summaryrefslogtreecommitdiffstats
path: root/drivers/media/video/sh_mobile_ceu_camera.c
diff options
context:
space:
mode:
authorGuennadi Liakhovetski <g.liakhovetski@gmx.de>2011-07-04 12:15:14 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2011-07-27 17:56:09 -0300
commitcb74cf5349a6a9225bbab278a808d5a0739c3b2c (patch)
treef666bd328e9f8cdfd47ebb71e2427d7ecd3b8137 /drivers/media/video/sh_mobile_ceu_camera.c
parent7dfff95366f48bf66f77c17cdc9ebd8be696ac5d (diff)
downloadlinux-cb74cf5349a6a9225bbab278a808d5a0739c3b2c.tar.bz2
[media] V4L: sh_mobile_ceu_camera: fix Oops when USERPTR mapping fails
If vb2_dma_contig_get_userptr() fails on a videobuffer, driver's .buf_init() method will not be called and the list will not be initialised. Trying to remove an uninitialised element from a list leads to a NULL-dereference. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Tested-by: Bastian Hecht <hechtb@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video/sh_mobile_ceu_camera.c')
-rw-r--r--drivers/media/video/sh_mobile_ceu_camera.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index f86550703f8e..e54089802b6b 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -422,8 +422,12 @@ static void sh_mobile_ceu_videobuf_release(struct vb2_buffer *vb)
pcdev->active = NULL;
}
- /* Doesn't hurt also if the list is empty */
- list_del_init(&buf->queue);
+ /*
+ * Doesn't hurt also if the list is empty, but it hurts, if queuing the
+ * buffer failed, and .buf_init() hasn't been called
+ */
+ if (buf->queue.next)
+ list_del_init(&buf->queue);
spin_unlock_irq(&pcdev->lock);
}