diff options
| author | David Sin <davidsin@ti.com> | 2010-08-28 13:59:34 -0500 |
|---|---|---|
| committer | Ricardo Perez Olivares <x0081762@ti.com> | 2010-09-14 19:27:45 -0500 |
| commit | cba27af35690d86ed6826002bb380ebffa4ecade (patch) | |
| tree | f48923d3b9e8b895f8fe1a587d5f45cff41f2f61 /drivers/media | |
| parent | 30cc48826a90b75e5cd2b7bbbc6a050ec952d0f9 (diff) | |
TILER: Don't assign mem struct inside kernel list
It's possible that the mem struct assignment inside of
the kernel list doesn't assigned properly (e.g. NULL), which
causes a deref crash during the free call.
Signed-off-by: David Sin <davidsin@ti.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/video/dmm/tmm_pat.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/media/video/dmm/tmm_pat.c b/drivers/media/video/dmm/tmm_pat.c index 4010bdfb2e08..4b975d33b90f 100644 --- a/drivers/media/video/dmm/tmm_pat.c +++ b/drivers/media/video/dmm/tmm_pat.c @@ -203,16 +203,18 @@ static u32 *tmm_pat_get_pages(struct tmm *tmm, s32 n) */ list_for_each_safe(pos, q, &pvt->free_list.list) { m = list_entry(pos, struct mem, list); - f->mem[i] = m; list_del(pos); break; } mutex_unlock(&pvt->mtx); - if (m != NULL) + if (m != NULL) { + f->mem[i] = m; f->pa[i] = m->pa; - else + } + else { goto cleanup; + } } mutex_lock(&pvt->mtx); |