diff options
| author | Terence Hampson <thampson@codeaurora.org> | 2013-07-15 15:15:12 -0400 |
|---|---|---|
| committer | David Keitel <dkeitel@codeaurora.org> | 2016-03-23 20:19:15 -0700 |
| commit | c2d61be2bb849d94eff170ef11824911528e708b (patch) | |
| tree | 2ca3563ee6eb0367ad3b75677115f3c66add13ec /drivers | |
| parent | 6b8956809b90ad03d56bba6b8f0594b06aa3e88e (diff) | |
mdss: ppp: Fix ppp parse error out sequence
Put was called on fence twice, second time with a NULL pointer,
which was causing a crash.
Change-Id: I3f8f0f01a390ee6eeb66612e0b8448d9b9b79013
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/fbdev/msm/mdp3_ppp.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/drivers/video/fbdev/msm/mdp3_ppp.c b/drivers/video/fbdev/msm/mdp3_ppp.c index b271582dc0f2..459ca5a46650 100644 --- a/drivers/video/fbdev/msm/mdp3_ppp.c +++ b/drivers/video/fbdev/msm/mdp3_ppp.c @@ -1024,14 +1024,14 @@ int mdp3_ppp_parse_req(void __user *p, if (req->cur_rel_fen_fd < 0) { pr_err("%s: get_unused_fd_flags failed\n", __func__); rc = -ENOMEM; - goto parse_err_2; + goto parse_err_1; } sync_fence_install(req->cur_rel_fence, req->cur_rel_fen_fd); rc = copy_to_user(req_list_header->sync.rel_fen_fd, &req->cur_rel_fen_fd, sizeof(int)); if (rc) { pr_err("%s:copy_to_user failed\n", __func__); - goto parse_err_3; + goto parse_err_2; } } else { fence = req->cur_rel_fence; @@ -1052,12 +1052,8 @@ int mdp3_ppp_parse_req(void __user *p, } return 0; -parse_err_3: - put_unused_fd(req->cur_rel_fen_fd); parse_err_2: - sync_fence_put(req->cur_rel_fence); - req->cur_rel_fence = NULL; - req->cur_rel_fen_fd = 0; + put_unused_fd(req->cur_rel_fen_fd); parse_err_1: for (i--; i >= 0; i--) { mdp3_put_img(&req->src_data[i]); |