Commit 232c297a authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

media: c8sectpfe: fix double free in configure_channels() 

The configure_channels() function has a double free because
configure_memdma_and_inputblock() calls free_input_block() and then
it's called again in the error handling code.

Link: https://lore.kernel.org/linux-media/20211208073544.GA22020@kili


Fixes: c5f5d0f9 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarPatrice Chotard <patrice.chotard@foss.st.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 43f0633f

drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c

+3 −5
Original line number Diff line number Diff line
@@ -925,7 +925,6 @@ static int c8sectpfe_remove(struct platform_device *pdev) 
static int configure_channels(struct c8sectpfei *fei)

{

	int index = 0, ret;

	struct channel_info *tsin;

	struct device_node *child, *np = fei->dev->of_node;



	/* iterate round each tsin and configure memdma descriptor and IB hw */
@@ -943,10 +942,9 @@ static int configure_channels(struct c8sectpfei *fei) 
	return 0;



err_unmap:

	for (index = 0; index < fei->tsin_count; index++) {

		tsin = fei->channel_data[index];

		free_input_block(fei, tsin);

	}

	while (--index >= 0)

		free_input_block(fei, fei->channel_data[index]);



	return ret;

}