From: Archit Taneja <architt@codeaurora.org>
Date: Wed, 17 May 2017 08:15:48 +0000 (+0530)
Subject: staging: android: ion: Avoid calling free_duped_table() twice
X-Git-Tag: v4.13-rc1~184^2~301
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=df794cfbb9660f098412481be7d41bcb8e842cc9;p=karo-tx-linux.git

staging: android: ion: Avoid calling free_duped_table() twice

Currently, the duplicated sg table is freed in the detach() and
the error path of map_dma_buf() ion's dma_buf_ops.

If a call to dma_buf_map_attachment() fails, the importer is
expected to call dma_buf_detach() to remove the attachment. This
will result in us trying to free the duped sg table twice.

Don't call free_duped_table() in ion_map_dma_buf() to avoid this.

Signed-off-by: Archit Taneja <architt@codeaurora.org>
Acked-by: Laura Abbott <labbott@redhat.com>
Reviewed-by: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index c3e601ce261d..afa7c4553125 100644
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -267,20 +267,14 @@ static struct sg_table *ion_map_dma_buf(struct dma_buf_attachment *attachment,
 {
 	struct ion_dma_buf_attachment *a = attachment->priv;
 	struct sg_table *table;
-	int ret;
 
 	table = a->table;
 
 	if (!dma_map_sg(attachment->dev, table->sgl, table->nents,
-			direction)){
-		ret = -ENOMEM;
-		goto err;
-	}
-	return table;
+			direction))
+		return ERR_PTR(-ENOMEM);
 
-err:
-	free_duped_table(table);
-	return ERR_PTR(ret);
+	return table;
 }
 
 static void ion_unmap_dma_buf(struct dma_buf_attachment *attachment,