vmalloc_sg: off by one in error handling

PATCH New Dan Carpenter 1 participant 1 message Aug 5, 2014

Subsystems (2)

Media (V4L/DVB) Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2014-08-05 08:11 UTC #0 lore raw

PATCH 1/1 vmalloc_sg: off by one in error handling

The "i--" needs to happen at the start of the loop or it will try to release something bogus (probably it will crash) and it won't release the first ->vaddr_page[].

Fixes 7b4eeed174b7 ('[media] vmalloc_sg: make sure all pages in vmalloc area are really DMA-ready')

Signed-off-by Dan Carpenter <[email protected]>

drivers/media/v4l2-core/videobuf-dma-sg.c +4 -2

index 3c8cc02..3ff15f1 100644
@@ -253,9 +253,11 @@ int videobuf_dma_init_kernel(struct videobuf_dmabuf *dma, int direction,
 	return 0;
 out_free_pages:
 	while (i > 0) {
-		void *addr = page_address(dma->vaddr_pages[i]);
-		dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]);
+		void *addr;
+
 		i--;
+		addr = page_address(dma->vaddr_pages[i]);
+		dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]);
 	}
 	kfree(dma->dma_addr);
 	dma->dma_addr = NULL;