[PATCH] omapdce : fix bug in ioctl_codec_process

[Varun B Patil <varun.basavaraj.patil@gmail.com>]

Do not send already free'd pointer to rpabort when rpsend fails.

Signed-off-by: Varun B Patil <varun.basavaraj.patil@gmail.com>
---
 drivers/staging/omapdce/dce.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/omapdce/dce.c b/drivers/staging/omapdce/dce.c
index 2a7cbef..1d9b75c 100644
--- a/drivers/staging/omapdce/dce.c
+++ b/drivers/staging/omapdce/dce.c
@@ -1318,15 +1318,17 @@ static int ioctl_codec_process(struct drm_device *dev, void *data,
 
 		ret = rpsend(priv, &arg->token, hdr(req), ptr - (void *)req);
 rpsend_out:
-		kfree(req);
 		if (ret) {
 			/* if input buffer is already locked, unlock it now so we
 			 * don't have a leak:
 			 */
 			if (input_id)
 				codec_unlockbuf(priv, arg->codec_handle, input_id);
-			return rpabort(hdr(req), ret);
+			ret = rpabort(hdr(req), ret);
+			kfree(req);
+			return ret;
 		}
+		kfree(req);
 	}
 
 	/* then wait for reply, which is interruptible */
-- 
1.8.1.2