From a56d092aa94ebcc9452ddaa47423b9a478aa6aa5 Mon Sep 17 00:00:00 2001 From: Rohit kumar Date: Wed, 30 Sep 2015 11:07:35 +0530 Subject: staging: ion: Fix error handling in ion_buffer_create This patch fixes error handling case when buffer->pages allocation fails. Also, it removes unreachable code of checking ret variable although it is not updated. Signed-off-by: Rohit kumar Reviewed-by: Laura Abbott Suggested-by: Pintu Kumar Reviewed-by: Pintu Kumar Reviewed-by: Gioh Kim Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ion/ion.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index df3539865fb4..91b9b75e41da 100644 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -213,10 +213,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, "heap->ops->map_dma should return ERR_PTR on error")) table = ERR_PTR(-EINVAL); if (IS_ERR(table)) { - heap->ops->free(buffer); - kfree(buffer); - return ERR_CAST(table); + ret = -EINVAL; + goto err1; } + buffer->sg_table = table; if (ion_buffer_fault_user_mappings(buffer)) { int num_pages = PAGE_ALIGN(buffer->size) / PAGE_SIZE; @@ -226,7 +226,7 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, buffer->pages = vmalloc(sizeof(struct page *) * num_pages); if (!buffer->pages) { ret = -ENOMEM; - goto err1; + goto err; } for_each_sg(table->sgl, sg, table->nents, i) { @@ -235,9 +235,6 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, for (j = 0; j < sg->length / PAGE_SIZE; j++) buffer->pages[k++] = page++; } - - if (ret) - goto err; } buffer->dev = dev; @@ -263,9 +260,8 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, err: heap->ops->unmap_dma(heap, buffer); - heap->ops->free(buffer); err1: - vfree(buffer->pages); + heap->ops->free(buffer); err2: kfree(buffer); return ERR_PTR(ret); -- cgit v1.2.3