Commit 6f9ca872 authored by Eugen Hristev's avatar Eugen Hristev Committed by Greg Kroah-Hartman

media: atmel: atmel-isc: fix asd memory allocation

[ Upstream commit 1e4e25c4 ]

The subsystem will free the asd memory on notifier cleanup, if the asd is
added to the notifier.
However the memory is freed using kfree.
Thus, we cannot allocate the asd using devm_*
This can lead to crashes and problems.
To test this issue, just return an error at probe, but cleanup the
notifier beforehand.

Fixes: 10626744 ("[media] atmel-isc: add the Image Sensor Controller code")
Signed-off-by: default avatarEugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent b0395364
...@@ -2065,8 +2065,11 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc) ...@@ -2065,8 +2065,11 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc)
break; break;
} }
subdev_entity->asd = devm_kzalloc(dev, /* asd will be freed by the subsystem once it's added to the
sizeof(*subdev_entity->asd), GFP_KERNEL); * notifier list
*/
subdev_entity->asd = kzalloc(sizeof(*subdev_entity->asd),
GFP_KERNEL);
if (!subdev_entity->asd) { if (!subdev_entity->asd) {
of_node_put(rem); of_node_put(rem);
ret = -ENOMEM; ret = -ENOMEM;
...@@ -2210,6 +2213,7 @@ static int atmel_isc_probe(struct platform_device *pdev) ...@@ -2210,6 +2213,7 @@ static int atmel_isc_probe(struct platform_device *pdev)
subdev_entity->asd); subdev_entity->asd);
if (ret) { if (ret) {
fwnode_handle_put(subdev_entity->asd->match.fwnode); fwnode_handle_put(subdev_entity->asd->match.fwnode);
kfree(subdev_entity->asd);
goto cleanup_subdev; goto cleanup_subdev;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment