Do not send already free'd pointer to rpabort when rpsend fails.
Signed-off-by: Varun B Patil <varun.basavaraj.patil@xxxxxxxxx>
---
drivers/staging/omapdce/dce.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/omapdce/dce.c b/drivers/staging/omapdce/dce.c
index 2a7cbef..1d9b75c 100644
--- a/drivers/staging/omapdce/dce.c
+++ b/drivers/staging/omapdce/dce.c
@@ -1318,15 +1318,17 @@ static int ioctl_codec_process(struct drm_device *dev, void *data,
ret = rpsend(priv, &arg->token, hdr(req), ptr - (void *)req);
rpsend_out:
- kfree(req);
if (ret) {
/* if input buffer is already locked, unlock it now so we
* don't have a leak:
*/
if (input_id)
codec_unlockbuf(priv, arg->codec_handle, input_id);
- return rpabort(hdr(req), ret);
+ ret = rpabort(hdr(req), ret);
+ kfree(req);
+ return ret;
}
+ kfree(req);
}
/* then wait for reply, which is interruptible */
--
1.8.1.2
--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
