From: ddl <ddl@rockchip.com>
Date: Sat, 29 Jan 2011 04:22:24 +0000 (+0800)
Subject: camera: fix access memory illegal which have been free , when sensor probe error
X-Git-Tag: firefly_0821_release~10784
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=9505d021e0c4e93eb854ae380529c04c81ddcf6f;p=firefly-linux-kernel-4.4.55.git

camera: fix access memory illegal which have been free , when sensor probe error
---

diff --git a/drivers/media/video/ov5640.c b/drivers/media/video/ov5640.c
index 8f50b98b9f2b..e66f28da30c1 100755
--- a/drivers/media/video/ov5640.c
+++ b/drivers/media/video/ov5640.c
@@ -3465,16 +3465,17 @@ static int sensor_probe(struct i2c_client *client,
         icd->ops = NULL;
         i2c_set_clientdata(client, NULL);
         kfree(sensor);
+		sensor = NULL;
+    } else {
+		#if CONFIG_SENSOR_Focus
+		sensor->sensor_wq = create_workqueue(SENSOR_NAME_STRING( wq));
+		if (sensor->sensor_wq == NULL)
+			SENSOR_TR("%s workqueue create fail!", SENSOR_NAME_STRING( wq));
+		mutex_init(&sensor->wq_lock);
+		sensor->sensor_wk.state = sensor_work_ready;
+		#endif
     }
 
-	#if CONFIG_SENSOR_Focus
-	sensor->sensor_wq = create_workqueue(SENSOR_NAME_STRING( wq));
-	if (sensor->sensor_wq == NULL)
-		SENSOR_TR("%s workqueue create fail!", SENSOR_NAME_STRING( wq));
-	mutex_init(&sensor->wq_lock);
-	sensor->sensor_wk.state = sensor_work_ready;
-	#endif
-
     SENSOR_DG("\n%s..%s..%d  ret = %x \n",__FUNCTION__,__FILE__,__LINE__,ret);
     return ret;
 }
@@ -3495,7 +3496,7 @@ static int sensor_remove(struct i2c_client *client)
     i2c_set_clientdata(client, NULL);
     client->driver = NULL;
     kfree(sensor);
-
+	sensor = NULL;
     return 0;
 }
 
diff --git a/drivers/media/video/ov5642.c b/drivers/media/video/ov5642.c
index ba3c14443534..af71249126d9 100755
--- a/drivers/media/video/ov5642.c
+++ b/drivers/media/video/ov5642.c
@@ -5437,20 +5437,21 @@ static int sensor_probe(struct i2c_client *client,
 	#endif
 
     ret = sensor_video_probe(icd, client);
-    if (ret) {
+    if (ret < 0) {
         icd->ops = NULL;
         i2c_set_clientdata(client, NULL);
         kfree(sensor);
+		sensor = NULL;
+    } else {
+		#if CONFIG_SENSOR_Focus
+		sensor->sensor_wq = create_workqueue(SENSOR_NAME_STRING( wq));
+		if (sensor->sensor_wq == NULL)
+			SENSOR_TR("%s workqueue create fail!", SENSOR_NAME_STRING( wq));
+		mutex_init(&sensor->wq_lock);
+		sensor->sensor_wk.state = sensor_work_ready;
+		#endif
     }
 
-	#if CONFIG_SENSOR_Focus
-	sensor->sensor_wq = create_workqueue(SENSOR_NAME_STRING( wq));
-	if (sensor->sensor_wq == NULL)
-		SENSOR_TR("%s workqueue create fail!", SENSOR_NAME_STRING( wq));
-	mutex_init(&sensor->wq_lock);
-	sensor->sensor_wk.state = sensor_work_ready;
-	#endif
-
     SENSOR_DG("\n%s..%s..%d  ret = %x \n",__FUNCTION__,__FILE__,__LINE__,ret);
     return ret;
 }
@@ -5471,7 +5472,7 @@ static int sensor_remove(struct i2c_client *client)
     i2c_set_clientdata(client, NULL);
     client->driver = NULL;
     kfree(sensor);
-
+	sensor = NULL;
     return 0;
 }