diff options
| author | Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> | 2018-04-24 19:45:06 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2018-05-05 10:27:15 -0400 |
| commit | 16cedd99c64cc9f128a3e9bb0613980833b7f938 (patch) | |
| tree | df153d984752534f44db356ed38b006633081066 /drivers/media/platform | |
| parent | ec2b0d04631748a799ded5f15926846c712062cb (diff) | |
media: rcar-vin: fix null pointer dereference in rvin_group_get()
Store the group pointer before disassociating the VIN from the group.
Fixes: 3bb4c3bc85bf77a7 ("media: rcar-vin: add group allocator functions")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Diffstat (limited to 'drivers/media/platform')
| -rw-r--r-- | drivers/media/platform/rcar-vin/rcar-core.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c index 55b745ac86a5..51e6694c4946 100644 --- a/drivers/media/platform/rcar-vin/rcar-core.c +++ b/drivers/media/platform/rcar-vin/rcar-core.c @@ -338,19 +338,21 @@ err_group: static void rvin_group_put(struct rvin_dev *vin) { - mutex_lock(&vin->group->lock); + struct rvin_group *group = vin->group; + + mutex_lock(&group->lock); vin->group = NULL; vin->v4l2_dev.mdev = NULL; - if (WARN_ON(vin->group->vin[vin->id] != vin)) + if (WARN_ON(group->vin[vin->id] != vin)) goto out; - vin->group->vin[vin->id] = NULL; + group->vin[vin->id] = NULL; out: - mutex_unlock(&vin->group->lock); + mutex_unlock(&group->lock); - kref_put(&vin->group->refcount, rvin_group_release); + kref_put(&group->refcount, rvin_group_release); } /* ----------------------------------------------------------------------------- |