Commit a84e355e authored by Colin Ian King's avatar Colin Ian King Committed by Mauro Carvalho Chehab
Browse files

media: staging: davinci: fix memory leaks and check for allocation failure 



There are three error return paths that don't kfree params causing a
memory leak.  Fix this by adding an error return path that kfree's
params before returning.  Also add a check to see params failed to
be allocated.

Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent 94b5bf3a

drivers/staging/media/davinci_vpfe/dm365_ipipe.c

+10 −5
Original line number Diff line number Diff line
@@ -1251,10 +1251,10 @@ static int ipipe_s_config(struct v4l2_subdev *sd, struct vpfe_ipipe_config *cfg) 
	struct vpfe_ipipe_device *ipipe = v4l2_get_subdevdata(sd);

	unsigned int i;

	int rval = 0;

	struct ipipe_module_params *params;



	for (i = 0; i < ARRAY_SIZE(ipipe_modules); i++) {

		const struct ipipe_module_if *module_if;

		struct ipipe_module_params *params;

		void *from, *to;

		size_t size;
@@ -1265,25 +1265,30 @@ static int ipipe_s_config(struct v4l2_subdev *sd, struct vpfe_ipipe_config *cfg) 
		from = *(void **)((void *)cfg + module_if->config_offset);



		params = kmalloc(sizeof(*params), GFP_KERNEL);

		if (!params)

			return -ENOMEM;

		to = (void *)params + module_if->param_offset;

		size = module_if->param_size;



		if (to && from && size) {

			if (copy_from_user(to, (void __user *)from, size)) {

				rval = -EFAULT;

				break;

				goto error_free;

			}

			rval = module_if->set(ipipe, to);

			if (rval)

				goto error;

				goto error_free;

		} else if (to && !from && size) {

			rval = module_if->set(ipipe, NULL);

			if (rval)

				goto error;

				goto error_free;

		}

		kfree(params);

	}

error:

	return rval;



error_free:

	kfree(params);

	return rval;

}