Commit a56d092a authored by Rohit kumar's avatar Rohit kumar Committed by Greg Kroah-Hartman
Browse files

staging: ion: Fix error handling in ion_buffer_create 



This patch fixes error handling case when buffer->pages allocation
fails. Also, it removes unreachable code of checking ret variable
although it is not updated.

Signed-off-by: default avatarRohit kumar <rohit.kr@samsung.com>
Reviewed-by: default avatarLaura Abbott <labbott@redhat.com>
Suggested-by: default avatarPintu Kumar <pintu.k@samsung.com>
Reviewed-by: default avatarPintu Kumar <pintu.k@samsung.com>
Reviewed-by: default avatarGioh Kim <gioh.kim@lge.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent bc719854

drivers/staging/android/ion/ion.c

+5 −9
Original line number Diff line number Diff line
@@ -213,10 +213,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, 
			"heap->ops->map_dma should return ERR_PTR on error"))

		table = ERR_PTR(-EINVAL);

	if (IS_ERR(table)) {

		heap->ops->free(buffer);

		kfree(buffer);

		return ERR_CAST(table);

		ret = -EINVAL;

		goto err1;

	}



	buffer->sg_table = table;

	if (ion_buffer_fault_user_mappings(buffer)) {

		int num_pages = PAGE_ALIGN(buffer->size) / PAGE_SIZE;
@@ -226,7 +226,7 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, 
		buffer->pages = vmalloc(sizeof(struct page *) * num_pages);

		if (!buffer->pages) {

			ret = -ENOMEM;

			goto err1;

			goto err;

		}



		for_each_sg(table->sgl, sg, table->nents, i) {
@@ -235,9 +235,6 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, 
			for (j = 0; j < sg->length / PAGE_SIZE; j++)

				buffer->pages[k++] = page++;

		}



		if (ret)

			goto err;

	}



	buffer->dev = dev;
@@ -263,9 +260,8 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, 


err:

	heap->ops->unmap_dma(heap, buffer);

	heap->ops->free(buffer);

err1:

	vfree(buffer->pages);

	heap->ops->free(buffer);

err2:

	kfree(buffer);

	return ERR_PTR(ret);