From: Guennadi Liakhovetski Date: Mon, 4 Jul 2011 15:15:14 +0000 (-0300) Subject: [media] V4L: sh_mobile_ceu_camera: fix Oops when USERPTR mapping fails X-Git-Tag: MMI-PSA29.97-13-9~18729^2~8 X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=cb74cf5349a6a9225bbab278a808d5a0739c3b2c;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git [media] V4L: sh_mobile_ceu_camera: fix Oops when USERPTR mapping fails If vb2_dma_contig_get_userptr() fails on a videobuffer, driver's .buf_init() method will not be called and the list will not be initialised. Trying to remove an uninitialised element from a list leads to a NULL-dereference. Signed-off-by: Guennadi Liakhovetski Tested-by: Bastian Hecht Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c index f86550703f8e..e54089802b6b 100644 --- a/drivers/media/video/sh_mobile_ceu_camera.c +++ b/drivers/media/video/sh_mobile_ceu_camera.c @@ -422,8 +422,12 @@ static void sh_mobile_ceu_videobuf_release(struct vb2_buffer *vb) pcdev->active = NULL; } - /* Doesn't hurt also if the list is empty */ - list_del_init(&buf->queue); + /* + * Doesn't hurt also if the list is empty, but it hurts, if queuing the + * buffer failed, and .buf_init() hasn't been called + */ + if (buf->queue.next) + list_del_init(&buf->queue); spin_unlock_irq(&pcdev->lock); }