Patch "staging: bcm2835-camera: fix error handling in init" has been added to the 4.11-stable tree

Patch "staging: bcm2835-camera: fix error handling in init" has been added to the 4.11-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    staging: bcm2835-camera: fix error handling in init

to the 4.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     staging-bcm2835-camera-fix-error-handling-in-init.patch
and it can be found in the queue-4.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 8e17858a8818b40d66e83de2bf3724c64eaad72d Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Sat, 18 Feb 2017 02:20:15 +0300
Subject: staging: bcm2835-camera: fix error handling in init

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 8e17858a8818b40d66e83de2bf3724c64eaad72d upstream.

The unwinding here isn't right.  We don't free gdev[0] and instead
free 1 step past what was allocated.  Also we can't allocate "dev" then
we should unwind instead of returning directly.

Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: walter harms <wharms@bfs.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/media/platform/bcm2835/bcm2835-camera.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/staging/media/platform/bcm2835/bcm2835-camera.c
+++ b/drivers/staging/media/platform/bcm2835/bcm2835-camera.c
@@ -1901,6 +1901,7 @@ static int __init bm2835_mmal_init(void)
 	unsigned int num_cameras;
 	struct vchiq_mmal_instance *instance;
 	unsigned int resolutions[MAX_BCM2835_CAMERAS][2];
+	int i;
 
 	ret = vchiq_mmal_init(&instance);
 	if (ret < 0)
@@ -1914,8 +1915,10 @@ static int __init bm2835_mmal_init(void)
 
 	for (camera = 0; camera < num_cameras; camera++) {
 		dev = kzalloc(sizeof(struct bm2835_mmal_dev), GFP_KERNEL);
-		if (!dev)
-			return -ENOMEM;
+		if (!dev) {
+			ret = -ENOMEM;
+			goto cleanup_gdev;
+		}
 
 		dev->camera_num = camera;
 		dev->max_width = resolutions[camera][0];
@@ -1998,9 +2001,10 @@ unreg_dev:
 free_dev:
 	kfree(dev);
 
-	for ( ; camera > 0; camera--) {
-		bcm2835_cleanup_instance(gdev[camera]);
-		gdev[camera] = NULL;
+cleanup_gdev:
+	for (i = 0; i < camera; i++) {
+		bcm2835_cleanup_instance(gdev[i]);
+		gdev[i] = NULL;
 	}
 	pr_info("%s: error %d while loading driver\n",
 		BM2835_MMAL_MODULE_NAME, ret);


Patches currently in stable-queue which might be from dan.carpenter@oracle.com are

queue-4.11/drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch
queue-4.11/iio-adc-ti_am335x_adc-allocating-too-much-in-probe.patch
queue-4.11/staging-bcm2835-camera-fix-error-handling-in-init.patch
queue-4.11/staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch