blob: 7f1b505336548acc9c87c0d0e6102dcfb21ad3a2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
|
From 3922bebc11fcc8459c798cfcb582828f9bbaa9e9 Mon Sep 17 00:00:00 2001
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Date: Thu, 28 Sep 2023 11:33:53 +0300
Subject: [PATCH] media: rp1: cfe: Fix use of freed memory on errors
cfe_probe_complete() calls cfe_put() on both success and fail code paths.
This works for the success path, but causes the cfe_device struct to be
freed, even if it will be used later in the teardown code.
Fix this by making the ref handling a bit saner: Let the video nodes
have the refs as they do now, but also keep a ref in the "main" driver,
released only at cfe_remove() time. This way the driver does not depend
on the video nodes keeping the refs.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
---
drivers/media/platform/raspberrypi/rp1_cfe/cfe.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
--- a/drivers/media/platform/raspberrypi/rp1_cfe/cfe.c
+++ b/drivers/media/platform/raspberrypi/rp1_cfe/cfe.c
@@ -1837,17 +1837,10 @@ static int cfe_probe_complete(struct cfe
goto unregister;
}
- /*
- * Release the initial reference, all references are now owned by the
- * video devices.
- */
- cfe_put(cfe);
return 0;
unregister:
cfe_unregister_nodes(cfe);
- cfe_put(cfe);
-
return ret;
}
@@ -2129,6 +2122,8 @@ static int cfe_remove(struct platform_de
v4l2_device_unregister(&cfe->v4l2_dev);
+ cfe_put(cfe);
+
return 0;
}
|