diff options
| author | Tuomas Tynkkynen <ttynkkynen@nvidia.com> | 2012-08-16 19:56:51 +0300 |
|---|---|---|
| committer | Varun Wadekar <vwadekar@nvidia.com> | 2012-08-23 17:30:21 +0530 |
| commit | d51541727cc05abf2035ff9e70ca6bec3bd5e054 (patch) | |
| tree | c714108010e999aa27ebf6757fcdba98417be8d9 /drivers/video | |
| parent | de3851c133c10d20ceb4867450521a42ba8aff73 (diff) | |
video: tegra: host: Fix crash if allocation fails
nvhost_module_remove_client assumes that a client structure
to be freed exists in the linked list. However, if an allocation fails
in nvhost_module_add_client, no client structure is allocated, and
during cleanup, nvhost_module_remove_client would then attempt
to free an invalid pointer.
Bug 1034729
Change-Id: Ie1a641071b86f8246951e9be824a6003f14b04b6
Signed-off-by: Tuomas Tynkkynen <ttynkkynen@nvidia.com>
Reviewed-on: http://git-master/r/124096
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-by: Juha Tukkinen <jtukkinen@nvidia.com>
Diffstat (limited to 'drivers/video')
| -rw-r--r-- | drivers/video/tegra/host/bus_client.c | 3 | ||||
| -rw-r--r-- | drivers/video/tegra/host/nvhost_acm.c | 4 |
2 files changed, 5 insertions, 2 deletions
diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c index 046ba163e653..2ed0d4c68af6 100644 --- a/drivers/video/tegra/host/bus_client.c +++ b/drivers/video/tegra/host/bus_client.c @@ -160,7 +160,8 @@ static int nvhost_channelopen(struct inode *inode, struct file *filp) } filp->private_data = priv; priv->ch = ch; - nvhost_module_add_client(ch->dev, priv); + if(nvhost_module_add_client(ch->dev, priv)) + goto fail; if (ch->ctxhandler && ch->ctxhandler->alloc) { priv->hwctx = ch->ctxhandler->alloc(ch->ctxhandler, ch); diff --git a/drivers/video/tegra/host/nvhost_acm.c b/drivers/video/tegra/host/nvhost_acm.c index 55749886d970..382f30b2cc2a 100644 --- a/drivers/video/tegra/host/nvhost_acm.c +++ b/drivers/video/tegra/host/nvhost_acm.c @@ -346,15 +346,17 @@ void nvhost_module_remove_client(struct nvhost_device *dev, void *priv) { int i; struct nvhost_module_client *m; + int found = 0; mutex_lock(&client_list_lock); list_for_each_entry(m, &dev->client_list, node) { if (priv == m->priv) { list_del(&m->node); + found = 1; break; } } - if (m) { + if (found) { kfree(m); for (i = 0; i < dev->num_clks; i++) nvhost_module_update_rate(dev, i); |