { - void *addr = page_address(dma->vaddr_pages[i]); - dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]); + void *addr; + i--; + addr = page_address(dma->vaddr_pages[i]); + dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]); } kfree(dma->dma_addr); dma->dma_addr = NULL; |