diff options
| author | Sylwester Nawrocki <s.nawrocki@samsung.com> | 2011-09-13 14:07:09 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2011-11-24 20:57:12 -0200 |
| commit | 7acde02a5bf4d3c32cd197eb7ce2257e6a0e17b7 (patch) | |
| tree | e21b2b83fb7dc1f9d4d8b65d685d59d521f4f4e4 /drivers/media | |
| parent | e067d5abdd04cbf1bed466f95682c67e2496ba42 (diff) | |
| download | talos-op-linux-7acde02a5bf4d3c32cd197eb7ce2257e6a0e17b7.tar.gz talos-op-linux-7acde02a5bf4d3c32cd197eb7ce2257e6a0e17b7.zip | |
[media] s5p-fimc: Fix wrong pointer dereference when unregistering sensors
After i2c_unregister_device() has been called the client object can already
be freed and thus using the client pointer may lead to dereferencing freed
memory. Avoid this by saving the adapter pointer for further use before
i2c_unregister_device() call.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/video/s5p-fimc/fimc-mdevice.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/media/video/s5p-fimc/fimc-mdevice.c b/drivers/media/video/s5p-fimc/fimc-mdevice.c index cc337b1de913..d558ae79e320 100644 --- a/drivers/media/video/s5p-fimc/fimc-mdevice.c +++ b/drivers/media/video/s5p-fimc/fimc-mdevice.c @@ -220,6 +220,7 @@ static struct v4l2_subdev *fimc_md_register_sensor(struct fimc_md *fmd, sd = v4l2_i2c_new_subdev_board(&fmd->v4l2_dev, adapter, s_info->pdata->board_info, NULL); if (IS_ERR_OR_NULL(sd)) { + i2c_put_adapter(adapter); v4l2_err(&fmd->v4l2_dev, "Failed to acquire subdev\n"); return NULL; } @@ -234,12 +235,15 @@ static struct v4l2_subdev *fimc_md_register_sensor(struct fimc_md *fmd, static void fimc_md_unregister_sensor(struct v4l2_subdev *sd) { struct i2c_client *client = v4l2_get_subdevdata(sd); + struct i2c_adapter *adapter; if (!client) return; v4l2_device_unregister_subdev(sd); + adapter = client->adapter; i2c_unregister_device(client); - i2c_put_adapter(client->adapter); + if (adapter) + i2c_put_adapter(adapter); } static int fimc_md_register_sensor_entities(struct fimc_md *fmd) |
