diff options
| author | David Sin <davidsin@ti.com> | 2010-08-28 13:59:34 -0500 |
|---|---|---|
| committer | Ricardo Perez Olivares <x0081762@ti.com> | 2010-08-31 20:16:11 -0500 |
| commit | 632475a39acbe5eb8a9d2d9aea04729c045f3baa (patch) | |
| tree | f1cd077b1ac09472e7c8626adfda496ab25076bd | |
| parent | e2ab37411a5991842674e159f0873e8bcbcb4e84 (diff) | |
TILER: Don't assign mem struct inside kernel listti-2.6.35-omap4-L24.9-p3
It's possible that the mem struct assignment inside of
the kernel list doesn't assigned properly (e.g. NULL), which
causes a deref crash during the free call.
Signed-off-by: David Sin <davidsin@ti.com>
| -rw-r--r-- | drivers/media/video/dmm/tmm_pat.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/media/video/dmm/tmm_pat.c b/drivers/media/video/dmm/tmm_pat.c index 4010bdfb2e08..4b975d33b90f 100644 --- a/drivers/media/video/dmm/tmm_pat.c +++ b/drivers/media/video/dmm/tmm_pat.c @@ -203,16 +203,18 @@ static u32 *tmm_pat_get_pages(struct tmm *tmm, s32 n) */ list_for_each_safe(pos, q, &pvt->free_list.list) { m = list_entry(pos, struct mem, list); - f->mem[i] = m; list_del(pos); break; } mutex_unlock(&pvt->mtx); - if (m != NULL) + if (m != NULL) { + f->mem[i] = m; f->pa[i] = m->pa; - else + } + else { goto cleanup; + } } mutex_lock(&pvt->mtx); |