Do not send already free'd pointer to rpabort when rpsend fails.
Signed-off-by: Varun B Patil <[email protected]>
---
drivers/staging/omapdce/dce.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/omapdce/dce.c b/drivers/staging/omapdce/dce.c
index 2a7cbef..1d9b75c 100644
--- a/drivers/staging/omapdce/dce.c
+++ b/drivers/staging/omapdce/dce.c
@@ -1318,15 +1318,17 @@ static int ioctl_codec_process(struct drm_device *dev,
void *data,
ret = rpsend(priv, &arg->token, hdr(req), ptr - (void *)req);
rpsend_out:
- kfree(req);
if (ret) {
/* if input buffer is already locked, unlock it now so
we
* don't have a leak:
*/
if (input_id)
codec_unlockbuf(priv, arg->codec_handle,
input_id);
- return rpabort(hdr(req), ret);
+ ret = rpabort(hdr(req), ret);
+ kfree(req);
+ return ret;
}
+ kfree(req);
}
/* then wait for reply, which is interruptible */
--
1.8.1.2
_______________________________________________
devel mailing list
[email protected]
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
