UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

media: rcar-vin: fix null pointer dereference in rvin_group_get() 

Store the group pointer before disassociating the VIN from the group.

Fixes: 3bb4c3bc85 ("media: rcar-vin: add group allocator functions")

Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
This commit is contained in:
Niklas Söderlund 2018-04-24 19:45:06 -04:00 committed by Mauro Carvalho Chehab
parent ec2b0d0463
commit 16cedd99c6
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/media/platform/rcar-vin/rcar-core.c
View File

@ -338,19 +338,21 @@ err_group:
static void rvin_group_put(struct rvin_dev *vin)
{
mutex_lock(&vin->group->lock);
struct rvin_group *group = vin->group;
mutex_lock(&group->lock);
vin->group = NULL;
vin->v4l2_dev.mdev = NULL;
if (WARN_ON(vin->group->vin[vin->id] != vin))
if (WARN_ON(group->vin[vin->id] != vin))
goto out;
vin->group->vin[vin->id] = NULL;
group->vin[vin->id] = NULL;
out:
mutex_unlock(&vin->group->lock);
mutex_unlock(&group->lock);
kref_put(&vin->group->refcount, rvin_group_release);
kref_put(&group->refcount, rvin_group_release);
}
/* -----------------------------------------------------------------------------